DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 9 September 2026

HighAdvisory sweepnpmPyPI

Between 2026-09-08 and 2026-09-09 UTC GHSA published ~25 npm/PyPI malware advisories: a coordinated sonner typosquat trio (sonmors/gloggo/file-type-detector) with a PNG-steganography loader gated on a fake isSign(); three @*/baileys WhatsApp scope hijacks; a rojo-rbx Roblox typosquat with Windows Run-key persistence; plus dep-confusion probes and remote-code loaders.

Published 9 Sept 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-09-09-ghsa-malware-sweep
25
Packages tracked45 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
9 Sept 2026
Ecosystems
npmPyPI
Detected by
GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector
Also known as
2026-09-09 GHSA npm/PyPI sweep, sonmors gloggo file-type-detector coordinated sonner typosquat, rojo-rbx Roblox Windows Run-key persistence

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

Between roughly 2026-09-08 00:00 UTC and 2026-09-09 12:00 UTC, GitHub Advisory Database published ~25 new npm and PyPI malware advisories. Unlike the 2026-09-07/08 wave (which was dominated by corporate-namespace dep-confusion probes hitting Air Canada / Medisend / Coinbase / Swisscom and many others), this window is dominated by analysed payloads: typosquats, remote-code loaders, an OS-level persistence chain, and a coordinated three-package cluster.

Cluster A — Coordinated sonner typosquat trio

The most operationally interesting drop of the day is a three-package coordinated attack against the very-widely-used sonner React toast library:

PackageGHSARole
sonmorsGHSA-vp67-pvcp-4j8jTyposquat of sonner; spoofs sonner's package.json identity; require('gloggo') at load time
gloggoGHSA-wmgg-555m-p7h6Typosquat of glogg (gulpjs); gates hidden loader on isSign('favorite','gloggo',12467) from file-type-detector
file-type-detectorGHSA-cjhh-g8v5-hg5gTyposquat of file-type-checker; the concealed isSign() function reads PNG files, extracts payloads, writes them to sibling packages under node_modules

All three carry the false attribution "Blockvora Team" / team@blockvora.com. The load-time chain is deliberately obfuscated: sonmors looks like a working toast library, gloggo looks like a working logger, and file-type-detector looks like a MIME-sniffing utility. Only when all three are present, and only when gloggo calls isSign(), does the malicious loader activate and extract the payload from PNG bytes.

The PNG-steganography step is the reason a static .js-only scan will not find the payload. Yara rules that trigger on eval(), Function(), child_process, or a known malicious URL will miss it entirely - the URL and shell commands only exist inside decoded PNG bytes, and only after all three packages line up.

Cluster B — WhatsApp Baileys scope hijacks

Three more Baileys-namespace scope hijacks landed (@vallensofficial/baileys, @versacode/baileys, @haimiya/baileys), all with the standard full-compromise GHSA boilerplate ("any computer that has this package installed or running should be considered fully compromised"). This continues the pattern from kiki-baileys (2026-09-08 sweep) and WhiskeySAML/baileys earlier in the year. Baileys (the real one, @whiskeysockets/baileys) is the de-facto unofficial WhatsApp Web API library for Node - a fertile lookalike target.

Cluster C — Roblox / gaming ecosystem malware

rojo-rbx@<=1.4.3 (GHSA-p55w-6rww-5frg) impersonates the well-known Rojo Roblox tooling project. On Windows, scripts/install.js:

  1. Downloads a VBScript from https://l81.me/updater.vbs
  2. Writes it to %APPDATA%\Rojo\rojo-sync.vbs
  3. Adds HKCU\Software\Microsoft\Windows\CurrentVersion\Run\RojoClientSync so the VBS re-launches on every login
  4. Provides no actual Rojo functionality

Unlike the OAST / webhook.site probes above, this one commits to persistence on the victim host - a genuine backdoor rather than reconnaissance. The real Rojo tool is distributed as a binary through GitHub releases, not through npm, so any npm-based "Rojo" install is fake by definition.

open-item-validator@1.0.3/1.0.5 (GHSA-jfq9-9hf7-gr4x) is a game-adjacent name grab (declared homepage game.spawnrealm.com, actual C2 itemx.servegame.com:8888 on the No-IP dynamic DNS) that spawns a persistent background Node process, polls /api/x-realtime, and new Function()-executes the returned code. The daemon survives its parent process exit, so a single dev-machine npm install gives the operator ongoing RCE.

Cluster D — Corporate-namespace dep-confusion probes

Same pattern as yesterday's Cluster A/B/C but with per-target IOCs published:

  • unifi-credential-server@99.0.0 (GHSA-9rgc-h7qj-q8w3) - Ubiquiti UniFi internal-build target; hex-encoded DNS labels to <payload>.oast.me
  • twilio-functions@99.99.99/99.99.100 (GHSA-73g6-c624-22hf) - Twilio SDK impersonator; POST to webhook.site/42ce0f0e-a0a0-41b5-b157-1c0f918e064f, DNS fallback 2b22ede784d5.oast.fun
  • @umschool/analytics@999.0.0-999.0.4 (GHSA-2qmq-f9mj-rwcj) - Umschool corporate scope; GET to akko.requestcatcher.com/dep-confusion
  • py-devoli-common@999.999.999 (PyPI, GHSA-g8qj-vfr2-9w5c) - Devoli target on PyPI; boilerplate-flagged, no published payload

The sentinel-version (99.x, 99.99.x, 999.x, 999.999.x) pattern is the fingerprint - real internal packages don't live at these versions, but they beat any semver range in resolution when a bare name accidentally resolves against public npm.

Cluster E — Webhook / OAST reconnaissance beacons

  • @yongot/canary-mcp-isolation@1.0.1 and @yongot/canary-mcp-test@2.0.0/3.0.0/4.0.0 - same operator; sends hostname + id + GCP metadata probes (169.254.169.254, metadata.google.internal) to webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b. The canary-mcp-* naming appears aimed at MCP (Model Context Protocol) / AI-agent servers, another corporate scope shape
  • alloy-graphql@1.0.1 - preinstall reads /etc/passwd + /etc/hosts, harvests DNS servers and full package.json, POSTs to a Burp Collaborator subdomain (*.oastify.com). This is the deepest reconnaissance in the batch
  • @aspect-adv-ui/consent-manager@2.4.0/2.4.1 - masquerades as a GDPR/CCPA consent manager; postinstall GET to webhook.site/kapper

Cluster F — Remote-code-loader droppers

Five packages that fetch code over the network and immediately execute it:

  • tailwind-aspect-styles@<=0.4.2 — http://23.27.245.100/index.js over plain HTTP; writes ./inout.js, require()s it
  • tailwindcss-aspectratio-styles@0.3.4/0.3.5 — tailwindlan.online remote JS; almost certainly the same operator as the previous line, both impersonating @tailwindcss/aspect-ratio
  • selfcerts@1.0.0 — hides a base64 C2 URL inside a fake sample/cert.pem, fetches http://144.172.104.211/settings/privacy.php, pipes it into detached python3. Cross-language execution is unusual for npm malware
  • punypump@1.2.2/1.2.4/1.2.5 — fetches AES-256-CBC ciphertext from jsonkeeper.com/b/V6NBX, decrypts with hardcoded key, eval()s the result. Disguised as a console-browserify shim
  • bx-ui-view@1.0.0 — self-referential dependency: package.json declares its own package name with an HTTPS URL value pointing to https://package-access.pages.dev/bx-ui-view. npm downloads and runs whatever the pages.dev URL currently serves at install time

Cluster G — Credential theft / hardcoded backdoor

toru-ultimate@1.0.0 (GHSA-jg37-3w86-3rx2) is a Facebook credential harvester. The loginViaAPI() function forwards user-supplied email + password + 2FA Base32 secret to https://minhdong.site/api/v1/facebook/login_ios, and the package pulls its own runtime code from an unpinned GitHub branch (VangBanLaNhat/fca-unofficial) - so the branch owner can inject fresh code any time.

vinzz-wcli@<=1.0.1 (GHSA-xv3f-69vw-grmg) is a WhatsApp CLI framework whose plugin config hardcodes a specific WhatsApp JID (6285185667890@s.whatsapp.net) as an authorised owner. Any user who pairs their own phone through the CLI has given the JID owner silent access to a cmd plugin (child_process.exec) and an eval plugin - full RCE with the installer's privileges over WhatsApp.

Cluster H — Destructive package

express-session-timer@1.0.0-1.0.16 (GHSA-xf4h-cmpp-qfvf) is unusual for the batch: no exfil, no C2, no persistence - just sabotage. Approximately 18 seconds after require('express-session-timer'), it recursively removes <cwd>/src and kills Node / PM2 processes. Its declared dependency express-timer@^0.0.1-security pins to the npm security-hold placeholder version, another red flag.

Cluster I — Amazon Inspector / OpenSSF boilerplate takedown

react-hook-doms@<=5.3.1 (GHSA-hj8f-64m3-wrpj) is amazon-inspector-flagged with only a source hash and no published analysis. Assume the full-compromise GHSA boilerplate applies until independent per-package analysis surfaces.

Distinction from the parallel 2026-09-08 sweep

Yesterday's multi-2026-09-08-ghsa-malware-sweep covered the sprawling corporate-namespace dep-confusion probe wave (Air Canada, Medisend, OPAP, Optimizely/Fastly, MATLAB/Azure DevOps, SimpliSafe, Tidal, PayPal, Twilio, Afterpay, Ecobee, Karapace, Glia, Jobber, Feishu, BMC, and more) with the oast.online + 5.189.159.252 shared-infrastructure Cluster A. Today's window is smaller and more analytical - each cluster comes with published IOCs and enough detail to identify per-cluster mitigation. Some Sept-8 corporate-namespace probes may still trickle through the GHSA pipeline today; check the parallel record for those.

Registry state

All packages listed below are flagged as malware on npm / PyPI and quarantined. Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs before quarantine will keep serving them - explicit deny-listing of every name below plus the @vallensofficial/, @versacode/, @haimiya/, @yongot/, @aspect-adv-ui/, and @umschool/ scopes is the durable mitigation.

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector. Per-package IOC details (URLs, IPs, hashes, hardcoded JIDs, webhook tokens) drawn verbatim from the GHSA advisory bodies published between 2026-09-08 and 2026-09-09.

typosquatdependency-confusioncredential-theftdns-exfiltrationobfuscationci-cd-compromise
Affected packages

25 packages 45 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • Cluster A — Coordinated sonner React-toast typosquat trio (sonmors + gloggo + file-type-detector): three npm packages published by the same operator work together as one payload. sonmors@<=2.11.2 (GHSA-vp67-pvcp-4j8j) is a near-copy of the widely-used sonner React toast library that spoofs sonner's identity in package.json and calls require('gloggo') at load time. gloggo@1.1.2/1.1.3/1.1.4 (GHSA-wmgg-555m-p7h6) masquerades as gulpjs' glogg logging library and gates its hidden loader on isSign('favorite','gloggo',12467) from file-type-detector. file-type-detector@1.1.0/1.1.1 (GHSA-cjhh-g8v5-hg5g) impersonates the legitimate file-type-checker and hides a payload in a PNG that it extracts and writes into sibling packages under node_modules. Any project that installed the sonner typosquat picked up all three; the PNG-steganography loader means static scanners that only look at .js will miss the payload
  • Cluster B — WhatsApp Baileys scope hijacks: @vallensofficial/baileys, @versacode/baileys, and @haimiya/baileys (all versions; GHSA-gg93-mm5f-23v8 / GHSA-fw7g-gr3j-7wf7 / GHSA-q246-72rh-fp8w) all carry the full-compromise GHSA boilerplate ("any computer that has this package installed or running should be considered fully compromised"). Continues the ongoing Baileys namespace-abuse pattern (kiki-baileys in the 2026-09-08 sweep, WhiskeySAML/baileys earlier). Baileys is a heavily-used unofficial WhatsApp Web API client; a bare or unscoped Baileys reference in a Node.js bot repo resolves against public npm and picks these up
  • Cluster C — Roblox / gaming ecosystem malware with confirmed persistence: rojo-rbx@<=1.4.3 (GHSA-p55w-6rww-5frg) impersonates the legitimate Rojo Roblox development tooling. On Windows, scripts/install.js downloads a VBScript from https://l81.me/updater.vbs, writes it to %APPDATA%\Rojo\rojo-sync.vbs, and installs a HKCU\Software\Microsoft\Windows\CurrentVersion\Run\RojoClientSync registry entry so the VBS re-launches on every login. open-item-validator@1.0.3/1.0.5 (GHSA-jfq9-9hf7-gr4x) spawns a background Node process that repeatedly polls http://itemx.servegame.com:8888/api/x-realtime and new Function()-executes the returned code, giving the operator arbitrary code execution on the host
  • Cluster D — Corporate-namespace dep-confusion probes at sentinel versions: unifi-credential-server@99.0.0 (GHSA-9rgc-h7qj-q8w3) targets Ubiquiti UniFi internal build systems - preinstall harvests hostname / username / cwd / internal IPv4s / CI environment variables and exfils via DNS queries to <hex-payload>.oast.me. twilio-functions@99.99.99/99.99.100 (GHSA-73g6-c624-22hf) impersonates the Twilio SDK - postinstall POSTs system info to webhook.site/42ce0f0e-a0a0-41b5-b157-1c0f918e064f with DNS fallback to 2b22ede784d5.oast.fun. @umschool/analytics@999.0.0-999.0.4 (GHSA-2qmq-f9mj-rwcj) targets the Umschool scope - postinstall GET to akko.requestcatcher.com/dep-confusion. PyPI py-devoli-common@999.999.999 (GHSA-g8qj-vfr2-9w5c) is the same shape on PyPI, boilerplate-flagged
  • Cluster E — Webhook / OAST reconnaissance beacons: @yongot/canary-mcp-isolation@1.0.1 (GHSA-7gq6-vvhp-97f4) and @yongot/canary-mcp-test@2.0.0/3.0.0/4.0.0 (GHSA-469r-xxvx-62x3) send installer hostname + id output + GCP metadata (169.254.169.254, metadata.google.internal) probe results to https://webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b - same operator across both. alloy-graphql@1.0.1 (GHSA-5xmm-9965-mvqw) reads /etc/passwd and /etc/hosts, harvests DNS servers and package.json, POSTs to ipbtwv9063nc5hvhodh0s4u9x03rrhf6.oastify.com (Burp Collaborator). @aspect-adv-ui/consent-manager@2.4.0/2.4.1 (GHSA-2m5c-v74g-r4m8) postinstall GET to webhook.site/kapper
  • Cluster F — Remote-code-loader droppers: tailwind-aspect-styles@<=0.4.2 (GHSA-r28r-839h-4gqw) fetches http://23.27.245.100/index.js over plain HTTP, writes it to ./inout.js, and immediately require()s it. tailwindcss-aspectratio-styles@0.3.4/0.3.5 (GHSA-4gjp-7xcv-m2gc) does the same shape via tailwindlan.online - clearly a related pair impersonating the Tailwind CSS aspect-ratio plugin. selfcerts@1.0.0 (GHSA-2cj2-qj4h-42hp) hides a base64-encoded C2 URL in a fake TLS cert, fetches http://144.172.104.211/settings/privacy.php, and pipes the response to a detached python3 process. punypump@1.2.2/1.2.4/1.2.5 (GHSA-45jc-2qr4-pmgf) fetches an AES-256-CBC-encrypted payload from jsonkeeper.com/b/V6NBX and eval()s the plaintext. bx-ui-view@1.0.0 (GHSA-hqg3-m33m-mvcr) declares a self-referential dependency pointing at https://package-access.pages.dev/bx-ui-view so npm downloads and runs whatever the pages.dev URL currently serves
  • Cluster G — Credential theft / hardcoded backdoor: toru-ultimate@1.0.0 (GHSA-jg37-3w86-3rx2) is a Facebook credential harvester - the loginViaAPI() function forwards email + password + 2FA Base32 secret to https://minhdong.site/api/v1/facebook/login_ios, and the package pulls an unpinned GitHub branch (VangBanLaNhat/fca-unofficial) so the branch controller can inject fresh code at any time. vinzz-wcli@<=1.0.1 (GHSA-xv3f-69vw-grmg) is a WhatsApp CLI tool with a hardcoded JID (6285185667890@s.whatsapp.net) that has always-on cmd- and eval-plugin authority - any user who pairs their phone gives the JID owner silent RCE with the installer's privileges
  • Cluster H — Destructive package: express-session-timer@1.0.0-1.0.16 (GHSA-xf4h-cmpp-qfvf) recursively removes <cwd>/src roughly 18 seconds after require(), then kills Node / PM2 processes on Unix and Windows. Not exfil - straight sabotage. Its declared dependency express-timer@^0.0.1-security pins to npm's security-hold placeholder, another red flag
  • Cluster I — Amazon Inspector / OpenSSF boilerplate takedown (no published analysis): react-hook-doms@<=5.3.1 (GHSA-hj8f-64m3-wrpj) is flagged by amazon-inspector with only a source hash; assume the same GHSA full-compromise boilerplate applies pending independent analysis
What to do

Clean-up steps

  1. Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, package.json, requirements.txt, and poetry.lock in your org for the names below. Uninstall on hit, wipe node_modules, delete the lockfile, and rebuild against a clean cache
  2. For Cluster A (sonmors / gloggo / file-type-detector): anyone who typosquat-installed sonmors instead of sonner picked up all three packages. The PNG-steganography payload is not visible in a .js-only static scan - grep for the exact package names, not for the payload. Any hit means the host executed hidden code from a PNG bundled by file-type-detector; treat as fully compromised, rotate every credential the host had access to, and reimage
  3. For Cluster B Baileys hijacks: audit every WhatsApp/Baileys-based Node bot repo for scoped @vallensofficial/baileys, @versacode/baileys, @haimiya/baileys (and the previous kiki-baileys). Pin the real upstream @whiskeysockets/baileys explicitly in package.json and enforce it in CI. GHSA marks all versions of these packages as malicious - assume any host that resolved one is fully compromised
  4. For Cluster C rojo-rbx Windows persistence: on any Windows dev machine that installed rojo-rbx, immediately delete %APPDATA%\Rojo\rojo-sync.vbs, remove the HKCU\Software\Microsoft\Windows\CurrentVersion\Run\RojoClientSync registry value, and block l81.me at the egress proxy. Real Rojo distribution is via github.com/rojo-rbx/rojo releases, not npm - never install a Roblox-tooling package that claims to be Rojo via npm
  5. For Cluster D dep-confusion probes: Ubiquiti / UniFi build systems - audit internal npm mirror logs for unifi-credential-server resolution attempts. Twilio SDK consumers - explicitly pin twilio (the real SDK), never resolve twilio-functions from public npm. Any org whose internal scope contains @umschool/ - enforce a scoped registry= line in .npmrc and treat the presence of @umschool/analytics@999.x in any mirror as evidence of active enumeration. Block oast.me, oast.fun, oastify.com (Interactsh / Burp Collaborator hosts), webhook.site, and akko.requestcatcher.com at the corporate egress proxy - all four are legitimate OAST services being repeatedly weaponised by dep-confusion probe operators and have no legitimate use in production egress
  6. For Cluster E OAST beacons: audit DNS logs for queries to *.oast.me, *.oast.fun, *.oastify.com, webhook.site, and *.requestcatcher.com between 2026-09-08 and now. Any host with matching DNS or egress records against a package named below is confirmed compromised on install. alloy-graphql in particular exfiltrates the contents of /etc/passwd and /etc/hosts - that leak is not undoable
  7. For Cluster F remote-code loaders: block 23.27.245.100, 144.172.104.211, tailwindlan.online, jsonkeeper.com, l81.me, minhdong.site, itemx.servegame.com, and package-access.pages.dev at the corporate egress proxy. Any host that fetched from one of these while any package below was in the lockfile is fully compromised - reimage after credential rotation
  8. For Cluster G credential-theft: any host that ran toru-ultimate may have leaked user-provided Facebook credentials + 2FA seeds to minhdong.site; notify affected users and rotate seeds. Any WhatsApp-bot host that installed vinzz-wcli has granted RCE to JID 6285185667890@s.whatsapp.net - assume every command that JID could have run has run
  9. For Cluster H destructive: any repo that had express-session-timer in its lockfile and imported it lost its src/ tree 18 seconds later. Restore from git; do not attempt to recover from node_modules
  10. For every npm install in CI, prefer --ignore-scripts to block postinstall / preinstall payloads. This is the single highest-value mitigation against Clusters D, E, and F
  11. Add every name below to internal private-registry (Verdaccio / Artifactory / Nexus) deny-lists for at least 30 days to prevent re-uploads by rotating operators
References

Sources

multi-2026-09-09-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents