# GitHub Advisory malware sweep, 5 September 2026

> Multi-ecosystem sweep. `houdus` (PyPI, Sept 5) is a Windows-only sandbox-detecting dropper; `timeweave` fetches Windows executables from `globaltimedata.com` via `WinExec`. Also: Box internal dep-confusion via `canarytokens.com` DNS, `tailwind-contact-forms` crypto-drainer typosquat, `line-through`/`real-router-telemetry` webhook.site exfil, and the `amirgo4496` PyPI dep-confusion campaign.

- Published: 2026-09-05
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 38 packages, 62 compromised versions
- Tags: dependency-confusion, credential-theft, infostealer, crypto-wallet-drain, typosquat, obfuscation, ci-cd-compromise, dns-exfiltration
- Also known as: 2026-09-05 GHSA sweep, 2026-09-houdus, 2026-09-amirgo4496 PyPI dep-confusion, 2026-09-asti, timeweave globaltimedata.com WinExec dropper, box-sign-client canarytokens.com dep-confusion, tailwind-contact-forms crypto drainer
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, bad-packages.kam193.eu
- Incident ID: multi-2026-09-05-ghsa-malware-sweep

## Affected packages (38)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@crysnovax/baileys](https://dependencywatch.io/package/npm/@crysnovax/baileys) | npm | 0.0.0 |
| [@crysnovax/baileys-fixed](https://dependencywatch.io/package/npm/@crysnovax/baileys-fixed) | npm | 0.0.0 |
| [@crysnovax/baileys-stable](https://dependencywatch.io/package/npm/@crysnovax/baileys-stable) | npm | 0.0.0 |
| [@crysnovax/plug](https://dependencywatch.io/package/npm/@crysnovax/plug) | npm | 0.0.0 |
| [astlsi](https://dependencywatch.io/package/pypi/astlsi) | PyPI | 0.1.0 |
| [box-sign-client](https://dependencywatch.io/package/npm/box-sign-client) | npm | 1.0.0 |
| [box-sign-client-poc](https://dependencywatch.io/package/npm/box-sign-client-poc) | npm | 1.0.0 |
| [chartkit-core](https://dependencywatch.io/package/pypi/chartkit-core) | PyPI | 1.0 |
| [claude-channel-discord](https://dependencywatch.io/package/npm/claude-channel-discord) | npm | 9.9.9 |
| [damp_coyote_0xrequest](https://dependencywatch.io/package/npm/damp_coyote_0xrequest) | npm | 1.0.0 |
| [damp_guanaco_z3n](https://dependencywatch.io/package/npm/damp_guanaco_z3n) | npm | 1.0.0 |
| [damp_haddock_requirement](https://dependencywatch.io/package/npm/damp_haddock_requirement) | npm | 1.0.0 |
| [damp_manatee_z3n](https://dependencywatch.io/package/npm/damp_manatee_z3n) | npm | 1.0.0 |
| [damp_mastodon_z3n](https://dependencywatch.io/package/npm/damp_mastodon_z3n) | npm | 1.0.0 |
| [damp_pelican_z3n](https://dependencywatch.io/package/npm/damp_pelican_z3n) | npm | 1.0.0 |
| [damp_spoonbill_coral-60](https://dependencywatch.io/package/npm/damp_spoonbill_coral-60) | npm | 1.0.0 |
| [damp_vulture_z3n](https://dependencywatch.io/package/npm/damp_vulture_z3n) | npm | 1.0.0 |
| [damp_wolverine_white-89](https://dependencywatch.io/package/npm/damp_wolverine_white-89) | npm | 1.0.0 |
| [dampradio](https://dependencywatch.io/package/npm/dampradio) | npm | 1.0.0 |
| [danangwijaya](https://dependencywatch.io/package/npm/danangwijaya) | npm | 1.0.0 |
| [danasah](https://dependencywatch.io/package/npm/danasah) | npm | 1.0.0 |
| [dandelion-amber-owt940-project](https://dependencywatch.io/package/npm/dandelion-amber-owt940-project) | npm | 1.0.0 |
| [dandelion-brook-wuk348-project](https://dependencywatch.io/package/npm/dandelion-brook-wuk348-project) | npm | 1.0.0 |
| [dandelion-cliff-atc189-project](https://dependencywatch.io/package/npm/dandelion-cliff-atc189-project) | npm | 1.0.0 |
| [dandelion-coral-rpv024-project](https://dependencywatch.io/package/npm/dandelion-coral-rpv024-project) | npm | 1.0.0 |
| [dandelion-dune-cli341-project](https://dependencywatch.io/package/npm/dandelion-dune-cli341-project) | npm | 1.0.0 |
| [dandelion-giraffe-mpa122-project](https://dependencywatch.io/package/npm/dandelion-giraffe-mpa122-project) | npm | 1.0.0 |
| [houdus](https://dependencywatch.io/package/pypi/houdus) | PyPI | 1.0.0, 1.0.1 |
| [line-through](https://dependencywatch.io/package/npm/line-through) | npm | 1.0.0 |
| [metricboxlite](https://dependencywatch.io/package/pypi/metricboxlite) | PyPI | 1.0, 2.0 |
| [olympuslib](https://dependencywatch.io/package/pypi/olympuslib) | PyPI | 99.99.0 |
| [pymaas](https://dependencywatch.io/package/pypi/pymaas) | PyPI | 99.99.0 |
| [qoeoe](https://dependencywatch.io/package/pypi/qoeoe) | PyPI | 0.1.0 |
| [real-router-telemetry](https://dependencywatch.io/package/npm/real-router-telemetry) | npm | 1.0.1, 1.0.4 |
| [tailwind-contact-forms](https://dependencywatch.io/package/npm/tailwind-contact-forms) | npm | 0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7, 0.5.8, 0.5.9, 0.5.10, 0.5.11, 0.5.12 |
| [timeweave](https://dependencywatch.io/package/pypi/timeweave) | PyPI | 1.0.0, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.6.0, 1.7.0, 1.8.0, 1.9.0 |
| [tpu-raiden-jax](https://dependencywatch.io/package/pypi/tpu-raiden-jax) | PyPI | 99.99.0 |
| [ulid-intel](https://dependencywatch.io/package/npm/ulid-intel) | npm | 0.0.0 |

## What happened

The 24-hour window ending 2026-09-05 published 1 new malware advisory (`houdus`, PyPI) plus a large tail of Sept 4 npm and PyPI advisories that were not covered in the Sept 4 GHSA sweep - GitHub kept publishing through the day after the Sept 4 batch closed. All 30+ new advisories fall into 12 clusters, ranging from a serious Windows sandbox-detection dropper (`houdus`) and a Windows fetch-and-execute dropper (`timeweave`) down to the ongoing tea.xyz reward-farming autopublisher flood.

## Cluster A - `houdus` PyPI Windows-only sandbox-detecting shellcode dropper (Sept 5)

| Package | Versions | GHSA | Campaign |
|---|---|---|---|
| `houdus` | `1.0.0`, `1.0.1` | GHSA-frjq-w86w-r3gr | `2026-09-houdus` |

**Attack chain**:

1. `import houdus` triggers loading of an obfuscated payload **disguised as a `.wav` file**
2. Payload does extensive fingerprinting against analysis sandboxes; silently no-ops if a sandbox is detected
3. On real hardware: downloads and executes heavily obfuscated code from a remote location
4. Establishes persistence via a **Windows scheduled task**
5. Runs shellcode

The `.wav`-disguised loader and sandbox-detection stage put this above the average GHSA-listed PyPI malware in effort. Classified as suspected infostealer by OpenSSF `malicious-packages`. Any Windows workstation that imported `houdus` must be treated as persistently compromised.

## Cluster B - `timeweave` PyPI Windows WinExec dropper

| Package | Versions | GHSA | Payload host |
|---|---|---|---|
| `timeweave` | `1.0.0` - `1.9.0` (10 versions) | GHSA-pjqm-mp65-gqw6 | `timezone.api.globaltimedata.com` |

Masquerades as a timezone utility. On any advertised API call (timezone detection or conversion) it spawns a background thread deceptively named `curls-autoupdate`, fetches a JSON manifest from `https://timezone.api.globaltimedata.com/latest/db.json`, downloads arbitrary files into a temp dir prefixed `firebeta_`, and executes each via `ctypes.windll.kernel32.WinExec`.

The C2 server controls the manifest, the payload files, AND their checksums - no attacker-independent integrity check is possible. Because activation is on API-call rather than import, a scan that looks for `import timeweave` on live processes misses hosts that used it once and cached shellcode.

## Cluster C - Box `@box/sign-client` dep-confusion via canarytokens.com DNS

| Package | Versions | GHSA | Exfil channel |
|---|---|---|---|
| `box-sign-client` | `1.0.0` | GHSA-g83p-hr9q-m2pp | `iv6mfybhp42k33ysmzi73de5w.canarytokens.com` DNS |
| `box-sign-client-poc` | `<=1.0.0` | GHSA-33rh-wv8r-6q4r | Same |

Both target Box's internal `@box/sign-client` namespace. `preinstall` reads `os.hostname()` and `process.env.USER`/`USERNAME`, embeds them plus a timestamp into a DNS subdomain, and resolves against `iv6mfybhp42k33ysmzi73de5w.canarytokens.com` (Thinkst Canarytokens beacon).

**Why DNS + Canarytokens matters**: canarytokens.com is a legitimate defender-side tripwire service - a defender who blocks it likely also blocks legitimate red-team infrastructure the enterprise uses. The operator is deliberately hiding inside noise a defender would hesitate to block. If this fired against a Box CI host, the operator knows Box's internal namespace resolves to public npm and a weaponised follow-up drop is coming.

## Cluster D - `tailwind-contact-forms` crypto-drainer typosquat

| Package | Versions | GHSA | C2 |
|---|---|---|---|
| `tailwind-contact-forms` | `<=0.5.12` (13 versions) | GHSA-389v-79qp-mvg6 | `h.drpc.org`, `pc.io/eth`, `stapi.io`, `ut.com/api` |

Impersonates the legitimate `@tailwindcss/forms` plugin. `package.json` `repository` field falsely references Tailwind Labs. Payload in `src/index.js` is obfuscated, fires on install and `require()`, and hits crypto infrastructure endpoints with Etherscan-style `module=account&action=txlist` queries - wallet-address enumeration and likely a follow-on wallet-drain drop.

## Cluster E - `real-router-telemetry` `.env` credential exfil to webhook.site

| Package | Versions | GHSA | Exfil |
|---|---|---|---|
| `real-router-telemetry` | `1.0.1`, `1.0.4` | GHSA-cwm2-j3h3-g35f | `https://webhook.site/e32d3b8a-a5df-40cc-ae60-7a8343b581e4` |

Obfuscated `telemetry.js` grabs hostname, username, CWD, platform, arch, memory, CPU info, runs shell commands for OS + process enumeration, and **reads `.env` from CWD** - every API key and DB password in the workspace `.env` is exfiltrated. `postinstall` hook fires the payload on `1.0.1`; on `1.0.4` the postinstall was partially disabled but the code still runs on `require()`.

## Cluster F - `line-through` GitHub Actions env-var exfil

| Package | Versions | GHSA | Exfil |
|---|---|---|---|
| `line-through` | `1.0.0` | GHSA-j28f-v2rv-5qxh | webhook.site + `*.your-collab-domain.oastify.com` |

`preinstall` script `vishu.js` grabs public IP, hostname, and GitHub Actions env vars: `CI`, `GITHUB_ACTIONS`, `GITHUB_WORKFLOW`, `GITHUB_RUN_ID`, ... - deliberately targets CI/CD workflow tokens rather than developer laptops. Dual-channel exfil: HTTPS GET to `https://webhook.site/66059630-2030-4b44-b2df-d37e02be0a7d` and DNS to `<hostname>.your-collab-domain.oastify.com` (the literal Burp Collaborator placeholder is either debug leftovers or a real deployment). Any GitHub Actions run that installed `line-through` compromised every workflow secret visible at that step.

## Cluster G - `claude-channel-discord` pipedream fingerprinter

| Package | Versions | GHSA | Exfil |
|---|---|---|---|
| `claude-channel-discord` | `9.9.9` | GHSA-787m-xjf4-8gx6 | `https://eo8f3m3ho26a0nm.m.pipedream.net/claude-channel-discord?h=<hostname>` |

Low-yield dep-confusion probe. Runs on preinstall, postinstall, and require. `9.9.9` version tag and Anthropic-adjacent naming are the tell. This is a fingerprinter, not the attack. If it resolved, the follow-up drop is coming.

## Cluster H - `ulid-intel` + `@crysnovax/*` npm minimal-detail malware

| Package | GHSA | Note |
|---|---|---|
| `ulid-intel` | GHSA-h48j-674x-299v | Full-compromise boilerplate |
| `@crysnovax/plug` | GHSA-vg98-2r8g-7qw2 | Full-compromise boilerplate |
| `@crysnovax/baileys` | GHSA-c34p-4828-cg5g | Typosquat of `@whiskeysockets/baileys` |
| `@crysnovax/baileys-fixed` | GHSA-262v-p7h8-9574 | Typosquat of `@whiskeysockets/baileys` |
| `@crysnovax/baileys-stable` | GHSA-p579-542j-6v98 | Typosquat of `@whiskeysockets/baileys` |

GHSA metadata is thin. The four `@crysnovax/*` packages share an operator and specifically target developers building WhatsApp Web automation with `@whiskeysockets/baileys` - a common target for account-takeover or session-hijack payloads.

## Cluster I - `amirgo4496` PyPI dep-confusion campaign

| Package | Versions | GHSA |
|---|---|---|
| `tpu-raiden-jax` | `>=99.99.0` | GHSA-3cvj-xhpg-ggw5 |
| `pymaas` | `99.99.0` | GHSA-9hv8-x7fp-26vw |
| `olympuslib` | `>=99.99.0` | GHSA-jjjp-27xc-v3pv |

All three exfiltrate environment variables on import. `>=99.99.0` version numbering is classic dep-confusion. Any organisation with an internal `tpu-raiden-jax` / `pymaas` / `olympuslib` pinned below `99.99.0` and no `--index-url` override will pull the malicious public version. Environment variables in most CI shells include cloud credentials, so the payload is high-value despite the "limited risk" classification in the OpenSSF metadata.

## Cluster J - Generic PyPI pentest sweep

| Package | Versions | GHSA |
|---|---|---|
| `chartkit-core` | `1.0` | GHSA-qhj3-jww9-gmfc |
| `metricboxlite` | `1.0`, `2.0` | GHSA-92qj-f225-g878 |

Both override `setup.py install` to exfil IP+username on install or import; campaign `GENERIC-standard-pypi-install-pentest`. Boilerplate pentest artefacts.

## Cluster K - `astlsi` + `qoeoe` PyPI file-exfil

| Package | Versions | GHSA | Campaign |
|---|---|---|---|
| `astlsi` | `0.1.0` | GHSA-mcr6-6rvw-7mg3 | Android-targeting |
| `qoeoe` | `0.1.0` | GHSA-mf95-3h9p-8xpm | `2026-09-asti` |

Hidden code exfiltrates files to a remote server. C2 endpoints not disclosed in GHSA metadata.

## Cluster L - tea.xyz autopublisher flood tail

~25 new `damp_*` / `damaged_*` / `dandelion-*` / `daliuren-*` / `damradio` / `danangwijaya` / `danasah` packages, all autopublisher-generated names abusing the tea.xyz protocol's dependency-count-based reward inflation. See `npm-2026-07-25-ghsa-tea-xyz-backfill` for the pattern write-up. No credential-stealer / wallet-drain payload; near-zero probability of a lockfile hit.

## Registry state

All packages listed above were flagged as malware on the npm and PyPI registries between 2026-09-04 and 2026-09-05 and added to the respective quarantine lists. Private mirrors (Verdaccio, Artifactory, Nexus, devpi) that cached tarballs before the takedown will keep serving the malicious versions - blocking the C2 hosts (`globaltimedata.com`, `webhook.site`, `canarytokens.com` from build hosts, `oastify.com`, pipedream.net beacon subdomains) at the network edge is a durable mitigation independent of registry-side quarantine.

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector`, `bad-packages.kam193.eu`.

## Impact

- **Cluster A - `houdus` PyPI Windows-only sandbox-detecting shellcode dropper (1 package, 2 versions)**: `houdus@1.0.0`+`1.0.1` (GHSA-frjq-w86w-r3gr, campaign `2026-09-houdus`) loads an obfuscated payload disguised as a `.wav` file on import. **Windows-only**, and does extensive fingerprinting against analysis sandboxes before doing anything malicious - if it detects a sandbox it silently no-ops, so a shallow dynamic-analysis pass sees nothing. On real hardware it downloads and executes heavily obfuscated code from a remote location, establishes persistence via Windows scheduled tasks, and runs shellcode. Suspected infostealer per the OSF `malicious-packages` classification. Any Windows developer workstation that imported `houdus` must be treated as fully compromised (persistence survives package removal)
- **Cluster B - `timeweave` PyPI Windows fetch-and-execute dropper (1 package, 10 versions)**: `timeweave@1.0.0`-`1.9.0` (GHSA-pjqm-mp65-gqw6) masquerades as a timezone utility. On any advertised API call (timezone detection or conversion) it spawns a background thread deceptively named `curls-autoupdate`, fetches a JSON manifest from **`https://timezone.api.globaltimedata.com/latest/db.json`**, downloads arbitrary files into a temp dir prefixed `firebeta_`, and executes them via `ctypes.windll.kernel32.WinExec`. **The C2 server controls both the manifest payload AND its checksums** - no integrity check possible. Because activation happens on library use (not just import), `--no-deps` audits miss it. Any Windows host that ran a `timeweave`-calling script during the exposure window must be treated as running attacker-supplied code
- **Cluster C - Box `@box/sign-client` dep-confusion via canarytokens.com DNS (2 packages, 2 versions)**: `box-sign-client@1.0.0` (GHSA-g83p-hr9q-m2pp) and `box-sign-client-poc@<=1.0.0` (GHSA-33rh-wv8r-6q4r) target Box's internal `@box/sign-client` namespace. Both run a `preinstall` script that reads `os.hostname()` and `process.env.USER`/`USERNAME`, embeds the values plus a timestamp into a DNS subdomain, and resolves against `iv6mfybhp42k33ysmzi73de5w.canarytokens.com` (a Thinkst Canarytokens beacon token). This is fingerprinting for a follow-up drop against confirmed-vulnerable Box installations - a preinstall DNS beacon is deliberately low-noise and slips past HTTPS egress filters that ignore DNS. Box engineers should audit private-registry precedence rules immediately
- **Cluster D - `tailwind-contact-forms` crypto-drainer typosquat (1 package, <=13 versions)**: `tailwind-contact-forms@<=0.5.12` (GHSA-389v-79qp-mvg6) impersonates the legitimate `@tailwindcss/forms` plugin. Package `repository` metadata falsely references Tailwind Labs' upstream. On install and `require()` an obfuscated payload in `src/index.js` reads hostname and env vars, then contacts cryptocurrency infrastructure: `h.drpc.org`, `pc.io/eth`, `stapi.io`, `ut.com/api`, and Etherscan-style endpoints with `module=account&action=txlist` parameters. Behaviour is consistent with a wallet-address enumeration / eventual wallet-drain drop. Any developer who fat-fingered `@tailwindcss/forms` and pulled `tailwind-contact-forms` must audit for wallet-address exposure
- **Cluster E - `real-router-telemetry` `.env` credential exfil to webhook.site (1 package, 2 versions)**: `real-router-telemetry@1.0.1`+`1.0.4` (GHSA-cwm2-j3h3-g35f) ships an obfuscated `telemetry.js` that grabs hostname, username, CWD, platform, arch, memory, CPU info, runs shell commands to enumerate OS + running processes, **and reads `.env` from the CWD** - so any API key, DB password, or OAuth secret in the workspace `.env` is exfiltrated. Data is POSTed to `https://webhook.site/e32d3b8a-a5df-40cc-ae60-7a8343b581e4`. The `1.0.4` version had the `postinstall` hook partially disabled but the module still runs on import
- **Cluster F - `line-through` webhook.site + `oastify.com` CI/CD-env exfil (1 package, 1 version)**: `line-through@1.0.0` (GHSA-j28f-v2rv-5qxh) preinstall script `vishu.js` grabs public IP, hostname, and **GitHub Actions env vars** (`CI`, `GITHUB_ACTIONS`, `GITHUB_WORKFLOW`, `GITHUB_RUN_ID`, ...) - a targeted CI/CD workflow-token-theft posture rather than developer laptop hunting. Exfil is dual-channel: HTTPS GET to `https://webhook.site/66059630-2030-4b44-b2df-d37e02be0a7d` and DNS to `<hostname>.your-collab-domain.oastify.com` (default Burp Collaborator subdomain - either debug leftovers or a real deployment). Any GitHub-Actions workflow that installed `line-through` should treat every workflow secret visible at that step as compromised
- **Cluster G - `claude-channel-discord` pipedream beacon (1 package, 1 version)**: `claude-channel-discord@9.9.9` (GHSA-787m-xjf4-8gx6) is a low-yield dep-confusion probe. Preinstall+postinstall+require paths all execute `node index.js` which reads `os.hostname()` and GETs `https://eo8f3m3ho26a0nm.m.pipedream.net/claude-channel-discord?h=<hostname>`. The `9.9.9` version tag and Anthropic-adjacent naming (dep-confusion probe against an internal `claude-channel-discord`-style package) are the fingerprint. Not a payload; a fingerprinter for a follow-up drop
- **Cluster H - `ulid-intel` + `@crysnovax/*` npm minimal-detail malware (5 packages, all versions)**: `ulid-intel` (GHSA-h48j-674x-299v) and the four `@crysnovax/*` packages `plug` (GHSA-vg98-2r8g-7qw2), `baileys-fixed` (GHSA-262v-p7h8-9574), `baileys-stable` (GHSA-p579-542j-6v98), `baileys` (GHSA-c34p-4828-cg5g) - GHSA flags each with the boilerplate "any computer that has this package installed should be considered fully compromised" and no further technical detail. The four `@crysnovax/*` names cluster under one operator; `baileys*` are typosquats/rebrands of the popular `@whiskeysockets/baileys` WhatsApp Web API library and would be pulled by anyone building WhatsApp automation. Uninstall on any lockfile hit and rotate any credentials on the host
- **Cluster I - `amirgo4496` PyPI dep-confusion recon campaign (3 packages, versions >=99.99.0)**: `tpu-raiden-jax` (GHSA-3cvj-xhpg-ggw5), `pymaas@99.99.0` (GHSA-9hv8-x7fp-26vw), and `olympuslib` (GHSA-jjjp-27xc-v3pv) share campaign id `2026-09-amirgo4496`. All exfiltrate environment variables on import; the `>=99.99.0` version numbering is the classic dep-confusion trick (any organisation with an internal `tpu-raiden-jax`/`pymaas`/`olympuslib` package pinned below `99.99.0` will resolve the malicious public version instead). Classified as "limited risk" by researchers but the fingerprint they capture (env vars including cloud credentials in most CI shells) is high-value
- **Cluster J - Generic PyPI pentest-pattern sweep (2 packages, 3 versions)**: `chartkit-core@1.0` (GHSA-qhj3-jww9-gmfc) and `metricboxlite@1.0`+`2.0` (GHSA-92qj-f225-g878) - both override the `setup.py install` command to exfil IP and username on install or import; campaign `GENERIC-standard-pypi-install-pentest`. Boilerplate pentest-tooling artefacts more than targeted attacks, but the same behaviour under a different name is used by real threat actors, so flag anyway
- **Cluster K - `astlsi` + `qoeoe` PyPI file-exfil (2 packages, 2 versions)**: `astlsi@0.1.0` (GHSA-mcr6-6rvw-7mg3) and `qoeoe@0.1.0` (GHSA-mf95-3h9p-8xpm, campaign `2026-09-asti`) both contain hidden code that exfiltrates files to a remote server. Advisory metadata tags them Android-targeting. C2 endpoints are not disclosed in the GHSA record but the file-exfil pattern is the payload
- **Cluster L - tea.xyz autopublisher flood tail (>=25 npm packages, all versions)**: `damp_*` (`damp_haddock_requirement`, `damp_manatee_z3n`, `damp_coyote_0xrequest`, `damp_guanaco_z3n`, `damp_mastodon_z3n`, `damp_spoonbill_coral-60`, `damp_wolverine_white-89`, `damp_vulture_z3n`, `damp_pelican_z3n`, `damp_swift-gooddev`, `damp_dog_z3n`, `damp_guineafowl_z3n`, `damp_ermine_z3n`, `damp_hawk_0xrequest`, `damp_hippopotamus_z3n`, `damp_tuna_z3n`, `damp_gayal_z3n`, `damp_angelfish_gray-42`, `damp_sheep_z3n`), `damaged_*`, `dandelion-*` (`dandelion-coral-rpv024-project`, `dandelion-amber-owt940-project`, `dandelion-giraffe-mpa122-project`, `dandelion-dune-cli341-project`, `dandelion-brook-wuk348-project`, `dandelion-cliff-atc189-project`), `daliuren-*`, `dampradio`, `danangwijaya`, `danasah`. All autopublisher-generated names abusing tea.xyz protocol reward inflation - see `npm-2026-07-25-ghsa-tea-xyz-backfill` for the pattern write-up. No credential-stealer / wallet-drain payload; zero practical dependency-audit risk (nobody legitimately depends on `damp_wolverine_white-89`)

## What to do

1. Grep every `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `requirements.txt`, `poetry.lock`, `Pipfile.lock`, `uv.lock`, and internal registry mirror for the package names below. Uninstall and rebuild the lockfile against a clean cache on any hit
2. **For Cluster A (`houdus` Windows dropper)**: any Windows host that ran `import houdus` should be treated as **persistently compromised** - the scheduled-task persistence survives package removal. Isolate the host, image it, and rebuild from a clean template rather than trying to clean in place. The obfuscated `.wav` payload and sandbox-detection logic mean signature-based AV likely missed the initial infection
3. **For Cluster B (`timeweave`)**: block outbound DNS/HTTPS to `timezone.api.globaltimedata.com` and `*.globaltimedata.com` from any Windows build/dev host. Uninstall `timeweave` from every project. Because activation is on API-call (not just import), a `pip list --outdated` sweep is insufficient - grep for `import timeweave` in every project. Rotate any credential accessible to a host that ran a `timeweave`-using script
4. **For Cluster C (Box `@box/sign-client` dep-confusion)**: Box engineers - audit `.npmrc` scope-registry pinning for the `@box` scope on every developer laptop and CI host. If either `box-sign-client` or `box-sign-client-poc` resolved on any host, the operator now knows Box's internal namespace resolves to public npm and a weaponised follow-up drop is coming. Block DNS to `*.canarytokens.com` from build/CI hosts (legit uses of Canarytokens are staff-side, not build-side)
5. **For Cluster D (`tailwind-contact-forms`)**: grep for `tailwind-contact-forms` in every lockfile. Any hit indicates a fat-finger of `@tailwindcss/forms` - remove it, pin `@tailwindcss/forms` explicitly, and audit for wallet-address exposure or unexpected outbound to `h.drpc.org`/`pc.io`/`stapi.io`/`ut.com`
6. **For Clusters E + F (`real-router-telemetry`, `line-through` webhook.site exfil)**: rotate every credential in any `.env` file present on the host during the exposure window. Block outbound to `webhook.site` from build/CI hosts entirely (webhook.site has zero legitimate build-time use and is by far the most common exfil sink). For `line-through`: any GitHub Actions workflow that installed it, treat every workflow secret visible at the step as compromised - rotate GITHUB_TOKEN, deploy keys, npm publish tokens, container registry creds, and any org-level secret exposed to the workflow
7. **For Cluster G (`claude-channel-discord`)**: fingerprinting probe only. If it resolved, the follow-up drop is coming; add `@claude-*` scopes and internal Anthropic-adjacent package names to your private-registry scope pin in `.npmrc`
8. **For Cluster H (`ulid-intel` + `@crysnovax/*`)**: uninstall on hit, rotate secrets. The `baileys*`-named packages are typosquats against `@whiskeysockets/baileys` (WhatsApp Web API) - if you build WhatsApp automation, pin explicitly to `@whiskeysockets/baileys`
9. **For Cluster I (`amirgo4496` PyPI dep-confusion)**: if any internal `tpu-raiden-jax`, `pymaas`, or `olympuslib` package existed at a version below `99.99.0` and any developer or CI host ran `pip install` without an explicit index-url override, the malicious public version was pulled. Audit `pip config` and set `--index-url` explicitly to your internal mirror. Rotate any env-var-exposed secret on affected hosts (env vars in CI usually include cloud credentials)
10. **For Clusters J + K + L (pentest, file-exfil, tea.xyz flood)**: uninstall on hit; no host-forensics response required beyond routine credential-rotation prudence. The tea.xyz flood packages are cataloguing noise - the near-zero probability of a lockfile hit means they exist here for audit-trail completeness, not urgent response
11. For every `npm install` and `pip install` in CI, prefer `--ignore-scripts` / `pip install --no-deps` where feasible - this blocks Clusters B (partial), C, D (partial), E (postinstall path only), F, G preinstall vectors. Clusters A, B (main path), D (require-time), H, I still fire on import - the only defence there is not resolving the package at all

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-frjq-w86w-r3gr - houdus (PyPI Windows sandbox-detecting shellcode dropper)](https://github.com/advisories/GHSA-frjq-w86w-r3gr) - GitHub
- [GHSA-pjqm-mp65-gqw6 - timeweave (PyPI Windows WinExec dropper via globaltimedata.com)](https://github.com/advisories/GHSA-pjqm-mp65-gqw6) - GitHub
- [GHSA-g83p-hr9q-m2pp - box-sign-client (Box internal dep-confusion, canarytokens.com DNS beacon)](https://github.com/advisories/GHSA-g83p-hr9q-m2pp) - GitHub
- [GHSA-33rh-wv8r-6q4r - box-sign-client-poc (Box internal dep-confusion, canarytokens.com DNS beacon)](https://github.com/advisories/GHSA-33rh-wv8r-6q4r) - GitHub
- [GHSA-389v-79qp-mvg6 - tailwind-contact-forms (@tailwindcss/forms typosquat, wallet-address enumeration)](https://github.com/advisories/GHSA-389v-79qp-mvg6) - GitHub
- [GHSA-cwm2-j3h3-g35f - real-router-telemetry (.env exfil to webhook.site)](https://github.com/advisories/GHSA-cwm2-j3h3-g35f) - GitHub
- [GHSA-j28f-v2rv-5qxh - line-through (GitHub Actions env exfil to webhook.site + oastify.com)](https://github.com/advisories/GHSA-j28f-v2rv-5qxh) - GitHub
- [GHSA-787m-xjf4-8gx6 - claude-channel-discord (pipedream.net dep-confusion beacon)](https://github.com/advisories/GHSA-787m-xjf4-8gx6) - GitHub
- [GHSA-h48j-674x-299v - ulid-intel](https://github.com/advisories/GHSA-h48j-674x-299v) - GitHub
- [GHSA-vg98-2r8g-7qw2 - @crysnovax/plug](https://github.com/advisories/GHSA-vg98-2r8g-7qw2) - GitHub
- [GHSA-c34p-4828-cg5g - @crysnovax/baileys (baileys typosquat)](https://github.com/advisories/GHSA-c34p-4828-cg5g) - GitHub
- [GHSA-262v-p7h8-9574 - @crysnovax/baileys-fixed (baileys typosquat)](https://github.com/advisories/GHSA-262v-p7h8-9574) - GitHub
- [GHSA-p579-542j-6v98 - @crysnovax/baileys-stable (baileys typosquat)](https://github.com/advisories/GHSA-p579-542j-6v98) - GitHub
- [GHSA-3cvj-xhpg-ggw5 - tpu-raiden-jax (2026-09-amirgo4496 env-var exfil)](https://github.com/advisories/GHSA-3cvj-xhpg-ggw5) - GitHub
- [GHSA-9hv8-x7fp-26vw - pymaas (2026-09-amirgo4496 env-var exfil)](https://github.com/advisories/GHSA-9hv8-x7fp-26vw) - GitHub
- [GHSA-jjjp-27xc-v3pv - olympuslib (2026-09-amirgo4496 env-var exfil)](https://github.com/advisories/GHSA-jjjp-27xc-v3pv) - GitHub
- [GHSA-qhj3-jww9-gmfc - chartkit-core](https://github.com/advisories/GHSA-qhj3-jww9-gmfc) - GitHub
- [GHSA-92qj-f225-g878 - metricboxlite](https://github.com/advisories/GHSA-92qj-f225-g878) - GitHub
- [GHSA-mcr6-6rvw-7mg3 - astlsi](https://github.com/advisories/GHSA-mcr6-6rvw-7mg3) - GitHub
- [GHSA-mf95-3h9p-8xpm - qoeoe (2026-09-asti)](https://github.com/advisories/GHSA-mf95-3h9p-8xpm) - GitHub
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF

---

Canonical page: https://dependencywatch.io/incident/multi-2026-09-05-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-09-05-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).