# GitHub Advisory malware sweep, 6 September 2026

> Tail sweep after yesterday's batch. 6 `@liuliang520500/*` npm packages impersonate Sina Taoke, Pinduoduo, JD.com, and Taobao SDKs; 7 `@domyjs/*` npm packages typosquat a reactive-framework namespace; `date-fns-formatter` extends the date-fns typosquat family; `trongridew` (PyPI) is a Tron/TRX private-key exfil dropper; `proxycer`/`dbt-sa-cli` are install-time IP+username exfil pentest artefacts.

- Published: 2026-09-06
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 27 packages, 27 compromised versions
- Tags: typosquat, dependency-confusion, credential-theft, infostealer, crypto-wallet-drain
- Also known as: 2026-09-06 GHSA sweep, @liuliang520500 Chinese e-commerce SDK impersonators, @domyjs reactive-framework typosquat sweep, date-fns typosquat family (date-fns-formatter), 2025-04-tronix Tron private-key exfil (trongridew), 2025-02-pxz proxycer
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, bad-packages.kam193.eu
- Incident ID: multi-2026-09-06-ghsa-malware-sweep

## Affected packages (27)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@domyjs/collapse](https://dependencywatch.io/package/npm/@domyjs/collapse) | npm | 0.0.0 |
| [@domyjs/i18n](https://dependencywatch.io/package/npm/@domyjs/i18n) | npm | 0.0.0 |
| [@domyjs/intersect](https://dependencywatch.io/package/npm/@domyjs/intersect) | npm | 0.0.0 |
| [@domyjs/mask](https://dependencywatch.io/package/npm/@domyjs/mask) | npm | 0.0.0 |
| [@domyjs/reactive](https://dependencywatch.io/package/npm/@domyjs/reactive) | npm | 0.0.0 |
| [@domyjs/router](https://dependencywatch.io/package/npm/@domyjs/router) | npm | 0.0.0 |
| [@domyjs/throttle](https://dependencywatch.io/package/npm/@domyjs/throttle) | npm | 0.0.0 |
| [@liuliang520500/jd-sdk](https://dependencywatch.io/package/npm/@liuliang520500/jd-sdk) | npm | 0.0.0 |
| [@liuliang520500/pdd-sdk](https://dependencywatch.io/package/npm/@liuliang520500/pdd-sdk) | npm | 0.0.0 |
| [@liuliang520500/pdd-sdk-new](https://dependencywatch.io/package/npm/@liuliang520500/pdd-sdk-new) | npm | 0.0.0 |
| [@liuliang520500/sinataoke_cn](https://dependencywatch.io/package/npm/@liuliang520500/sinataoke_cn) | npm | 0.0.0 |
| [@liuliang520500/sinataoke_cn_test](https://dependencywatch.io/package/npm/@liuliang520500/sinataoke_cn_test) | npm | 0.0.0 |
| [@liuliang520500/taobao-topclient](https://dependencywatch.io/package/npm/@liuliang520500/taobao-topclient) | npm | 0.0.0 |
| [@pilllesss/yorn](https://dependencywatch.io/package/npm/@pilllesss/yorn) | npm | 0.0.0 |
| [1cattunnel](https://dependencywatch.io/package/npm/1cattunnel) | npm | 0.0.0 |
| [array-frames](https://dependencywatch.io/package/npm/array-frames) | npm | 0.0.0 |
| [array-scala](https://dependencywatch.io/package/npm/array-scala) | npm | 0.0.0 |
| [btn-particles](https://dependencywatch.io/package/npm/btn-particles) | npm | 0.0.0 |
| [date-fns-formatter](https://dependencywatch.io/package/npm/date-fns-formatter) | npm | 0.0.0 |
| [dbt-sa-cli](https://dependencywatch.io/package/pypi/dbt-sa-cli) | PyPI | 0.0.1 |
| [dcftunnel](https://dependencywatch.io/package/npm/dcftunnel) | npm | 0.0.0 |
| [infinity-grid](https://dependencywatch.io/package/npm/infinity-grid) | npm | 0.0.0 |
| [jwt-logger](https://dependencywatch.io/package/npm/jwt-logger) | npm | 0.0.0 |
| [multicore-kit](https://dependencywatch.io/package/npm/multicore-kit) | npm | 0.0.0 |
| [node-helper](https://dependencywatch.io/package/npm/node-helper) | npm | 0.0.0 |
| [proxycer](https://dependencywatch.io/package/pypi/proxycer) | PyPI | 0.1.0 |
| [trongridew](https://dependencywatch.io/package/pypi/trongridew) | PyPI | 0.0.1 |

## What happened

The 24-hour window ending 2026-09-06 published 25 new malware advisories - 13 npm packages published Sept 6 and 12 more Sept 5 npm/PyPI advisories that surfaced after yesterday's (Sept 5) sweep closed. All fall into 6 clusters. Two of the six (Cluster A `@liuliang520500/*` Chinese e-commerce SDK impersonators, Cluster B `@domyjs/*` reactive-framework typosquat sweep) are single-operator drops of 6-7 packages each under one npm scope. Cluster C (`date-fns-formatter`) extends an already-active `date-fns` typosquat family. Cluster E (`trongridew`, PyPI) is a Tron/TRX cryptocurrency private-key exfil from the long-running `2025-04-tronix` campaign. Clusters D and F are boilerplate opportunistic drops and PROBABLY_PENTEST reconnaissance artefacts.

## Cluster A - `@liuliang520500/*` Chinese e-commerce SDK impersonator sweep (Sept 6)

| Package | GHSA | Impersonates |
|---|---|---|
| `@liuliang520500/sinataoke_cn` | GHSA-jjx2-vpx2-qp32 | Sina Taoke (coupon/affiliate SDK) |
| `@liuliang520500/sinataoke_cn_test` | GHSA-36jr-wqjh-q55x | Sina Taoke (test-suffixed variant) |
| `@liuliang520500/pdd-sdk` | GHSA-g9hc-xr9f-27g4 | Pinduoduo (PDD) open-platform SDK |
| `@liuliang520500/pdd-sdk-new` | GHSA-jp84-gqp2-j9qq | Pinduoduo (PDD) - "new" suffix |
| `@liuliang520500/jd-sdk` | GHSA-j849-992g-rggr | JD.com open-platform SDK |
| `@liuliang520500/taobao-topclient` | GHSA-75r6-9fpm-rf6j | Taobao TOP client SDK |

One operator publishing under one npm scope, all six packages named after the four biggest Chinese e-commerce open-platform SDKs. GHSA metadata is thin (boilerplate "any computer that has this package installed or running should be considered fully compromised") but the six-package burst under one scope is the classic drop-and-run pattern - the operator expects a subset of developers at Chinese e-commerce integrators (or Western brands' outsourced integration partners) to fat-finger the scope while adding legitimate `@jd/*`, `@pdd/*`, `@sina/*`, or `@taobao/*` dependencies.

## Cluster B - `@domyjs/*` reactive-framework typosquat sweep (Sept 5)

| Package | GHSA | Framework role |
|---|---|---|
| `@domyjs/reactive` | GHSA-3ggc-3pw2-c9v9 | State / reactivity |
| `@domyjs/i18n` | GHSA-22jr-v88r-5cj6 | Internationalisation |
| `@domyjs/router` | GHSA-j7wp-3648-mh57 | SPA router |
| `@domyjs/intersect` | GHSA-v8xv-9q46-8h3x | Intersection observer |
| `@domyjs/throttle` | GHSA-fr62-p59g-hr9f | Throttle / debounce |
| `@domyjs/mask` | GHSA-93j2-q7r7-7qhh | Input mask |
| `@domyjs/collapse` | GHSA-39q9-7vqg-3m6w | Collapse / expand UI |

Seven packages under `@domyjs` published together and covering what looks like an entire reactive-framework utility ecosystem. The naming is designed to look like a legitimate Vue-adjacent or Svelte-adjacent utility bundle. Boilerplate GHSA metadata but any lockfile hit on the `@domyjs` scope means an operator now has full-compromise access to the host.

## Cluster C - `date-fns-formatter` date-fns typosquat (Sept 6)

| Package | GHSA | Family |
|---|---|---|
| `date-fns-formatter` | GHSA-h258-m2gc-2p4q | `date-fns` typosquat |

Extends the ongoing `date-fns` typosquat family (siblings: `datefmt-helper` = MAL-2026-6788, `date-fns-lite` = MAL-2026-6722, `date-fns-2`). The `date-fns` family is one of the highest-download npm namespaces so typosquat probability against it is high. Boilerplate GHSA metadata but assume the same postinstall-hook AWS/GCP/Azure/SSH credential harvest pattern the other family members used, until reverse-engineered otherwise.

## Cluster D - Miscellaneous npm boilerplate malware (Sept 5-6)

| Package | GHSA | Published |
|---|---|---|
| `@pilllesss/yorn` | GHSA-rghh-4gfg-jvqc | Sep 6 |
| `1cattunnel` | GHSA-r35j-cv2x-mm7h | Sep 6 |
| `dcftunnel` | GHSA-4c2f-x64v-297x | Sep 6 |
| `multicore-kit` | GHSA-q588-cfvg-8346 | Sep 6 |
| `array-frames` | GHSA-24hx-4mc8-g9q7 | Sep 6 |
| `node-helper` | GHSA-2ggc-wmq2-3whp | Sep 6 |
| `jwt-logger` | GHSA-rpqx-cp2g-55w5 | Sep 5 |
| `array-scala` | GHSA-rx3f-9hxc-773g | Sep 5 |
| `infinity-grid` | GHSA-39fr-j2vr-r24p | Sep 5 |
| `btn-particles` | GHSA-6w56-62pq-vhph | Sep 5 |

Boilerplate CWE-506 "any computer that has this package installed or running should be considered fully compromised" with no source, no C2. `1cattunnel` / `dcftunnel` share the `-tunnel` suffix pattern - either legitimate-sounding tunnel utilities or paired droppers under one operator. `jwt-logger` and `node-helper` are generic-utility naming designed to slip past a shallow audit. `multicore-kit` reads as a plausible `node-multicore` adjacent name.

## Cluster E - `trongridew` PyPI Tron/TRX private-key exfil (Sept 5)

| Package | Versions | GHSA | Campaign |
|---|---|---|---|
| `trongridew` | `0.0.1` | GHSA-vjjx-756v-6p3x | `2025-04-tronix` |

OpenSSF `malicious-packages`: "appears to be designed for private key exfiltration". Naming references TRX (Tron / Tronix blockchain). Uses deceptive tactics by cloning legitimate library documentation. Part of the long-running `2025-04-tronix` campaign that has re-uploaded this and adjacent typosquats repeatedly to PyPI. Any Python cryptocurrency tool depending on `trongridew` (dep-confusion against internal `tronpy`-adjacent names, or a fat-finger of the real package) leaks TRX private keys.

## Cluster F - Generic PyPI install-time exfil pentest artefacts (Sept 5)

| Package | Versions | GHSA | Campaign |
|---|---|---|---|
| `proxycer` | `0.1.0` | GHSA-qff6-cqrr-65wv | `2025-02-pxz` |
| `dbt-sa-cli` | `0.0.1` | GHSA-xf8p-r8w2-fx5m | `GENERIC-standard-pypi-install-pentest` |

Both classified "PROBABLY_PENTEST" by OpenSSF - low-harm reconnaissance rather than a real payload. `proxycer` collects basic user info on import; `dbt-sa-cli` overrides `setup.py install` to exfil IP+username on install. The `dbt-sa-cli` name is a plausible dep-confusion probe against internal `dbt` (data-build-tool) service-account CLI utilities in enterprise data teams.

## Registry state

All packages listed above were flagged as malware on the npm and PyPI registries between 2026-09-05 and 2026-09-06 and added to the respective quarantine lists. Private mirrors (Verdaccio, Artifactory, Nexus, devpi) that cached tarballs before takedown will keep serving the malicious versions - explicit deny-listing of the `@liuliang520500` and `@domyjs` npm scopes and the `trongridew` PyPI name is a durable mitigation independent of registry-side quarantine.

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `bad-packages.kam193.eu`.

## Impact

- **Cluster A - `@liuliang520500/*` Chinese e-commerce SDK impersonator sweep (6 packages, all versions)**: `@liuliang520500/sinataoke_cn` (GHSA-jjx2-vpx2-qp32), `@liuliang520500/sinataoke_cn_test` (GHSA-36jr-wqjh-q55x), `@liuliang520500/pdd-sdk-new` (GHSA-jp84-gqp2-j9qq), `@liuliang520500/jd-sdk` (GHSA-j849-992g-rggr), `@liuliang520500/pdd-sdk` (GHSA-g9hc-xr9f-27g4), `@liuliang520500/taobao-topclient` (GHSA-75r6-9fpm-rf6j) - one operator publishing under a single npm scope, all six packages named after the four biggest Chinese e-commerce SDKs (Sina Taoke coupon/affiliate SDK, Pinduoduo PDD open-platform SDK, JD.com open-platform SDK, Taobao Top-Client SDK). GHSA flags each with the boilerplate "any computer that has this package installed or running should be considered fully compromised" - no source, no C2 disclosed, but the six-package burst under one scope is the classic drop-and-run pattern for dep-confusion / typosquat harvesting. Anyone at a Chinese e-commerce integrator (or an outsourcer building against these platforms for a Western brand) who fat-fingered the scope is exposed
- **Cluster B - `@domyjs/*` reactive-framework typosquat sweep (7 packages, all versions)**: `@domyjs/reactive` (GHSA-3ggc-3pw2-c9v9), `@domyjs/i18n` (GHSA-22jr-v88r-5cj6), `@domyjs/router` (GHSA-j7wp-3648-mh57), `@domyjs/intersect` (GHSA-v8xv-9q46-8h3x), `@domyjs/throttle` (GHSA-fr62-p59g-hr9f), `@domyjs/mask` (GHSA-93j2-q7r7-7qhh), `@domyjs/collapse` (GHSA-39q9-7vqg-3m6w) - one scope publishing what looks like a full reactive-framework ecosystem (state / i18n / router / intersect observer / throttle / input-mask / collapse) in one shot. Boilerplate CWE-506 metadata but the naming pattern is designed to look like a legitimate Vue/Svelte-adjacent utility bundle a developer would trust. Any lockfile hit on the `@domyjs` scope means an operator now has full-compromise access to the host
- **Cluster C - `date-fns-formatter` date-fns typosquat (1 package, all versions)**: `date-fns-formatter` (GHSA-h258-m2gc-2p4q) - extends the ongoing `date-fns` typosquat family (`datefmt-helper` (MAL-2026-6788), `date-fns-lite` (MAL-2026-6722), `date-fns-2`). The `date-fns` family is one of the highest-download npm namespaces so typosquat probability against it is high. Boilerplate GHSA metadata; assume the same postinstall-hook AWS/GCP/Azure/SSH credential harvest pattern the other family members used until reverse-engineered otherwise
- **Cluster D - Miscellaneous npm boilerplate malware (10 packages, all versions)**: `@pilllesss/yorn` (GHSA-rghh-4gfg-jvqc), `1cattunnel` (GHSA-r35j-cv2x-mm7h), `dcftunnel` (GHSA-4c2f-x64v-297x), `multicore-kit` (GHSA-q588-cfvg-8346), `array-frames` (GHSA-24hx-4mc8-g9q7), `node-helper` (GHSA-2ggc-wmq2-3whp), `jwt-logger` (GHSA-rpqx-cp2g-55w5), `array-scala` (GHSA-rx3f-9hxc-773g), `infinity-grid` (GHSA-39fr-j2vr-r24p), `btn-particles` (GHSA-6w56-62pq-vhph) - GHSA flags each with the boilerplate "any computer that has this package installed or running should be considered fully compromised" and no further technical detail. `1cattunnel` / `dcftunnel` share the `-tunnel` suffix pattern (either legitimate-sounding tunnel utilities or paired droppers under one operator); `jwt-logger` and `node-helper` are generic-utility naming designed to slip past a shallow audit; `multicore-kit` reads as a plausible `node-multicore` adjacent name. Uninstall on any lockfile hit and rotate host credentials
- **Cluster E - `trongridew` PyPI Tronix private-key exfil (1 package, 1 version)**: `trongridew@0.0.1` (GHSA-vjjx-756v-6p3x, campaign `2025-04-tronix`) - Tron/TRX-blockchain infostealer that clones the legitimate `tronpy` (or similar TRX SDK) documentation to look plausible. OpenSSF metadata: "appears to be designed for private key exfiltration". Part of the long-running `2025-04-tronix` campaign that has re-uploaded this and adjacent typosquats repeatedly to PyPI. Any Python cryptocurrency tool depending on `trongridew` (dep-confusion against internal `tronpy`-adjacent names, or a fat-finger of the real package) leaks TRX private keys
- **Cluster F - Generic PyPI install-time exfil pentest artefacts (2 packages, 2 versions)**: `proxycer@0.1.0` (GHSA-qff6-cqrr-65wv, campaign `2025-02-pxz`) collects basic user info on import; `dbt-sa-cli@0.0.1` (GHSA-xf8p-r8w2-fx5m, campaign `GENERIC-standard-pypi-install-pentest`) overrides `setup.py install` to exfil IP+username on install. Both classified "PROBABLY_PENTEST" by OpenSSF `malicious-packages` - low-harm reconnaissance rather than a real payload, but the exact same `setup.py install` override is the pattern real threat actors use, so flag anyway. `dbt-sa-cli` is a plausible dep-confusion name against `dbt` (data-build-tool) service-account CLI utilities in enterprise data teams

## What to do

1. Grep every `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `requirements.txt`, `poetry.lock`, `Pipfile.lock`, `uv.lock`, and internal registry mirror for the package names below. Uninstall and rebuild the lockfile against a clean cache on any hit
2. **For Cluster A (`@liuliang520500/*` Chinese e-commerce SDK impersonators)**: any team integrating Sina Taoke, Pinduoduo, JD.com, or Taobao open-platform SDKs - lock explicit scoped-registry pinning for the legitimate scopes (`@jd/`, `@pdd/`, `@sina/`, `@taobao/`, and their team-side private-registry equivalents) in `.npmrc`. If any developer or CI host resolved `@liuliang520500/*`, rotate every credential on the host
3. **For Cluster B (`@domyjs/*`)**: uninstall on any lockfile hit and rotate host credentials. Do not import any package under the `@domyjs` scope until the operator identity is verified by an unrelated source. If your project uses a Vue/Svelte reactive-framework-style utility bundle from an unfamiliar scope, verify the publisher through a second channel before adopting
4. **For Cluster C (`date-fns-formatter`)**: block or unpublish `date-fns-formatter` from any internal npm mirror. Explicitly pin `date-fns` in your top-level dependencies (never `date-fns-*`). Also add the sibling typosquats `datefmt-helper`, `date-fns-lite`, `date-fns-2` to a mirror-side deny-list
5. **For Cluster D (miscellaneous boilerplate)**: uninstall on any lockfile hit and rotate host credentials. Any host that resolved a `-tunnel`-suffixed npm package it did not explicitly add is likely compromised - grep dev, CI, and runtime hosts for `1cattunnel` / `dcftunnel` / `multicore-kit` / `array-frames` / `node-helper` / `jwt-logger` / `array-scala` / `infinity-grid` / `btn-particles` / `@pilllesss/yorn`
6. **For Cluster E (`trongridew`)**: any Python tool depending on TRX SDKs - pin `tronpy` explicitly in `requirements.txt` / `pyproject.toml`. Audit `pip install` history on developer laptops and CI hosts for `trongridew` (and the sibling `2025-04-tronix` campaign packages historically indexed to that campaign id). Any Tron wallet whose private key was on a host that ran `trongridew` must be treated as drained
7. **For Cluster F (`proxycer`, `dbt-sa-cli`)**: uninstall on hit; no host-forensics response required beyond routine credential-rotation prudence. For data teams: if you have an internal `dbt-sa-cli` (dbt service-account CLI) package, pin it to your internal index-url explicitly - the malicious public version was published against an obvious internal-namespace guess
8. For every `npm install` and `pip install` in CI, prefer `--ignore-scripts` / `pip install --no-deps` where feasible - this blocks Clusters A, B, C, D postinstall vectors and Cluster F setup.py install overrides. Cluster E (`trongridew`) fires on import so `--no-deps` alone is insufficient; grep for `import trongridew` in Python source trees
9. Consider adding the `@liuliang520500` and `@domyjs` npm scopes and `trongridew` PyPI name to any private-registry deny-list to prevent future re-publishes under the same identity

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-jjx2-vpx2-qp32 - @liuliang520500/sinataoke_cn](https://github.com/advisories/GHSA-jjx2-vpx2-qp32) - GitHub
- [GHSA-36jr-wqjh-q55x - @liuliang520500/sinataoke_cn_test](https://github.com/advisories/GHSA-36jr-wqjh-q55x) - GitHub
- [GHSA-jp84-gqp2-j9qq - @liuliang520500/pdd-sdk-new](https://github.com/advisories/GHSA-jp84-gqp2-j9qq) - GitHub
- [GHSA-j849-992g-rggr - @liuliang520500/jd-sdk](https://github.com/advisories/GHSA-j849-992g-rggr) - GitHub
- [GHSA-g9hc-xr9f-27g4 - @liuliang520500/pdd-sdk](https://github.com/advisories/GHSA-g9hc-xr9f-27g4) - GitHub
- [GHSA-75r6-9fpm-rf6j - @liuliang520500/taobao-topclient](https://github.com/advisories/GHSA-75r6-9fpm-rf6j) - GitHub
- [GHSA-3ggc-3pw2-c9v9 - @domyjs/reactive](https://github.com/advisories/GHSA-3ggc-3pw2-c9v9) - GitHub
- [GHSA-22jr-v88r-5cj6 - @domyjs/i18n](https://github.com/advisories/GHSA-22jr-v88r-5cj6) - GitHub
- [GHSA-j7wp-3648-mh57 - @domyjs/router](https://github.com/advisories/GHSA-j7wp-3648-mh57) - GitHub
- [GHSA-v8xv-9q46-8h3x - @domyjs/intersect](https://github.com/advisories/GHSA-v8xv-9q46-8h3x) - GitHub
- [GHSA-fr62-p59g-hr9f - @domyjs/throttle](https://github.com/advisories/GHSA-fr62-p59g-hr9f) - GitHub
- [GHSA-93j2-q7r7-7qhh - @domyjs/mask](https://github.com/advisories/GHSA-93j2-q7r7-7qhh) - GitHub
- [GHSA-39q9-7vqg-3m6w - @domyjs/collapse](https://github.com/advisories/GHSA-39q9-7vqg-3m6w) - GitHub
- [GHSA-h258-m2gc-2p4q - date-fns-formatter (date-fns typosquat)](https://github.com/advisories/GHSA-h258-m2gc-2p4q) - GitHub
- [GHSA-rghh-4gfg-jvqc - @pilllesss/yorn](https://github.com/advisories/GHSA-rghh-4gfg-jvqc) - GitHub
- [GHSA-r35j-cv2x-mm7h - 1cattunnel](https://github.com/advisories/GHSA-r35j-cv2x-mm7h) - GitHub
- [GHSA-4c2f-x64v-297x - dcftunnel](https://github.com/advisories/GHSA-4c2f-x64v-297x) - GitHub
- [GHSA-q588-cfvg-8346 - multicore-kit](https://github.com/advisories/GHSA-q588-cfvg-8346) - GitHub
- [GHSA-24hx-4mc8-g9q7 - array-frames](https://github.com/advisories/GHSA-24hx-4mc8-g9q7) - GitHub
- [GHSA-2ggc-wmq2-3whp - node-helper](https://github.com/advisories/GHSA-2ggc-wmq2-3whp) - GitHub
- [GHSA-rpqx-cp2g-55w5 - jwt-logger](https://github.com/advisories/GHSA-rpqx-cp2g-55w5) - GitHub
- [GHSA-rx3f-9hxc-773g - array-scala](https://github.com/advisories/GHSA-rx3f-9hxc-773g) - GitHub
- [GHSA-39fr-j2vr-r24p - infinity-grid](https://github.com/advisories/GHSA-39fr-j2vr-r24p) - GitHub
- [GHSA-6w56-62pq-vhph - btn-particles](https://github.com/advisories/GHSA-6w56-62pq-vhph) - GitHub
- [GHSA-vjjx-756v-6p3x - trongridew (PyPI Tron/TRX private-key exfil, campaign 2025-04-tronix)](https://github.com/advisories/GHSA-vjjx-756v-6p3x) - GitHub
- [GHSA-qff6-cqrr-65wv - proxycer (PyPI PROBABLY_PENTEST, campaign 2025-02-pxz)](https://github.com/advisories/GHSA-qff6-cqrr-65wv) - GitHub
- [GHSA-xf8p-r8w2-fx5m - dbt-sa-cli (PyPI PROBABLY_PENTEST, campaign GENERIC-standard-pypi-install-pentest)](https://github.com/advisories/GHSA-xf8p-r8w2-fx5m) - GitHub
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF

---

Canonical page: https://dependencywatch.io/incident/multi-2026-09-06-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-09-06-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).