DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 6 September 2026

HighAdvisory sweepnpmPyPI

Tail sweep after yesterday's batch. 6 @liuliang520500/* npm packages impersonate Sina Taoke, Pinduoduo, JD.com, and Taobao SDKs; 7 @domyjs/* npm packages typosquat a reactive-framework namespace; date-fns-formatter extends the date-fns typosquat family; trongridew (PyPI) is a Tron/TRX private-key exfil dropper; proxycer/dbt-sa-cli are install-time IP+username exfil pentest artefacts.

Published 6 Sept 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-09-06-ghsa-malware-sweep
27
Packages tracked27 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
6 Sept 2026
Ecosystems
npmPyPI
Detected by
GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, bad-packages.kam193.eu
Also known as
2026-09-06 GHSA sweep, @liuliang520500 Chinese e-commerce SDK impersonators, @domyjs reactive-framework typosquat sweep

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

The 24-hour window ending 2026-09-06 published 25 new malware advisories - 13 npm packages published Sept 6 and 12 more Sept 5 npm/PyPI advisories that surfaced after yesterday's (Sept 5) sweep closed. All fall into 6 clusters. Two of the six (Cluster A @liuliang520500/* Chinese e-commerce SDK impersonators, Cluster B @domyjs/* reactive-framework typosquat sweep) are single-operator drops of 6-7 packages each under one npm scope. Cluster C (date-fns-formatter) extends an already-active date-fns typosquat family. Cluster E (trongridew, PyPI) is a Tron/TRX cryptocurrency private-key exfil from the long-running 2025-04-tronix campaign. Clusters D and F are boilerplate opportunistic drops and PROBABLY_PENTEST reconnaissance artefacts.

Cluster A - @liuliang520500/* Chinese e-commerce SDK impersonator sweep (Sept 6)

PackageGHSAImpersonates
@liuliang520500/sinataoke_cnGHSA-jjx2-vpx2-qp32Sina Taoke (coupon/affiliate SDK)
@liuliang520500/sinataoke_cn_testGHSA-36jr-wqjh-q55xSina Taoke (test-suffixed variant)
@liuliang520500/pdd-sdkGHSA-g9hc-xr9f-27g4Pinduoduo (PDD) open-platform SDK
@liuliang520500/pdd-sdk-newGHSA-jp84-gqp2-j9qqPinduoduo (PDD) - "new" suffix
@liuliang520500/jd-sdkGHSA-j849-992g-rggrJD.com open-platform SDK
@liuliang520500/taobao-topclientGHSA-75r6-9fpm-rf6jTaobao TOP client SDK

One operator publishing under one npm scope, all six packages named after the four biggest Chinese e-commerce open-platform SDKs. GHSA metadata is thin (boilerplate "any computer that has this package installed or running should be considered fully compromised") but the six-package burst under one scope is the classic drop-and-run pattern - the operator expects a subset of developers at Chinese e-commerce integrators (or Western brands' outsourced integration partners) to fat-finger the scope while adding legitimate @jd/*, @pdd/*, @sina/*, or @taobao/* dependencies.

Cluster B - @domyjs/* reactive-framework typosquat sweep (Sept 5)

PackageGHSAFramework role
@domyjs/reactiveGHSA-3ggc-3pw2-c9v9State / reactivity
@domyjs/i18nGHSA-22jr-v88r-5cj6Internationalisation
@domyjs/routerGHSA-j7wp-3648-mh57SPA router
@domyjs/intersectGHSA-v8xv-9q46-8h3xIntersection observer
@domyjs/throttleGHSA-fr62-p59g-hr9fThrottle / debounce
@domyjs/maskGHSA-93j2-q7r7-7qhhInput mask
@domyjs/collapseGHSA-39q9-7vqg-3m6wCollapse / expand UI

Seven packages under @domyjs published together and covering what looks like an entire reactive-framework utility ecosystem. The naming is designed to look like a legitimate Vue-adjacent or Svelte-adjacent utility bundle. Boilerplate GHSA metadata but any lockfile hit on the @domyjs scope means an operator now has full-compromise access to the host.

Cluster C - date-fns-formatter date-fns typosquat (Sept 6)

PackageGHSAFamily
date-fns-formatterGHSA-h258-m2gc-2p4qdate-fns typosquat

Extends the ongoing date-fns typosquat family (siblings: datefmt-helper = MAL-2026-6788, date-fns-lite = MAL-2026-6722, date-fns-2). The date-fns family is one of the highest-download npm namespaces so typosquat probability against it is high. Boilerplate GHSA metadata but assume the same postinstall-hook AWS/GCP/Azure/SSH credential harvest pattern the other family members used, until reverse-engineered otherwise.

Cluster D - Miscellaneous npm boilerplate malware (Sept 5-6)

PackageGHSAPublished
@pilllesss/yornGHSA-rghh-4gfg-jvqcSep 6
1cattunnelGHSA-r35j-cv2x-mm7hSep 6
dcftunnelGHSA-4c2f-x64v-297xSep 6
multicore-kitGHSA-q588-cfvg-8346Sep 6
array-framesGHSA-24hx-4mc8-g9q7Sep 6
node-helperGHSA-2ggc-wmq2-3whpSep 6
jwt-loggerGHSA-rpqx-cp2g-55w5Sep 5
array-scalaGHSA-rx3f-9hxc-773gSep 5
infinity-gridGHSA-39fr-j2vr-r24pSep 5
btn-particlesGHSA-6w56-62pq-vhphSep 5

Boilerplate CWE-506 "any computer that has this package installed or running should be considered fully compromised" with no source, no C2. 1cattunnel / dcftunnel share the -tunnel suffix pattern - either legitimate-sounding tunnel utilities or paired droppers under one operator. jwt-logger and node-helper are generic-utility naming designed to slip past a shallow audit. multicore-kit reads as a plausible node-multicore adjacent name.

Cluster E - trongridew PyPI Tron/TRX private-key exfil (Sept 5)

PackageVersionsGHSACampaign
trongridew0.0.1GHSA-vjjx-756v-6p3x2025-04-tronix

OpenSSF malicious-packages: "appears to be designed for private key exfiltration". Naming references TRX (Tron / Tronix blockchain). Uses deceptive tactics by cloning legitimate library documentation. Part of the long-running 2025-04-tronix campaign that has re-uploaded this and adjacent typosquats repeatedly to PyPI. Any Python cryptocurrency tool depending on trongridew (dep-confusion against internal tronpy-adjacent names, or a fat-finger of the real package) leaks TRX private keys.

Cluster F - Generic PyPI install-time exfil pentest artefacts (Sept 5)

PackageVersionsGHSACampaign
proxycer0.1.0GHSA-qff6-cqrr-65wv2025-02-pxz
dbt-sa-cli0.0.1GHSA-xf8p-r8w2-fx5mGENERIC-standard-pypi-install-pentest

Both classified "PROBABLY_PENTEST" by OpenSSF - low-harm reconnaissance rather than a real payload. proxycer collects basic user info on import; dbt-sa-cli overrides setup.py install to exfil IP+username on install. The dbt-sa-cli name is a plausible dep-confusion probe against internal dbt (data-build-tool) service-account CLI utilities in enterprise data teams.

Registry state

All packages listed above were flagged as malware on the npm and PyPI registries between 2026-09-05 and 2026-09-06 and added to the respective quarantine lists. Private mirrors (Verdaccio, Artifactory, Nexus, devpi) that cached tarballs before takedown will keep serving the malicious versions - explicit deny-listing of the @liuliang520500 and @domyjs npm scopes and the trongridew PyPI name is a durable mitigation independent of registry-side quarantine.

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, bad-packages.kam193.eu.

typosquatdependency-confusioncredential-theftinfostealercrypto-wallet-drain
Affected packages

27 packages 27 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • *Cluster A - `@liuliang520500/ Chinese e-commerce SDK impersonator sweep (6 packages, all versions)**: @liuliang520500/sinataoke_cn (GHSA-jjx2-vpx2-qp32), @liuliang520500/sinataoke_cn_test (GHSA-36jr-wqjh-q55x), @liuliang520500/pdd-sdk-new (GHSA-jp84-gqp2-j9qq), @liuliang520500/jd-sdk (GHSA-j849-992g-rggr), @liuliang520500/pdd-sdk (GHSA-g9hc-xr9f-27g4), @liuliang520500/taobao-topclient` (GHSA-75r6-9fpm-rf6j) - one operator publishing under a single npm scope, all six packages named after the four biggest Chinese e-commerce SDKs (Sina Taoke coupon/affiliate SDK, Pinduoduo PDD open-platform SDK, JD.com open-platform SDK, Taobao Top-Client SDK). GHSA flags each with the boilerplate "any computer that has this package installed or running should be considered fully compromised" - no source, no C2 disclosed, but the six-package burst under one scope is the classic drop-and-run pattern for dep-confusion / typosquat harvesting. Anyone at a Chinese e-commerce integrator (or an outsourcer building against these platforms for a Western brand) who fat-fingered the scope is exposed
  • *Cluster B - `@domyjs/ reactive-framework typosquat sweep (7 packages, all versions)**: @domyjs/reactive (GHSA-3ggc-3pw2-c9v9), @domyjs/i18n (GHSA-22jr-v88r-5cj6), @domyjs/router (GHSA-j7wp-3648-mh57), @domyjs/intersect (GHSA-v8xv-9q46-8h3x), @domyjs/throttle (GHSA-fr62-p59g-hr9f), @domyjs/mask (GHSA-93j2-q7r7-7qhh), @domyjs/collapse (GHSA-39q9-7vqg-3m6w) - one scope publishing what looks like a full reactive-framework ecosystem (state / i18n / router / intersect observer / throttle / input-mask / collapse) in one shot. Boilerplate CWE-506 metadata but the naming pattern is designed to look like a legitimate Vue/Svelte-adjacent utility bundle a developer would trust. Any lockfile hit on the @domyjs` scope means an operator now has full-compromise access to the host
  • Cluster C - date-fns-formatter date-fns typosquat (1 package, all versions): date-fns-formatter (GHSA-h258-m2gc-2p4q) - extends the ongoing date-fns typosquat family (datefmt-helper (MAL-2026-6788), date-fns-lite (MAL-2026-6722), date-fns-2). The date-fns family is one of the highest-download npm namespaces so typosquat probability against it is high. Boilerplate GHSA metadata; assume the same postinstall-hook AWS/GCP/Azure/SSH credential harvest pattern the other family members used until reverse-engineered otherwise
  • Cluster D - Miscellaneous npm boilerplate malware (10 packages, all versions): @pilllesss/yorn (GHSA-rghh-4gfg-jvqc), 1cattunnel (GHSA-r35j-cv2x-mm7h), dcftunnel (GHSA-4c2f-x64v-297x), multicore-kit (GHSA-q588-cfvg-8346), array-frames (GHSA-24hx-4mc8-g9q7), node-helper (GHSA-2ggc-wmq2-3whp), jwt-logger (GHSA-rpqx-cp2g-55w5), array-scala (GHSA-rx3f-9hxc-773g), infinity-grid (GHSA-39fr-j2vr-r24p), btn-particles (GHSA-6w56-62pq-vhph) - GHSA flags each with the boilerplate "any computer that has this package installed or running should be considered fully compromised" and no further technical detail. 1cattunnel / dcftunnel share the -tunnel suffix pattern (either legitimate-sounding tunnel utilities or paired droppers under one operator); jwt-logger and node-helper are generic-utility naming designed to slip past a shallow audit; multicore-kit reads as a plausible node-multicore adjacent name. Uninstall on any lockfile hit and rotate host credentials
  • Cluster E - trongridew PyPI Tronix private-key exfil (1 package, 1 version): trongridew@0.0.1 (GHSA-vjjx-756v-6p3x, campaign 2025-04-tronix) - Tron/TRX-blockchain infostealer that clones the legitimate tronpy (or similar TRX SDK) documentation to look plausible. OpenSSF metadata: "appears to be designed for private key exfiltration". Part of the long-running 2025-04-tronix campaign that has re-uploaded this and adjacent typosquats repeatedly to PyPI. Any Python cryptocurrency tool depending on trongridew (dep-confusion against internal tronpy-adjacent names, or a fat-finger of the real package) leaks TRX private keys
  • Cluster F - Generic PyPI install-time exfil pentest artefacts (2 packages, 2 versions): proxycer@0.1.0 (GHSA-qff6-cqrr-65wv, campaign 2025-02-pxz) collects basic user info on import; dbt-sa-cli@0.0.1 (GHSA-xf8p-r8w2-fx5m, campaign GENERIC-standard-pypi-install-pentest) overrides setup.py install to exfil IP+username on install. Both classified "PROBABLY_PENTEST" by OpenSSF malicious-packages - low-harm reconnaissance rather than a real payload, but the exact same setup.py install override is the pattern real threat actors use, so flag anyway. dbt-sa-cli is a plausible dep-confusion name against dbt (data-build-tool) service-account CLI utilities in enterprise data teams
What to do

Clean-up steps

  1. Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, Pipfile.lock, uv.lock, and internal registry mirror for the package names below. Uninstall and rebuild the lockfile against a clean cache on any hit
  2. *For Cluster A (`@liuliang520500/ Chinese e-commerce SDK impersonators)**: any team integrating Sina Taoke, Pinduoduo, JD.com, or Taobao open-platform SDKs - lock explicit scoped-registry pinning for the legitimate scopes (@jd/, @pdd/, @sina/, @taobao/, and their team-side private-registry equivalents) in .npmrc. If any developer or CI host resolved @liuliang520500/*`, rotate every credential on the host
  3. *For Cluster B (`@domyjs/)**: uninstall on any lockfile hit and rotate host credentials. Do not import any package under the @domyjs` scope until the operator identity is verified by an unrelated source. If your project uses a Vue/Svelte reactive-framework-style utility bundle from an unfamiliar scope, verify the publisher through a second channel before adopting
  4. For Cluster C (date-fns-formatter): block or unpublish date-fns-formatter from any internal npm mirror. Explicitly pin date-fns in your top-level dependencies (never date-fns-*). Also add the sibling typosquats datefmt-helper, date-fns-lite, date-fns-2 to a mirror-side deny-list
  5. For Cluster D (miscellaneous boilerplate): uninstall on any lockfile hit and rotate host credentials. Any host that resolved a -tunnel-suffixed npm package it did not explicitly add is likely compromised - grep dev, CI, and runtime hosts for 1cattunnel / dcftunnel / multicore-kit / array-frames / node-helper / jwt-logger / array-scala / infinity-grid / btn-particles / @pilllesss/yorn
  6. For Cluster E (trongridew): any Python tool depending on TRX SDKs - pin tronpy explicitly in requirements.txt / pyproject.toml. Audit pip install history on developer laptops and CI hosts for trongridew (and the sibling 2025-04-tronix campaign packages historically indexed to that campaign id). Any Tron wallet whose private key was on a host that ran trongridew must be treated as drained
  7. For Cluster F (proxycer, dbt-sa-cli): uninstall on hit; no host-forensics response required beyond routine credential-rotation prudence. For data teams: if you have an internal dbt-sa-cli (dbt service-account CLI) package, pin it to your internal index-url explicitly - the malicious public version was published against an obvious internal-namespace guess
  8. For every npm install and pip install in CI, prefer --ignore-scripts / pip install --no-deps where feasible - this blocks Clusters A, B, C, D postinstall vectors and Cluster F setup.py install overrides. Cluster E (trongridew) fires on import so --no-deps alone is insufficient; grep for import trongridew in Python source trees
  9. Consider adding the @liuliang520500 and @domyjs npm scopes and trongridew PyPI name to any private-registry deny-list to prevent future re-publishes under the same identity
References

Sources

multi-2026-09-06-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents