# GitHub Advisory malware sweep, 7 September 2026

> Yesterday's (Sept 6) sweep captured 13 npm items; the queue then flushed ~200 more, mostly published as of 2026-09-06 and continuing into 2026-09-07. Three coherent clusters (tea.xyz `eka-<indonesian-food><N>-<suffix>` autopublish, tea.xyz `eigenstate-<astronomy>-<tech>-<lib>` autopublish, and `effective_/efficient_<animal>_z3n` research spam) plus a long tail of misc E-prefix drops.

- Published: 2026-09-07
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 186 packages, 186 compromised versions
- Tags: typosquat, dependency-confusion, credential-theft, obfuscation
- Also known as: 2026-09-07 GHSA E-range mass backfill, tea.xyz eka-* Indonesian-food autopublish flood, tea.xyz eigenstate-* astronomy-lib autopublish flood, z3n research spam effective_/efficient_<animal>_z3n
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector
- Incident ID: multi-2026-09-07-ghsa-malware-sweep

## Affected packages (186)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [effective_landfowl_requirement](https://dependencywatch.io/package/npm/effective_landfowl_requirement) | npm | 0.0.0 |
| [effective_lungfish_z3n](https://dependencywatch.io/package/npm/effective_lungfish_z3n) | npm | 0.0.0 |
| [effective_monkey_z3n](https://dependencywatch.io/package/npm/effective_monkey_z3n) | npm | 0.0.0 |
| [effective_orangutan-silentdev](https://dependencywatch.io/package/npm/effective_orangutan-silentdev) | npm | 0.0.0 |
| [effective_ostrich_z3n](https://dependencywatch.io/package/npm/effective_ostrich_z3n) | npm | 0.0.0 |
| [effective_penguin_z3n](https://dependencywatch.io/package/npm/effective_penguin_z3n) | npm | 0.0.0 |
| [effective_ptarmigan_z3n](https://dependencywatch.io/package/npm/effective_ptarmigan_z3n) | npm | 0.0.0 |
| [effective_scallop_z3n](https://dependencywatch.io/package/npm/effective_scallop_z3n) | npm | 0.0.0 |
| [effective_spoonbill_z3n](https://dependencywatch.io/package/npm/effective_spoonbill_z3n) | npm | 0.0.0 |
| [effector-kws](https://dependencywatch.io/package/npm/effector-kws) | npm | 0.0.0 |
| [effector-react-kws](https://dependencywatch.io/package/npm/effector-react-kws) | npm | 0.0.0 |
| [efficiant](https://dependencywatch.io/package/npm/efficiant) | npm | 0.0.0 |
| [efficient_aphid_z3n](https://dependencywatch.io/package/npm/efficient_aphid_z3n) | npm | 0.0.0 |
| [efficient_asp_0xrequest](https://dependencywatch.io/package/npm/efficient_asp_0xrequest) | npm | 0.0.0 |
| [efficient_butterfly_z3n](https://dependencywatch.io/package/npm/efficient_butterfly_z3n) | npm | 0.0.0 |
| [efficient_catfish_chocolate-98](https://dependencywatch.io/package/npm/efficient_catfish_chocolate-98) | npm | 0.0.0 |
| [efficient_chickadee_z3n](https://dependencywatch.io/package/npm/efficient_chickadee_z3n) | npm | 0.0.0 |
| [efficient_duck_emerald-86](https://dependencywatch.io/package/npm/efficient_duck_emerald-86) | npm | 0.0.0 |
| [efficient_gerbil_white-13](https://dependencywatch.io/package/npm/efficient_gerbil_white-13) | npm | 0.0.0 |
| [efficient_grouse_z3n](https://dependencywatch.io/package/npm/efficient_grouse_z3n) | npm | 0.0.0 |
| [efficient_guineafowl_z3n](https://dependencywatch.io/package/npm/efficient_guineafowl_z3n) | npm | 0.0.0 |
| [efficient_hare_z3n](https://dependencywatch.io/package/npm/efficient_hare_z3n) | npm | 0.0.0 |
| [efficient_lemur_z3n](https://dependencywatch.io/package/npm/efficient_lemur_z3n) | npm | 0.0.0 |
| [efficient_macaw_moccasin-85](https://dependencywatch.io/package/npm/efficient_macaw_moccasin-85) | npm | 0.0.0 |
| [efficient_meadowlark-smiletea](https://dependencywatch.io/package/npm/efficient_meadowlark-smiletea) | npm | 0.0.0 |
| [efficient_moth_dumbs](https://dependencywatch.io/package/npm/efficient_moth_dumbs) | npm | 0.0.0 |
| [efficient_moth_z3n](https://dependencywatch.io/package/npm/efficient_moth_z3n) | npm | 0.0.0 |
| [efficient_python_z3n](https://dependencywatch.io/package/npm/efficient_python_z3n) | npm | 0.0.0 |
| [efficient_rabbit_z3n](https://dependencywatch.io/package/npm/efficient_rabbit_z3n) | npm | 0.0.0 |
| [efficient_starfish_dumbs](https://dependencywatch.io/package/npm/efficient_starfish_dumbs) | npm | 0.0.0 |
| [efficient_takin_z3n](https://dependencywatch.io/package/npm/efficient_takin_z3n) | npm | 0.0.0 |
| [efficient_tarantula_z3n](https://dependencywatch.io/package/npm/efficient_tarantula_z3n) | npm | 0.0.0 |
| [efficient_termite_z3n](https://dependencywatch.io/package/npm/efficient_termite_z3n) | npm | 0.0.0 |
| [efficient_tiger_z3n](https://dependencywatch.io/package/npm/efficient_tiger_z3n) | npm | 0.0.0 |
| [efficient-brown-quail](https://dependencywatch.io/package/npm/efficient-brown-quail) | npm | 0.0.0 |
| [efficient-jade-mackerel](https://dependencywatch.io/package/npm/efficient-jade-mackerel) | npm | 0.0.0 |
| [efficient-yellow-mole](https://dependencywatch.io/package/npm/efficient-yellow-mole) | npm | 0.0.0 |
| [eficsi](https://dependencywatch.io/package/npm/eficsi) | npm | 0.0.0 |
| [eflectron](https://dependencywatch.io/package/npm/eflectron) | npm | 0.0.0 |
| [efp9](https://dependencywatch.io/package/npm/efp9) | npm | 0.0.0 |
| [efx-angular-components](https://dependencywatch.io/package/npm/efx-angular-components) | npm | 0.0.0 |
| [eg-affiliates-common](https://dependencywatch.io/package/npm/eg-affiliates-common) | npm | 0.0.0 |
| [eg-affiliates-common-test](https://dependencywatch.io/package/npm/eg-affiliates-common-test) | npm | 0.0.0 |
| [eg4-fangfa](https://dependencywatch.io/package/npm/eg4-fangfa) | npm | 0.0.0 |
| [eganglia](https://dependencywatch.io/package/npm/eganglia) | npm | 0.0.0 |
| [egg-arbitrary](https://dependencywatch.io/package/npm/egg-arbitrary) | npm | 0.0.0 |
| [egg-plugin-knex](https://dependencywatch.io/package/npm/egg-plugin-knex) | npm | 0.0.0 |
| [eggcoin](https://dependencywatch.io/package/npm/eggcoin) | npm | 0.0.0 |
| [eggdrop](https://dependencywatch.io/package/npm/eggdrop) | npm | 0.0.0 |
| [eggplant-delta-8omx](https://dependencywatch.io/package/npm/eggplant-delta-8omx) | npm | 0.0.0 |
| [eggplant-juniper-lcjd](https://dependencywatch.io/package/npm/eggplant-juniper-lcjd) | npm | 0.0.0 |
| [eggplant-radish-ka52](https://dependencywatch.io/package/npm/eggplant-radish-ka52) | npm | 0.0.0 |
| [eggplant-umbrella-aig1](https://dependencywatch.io/package/npm/eggplant-umbrella-aig1) | npm | 0.0.0 |
| [egis-tsc](https://dependencywatch.io/package/npm/egis-tsc) | npm | 0.0.0 |
| [egjs-cli](https://dependencywatch.io/package/npm/egjs-cli) | npm | 0.0.0 |
| [egmoizjqkvybsulc](https://dependencywatch.io/package/npm/egmoizjqkvybsulc) | npm | 0.0.0 |
| [egnxaqfzbjhdlvkp](https://dependencywatch.io/package/npm/egnxaqfzbjhdlvkp) | npm | 0.0.0 |
| [egov-pep-frontend](https://dependencywatch.io/package/npm/egov-pep-frontend) | npm | 0.0.0 |
| [egret_moccasin-14](https://dependencywatch.io/package/npm/egret_moccasin-14) | npm | 0.0.0 |
| [egs-trusted-domains](https://dependencywatch.io/package/npm/egs-trusted-domains) | npm | 0.0.0 |
| [egstore-carousel](https://dependencywatch.io/package/npm/egstore-carousel) | npm | 0.0.0 |
| [egstore-ctx](https://dependencywatch.io/package/npm/egstore-ctx) | npm | 0.0.0 |
| [egstore-graphql-client](https://dependencywatch.io/package/npm/egstore-graphql-client) | npm | 0.0.0 |
| [egstore-query](https://dependencywatch.io/package/npm/egstore-query) | npm | 0.0.0 |
| [egstore-suspense](https://dependencywatch.io/package/npm/egstore-suspense) | npm | 0.0.0 |
| [egudkjkpcrwhlfvy](https://dependencywatch.io/package/npm/egudkjkpcrwhlfvy) | npm | 0.0.0 |
| [eh-fiddle](https://dependencywatch.io/package/npm/eh-fiddle) | npm | 0.0.0 |
| [ehance-assistant](https://dependencywatch.io/package/npm/ehance-assistant) | npm | 0.0.0 |
| [ehance-assistant33](https://dependencywatch.io/package/npm/ehance-assistant33) | npm | 0.0.0 |
| [ehouse](https://dependencywatch.io/package/npm/ehouse) | npm | 0.0.0 |
| [ehquvdznyglmrpxb](https://dependencywatch.io/package/npm/ehquvdznyglmrpxb) | npm | 0.0.0 |
| [ehxjimturwyqnzbk](https://dependencywatch.io/package/npm/ehxjimturwyqnzbk) | npm | 0.0.0 |
| [eigenstate-archaeogenetics-singularitarianism-socketio](https://dependencywatch.io/package/npm/eigenstate-archaeogenetics-singularitarianism-socketio) | npm | 0.0.0 |
| [eigenstate-areology-deneb-parallax](https://dependencywatch.io/package/npm/eigenstate-areology-deneb-parallax) | npm | 0.0.0 |
| [eigenstate-auriga-module-chromedriver](https://dependencywatch.io/package/npm/eigenstate-auriga-module-chromedriver) | npm | 0.0.0 |
| [eigenstate-bionics-alphard-hermes](https://dependencywatch.io/package/npm/eigenstate-bionics-alphard-hermes) | npm | 0.0.0 |
| [eigenstate-electron-builder-despina-bionics](https://dependencywatch.io/package/npm/eigenstate-electron-builder-despina-bionics) | npm | 0.0.0 |
| [eigenstate-electron-lithosphere-dagda](https://dependencywatch.io/package/npm/eigenstate-electron-lithosphere-dagda) | npm | 0.0.0 |
| [eigenstate-gravitationalwave-config-ora](https://dependencywatch.io/package/npm/eigenstate-gravitationalwave-config-ora) | npm | 0.0.0 |
| [eigenstate-ophiuchus-sociobiology-koa](https://dependencywatch.io/package/npm/eigenstate-ophiuchus-sociobiology-koa) | npm | 0.0.0 |
| [eigenstate-outercore-procyon-colors](https://dependencywatch.io/package/npm/eigenstate-outercore-procyon-colors) | npm | 0.0.0 |
| [eigenstate-parallax-init-miranda](https://dependencywatch.io/package/npm/eigenstate-parallax-init-miranda) | npm | 0.0.0 |
| [eigenstate-spectron-loopback-wormhole](https://dependencywatch.io/package/npm/eigenstate-spectron-loopback-wormhole) | npm | 0.0.0 |
| [eigenstate-test-technocracy-javascript](https://dependencywatch.io/package/npm/eigenstate-test-technocracy-javascript) | npm | 0.0.0 |
| [eighster](https://dependencywatch.io/package/npm/eighster) | npm | 0.0.0 |
| [eight-spend-men](https://dependencywatch.io/package/npm/eight-spend-men) | npm | 0.0.0 |
| [eikasia](https://dependencywatch.io/package/npm/eikasia) | npm | 0.0.0 |
| [eikpndvxbtfhkcas](https://dependencywatch.io/package/npm/eikpndvxbtfhkcas) | npm | 0.0.0 |
| [eimearmartin](https://dependencywatch.io/package/npm/eimearmartin) | npm | 0.0.0 |
| [eimearobrien](https://dependencywatch.io/package/npm/eimearobrien) | npm | 0.0.0 |
| [ein-loader](https://dependencywatch.io/package/npm/ein-loader) | npm | 0.0.0 |
| [ein-services](https://dependencywatch.io/package/npm/ein-services) | npm | 0.0.0 |
| [einfprog](https://dependencywatch.io/package/npm/einfprog) | npm | 0.0.0 |
| [einkaufen](https://dependencywatch.io/package/npm/einkaufen) | npm | 0.0.0 |
| [einthyra-notthedevs](https://dependencywatch.io/package/npm/einthyra-notthedevs) | npm | 0.0.0 |
| [eip-119-json-provider](https://dependencywatch.io/package/npm/eip-119-json-provider) | npm | 0.0.0 |
| [eithernet](https://dependencywatch.io/package/npm/eithernet) | npm | 0.0.0 |
| [eithernet-test](https://dependencywatch.io/package/npm/eithernet-test) | npm | 0.0.0 |
| [eithernet-test-fixtures](https://dependencywatch.io/package/npm/eithernet-test-fixtures) | npm | 0.0.0 |
| [eithernet-test-fixtures-test](https://dependencywatch.io/package/npm/eithernet-test-fixtures-test) | npm | 0.0.0 |
| [eivybsafunmzpxlg](https://dependencywatch.io/package/npm/eivybsafunmzpxlg) | npm | 0.0.0 |
| [eixp4ressz](https://dependencywatch.io/package/npm/eixp4ressz) | npm | 0.0.0 |
| [ejbwdr-devapptea](https://dependencywatch.io/package/npm/ejbwdr-devapptea) | npm | 0.0.0 |
| [ejdgrvaqkioslhbf](https://dependencywatch.io/package/npm/ejdgrvaqkioslhbf) | npm | 0.0.0 |
| [ejercico](https://dependencywatch.io/package/npm/ejercico) | npm | 0.0.0 |
| [ejrfsqmkdconukbl](https://dependencywatch.io/package/npm/ejrfsqmkdconukbl) | npm | 0.0.0 |
| [ejs-client](https://dependencywatch.io/package/npm/ejs-client) | npm | 0.0.0 |
| [ejson-rails](https://dependencywatch.io/package/npm/ejson-rails) | npm | 0.0.0 |
| [ejson2env](https://dependencywatch.io/package/npm/ejson2env) | npm | 0.0.0 |
| [ejstags](https://dependencywatch.io/package/npm/ejstags) | npm | 0.0.0 |
| [ejungle](https://dependencywatch.io/package/npm/ejungle) | npm | 0.0.0 |
| [eka-asinan10-breki](https://dependencywatch.io/package/npm/eka-asinan10-breki) | npm | 0.0.0 |
| [eka-asinan38-sluey](https://dependencywatch.io/package/npm/eka-asinan38-sluey) | npm | 0.0.0 |
| [eka-asinan60-sukiwir](https://dependencywatch.io/package/npm/eka-asinan60-sukiwir) | npm | 0.0.0 |
| [eka-bakso19-miaww](https://dependencywatch.io/package/npm/eka-bakso19-miaww) | npm | 0.0.0 |
| [eka-bakso57-breki](https://dependencywatch.io/package/npm/eka-bakso57-breki) | npm | 0.0.0 |
| [eka-bakso64-breki](https://dependencywatch.io/package/npm/eka-bakso64-breki) | npm | 0.0.0 |
| [eka-bakso88-riris](https://dependencywatch.io/package/npm/eka-bakso88-riris) | npm | 0.0.0 |
| [eka-bakso92-breki](https://dependencywatch.io/package/npm/eka-bakso92-breki) | npm | 0.0.0 |
| [eka-bakso93-miaww](https://dependencywatch.io/package/npm/eka-bakso93-miaww) | npm | 0.0.0 |
| [eka-bakwan14-breki](https://dependencywatch.io/package/npm/eka-bakwan14-breki) | npm | 0.0.0 |
| [eka-bakwan21-breki](https://dependencywatch.io/package/npm/eka-bakwan21-breki) | npm | 0.0.0 |
| [eka-bakwan35-riris](https://dependencywatch.io/package/npm/eka-bakwan35-riris) | npm | 0.0.0 |
| [eka-bakwan94-miaww](https://dependencywatch.io/package/npm/eka-bakwan94-miaww) | npm | 0.0.0 |
| [eka-bika1-sukiwir](https://dependencywatch.io/package/npm/eka-bika1-sukiwir) | npm | 0.0.0 |
| [eka-bika31-breki](https://dependencywatch.io/package/npm/eka-bika31-breki) | npm | 0.0.0 |
| [eka-bika74-sukiwir](https://dependencywatch.io/package/npm/eka-bika74-sukiwir) | npm | 0.0.0 |
| [eka-bika97-sukiwir](https://dependencywatch.io/package/npm/eka-bika97-sukiwir) | npm | 0.0.0 |
| [eka-botok35-miaww](https://dependencywatch.io/package/npm/eka-botok35-miaww) | npm | 0.0.0 |
| [eka-botok87-riris](https://dependencywatch.io/package/npm/eka-botok87-riris) | npm | 0.0.0 |
| [eka-brengkes16-sluey](https://dependencywatch.io/package/npm/eka-brengkes16-sluey) | npm | 0.0.0 |
| [eka-brengkes44-ruro](https://dependencywatch.io/package/npm/eka-brengkes44-ruro) | npm | 0.0.0 |
| [eka-brengkes56-riris](https://dependencywatch.io/package/npm/eka-brengkes56-riris) | npm | 0.0.0 |
| [eka-brengkes59-sluey](https://dependencywatch.io/package/npm/eka-brengkes59-sluey) | npm | 0.0.0 |
| [eka-brengkes76-sukiwir](https://dependencywatch.io/package/npm/eka-brengkes76-sukiwir) | npm | 0.0.0 |
| [eka-brengkes98-breki](https://dependencywatch.io/package/npm/eka-brengkes98-breki) | npm | 0.0.0 |
| [eka-brongkos29-sluey](https://dependencywatch.io/package/npm/eka-brongkos29-sluey) | npm | 0.0.0 |
| [eka-brongkos41-sukiwir](https://dependencywatch.io/package/npm/eka-brongkos41-sukiwir) | npm | 0.0.0 |
| [eka-brongkos63-sluey](https://dependencywatch.io/package/npm/eka-brongkos63-sluey) | npm | 0.0.0 |
| [eka-brongkos66-sluey](https://dependencywatch.io/package/npm/eka-brongkos66-sluey) | npm | 0.0.0 |
| [eka-brongkos84-riris](https://dependencywatch.io/package/npm/eka-brongkos84-riris) | npm | 0.0.0 |
| [eka-bubur49-sluey](https://dependencywatch.io/package/npm/eka-bubur49-sluey) | npm | 0.0.0 |
| [eka-bubur69-breki](https://dependencywatch.io/package/npm/eka-bubur69-breki) | npm | 0.0.0 |
| [eka-buburayam24-miaww](https://dependencywatch.io/package/npm/eka-buburayam24-miaww) | npm | 0.0.0 |
| [eka-buburayam35-sluey](https://dependencywatch.io/package/npm/eka-buburayam35-sluey) | npm | 0.0.0 |
| [eka-buburayam37-breki](https://dependencywatch.io/package/npm/eka-buburayam37-breki) | npm | 0.0.0 |
| [eka-buburayam38-riris](https://dependencywatch.io/package/npm/eka-buburayam38-riris) | npm | 0.0.0 |
| [eka-buburayam42-miaww](https://dependencywatch.io/package/npm/eka-buburayam42-miaww) | npm | 0.0.0 |
| [eka-buburayam47-sluey](https://dependencywatch.io/package/npm/eka-buburayam47-sluey) | npm | 0.0.0 |
| [eka-buburayam76-ruro](https://dependencywatch.io/package/npm/eka-buburayam76-ruro) | npm | 0.0.0 |
| [eka-bubursumsum17-breki](https://dependencywatch.io/package/npm/eka-bubursumsum17-breki) | npm | 0.0.0 |
| [eka-bubursumsum2-riris](https://dependencywatch.io/package/npm/eka-bubursumsum2-riris) | npm | 0.0.0 |
| [eka-bubursumsum20-pore](https://dependencywatch.io/package/npm/eka-bubursumsum20-pore) | npm | 0.0.0 |
| [eka-bubursumsum24-breki](https://dependencywatch.io/package/npm/eka-bubursumsum24-breki) | npm | 0.0.0 |
| [eka-bubursumsum84-sumpek](https://dependencywatch.io/package/npm/eka-bubursumsum84-sumpek) | npm | 0.0.0 |
| [eka-bubursumsum92-miaww](https://dependencywatch.io/package/npm/eka-bubursumsum92-miaww) | npm | 0.0.0 |
| [eka-dodol16-miaww](https://dependencywatch.io/package/npm/eka-dodol16-miaww) | npm | 0.0.0 |
| [eka-dodol26-miaww](https://dependencywatch.io/package/npm/eka-dodol26-miaww) | npm | 0.0.0 |
| [eka-dodol73-ruro](https://dependencywatch.io/package/npm/eka-dodol73-ruro) | npm | 0.0.0 |
| [eka-dodol77-apidev](https://dependencywatch.io/package/npm/eka-dodol77-apidev) | npm | 0.0.0 |
| [eka-dodol85-miaww](https://dependencywatch.io/package/npm/eka-dodol85-miaww) | npm | 0.0.0 |
| [eka-dodol91-sukiwir](https://dependencywatch.io/package/npm/eka-dodol91-sukiwir) | npm | 0.0.0 |
| [eka-dodol98-breki](https://dependencywatch.io/package/npm/eka-dodol98-breki) | npm | 0.0.0 |
| [eka-dodol98-sukiwir](https://dependencywatch.io/package/npm/eka-dodol98-sukiwir) | npm | 0.0.0 |
| [eka-donat14-sluey](https://dependencywatch.io/package/npm/eka-donat14-sluey) | npm | 0.0.0 |
| [eka-donat34-breki](https://dependencywatch.io/package/npm/eka-donat34-breki) | npm | 0.0.0 |
| [eka-donat34-sluey](https://dependencywatch.io/package/npm/eka-donat34-sluey) | npm | 0.0.0 |
| [eka-donat40-riris](https://dependencywatch.io/package/npm/eka-donat40-riris) | npm | 0.0.0 |
| [eka-dradag100-miaww](https://dependencywatch.io/package/npm/eka-dradag100-miaww) | npm | 0.0.0 |
| [eka-dradag43-kuki](https://dependencywatch.io/package/npm/eka-dradag43-kuki) | npm | 0.0.0 |
| [eka-empal30-sluey](https://dependencywatch.io/package/npm/eka-empal30-sluey) | npm | 0.0.0 |
| [eka-empal42-sukiwir](https://dependencywatch.io/package/npm/eka-empal42-sukiwir) | npm | 0.0.0 |
| [eka-empal52-pore](https://dependencywatch.io/package/npm/eka-empal52-pore) | npm | 0.0.0 |
| [eka-empal53-sukiwir](https://dependencywatch.io/package/npm/eka-empal53-sukiwir) | npm | 0.0.0 |
| [eka-empal63-sukiwir](https://dependencywatch.io/package/npm/eka-empal63-sukiwir) | npm | 0.0.0 |
| [eka-empal64-breki](https://dependencywatch.io/package/npm/eka-empal64-breki) | npm | 0.0.0 |
| [eka-empal71-ruro](https://dependencywatch.io/package/npm/eka-empal71-ruro) | npm | 0.0.0 |
| [eka-empal71-sluey](https://dependencywatch.io/package/npm/eka-empal71-sluey) | npm | 0.0.0 |
| [eka-empal81-kyuki](https://dependencywatch.io/package/npm/eka-empal81-kyuki) | npm | 0.0.0 |
| [eka-empal98-miaww](https://dependencywatch.io/package/npm/eka-empal98-miaww) | npm | 0.0.0 |
| [eka-enting14-breki](https://dependencywatch.io/package/npm/eka-enting14-breki) | npm | 0.0.0 |
| [eka-enting48-breki](https://dependencywatch.io/package/npm/eka-enting48-breki) | npm | 0.0.0 |
| [eka-enting87-breki](https://dependencywatch.io/package/npm/eka-enting87-breki) | npm | 0.0.0 |
| [eka-esdoger35-breki](https://dependencywatch.io/package/npm/eka-esdoger35-breki) | npm | 0.0.0 |
| [eka-esdoger53-breki](https://dependencywatch.io/package/npm/eka-esdoger53-breki) | npm | 0.0.0 |
| [eka-esdoger71-pore](https://dependencywatch.io/package/npm/eka-esdoger71-pore) | npm | 0.0.0 |

## What happened

Between roughly 2026-09-06 00:00 and 2026-09-07 08:00 UTC, GitHub Advisory Database flushed a large alphabetical backfill of malicious-package advisories in the `e-` prefix range. Yesterday's (Sept 6) ingest ran before this queue drained and captured only the first 13; the rest (~200 more) landed after and are catalogued here. Four coherent clusters emerge:

## Cluster A - tea.xyz `eka-<indonesian-food><N>-<suffix>` autopublish flood

**Naming template**: `eka-<food><N>-<tag>` with food ∈ {enting, empal, esdoger, brongkos, bubursumsum, dodol, donat, buburayam, dradag, bakwan, brengkes, botok, bakso, bika, bubur, asinan} (all Indonesian dishes / snacks / drinks), N ∈ 1-100, tag ∈ {breki, sluey, ruro, sukiwir, miaww, kuki, kyuki, pore, sumpek, apidev, riris}.

GHSA metadata verbatim: *"This package appears to be part of the tea.xyz token reward campaign that flooded npm. The package contains autopublish scripts designed to automatically generate and publish derivative packages with randomized names to artificially inflate developer reputation scores for tea protocol token rewards. The malware modifies package.json files, removes private flags, alters version numbers, generates random Indonesian-themed and English package names, and continuously republishes variants to pollute the npm registry."*

**Sampled GHSA advisories**: GHSA-rppw-gq7q-4v3m (`eka-enting87-breki`), GHSA-fq2f-vpxp-rmj6 (`eka-empal42-sukiwir`), GHSA-fjhh-fr66-j7p3 (`eka-empal81-kyuki`), GHSA-p8xp-vqhv-j4c4 (`eka-esdoger53-breki`), GHSA-fgjm-wcg2-xqg7 (`eka-brongkos29-sluey`), GHSA-72xh-8mhp-xhrp (`eka-empal71-ruro`), and ~90 more under the same template.

## Cluster B - tea.xyz `eigenstate-<astronomy><tech><lib>` autopublish spam

**Naming template**: `eigenstate-<astro-term>-<tech-fragment>-<lib>` blending astronomy terms (parallax, ophiuchus, procyon, auriga, deneb, alphard, hermes, spectron, gravitationalwave, wormhole, singularitarianism, areology, archaeogenetics, outercore, bionics) with tech-lib fragments (chromedriver, socketio, electron-builder, electron-lithosphere, config-ora, module, init, test, javascript, technocracy, despina).

Same tea.xyz autopublish description as Cluster A - different template, same operator pattern.

**Sampled GHSA advisories**: GHSA-xq8g-m5c6-6m24 (`eigenstate-gravitationalwave-config-ora`), GHSA-7cg9-4wqc-3vqg (`eigenstate-ophiuchus-sociobiology-koa`), GHSA-wrwf-w7jm-gw84 (`eigenstate-auriga-module-chromedriver`), GHSA-2cpr-h94x-qprf (`eigenstate-parallax-init-miranda`), GHSA-3mxp-qpcq-fg64 (`eigenstate-spectron-loopback-wormhole`), GHSA-rp54-9fmm-3p28 (`eigenstate-outercore-procyon-colors`), GHSA-rvjf-x2pj-6cj9 (`eigenstate-archaeogenetics-singularitarianism-socketio`), GHSA-9prv-62qg-qv48 (`eigenstate-electron-builder-despina-bionics`).

## Cluster C - z3n research-pattern `effective_/efficient_<animal>_z3n` spam

**Naming template**: `{effective|efficient}_<animal>_z3n` (animals include orangutan, monkey, termite, chickadee, ostrich, ptarmigan, spoonbill, aphid, scallop, lungfish, penguin, landfowl, moth, rabbit, grouse, duck, tarantula, tiger, hare, lemur, python, takin, guineafowl, butterfly, starfish, meadowlark). Variants swap the `_z3n` suffix for `_dumbs`, `_0xrequest`, or a color-modifier tag (`efficient_gerbil_white-13`, `efficient_catfish_chocolate-98`, `efficient_macaw_moccasin-85`, `efficient_duck_emerald-86`).

Boilerplate CWE-506 "malicious code" description on each; this template has appeared in earlier 2026 sweeps and is consistent with a single OSS-research group's registry-pollution testing rather than active exploitation.

## Cluster D - Sept 6-7 misc E-prefix opportunistic drops

Mixed opportunistic drops carrying the more serious GHSA full-compromise boilerplate ("any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer"). Names split into two sub-groups:

**Corporate-namespace / ecosystem impersonators** (the dep-confusion probes worth manual triage):

| Package | Ecosystem hook |
|---|---|
| `egjs-cli` | egjs (NAVER open-source UI framework) |
| `ejson2env` | Shopify EJSON tooling |
| `ejson-rails` | Ruby-on-Rails / Shopify EJSON |
| `ejs-client` | EJS template engine |
| `egg-plugin-knex` | eggjs Node framework + knex ORM |
| `egg-arbitrary` | eggjs Node framework |
| `effector-kws` | Effector state manager |
| `effector-react-kws` | Effector + React binding |
| `eip-119-json-provider` | Ethereum EIP-119 wallet-connect RPC |
| `efx-angular-components` | Corporate Angular UI namespace |
| `eg-affiliates-common` / `eg-affiliates-common-test` | Affiliate-tooling internal namespace |
| `eg4-fangfa` | Chinese enterprise namespace |
| `egov-pep-frontend` | E-government / PEP-check frontend |
| `egs-trusted-domains` | Trust-store / SSO tooling |
| `egstore-ctx` / `egstore-query` / `egstore-carousel` / `egstore-graphql-client` / `egstore-suspense` | `egstore` frontend framework family |
| `ein-services` / `ein-loader` | EIN tax-ID / internal service naming |
| `einthyra-notthedevs` | Impersonator of an unnamed vendor |
| `einfprog` | German intro-to-programming coursepack |
| `einkaufen` | German-language shopping SDK impersonator |
| `eithernet` / `eithernet-test` / `eithernet-test-fixtures` / `eithernet-test-fixtures-test` | `ethernet`-typosquat family |
| `ehance-assistant` / `ehance-assistant33` | Vendor-name typosquat |
| `ehouse`, `eh-fiddle`, `eflectron`, `eficsi`, `efp9` | Misc opportunistic drops |
| `eganglia` | Ganglia monitoring impersonator |
| `egret_moccasin-14` | Egret game engine + color-tag operator suffix |
| `egis-tsc` | Egis vendor + TypeScript compiler tag |
| `eggcoin` / `eggdrop` | Crypto / IRC name grab |
| `eggplant-umbrella-aig1` / `eggplant-juniper-lcjd` / `eggplant-radish-ka52` / `eggplant-delta-8omx` | Eggplant test-automation vendor typosquats |
| `eight-spend-men`, `eighster`, `eimearmartin`, `eimearobrien`, `eikasia`, `ejercico`, `ejungle`, `ejstags` | Misc / individual-name grabs |

**Random-string opportunistic drops** (grep-only): `ejrfsqmkdconukbl`, `ejdgrvaqkioslhbf`, `ejbwdr-devapptea`, `eikpndvxbtfhkcas`, `ehquvdznyglmrpxb`, `ehxjimturwyqnzbk`, `eivybsafunmzpxlg`, `eixp4ressz`, `egnxaqfzbjhdlvkp`, `egmoizjqkvybsulc`, `egudkjkpcrwhlfvy`.

## Distinction from `npm-2026-09-07-coinbase-base-cb-wallet-dep-confusion`

The Coinbase / Base / SCW dep-confusion drop published the same day (2026-09-07) is a completely separate cluster: single-operator, 13 packages, all named to shadow Coinbase internal namespaces. That is a targeted campaign catalogued in its own module. This sweep covers the alphabetical E-prefix backfill and tea.xyz reward spam - registry-pollution rather than a targeted campaign.

## Registry state

All packages listed below are flagged as malware on npm and quarantined. Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs before quarantine will keep serving them - explicit deny-listing of the `eka-` / `eigenstate-` name prefixes, the `_z3n` suffix, and the individual misc names is the durable mitigation.

## Discovery credits

`GitHub Advisory Database` (all advisories published 2026-09-06 and 2026-09-07), `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector` (source for the tea.xyz Cluster B advisories).

## Impact

- **Cluster A - tea.xyz `eka-<indonesian-food><N>-<suffix>` autopublish flood (~100 packages, all versions)**: GHSA description on each explicitly reads "part of the tea.xyz token reward campaign that flooded npm" - autopublish scripts modify `package.json`, strip private flags, bump versions, generate random Indonesian-food + English/random-word package names, and republish variants to inflate developer reputation for tea protocol token rewards. Name shape: `eka-<food><N>-<tag>` where food ∈ {enting, empal, esdoger, brongkos, bubursumsum, dodol, donat, buburayam, dradag, bakwan, brengkes, botok, bakso, bika, bubur, asinan}, N ∈ 1-100, tag ∈ {breki, sluey, ruro, sukiwir, miaww, kuki, kyuki, pore, sumpek, apidev, riris}. Low real-lockfile probability but registry pollution is severe
- **Cluster B - tea.xyz `eigenstate-<astronomy><tech><lib>` autopublish spam (~15 packages, all versions)**: same tea.xyz reward pattern, different naming template. Multi-word chained names blending astronomy terms (parallax, ophiuchus, procyon, auriga, deneb, alphard, hermes, spectron, singularitarianism, gravitationalwave, wormhole) with tech-lib fragments (chromedriver, socketio, electron-builder, electron-lithosphere, config-ora, module, init, test, javascript). Each carries the same tea.xyz autopublish disclosure in GHSA description. Same low real-lockfile probability but higher visual-legitimacy risk
- **Cluster C - z3n research-pattern `effective_<animal>_z3n` / `efficient_<animal>_z3n` (~35 packages, all versions)**: uniform naming template `{effective|efficient}_<animal>_z3n` (animals: orangutan, monkey, termite, chickadee, ostrich, ptarmigan, spoonbill, aphid, scallop, lungfish, penguin, landfowl, moth, rabbit, grouse, duck, tarantula, tiger, hare, lemur, python, takin, guineafowl, butterfly, starfish, meadowlark, brown-quail, yellow-mole, jade-mackerel) plus adjective-color variants (`efficient_gerbil_white-13`, `efficient_catfish_chocolate-98`, `efficient_macaw_moccasin-85`, `efficient_duck_emerald-86`) and `_dumbs` / `_0xrequest` operator suffixes. Boilerplate CWE-506 "malicious code"; matches the `z3n` OSS research pattern flagged earlier in 2026. Very low real-lockfile probability
- **Cluster D - Sept 6-7 misc E-prefix opportunistic drops (~50 packages, all versions)**: mixed opportunistic drops carrying the full-compromise boilerplate ("any computer that has this package installed or running should be considered fully compromised"). Names include ecosystem-adjacent hooks (`egjs-cli`, `ejson2env`, `ejson-rails`, `ejs-client`, `egg-plugin-knex`, `egg-arbitrary`, `effector-kws`, `effector-react-kws`, `eip-119-json-provider`), corporate-namespace impersonators (`efx-angular-components`, `eg-affiliates-common`, `eg-affiliates-common-test`, `eg4-fangfa`, `egov-pep-frontend`, `egs-trusted-domains`, `egstore-ctx`, `egstore-query`, `egstore-carousel`, `egstore-graphql-client`, `egstore-suspense`, `ein-services`, `ein-loader`, `einthyra-notthedevs`, `einfprog`, `einkaufen`, `eithernet`, `eithernet-test`, `eithernet-test-fixtures`, `eithernet-test-fixtures-test`, `efx-angular-components`, `ehance-assistant`, `ehance-assistant33`, `ehouse`, `eh-fiddle`, `eflectron`, `eficsi`, `efp9`, `eganglia`, `egret_moccasin-14`, `egis-tsc`, `eggcoin`, `eggdrop`, `eggplant-umbrella-aig1`, `eggplant-juniper-lcjd`, `eggplant-radish-ka52`, `eggplant-delta-8omx`, `eight-spend-men`, `eighster`, `eight-spend-men`, `eimearmartin`, `eimearobrien`, `eikasia`, `ejercico`, `ejungle`, `ejstags`, `ejrfsqmkdconukbl`, `ejdgrvaqkioslhbf`, `ejbwdr-devapptea`, `eikpndvxbtfhkcas`, `ehquvdznyglmrpxb`, `ehxjimturwyqnzbk`, `eivybsafunmzpxlg`, `eixp4ressz`, `egnxaqfzbjhdlvkp`, `egmoizjqkvybsulc`, `egudkjkpcrwhlfvy`). Any lockfile hit is a real compromise; the corporate-namespace names in particular (`egov-pep-frontend`, `egstore-*`, `ein-services`, `eip-119-json-provider`, `egg-plugin-knex`) are the ones most likely to be resolved as dep-confusion probes

## What to do

1. Grep every `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, and `package.json` in your org for the names listed below. Uninstall on hit and rebuild the lockfile against a clean cache
2. **For Cluster A (`eka-*` tea.xyz Indonesian-food autopublish)** and **Cluster B (`eigenstate-*` tea.xyz astronomy-lib autopublish)**: these are registry-pollution / reputation-mining spam - low real-user probability. Block the `eka-` and `eigenstate-` name prefixes on internal Verdaccio / Artifactory / Nexus mirrors to prevent future re-uploads under the same pattern. No host-side forensics required unless a lockfile actually references one
3. **For Cluster C (`effective_*_z3n` / `efficient_*_z3n`)**: research-pattern spam - block the `_z3n` suffix on internal mirrors and grep for the exact names listed below
4. **For Cluster D (misc E-prefix opportunistic drops)**: on any lockfile hit, treat the resolving host as fully compromised (per GHSA boilerplate) - rotate every credential the host had access to (npm tokens, SSH keys, cloud IAM, git, SSO), reimage where practical. Focus manual triage on the corporate-namespace names (`egov-pep-frontend`, `egstore-*`, `ein-services`, `ein-loader`, `eip-119-json-provider`, `egg-plugin-knex`, `egg-arbitrary`, `efx-angular-components`) - these are the dep-confusion probes most likely to hit real internal-namespace resolution
5. For every `npm install` in CI, prefer `--ignore-scripts` to block postinstall payloads. Cluster D is where this matters most - Clusters A/B/C are registry-pollution rather than install-time-execution
6. Consider adding all four cluster name prefixes (`eka-`, `eigenstate-`, `_z3n` suffix, and the individual misc names) to a private-registry deny-list until further vendor triage exists

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-rppw-gq7q-4v3m - eka-enting87-breki (representative tea.xyz Cluster A advisory)](https://github.com/advisories/GHSA-rppw-gq7q-4v3m) - GitHub
- [GHSA-xq8g-m5c6-6m24 - eigenstate-gravitationalwave-config-ora (representative tea.xyz Cluster B advisory)](https://github.com/advisories/GHSA-xq8g-m5c6-6m24) - GitHub
- [GHSA-3hj9-q4rp-rjx8 - eip-119-json-provider (representative Cluster D advisory)](https://github.com/advisories/GHSA-3hj9-q4rp-rjx8) - GitHub
- [GHSA-gp93-fv42-5xp2 - eggplant-umbrella-aig1 (representative Cluster D advisory)](https://github.com/advisories/GHSA-gp93-fv42-5xp2) - GitHub
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF

---

Canonical page: https://dependencywatch.io/incident/multi-2026-09-07-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-09-07-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).