# GitHub Advisory malware sweep, 2 September 2026

> PyPI `syswatch@1.0.0` is a **third package** in the `2026-08-envprovision` Snow Stealer campaign (browser + wallet infostealer, sandbox evasion, log wiping on Windows). npm `eslint-rxjs@1.0.1` typosquats `eslint-plugin-rxjs` (OpenSSF flagged: "communicates with a domain associated with malicious activity"). `eyiouss` and `twapfetch` are all-versions CWE-506 boilerplate npm takedowns.

- Published: 2026-09-02
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 4 packages, 4 compromised versions
- Tags: typosquat, infostealer, credential-theft, crypto-wallet-drain, obfuscation
- Also known as: 2026-09-02 GHSA sweep, 2026-08-envprovision wave 3 (syswatch), eslint-rxjs eslint-plugin-rxjs typosquat
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector
- Incident ID: multi-2026-09-02-ghsa-malware-sweep

## Affected packages (4)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [eslint-rxjs](https://dependencywatch.io/package/npm/eslint-rxjs) | npm | 1.0.1 |
| [eyiouss](https://dependencywatch.io/package/npm/eyiouss) | npm | 0.0.0 |
| [syswatch](https://dependencywatch.io/package/pypi/syswatch) | PyPI | 1.0.0 |
| [twapfetch](https://dependencywatch.io/package/npm/twapfetch) | npm | 0.0.0 |

## What happened

The 24 hours ending 2026-09-02 published 4 new npm+PyPI malware advisories. Headline: **PyPI `syswatch` is a third package in the `2026-08-envprovision` Snow Stealer campaign** (browser + wallet infostealer on Windows with sandbox evasion and log wiping - see [envprovision 2026-08-24](https://dependencywatch.io/incident/multi-2026-08-24-ghsa-malware-sweep) for the family writeup). The npm side is quieter: one credible eslint-plugin-rxjs typosquat with an OpenSSF "communicates with malicious domain" tag, and two boilerplate CWE-506 takedowns.

## Cluster A - PyPI `syswatch` Snow Stealer (third `2026-08-envprovision` wave)

| Package | Version | GHSA | Payload | Campaign |
|---|---|---|---|---|
| `syswatch` | `1.0.0` | GHSA-mpch-m5gg-4894 | Snow Stealer | `2026-08-envprovision` |

**Same operator, same payload family as `envprovision`**. Attack chain (Windows-only):

1. `pip install syswatch` → package installs cleanly
2. On first `import syswatch`, the package downloads and installs a disguised Windows executable
3. The dropper cleans logs and deletes the downloaded stager to defeat forensic recovery
4. Snow Stealer runs: enumerates browser saved-password / cookie / autofill stores (Chrome, Edge, Brave, Firefox), modifies cryptocurrency wallet binaries so future transaction-signing leaks keys, executes sandbox-evasion checks (process list, mouse-heuristics, VM registry-tell keys) to defeat dynamic analysis
5. Persistent installation: `pip uninstall syswatch` does NOT remove the dropped Windows binary

**Campaign lineage**:
- [`envprovision@1.2.0` / `1.3.0` / `1.4.0`](https://dependencywatch.io/incident/multi-2026-08-24-ghsa-malware-sweep) - published 2026-08-24, source hash `cf3a48b4…d869`, VT file hash `d49fa539…b878`
- [`envprovision@1.2.0-1.4.0`](https://dependencywatch.io/incident/multi-2026-08-26-ghsa-malware-sweep) - re-catalogued 2026-08-26 as `2026-08-envprovision` campaign identifier
- `syswatch@1.0.0` (this file, 2026-09-02)

This is the third distinct package in the same campaign in nine days. Expect a fourth brand within days.

## Cluster B - npm `eslint-rxjs` typosquat of `eslint-plugin-rxjs`

| Package | Version | GHSA | OpenSSF flag |
|---|---|---|---|
| `eslint-rxjs` | `1.0.1` | GHSA-45hh-8cg6-r5qp | `communicates with a domain associated with malicious activity` |

Typosquats the legitimate [`eslint-plugin-rxjs`](https://www.npmjs.com/package/eslint-plugin-rxjs) (RxJS lint rules maintained by Cartant). The `eslint-<name>` vs `eslint-plugin-<name>` naming is a well-known npm dep-confusion vector because a developer editing `.eslintrc.js` often writes `plugins: ['rxjs']` (which resolves to `eslint-plugin-rxjs`), but when installing `npm install eslint-rxjs --save-dev` the shortened form is a common muscle-memory typo. Any Angular / NgRx / RxJS-heavy shop is a candidate target.

## Cluster C - npm CWE-506 boilerplate

| Package | Versions | GHSA | Note |
|---|---|---|---|
| `eyiouss` | all versions (>= 0) | GHSA-h2w3-x32h-cpqq | Keyboard-mash naming, generic RCE |
| `twapfetch` | all versions (>= 0) | GHSA-vfw8-w58v-xv38 | DeFi TWAP-price-fetcher name shape (targeting algo / MEV / market-maker dev environments) |

All-versions CWE-506 takedowns with only the standard "considered fully compromised" advisory boilerplate. Defensive value is name-level.

## Registry state

All 4 packages were flagged as malware on their respective registries on 2026-09-02. `syswatch` has been yanked from PyPI; the three npm packages have been added to the npm quarantine list.

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector`. `syswatch` cross-referenced against `bad-packages.kam193.eu/pypi/package/syswatch` (Kamil Mańkowski's PyPI malware tracker).

## Impact

- **Cluster A - PyPI `syswatch` Snow Stealer (2026-09-02, 1 package, 1 version)**: `syswatch@1.0.0` (GHSA-mpch-m5gg-4894, campaign `2026-08-envprovision`). This is the **third package** tracked in the ongoing `2026-08-envprovision` Snow Stealer campaign after [`envprovision@1.2.0-1.4.0` (2026-08-24 / 2026-08-26)](https://dependencywatch.io/incident/multi-2026-08-24-ghsa-malware-sweep). Payload chain: on **Windows only**, on import, the package downloads and installs a disguised executable, cleans logs to defeat forensic recovery, and drops **Snow Stealer** - a heavily obfuscated infostealer with sandbox-evasion routines that (a) enumerates browser saved-password / cookie / autofill stores (Chrome, Edge, Brave, Firefox), (b) **modifies cryptocurrency wallet application binaries** so subsequent transaction-signing flows leak keys, and (c) implements sandbox-evasion checks (process list, mouse-heuristics, VM registry-tell keys) that force dynamic analysis to actively fight the sample. Persistent installation behaviour: even after `pip uninstall syswatch`, the dropped Windows binary continues to run. Package name (`syswatch` = "system watcher") targets operators / SREs who might grep PyPI for a Python system-monitoring library. Any Windows host that ran `pip install syswatch` since 2026-09-02 needs re-imaging plus wallet-key rotation - the dropper cleans its own logs so post-hoc "we did not find IOCs on disk" is not a clean signal
- **Cluster B - npm `eslint-rxjs@1.0.1` typosquat (2026-09-02, 1 package, 1 version)**: `eslint-rxjs@1.0.1` (GHSA-45hh-8cg6-r5qp, OpenSSF `CWE-506`). Typosquats the legitimate `eslint-plugin-rxjs` (RxJS lint rules maintained by Cartant) - `eslint-*` shorthand-style names are a well-known npm dep-confusion vector because Node developers routinely omit the `-plugin-` in imports and configs. OpenSSF Package Analysis flag: **"the package communicates with a domain associated with malicious activity"**. All the highest-fingerprinted eslint config repos (Airbnb, StandardJS, ES bar, RxJS-style guides) are candidate targets. Any Angular / NgRx / RxJS-heavy team that added `eslint-rxjs` to devDependencies (rather than `eslint-plugin-rxjs`) should assume dev-workstation compromise
- **Cluster C - npm CWE-506 boilerplate takedowns (2026-09-02, 2 packages, no per-package IOCs)**: `eyiouss` (GHSA-h2w3-x32h-cpqq) - keyboard-mash naming, generic RCE; `twapfetch` (GHSA-vfw8-w58v-xv38) - "twap fetch" reads as a DeFi TWAP-price-fetcher helper (targeting DeFi trader / MEV / algo bots). All-versions CWE-506 takedowns with only the standard "any computer that has this package installed or running should be considered fully compromised" advisory boilerplate - defensive value is name-level: any lockfile hit means uninstall

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `requirements.txt`, `Pipfile.lock`, `poetry.lock`, `uv.lock`) for: `syswatch`, `eslint-rxjs`, `eyiouss`, `twapfetch`. Uninstall on any hit and rebuild the lockfile against a clean cache
2. **For Cluster A (`syswatch` Snow Stealer - third `2026-08-envprovision` wave)**: any Windows host that ran `pip install syswatch` needs to be **re-imaged**. Rotate every browser saved-password, cookie, autofill entry, MFA seed, VPN / SSH / cloud-CLI credential on the host - all from a separate clean workstation. If the host held any cryptocurrency wallet, **assume funds are at risk**: transfer remaining balances to a fresh wallet generated on a known-clean machine before doing anything else. The Snow Stealer family also **modifies wallet application binaries** so any subsequent wallet install on the same host cannot be trusted - reinstall wallet software from the vendor after re-imaging, never restored from backup. Push the campaign hash lineage (see [envprovision 2026-08-24 IOCs](https://dependencywatch.io/incident/multi-2026-08-24-ghsa-malware-sweep)) to endpoint EDR blocklists. This is the third package in the same campaign in nine days - expect a fourth brand within days
3. **For Cluster B (`eslint-rxjs` typosquat)**: every `package.json` and eslint config in the codebase should be audited for `"eslint-rxjs"` and replaced with `"eslint-plugin-rxjs"` (the legitimate package). If `eslint-rxjs` was installed at any point, the dev workstation must be treated as compromised - the malicious variant "communicates with a domain associated with malicious activity" (OpenSSF Package Analysis flag), meaning outbound C2 was in place during the install window. Rotate npm / GitHub / cloud-CLI credentials on the dev workstation
4. **For Cluster C (CWE-506 boilerplate)**: any lockfile hit for `eyiouss` or `twapfetch` means uninstall and rebuild. `twapfetch` is a targeted name for DeFi / TWAP / MEV algo trader dev environments - if the affected workstation held any hot wallet or trading-API key, rotate those first
5. For all `pip install` runs in CI, prefer `--no-build-isolation` + explicit `--only-binary` where possible. Note: `syswatch` triggers on import (not install-time build), so `--only-binary` does not stop it - add `syswatch` (and any `envprovision`-family variant) to your registry-mirror deny list
6. For all `npm install` runs in CI, prefer `--ignore-scripts` - typosquats and dep-confusion pkgs still typically ship postinstall/preinstall hooks even when the primary payload lives in imported code
7. Verify none of the enumerated packages still resolves via your private mirror - internal caches (Nexus / Artifactory / Verdaccio / Sonatype / devpi) routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-mpch-m5gg-4894 - syswatch (PyPI Snow Stealer, 2026-08-envprovision campaign wave 3)](https://github.com/advisories/GHSA-mpch-m5gg-4894) - GitHub
- [GHSA-45hh-8cg6-r5qp - eslint-rxjs (npm typosquat of eslint-plugin-rxjs, malicious domain callback)](https://github.com/advisories/GHSA-45hh-8cg6-r5qp) - GitHub
- [GHSA-h2w3-x32h-cpqq - eyiouss (npm CWE-506 takedown)](https://github.com/advisories/GHSA-h2w3-x32h-cpqq) - GitHub
- [GHSA-vfw8-w58v-xv38 - twapfetch (npm CWE-506 takedown, DeFi TWAP-shape name)](https://github.com/advisories/GHSA-vfw8-w58v-xv38) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GitHub Advisory Database - recent PyPI malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF

---

Canonical page: https://dependencywatch.io/incident/multi-2026-09-02-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-09-02-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).