# GitHub Advisory malware sweep - 2026-09-08/09 (coordinated `sonner` typosquat trio, Baileys scope hijacks, `rojo-rbx` Windows persistence, dep-confusion probes and remote-code loaders) > Between 2026-09-08 and 2026-09-09 UTC GHSA published ~25 npm/PyPI malware advisories: a coordinated `sonner` typosquat trio (`sonmors`/`gloggo`/`file-type-detector`) with a PNG-steganography loader gated on a fake `isSign()`; three `@*/baileys` WhatsApp scope hijacks; a `rojo-rbx` Roblox typosquat with Windows Run-key persistence; plus dep-confusion probes and remote-code loaders. - Published: 2026-09-09 - Severity: high - Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole. - Ecosystems: npm, PyPI - Scope: 25 packages, 45 compromised versions - Tags: typosquat, dependency-confusion, credential-theft, dns-exfiltration, obfuscation, ci-cd-compromise - Also known as: 2026-09-09 GHSA npm/PyPI sweep, sonmors gloggo file-type-detector coordinated sonner typosquat, rojo-rbx Roblox Windows Run-key persistence, baileys scope hijack wave 2026-09-09 - Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector - Incident ID: multi-2026-09-09-ghsa-malware-sweep ## Affected packages (25) Only the exact versions listed were named by the source advisories. Other versions are not implicated. | Package | Ecosystem | Compromised versions | |---|---|---| | [@aspect-adv-ui/consent-manager](https://dependencywatch.io/package/npm/@aspect-adv-ui/consent-manager) | npm | 2.4.0, 2.4.1 | | [@haimiya/baileys](https://dependencywatch.io/package/npm/@haimiya/baileys) | npm | * | | [@umschool/analytics](https://dependencywatch.io/package/npm/@umschool/analytics) | npm | 999.0.0, 999.0.1, 999.0.2, 999.0.3, 999.0.4 | | [@vallensofficial/baileys](https://dependencywatch.io/package/npm/@vallensofficial/baileys) | npm | * | | [@versacode/baileys](https://dependencywatch.io/package/npm/@versacode/baileys) | npm | * | | [@yongot/canary-mcp-isolation](https://dependencywatch.io/package/npm/@yongot/canary-mcp-isolation) | npm | 1.0.1 | | [@yongot/canary-mcp-test](https://dependencywatch.io/package/npm/@yongot/canary-mcp-test) | npm | 2.0.0, 3.0.0, 4.0.0 | | [alloy-graphql](https://dependencywatch.io/package/npm/alloy-graphql) | npm | 1.0.1 | | [bx-ui-view](https://dependencywatch.io/package/npm/bx-ui-view) | npm | 1.0.0 | | [express-session-timer](https://dependencywatch.io/package/npm/express-session-timer) | npm | 1.0.0, 1.0.1, 1.0.13, 1.0.14, 1.0.16 | | [file-type-detector](https://dependencywatch.io/package/npm/file-type-detector) | npm | 1.1.0, 1.1.1 | | [gloggo](https://dependencywatch.io/package/npm/gloggo) | npm | 1.1.2, 1.1.3, 1.1.4 | | [open-item-validator](https://dependencywatch.io/package/npm/open-item-validator) | npm | 1.0.3, 1.0.5 | | [punypump](https://dependencywatch.io/package/npm/punypump) | npm | 1.2.2, 1.2.4, 1.2.5 | | [py-devoli-common](https://dependencywatch.io/package/pypi/py-devoli-common) | PyPI | 999.999.999 | | [react-hook-doms](https://dependencywatch.io/package/npm/react-hook-doms) | npm | <=5.3.1 | | [rojo-rbx](https://dependencywatch.io/package/npm/rojo-rbx) | npm | <=1.4.3 | | [selfcerts](https://dependencywatch.io/package/npm/selfcerts) | npm | 1.0.0 | | [sonmors](https://dependencywatch.io/package/npm/sonmors) | npm | 2.11.2, <=2.11.2 | | [tailwind-aspect-styles](https://dependencywatch.io/package/npm/tailwind-aspect-styles) | npm | <=0.4.2 | | [tailwindcss-aspectratio-styles](https://dependencywatch.io/package/npm/tailwindcss-aspectratio-styles) | npm | 0.3.4, 0.3.5 | | [toru-ultimate](https://dependencywatch.io/package/npm/toru-ultimate) | npm | 1.0.0 | | [twilio-functions](https://dependencywatch.io/package/npm/twilio-functions) | npm | 99.99.99, 99.99.100 | | [unifi-credential-server](https://dependencywatch.io/package/npm/unifi-credential-server) | npm | 99.0.0 | | [vinzz-wcli](https://dependencywatch.io/package/npm/vinzz-wcli) | npm | <=1.0.1 | ## What happened Between roughly 2026-09-08 00:00 UTC and 2026-09-09 12:00 UTC, GitHub Advisory Database published ~25 new npm and PyPI malware advisories. Unlike the 2026-09-07/08 wave (which was dominated by corporate-namespace dep-confusion probes hitting Air Canada / Medisend / Coinbase / Swisscom and many others), this window is dominated by *analysed* payloads: typosquats, remote-code loaders, an OS-level persistence chain, and a coordinated three-package cluster. ## Cluster A — Coordinated `sonner` typosquat trio The most operationally interesting drop of the day is a three-package coordinated attack against the very-widely-used `sonner` React toast library: | Package | GHSA | Role | |---|---|---| | `sonmors` | GHSA-vp67-pvcp-4j8j | Typosquat of `sonner`; spoofs sonner's `package.json` identity; `require('gloggo')` at load time | | `gloggo` | GHSA-wmgg-555m-p7h6 | Typosquat of `glogg` (gulpjs); gates hidden loader on `isSign('favorite','gloggo',12467)` from `file-type-detector` | | `file-type-detector` | GHSA-cjhh-g8v5-hg5g | Typosquat of `file-type-checker`; the concealed `isSign()` function reads PNG files, extracts payloads, writes them to sibling packages under `node_modules` | All three carry the false attribution "Blockvora Team" / `team@blockvora.com`. The load-time chain is deliberately obfuscated: `sonmors` looks like a working toast library, `gloggo` looks like a working logger, and `file-type-detector` looks like a MIME-sniffing utility. Only when all three are present, and only when `gloggo` calls `isSign()`, does the malicious loader activate and extract the payload from PNG bytes. The PNG-steganography step is the reason a static `.js`-only scan will not find the payload. Yara rules that trigger on `eval()`, `Function()`, `child_process`, or a known malicious URL will miss it entirely - the URL and shell commands only exist inside decoded PNG bytes, and only after all three packages line up. ## Cluster B — WhatsApp Baileys scope hijacks Three more Baileys-namespace scope hijacks landed (`@vallensofficial/baileys`, `@versacode/baileys`, `@haimiya/baileys`), all with the standard full-compromise GHSA boilerplate ("any computer that has this package installed or running should be considered fully compromised"). This continues the pattern from `kiki-baileys` (2026-09-08 sweep) and `WhiskeySAML/baileys` earlier in the year. Baileys (the real one, `@whiskeysockets/baileys`) is the de-facto unofficial WhatsApp Web API library for Node - a fertile lookalike target. ## Cluster C — Roblox / gaming ecosystem malware **`rojo-rbx@<=1.4.3`** (GHSA-p55w-6rww-5frg) impersonates the well-known Rojo Roblox tooling project. On Windows, `scripts/install.js`: 1. Downloads a VBScript from `https://l81.me/updater.vbs` 2. Writes it to `%APPDATA%\Rojo\rojo-sync.vbs` 3. Adds `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\RojoClientSync` so the VBS re-launches on every login 4. Provides no actual Rojo functionality Unlike the OAST / webhook.site probes above, this one commits to persistence on the victim host - a genuine backdoor rather than reconnaissance. The real Rojo tool is distributed as a binary through GitHub releases, not through npm, so any npm-based "Rojo" install is fake by definition. **`open-item-validator@1.0.3/1.0.5`** (GHSA-jfq9-9hf7-gr4x) is a game-adjacent name grab (declared homepage `game.spawnrealm.com`, actual C2 `itemx.servegame.com:8888` on the No-IP dynamic DNS) that spawns a persistent background Node process, polls `/api/x-realtime`, and `new Function()`-executes the returned code. The daemon survives its parent process exit, so a single dev-machine `npm install` gives the operator ongoing RCE. ## Cluster D — Corporate-namespace dep-confusion probes Same pattern as yesterday's Cluster A/B/C but with per-target IOCs published: - **`unifi-credential-server@99.0.0`** (GHSA-9rgc-h7qj-q8w3) - Ubiquiti UniFi internal-build target; hex-encoded DNS labels to `.oast.me` - **`twilio-functions@99.99.99/99.99.100`** (GHSA-73g6-c624-22hf) - Twilio SDK impersonator; POST to `webhook.site/42ce0f0e-a0a0-41b5-b157-1c0f918e064f`, DNS fallback `2b22ede784d5.oast.fun` - **`@umschool/analytics@999.0.0-999.0.4`** (GHSA-2qmq-f9mj-rwcj) - Umschool corporate scope; GET to `akko.requestcatcher.com/dep-confusion` - **`py-devoli-common@999.999.999`** (PyPI, GHSA-g8qj-vfr2-9w5c) - Devoli target on PyPI; boilerplate-flagged, no published payload The sentinel-version (99.x, 99.99.x, 999.x, 999.999.x) pattern is the fingerprint - real internal packages don't live at these versions, but they beat any semver range in resolution when a bare name accidentally resolves against public npm. ## Cluster E — Webhook / OAST reconnaissance beacons - **`@yongot/canary-mcp-isolation@1.0.1`** and **`@yongot/canary-mcp-test@2.0.0/3.0.0/4.0.0`** - same operator; sends hostname + `id` + GCP metadata probes (`169.254.169.254`, `metadata.google.internal`) to `webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b`. The `canary-mcp-*` naming appears aimed at MCP (Model Context Protocol) / AI-agent servers, another corporate scope shape - **`alloy-graphql@1.0.1`** - preinstall reads `/etc/passwd` + `/etc/hosts`, harvests DNS servers and full `package.json`, POSTs to a Burp Collaborator subdomain (`*.oastify.com`). This is the deepest reconnaissance in the batch - **`@aspect-adv-ui/consent-manager@2.4.0/2.4.1`** - masquerades as a GDPR/CCPA consent manager; postinstall GET to `webhook.site/kapper` ## Cluster F — Remote-code-loader droppers Five packages that fetch code over the network and immediately execute it: - **`tailwind-aspect-styles@<=0.4.2`** — `http://23.27.245.100/index.js` over plain HTTP; writes `./inout.js`, `require()`s it - **`tailwindcss-aspectratio-styles@0.3.4/0.3.5`** — `tailwindlan.online` remote JS; almost certainly the same operator as the previous line, both impersonating `@tailwindcss/aspect-ratio` - **`selfcerts@1.0.0`** — hides a base64 C2 URL inside a fake `sample/cert.pem`, fetches `http://144.172.104.211/settings/privacy.php`, pipes it into detached `python3`. Cross-language execution is unusual for npm malware - **`punypump@1.2.2/1.2.4/1.2.5`** — fetches AES-256-CBC ciphertext from `jsonkeeper.com/b/V6NBX`, decrypts with hardcoded key, `eval()`s the result. Disguised as a `console-browserify` shim - **`bx-ui-view@1.0.0`** — self-referential dependency: `package.json` declares its own package name with an HTTPS URL value pointing to `https://package-access.pages.dev/bx-ui-view`. npm downloads and runs whatever the pages.dev URL currently serves at install time ## Cluster G — Credential theft / hardcoded backdoor **`toru-ultimate@1.0.0`** (GHSA-jg37-3w86-3rx2) is a Facebook credential harvester. The `loginViaAPI()` function forwards user-supplied email + password + 2FA Base32 secret to `https://minhdong.site/api/v1/facebook/login_ios`, and the package pulls its own runtime code from an *unpinned* GitHub branch (`VangBanLaNhat/fca-unofficial`) - so the branch owner can inject fresh code any time. **`vinzz-wcli@<=1.0.1`** (GHSA-xv3f-69vw-grmg) is a WhatsApp CLI framework whose plugin config hardcodes a specific WhatsApp JID (`6285185667890@s.whatsapp.net`) as an authorised owner. Any user who pairs their own phone through the CLI has given the JID owner silent access to a `cmd` plugin (`child_process.exec`) and an `eval` plugin - full RCE with the installer's privileges over WhatsApp. ## Cluster H — Destructive package **`express-session-timer@1.0.0-1.0.16`** (GHSA-xf4h-cmpp-qfvf) is unusual for the batch: no exfil, no C2, no persistence - just sabotage. Approximately 18 seconds after `require('express-session-timer')`, it recursively removes `/src` and kills Node / PM2 processes. Its declared dependency `express-timer@^0.0.1-security` pins to the npm security-hold placeholder version, another red flag. ## Cluster I — Amazon Inspector / OpenSSF boilerplate takedown **`react-hook-doms@<=5.3.1`** (GHSA-hj8f-64m3-wrpj) is amazon-inspector-flagged with only a source hash and no published analysis. Assume the full-compromise GHSA boilerplate applies until independent per-package analysis surfaces. ## Distinction from the parallel 2026-09-08 sweep Yesterday's `multi-2026-09-08-ghsa-malware-sweep` covered the sprawling corporate-namespace dep-confusion probe wave (Air Canada, Medisend, OPAP, Optimizely/Fastly, MATLAB/Azure DevOps, SimpliSafe, Tidal, PayPal, Twilio, Afterpay, Ecobee, Karapace, Glia, Jobber, Feishu, BMC, and more) with the `oast.online` + `5.189.159.252` shared-infrastructure Cluster A. Today's window is smaller and more analytical - each cluster comes with published IOCs and enough detail to identify per-cluster mitigation. Some Sept-8 corporate-namespace probes may still trickle through the GHSA pipeline today; check the parallel record for those. ## Registry state All packages listed below are flagged as malware on npm / PyPI and quarantined. Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs before quarantine will keep serving them - explicit deny-listing of every name below plus the `@vallensofficial/`, `@versacode/`, `@haimiya/`, `@yongot/`, `@aspect-adv-ui/`, and `@umschool/` scopes is the durable mitigation. ## Discovery credits `GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `amazon-inspector`. Per-package IOC details (URLs, IPs, hashes, hardcoded JIDs, webhook tokens) drawn verbatim from the GHSA advisory bodies published between 2026-09-08 and 2026-09-09. ## Impact - **Cluster A — Coordinated `sonner` React-toast typosquat trio (`sonmors` + `gloggo` + `file-type-detector`)**: three npm packages published by the same operator work together as one payload. `sonmors@<=2.11.2` (GHSA-vp67-pvcp-4j8j) is a near-copy of the widely-used `sonner` React toast library that spoofs sonner's identity in `package.json` and calls `require('gloggo')` at load time. `gloggo@1.1.2/1.1.3/1.1.4` (GHSA-wmgg-555m-p7h6) masquerades as gulpjs' `glogg` logging library and gates its hidden loader on `isSign('favorite','gloggo',12467)` from `file-type-detector`. `file-type-detector@1.1.0/1.1.1` (GHSA-cjhh-g8v5-hg5g) impersonates the legitimate `file-type-checker` and hides a payload in a PNG that it extracts and writes into sibling packages under `node_modules`. Any project that installed the sonner typosquat picked up all three; the PNG-steganography loader means static scanners that only look at `.js` will miss the payload - **Cluster B — WhatsApp Baileys scope hijacks**: `@vallensofficial/baileys`, `@versacode/baileys`, and `@haimiya/baileys` (all versions; GHSA-gg93-mm5f-23v8 / GHSA-fw7g-gr3j-7wf7 / GHSA-q246-72rh-fp8w) all carry the full-compromise GHSA boilerplate ("any computer that has this package installed or running should be considered fully compromised"). Continues the ongoing Baileys namespace-abuse pattern (`kiki-baileys` in the 2026-09-08 sweep, `WhiskeySAML/baileys` earlier). Baileys is a heavily-used unofficial WhatsApp Web API client; a bare or unscoped Baileys reference in a Node.js bot repo resolves against public npm and picks these up - **Cluster C — Roblox / gaming ecosystem malware with confirmed persistence**: `rojo-rbx@<=1.4.3` (GHSA-p55w-6rww-5frg) impersonates the legitimate Rojo Roblox development tooling. On Windows, `scripts/install.js` downloads a VBScript from `https://l81.me/updater.vbs`, writes it to `%APPDATA%\Rojo\rojo-sync.vbs`, and installs a `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\RojoClientSync` registry entry so the VBS re-launches on every login. `open-item-validator@1.0.3/1.0.5` (GHSA-jfq9-9hf7-gr4x) spawns a background Node process that repeatedly polls `http://itemx.servegame.com:8888/api/x-realtime` and `new Function()`-executes the returned code, giving the operator arbitrary code execution on the host - **Cluster D — Corporate-namespace dep-confusion probes at sentinel versions**: `unifi-credential-server@99.0.0` (GHSA-9rgc-h7qj-q8w3) targets Ubiquiti UniFi internal build systems - preinstall harvests hostname / username / cwd / internal IPv4s / CI environment variables and exfils via DNS queries to `.oast.me`. `twilio-functions@99.99.99/99.99.100` (GHSA-73g6-c624-22hf) impersonates the Twilio SDK - postinstall POSTs system info to `webhook.site/42ce0f0e-a0a0-41b5-b157-1c0f918e064f` with DNS fallback to `2b22ede784d5.oast.fun`. `@umschool/analytics@999.0.0-999.0.4` (GHSA-2qmq-f9mj-rwcj) targets the Umschool scope - postinstall GET to `akko.requestcatcher.com/dep-confusion`. PyPI `py-devoli-common@999.999.999` (GHSA-g8qj-vfr2-9w5c) is the same shape on PyPI, boilerplate-flagged - **Cluster E — Webhook / OAST reconnaissance beacons**: `@yongot/canary-mcp-isolation@1.0.1` (GHSA-7gq6-vvhp-97f4) and `@yongot/canary-mcp-test@2.0.0/3.0.0/4.0.0` (GHSA-469r-xxvx-62x3) send installer hostname + `id` output + GCP metadata (`169.254.169.254`, `metadata.google.internal`) probe results to `https://webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b` - same operator across both. `alloy-graphql@1.0.1` (GHSA-5xmm-9965-mvqw) reads `/etc/passwd` and `/etc/hosts`, harvests DNS servers and package.json, POSTs to `ipbtwv9063nc5hvhodh0s4u9x03rrhf6.oastify.com` (Burp Collaborator). `@aspect-adv-ui/consent-manager@2.4.0/2.4.1` (GHSA-2m5c-v74g-r4m8) postinstall GET to `webhook.site/kapper` - **Cluster F — Remote-code-loader droppers**: `tailwind-aspect-styles@<=0.4.2` (GHSA-r28r-839h-4gqw) fetches `http://23.27.245.100/index.js` over plain HTTP, writes it to `./inout.js`, and immediately `require()`s it. `tailwindcss-aspectratio-styles@0.3.4/0.3.5` (GHSA-4gjp-7xcv-m2gc) does the same shape via `tailwindlan.online` - clearly a related pair impersonating the Tailwind CSS aspect-ratio plugin. `selfcerts@1.0.0` (GHSA-2cj2-qj4h-42hp) hides a base64-encoded C2 URL in a fake TLS cert, fetches `http://144.172.104.211/settings/privacy.php`, and pipes the response to a detached `python3` process. `punypump@1.2.2/1.2.4/1.2.5` (GHSA-45jc-2qr4-pmgf) fetches an AES-256-CBC-encrypted payload from `jsonkeeper.com/b/V6NBX` and `eval()`s the plaintext. `bx-ui-view@1.0.0` (GHSA-hqg3-m33m-mvcr) declares a self-referential dependency pointing at `https://package-access.pages.dev/bx-ui-view` so npm downloads and runs whatever the pages.dev URL currently serves - **Cluster G — Credential theft / hardcoded backdoor**: `toru-ultimate@1.0.0` (GHSA-jg37-3w86-3rx2) is a Facebook credential harvester - the `loginViaAPI()` function forwards email + password + 2FA Base32 secret to `https://minhdong.site/api/v1/facebook/login_ios`, and the package pulls an unpinned GitHub branch (`VangBanLaNhat/fca-unofficial`) so the branch controller can inject fresh code at any time. `vinzz-wcli@<=1.0.1` (GHSA-xv3f-69vw-grmg) is a WhatsApp CLI tool with a hardcoded JID (`6285185667890@s.whatsapp.net`) that has always-on `cmd`- and `eval`-plugin authority - any user who pairs their phone gives the JID owner silent RCE with the installer's privileges - **Cluster H — Destructive package**: `express-session-timer@1.0.0-1.0.16` (GHSA-xf4h-cmpp-qfvf) recursively removes `/src` roughly 18 seconds after `require()`, then kills Node / PM2 processes on Unix and Windows. Not exfil - straight sabotage. Its declared dependency `express-timer@^0.0.1-security` pins to npm's security-hold placeholder, another red flag - **Cluster I — Amazon Inspector / OpenSSF boilerplate takedown (no published analysis)**: `react-hook-doms@<=5.3.1` (GHSA-hj8f-64m3-wrpj) is flagged by amazon-inspector with only a source hash; assume the same GHSA full-compromise boilerplate applies pending independent analysis ## What to do 1. Grep every `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `package.json`, `requirements.txt`, and `poetry.lock` in your org for the names below. Uninstall on hit, wipe `node_modules`, delete the lockfile, and rebuild against a clean cache 2. **For Cluster A (`sonmors` / `gloggo` / `file-type-detector`)**: anyone who typosquat-installed `sonmors` instead of `sonner` picked up all three packages. The PNG-steganography payload is not visible in a `.js`-only static scan - grep for the exact package names, not for the payload. Any hit means the host executed hidden code from a PNG bundled by `file-type-detector`; treat as fully compromised, rotate every credential the host had access to, and reimage 3. **For Cluster B Baileys hijacks**: audit every WhatsApp/Baileys-based Node bot repo for scoped `@vallensofficial/baileys`, `@versacode/baileys`, `@haimiya/baileys` (and the previous `kiki-baileys`). Pin the real upstream `@whiskeysockets/baileys` explicitly in `package.json` and enforce it in CI. GHSA marks all versions of these packages as malicious - assume any host that resolved one is fully compromised 4. **For Cluster C `rojo-rbx` Windows persistence**: on any Windows dev machine that installed `rojo-rbx`, immediately delete `%APPDATA%\Rojo\rojo-sync.vbs`, remove the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\RojoClientSync` registry value, and block `l81.me` at the egress proxy. Real Rojo distribution is via `github.com/rojo-rbx/rojo` releases, not npm - never install a Roblox-tooling package that claims to be Rojo via npm 5. **For Cluster D dep-confusion probes**: Ubiquiti / UniFi build systems - audit internal npm mirror logs for `unifi-credential-server` resolution attempts. Twilio SDK consumers - explicitly pin `twilio` (the real SDK), never resolve `twilio-functions` from public npm. Any org whose internal scope contains `@umschool/` - enforce a scoped `registry=` line in `.npmrc` and treat the presence of `@umschool/analytics@999.x` in any mirror as evidence of active enumeration. Block `oast.me`, `oast.fun`, `oastify.com` (Interactsh / Burp Collaborator hosts), `webhook.site`, and `akko.requestcatcher.com` at the corporate egress proxy - all four are legitimate OAST services being repeatedly weaponised by dep-confusion probe operators and have no legitimate use in production egress 6. **For Cluster E OAST beacons**: audit DNS logs for queries to `*.oast.me`, `*.oast.fun`, `*.oastify.com`, `webhook.site`, and `*.requestcatcher.com` between 2026-09-08 and now. Any host with matching DNS or egress records against a package named below is confirmed compromised on install. `alloy-graphql` in particular exfiltrates the contents of `/etc/passwd` and `/etc/hosts` - that leak is not undoable 7. **For Cluster F remote-code loaders**: block `23.27.245.100`, `144.172.104.211`, `tailwindlan.online`, `jsonkeeper.com`, `l81.me`, `minhdong.site`, `itemx.servegame.com`, and `package-access.pages.dev` at the corporate egress proxy. Any host that fetched from one of these while any package below was in the lockfile is fully compromised - reimage after credential rotation 8. **For Cluster G credential-theft**: any host that ran `toru-ultimate` may have leaked user-provided Facebook credentials + 2FA seeds to `minhdong.site`; notify affected users and rotate seeds. Any WhatsApp-bot host that installed `vinzz-wcli` has granted RCE to JID `6285185667890@s.whatsapp.net` - assume every command that JID could have run has run 9. **For Cluster H destructive**: any repo that had `express-session-timer` in its lockfile and imported it lost its `src/` tree 18 seconds later. Restore from git; do not attempt to recover from `node_modules` 10. For every `npm install` in CI, prefer `--ignore-scripts` to block postinstall / preinstall payloads. This is the single highest-value mitigation against Clusters D, E, and F 11. Add every name below to internal private-registry (Verdaccio / Artifactory / Nexus) deny-lists for at least 30 days to prevent re-uploads by rotating operators ## Check your own dependencies - Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json - Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt The scan runs entirely in the browser; lockfile contents are never uploaded. ## References - [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub - [GHSA-vp67-pvcp-4j8j - sonmors (Cluster A - sonner typosquat)](https://github.com/advisories/GHSA-vp67-pvcp-4j8j) - GitHub - [GHSA-wmgg-555m-p7h6 - gloggo (Cluster A - glogg typosquat, isSign() gate)](https://github.com/advisories/GHSA-wmgg-555m-p7h6) - GitHub - [GHSA-cjhh-g8v5-hg5g - file-type-detector (Cluster A - PNG steganography loader)](https://github.com/advisories/GHSA-cjhh-g8v5-hg5g) - GitHub - [GHSA-gg93-mm5f-23v8 - @vallensofficial/baileys (Cluster B)](https://github.com/advisories/GHSA-gg93-mm5f-23v8) - GitHub - [GHSA-fw7g-gr3j-7wf7 - @versacode/baileys (Cluster B)](https://github.com/advisories/GHSA-fw7g-gr3j-7wf7) - GitHub - [GHSA-q246-72rh-fp8w - @haimiya/baileys (Cluster B)](https://github.com/advisories/GHSA-q246-72rh-fp8w) - GitHub - [GHSA-p55w-6rww-5frg - rojo-rbx (Cluster C - Rojo Roblox typosquat, Windows Run-key persistence)](https://github.com/advisories/GHSA-p55w-6rww-5frg) - GitHub - [GHSA-jfq9-9hf7-gr4x - open-item-validator (Cluster C - servegame.com C2 loader)](https://github.com/advisories/GHSA-jfq9-9hf7-gr4x) - GitHub - [GHSA-9rgc-h7qj-q8w3 - unifi-credential-server (Cluster D - UniFi dep-confusion, oast.me)](https://github.com/advisories/GHSA-9rgc-h7qj-q8w3) - GitHub - [GHSA-73g6-c624-22hf - twilio-functions (Cluster D - Twilio SDK impersonator)](https://github.com/advisories/GHSA-73g6-c624-22hf) - GitHub - [GHSA-2qmq-f9mj-rwcj - @umschool/analytics (Cluster D - dep-confusion 999.x)](https://github.com/advisories/GHSA-2qmq-f9mj-rwcj) - GitHub - [GHSA-g8qj-vfr2-9w5c - py-devoli-common (Cluster D - PyPI dep-confusion 999.999.999)](https://github.com/advisories/GHSA-g8qj-vfr2-9w5c) - GitHub - [GHSA-7gq6-vvhp-97f4 - @yongot/canary-mcp-isolation (Cluster E)](https://github.com/advisories/GHSA-7gq6-vvhp-97f4) - GitHub - [GHSA-469r-xxvx-62x3 - @yongot/canary-mcp-test (Cluster E)](https://github.com/advisories/GHSA-469r-xxvx-62x3) - GitHub - [GHSA-5xmm-9965-mvqw - alloy-graphql (Cluster E - oastify.com, reads /etc/passwd)](https://github.com/advisories/GHSA-5xmm-9965-mvqw) - GitHub - [GHSA-2m5c-v74g-r4m8 - @aspect-adv-ui/consent-manager (Cluster E)](https://github.com/advisories/GHSA-2m5c-v74g-r4m8) - GitHub - [GHSA-r28r-839h-4gqw - tailwind-aspect-styles (Cluster F - 23.27.245.100 remote loader)](https://github.com/advisories/GHSA-r28r-839h-4gqw) - GitHub - [GHSA-4gjp-7xcv-m2gc - tailwindcss-aspectratio-styles (Cluster F - tailwindlan.online remote loader)](https://github.com/advisories/GHSA-4gjp-7xcv-m2gc) - GitHub - [GHSA-2cj2-qj4h-42hp - selfcerts (Cluster F - 144.172.104.211 Python payload)](https://github.com/advisories/GHSA-2cj2-qj4h-42hp) - GitHub - [GHSA-45jc-2qr4-pmgf - punypump (Cluster F - jsonkeeper.com AES-256 loader)](https://github.com/advisories/GHSA-45jc-2qr4-pmgf) - GitHub - [GHSA-hqg3-m33m-mvcr - bx-ui-view (Cluster F - pages.dev self-ref)](https://github.com/advisories/GHSA-hqg3-m33m-mvcr) - GitHub - [GHSA-jg37-3w86-3rx2 - toru-ultimate (Cluster G - Facebook credential harvester)](https://github.com/advisories/GHSA-jg37-3w86-3rx2) - GitHub - [GHSA-xv3f-69vw-grmg - vinzz-wcli (Cluster G - hardcoded WhatsApp JID backdoor)](https://github.com/advisories/GHSA-xv3f-69vw-grmg) - GitHub - [GHSA-xf4h-cmpp-qfvf - express-session-timer (Cluster H - destructive rm src)](https://github.com/advisories/GHSA-xf4h-cmpp-qfvf) - GitHub - [GHSA-hj8f-64m3-wrpj - react-hook-doms (Cluster I - Amazon Inspector boilerplate)](https://github.com/advisories/GHSA-hj8f-64m3-wrpj) - GitHub - [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF --- Canonical page: https://dependencywatch.io/incident/multi-2026-09-09-ghsa-malware-sweep Markdown version: https://dependencywatch.io/incident/multi-2026-09-09-ghsa-malware-sweep.md Site index for agents: https://dependencywatch.io/llms.txt DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).