DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 10 September 2026

HighAdvisory sweepnpmPyPI

Between 2026-09-09 and 2026-09-10 UTC GHSA published ~26 new npm/PyPI malware advisories: a third Baileys WhatsApp scope-hijack wave, a @umschool/platform follow-up that adds a live Kubernetes-secrets + cloud-metadata harvester, a shared "Master Harvester" template hitting Solana wallets via gmgn-trading-kit and soltinel-pro, a coordinated Discord MFA lure trio, plus BigQuery/Databricks PyPI probes and boilerplate takedowns.

Published 10 Sept 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-09-10-ghsa-malware-sweep
28
Packages tracked38 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
10 Sept 2026
Ecosystems
npmPyPI
Detected by
GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector
Also known as
2026-09-10 GHSA npm/PyPI sweep, Baileys scope hijack wave 3 2026-09-10, @umschool/platform Kubernetes secrets harvester

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

Between roughly 2026-09-09 12:00 UTC and 2026-09-10 12:00 UTC, GitHub Advisory Database published ~26 new npm and PyPI malware advisories. Unlike yesterday's window (which was headlined by the coordinated sonner typosquat trio and the rojo-rbx Windows Run-key persistence chain), today's drop is dominated by follow-through on ongoing sub-waves and by shared harvester templates being ported into new lures.

Cluster A — Baileys WhatsApp scope hijacks wave 3

Three more Baileys-namespace scope hijacks, each with a different tradecraft variant:

PackageGHSATradecraft
@sahril2nd/baileys@1.0.21GHSA-j2h4-4g8c-mqh9Hardcoded C2 (fiora.nixel.my.id) hidden as String.fromCharCode(...) decimal-ASCII array in messages-send.js
@nexustechpro/baileys@2.2.7GHSA-pv55-pgr3-jjrj~270 KB obfuscator.io payload in chats.js (authState / Signal identity keys code path) + "whatsapp-rust-bridge": "latest" unpinned
@neroxkira/vangal-baileys@1.0.0/1.0.1GHSA-8g69-mcxv-f88gUnpinned github:RILLYZY/libsignal-node dependency (attacker account unrelated to signalapp)

Combined with @vallensofficial/baileys, @versacode/baileys, @haimiya/baileys (2026-09-09), kiki-baileys (2026-09-08), and the earlier WhiskeySAML/baileys, the Baileys namespace has now been hit at least seven times in three days. The real upstream is @whiskeysockets/baileys; every other Baileys-labelled package on npm should currently be treated as suspicious.

Cluster C — @umschool/platform (Kubernetes-secrets harvester)

The @umschool scope was flagged yesterday for @umschool/analytics@999.0.0-999.0.4, which only carried the GHSA full-compromise boilerplate. Today's @umschool/platform@999.0.0/999.0.1/999.0.2 (GHSA-vj55-82hp-jrcm) publishes the full payload analysis and it is materially more advanced than yesterday's beacon-only Cluster D probes:

  1. Reads Kubernetes service-account tokens from /var/run/secrets/kubernetes.io/serviceaccount/
  2. Queries AWS IMDS (169.254.169.254), ECS credentials endpoint (169.254.170.2), Azure IMDS, and Yandex/GCP metadata services
  3. Calls the in-cluster Kubernetes API at https://kubernetes.default.svc/api/v1/secrets with the harvested service-account credentials to enumerate every Secret the pod can read
  4. Scans up to 8 parent directories for .env files and filters process.env for token|secret|key|pass|cred|auth|aws|jwt|api|stripe|sendgrid|twilio
  5. POSTs everything base64-encoded to https://akko.requestcatcher.com/dep-confusion-v2

Any Kubernetes cluster where a build container resolved @umschool/platform from public npm has almost certainly leaked its Secret objects. The dep-confusion-v2 collector path suggests the operator is running this as a second-generation campaign iteration and not merely a pentest artefact.

Cluster D — Shared "Master Harvester" template

gmgn-trading-kit@1.7.x (GMGN Solana trading toolkit lure) and soltinel-pro@0.2.x (Solana trading bot lure) both ship a postinstall.cjs with a self-identifying header comment:

"Master Harvester — injectable into any npm package via postinstall"

Collection routine is identical between them: SSH keys (id_rsa, id_ed25519, *_rsa, *_ed25519), .netrc, .git-credentials, Solana CLI keypairs (default paths), ~/.config wallet/env/credentials files, .blockrun wallet directories, and every .env up the tree filtered for KEY|SECRET|PRIVATE|TOKEN. Exfil goes over HTTPS POST to a hardcoded webhook.site collector (rotating per package).

The template is deliberately reusable - expect more packages this week using the exact same routine and a rotating webhook.site collector. This is a signature to hunt for in future daily sweeps.

Cluster E — Coordinated Discord MFA lure trio

mfatest2@1.0.0 and discord-mfa-solver@1.0.0-1.0.2 are the same operator: both declare "node-net-pool": "github:trktgq0wbre1/node-net-pool" (an attacker-controlled GitHub account) and both load it via the identical module['require']('node-net-pool') obfuscated dynamic-require inside a swallowed try/catch in lib/cache.js. Once loaded, the transitive dep downloads a remote "runtime patch asset" and detaches it via child_process.execFile - the shipped tarball contains only a loader stub, so a .js-only scan of the top-level package will miss the payload.

mfaby@1.0.0 is a separate but adjacent operator - base64-hidden URL https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKl3RalN_TVUZYGPsJy2Y, download to os.tmpdir(), execute with new Worker(tmp), and explicit rejectUnauthorized:false on Discord traffic so TLS pinning cannot detect the credential leak.

All three claim to be Discord MFA helpers; the theme is credential/session harvesting from Discord token stores.

Cluster F — Corporate-namespace / pentest dep-confusion probes

Today's dep-confusion probe cluster is smaller than yesterday's (Cluster D of multi-2026-09-09-ghsa-malware-sweep) but has one item worth calling out:

twilio-hackerone-poc-b8f21a@1.0.0/1.0.1 (GHSA-wpq4-r5p3-386q) is an explicit HackerOne bug-bounty POC (the name embeds a HackerOne report ID b8f21a). It enumerates AC[0-9a-f]{32} Twilio account directories to identify co-tenants on shared build infrastructure, and reports via a Cloudflare Quick Tunnel (encryption-watch-tubes-finger.trycloudflare.com) - ephemeral, anonymous, and hard to block-list. Even if the underlying report is closed, the package remains publicly installable until the registry removes it.

On PyPI, bq-sdist-probe-vrp@0.0.1 and bq-build-probe-vrp-2026@0.2.0 are coordinated BigQuery-build probes (bq- prefix, -probe-vrp suffix consistent with a single "Vulnerability Reporting Program" naming convention) whose setup.py queries GCE metadata for OAuth tokens and service-account emails. databricks-webapp-navigation-homepage@999.0.0 is fingerprinted as the "GENERIC-standard-pypi-install-pentest" campaign.

Cluster G — Miscellaneous obfuscated payloads

matrixkit-js is interesting because the AES-256-GCM decryption uses scryptSync with runtime-supplied passwords - meaning static analysis cannot recover the plaintext even if the ciphertext files are extracted. The obfuscation resists both source-scanner and dynamic yara-in-node approaches.

@staticj/cropperxmjs is the only package in this batch that targets end users rather than developers: any userscript that bundles it inherits the Tampermonkey/Greasemonkey privileges of the running browser, and exfils the userscript's updateURL so the operator can pivot to targeted supply-chain follow-up (poisoning the userscript's own auto-update channel).

Cluster H — Boilerplate takedowns

Eight npm packages flagged with the full-compromise GHSA boilerplate and no published payload analysis or source code. Include them in scans and deny-lists but note that any specific IOC discussion requires independent per-package analysis - the GHSA entry alone is not sufficient. Package names to watch: chai-as-testkit, sams-text-style, sams-run-style, graphql-js-client-transform, react-remove-properties, crypto-validates, polygon-toolkits-validator, raydium-clmm-sdk.

Distinction from parallel same-day PR (2026-09-09 sweep)

Yesterday's multi-2026-09-09-ghsa-malware-sweep covered the coordinated sonner React-toast typosquat trio, three earlier Baileys scope hijacks, rojo-rbx Windows Run-key persistence, dep-confusion probes at unifi-credential-server/twilio-functions/@umschool/analytics, several OAST beacons (@yongot/canary-mcp-*, alloy-graphql, @aspect-adv-ui/consent-manager), remote-code-loader droppers (tailwind-aspect-styles, tailwindcss-aspectratio-styles, selfcerts, punypump, bx-ui-view), the toru-ultimate Facebook credential harvester, vinzz-wcli hardcoded-JID backdoor, and the destructive express-session-timer. Today's window continues the Baileys and @umschool scope-abuse threads and adds new payload templates (Master Harvester, node-net-pool loader).

Registry state

All packages listed below are flagged as malware on npm / PyPI and quarantined. Private mirrors that cached tarballs before quarantine will keep serving them - explicit deny-listing of every name below plus the @auction-fe/, @convertics/, @nexustechpro/, @sahril2nd/, @neroxkira/, @umschool/, and @staticj/ scopes is the durable mitigation.

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector. Per-package IOC details (URLs, IPs, hashes, hardcoded webhook tokens, hardcoded JIDs) drawn verbatim from GHSA advisory bodies published between 2026-09-09 and 2026-09-10.

typosquatdependency-confusioncredential-theftcrypto-wallet-drainobfuscationci-cd-compromiseinfostealer
Affected packages

28 packages 38 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • Cluster A — Baileys WhatsApp scope hijacks wave 3 (three more packages): @sahril2nd/baileys@1.0.21 (GHSA-j2h4-4g8c-mqh9) hides a hardcoded C2 URL inside lib/Socket/messages-send.js as a String.fromCharCode(...) decimal-ASCII array that reconstructs to https://fiora.nixel.my.id/ at lines 425/436 of message-send. @nexustechpro/baileys@2.2.7 (GHSA-pv55-pgr3-jjrj) ships a ~270 KB obfuscator.io-obfuscated lib/Socket/chats.js (~2,772-entry string array, hex-escaped imports, integer-arithmetic control flow) sitting exactly in the authState / Signal-identity-keys / noise-keys code path, and declares "whatsapp-rust-bridge": "latest" unpinned so the dependency publisher can ship arbitrary install-time code. @neroxkira/vangal-baileys@1.0.0/1.0.1 (GHSA-8g69-mcxv-f88g) declares libsignal as an unpinned GitHub dep github:RILLYZY/libsignal-node unrelated to the real signalapp upstream. Continues the pattern from @vallensofficial/@versacode/@haimiya/baileys (2026-09-09 sweep) and kiki-baileys (2026-09-08 sweep) - Baileys namespace abuse is now the highest-volume single lookalike target on npm this month
  • *Cluster B — `@auction-fe/ corporate-namespace boilerplate cluster**: four coordinated npm packages published under the same @auction-fe scope on 2026-09-09 with the standard GHSA full-compromise boilerplate ("any computer that has this package installed or running should be considered fully compromised") and no published payload analysis: @auction-fe/portal (GHSA-qmw2-mp2f-cgg3), @auction-fe/base (GHSA-w6hj-c25h-wgh7), @auction-fe/ui-kit (GHSA-2r37-886p-hj65), @auction-fe/reporting-system` (GHSA-4x79-pcqv-r9rf), all versions. Shape matches an internal-frontend dep-confusion probe against an "auction-fe" corporate scope, but with no IOC published we treat it as boilerplate flagging
  • Cluster C — @umschool/platform follow-up (live Kubernetes + cloud-metadata harvester): @umschool/platform@999.0.0/999.0.1/999.0.2 (GHSA-vj55-82hp-jrcm) is the SAME @umschool scope that yesterday's sweep flagged via @umschool/analytics@999.x, but the payload is materially more advanced: postinstall.js reads Kubernetes service-account tokens from /var/run/secrets/kubernetes.io/serviceaccount/, queries AWS IMDS (169.254.169.254), the ECS credentials endpoint (169.254.170.2), Azure IMDS, and Yandex/GCP metadata services, then calls https://kubernetes.default.svc/api/v1/secrets using the harvested service-account credentials, scans up to 8 parent directories for .env files, and POSTs everything base64-encoded to https://akko.requestcatcher.com/dep-confusion-v2 (same requestcatcher subdomain as yesterday). This is a functioning K8s-cluster-secrets exfiltration chain, not a beacon
  • Cluster D — Shared "Master Harvester" Solana wallet drainers: gmgn-trading-kit@1.7.0/1.7.1/1.7.2 (GHSA-g6w4-rgw8-65r7) impersonates the GMGN Solana trading toolkit and runs a postinstall.cjs that scans $HOME for SSH private keys (id_rsa, id_ed25519, *_rsa, *_ed25519), .netrc, .git-credentials, Solana keypairs, .blockrun wallet files, walks upward from install-dir reading every .env for KEY|SECRET|PRIVATE|TOKEN, POSTs everything to https://webhook.site/d7ab73fe-7cbc-4ed3-bf8e-7207eb06875b. soltinel-pro@0.2.0/0.2.1/0.2.2 (GHSA-69g5-q5j6-cxx4) is a Solana trading-bot lure with the SAME self-identifying header comment ("Master Harvester — injectable into any npm package via postinstall") - a reusable harvester template being ported into new lures, so expect more packages this week using the exact same collection routine and a rotating webhook.site collector
  • Cluster E — Coordinated Discord MFA lure trio: three npm packages published 2026-09-09 that all disguise a hidden dependency loader as a Discord multi-factor-auth helper. mfatest2@1.0.0 (GHSA-2cf3-8wq3-f2xq) declares "node-net-pool": "github:trktgq0wbre1/node-net-pool" (an attacker-controlled GitHub account unrelated to any legitimate node-net-pool) and loads it via the obfuscated module['require']('node-net-pool') inside a swallowed try/catch in lib/cache.js, then downloads a remote "runtime patch asset" and detaches it via child_process.execFile. discord-mfa-solver@1.0.0/1.0.1/1.0.2 (GHSA-f5p4-vw6q-5w28) is the same operator - identical module['require']('node-net-pool') loader stub in lib/cache.js, plus explicit Discord-abuse tooling exercising /api/v9/guilds/0/vanity-url and /api/v9/mfa/finish. mfaby@1.0.0 (GHSA-x3f6-cx35-q6mw) is a separate strain: a base64-hidden URL https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKl3RalN_TVUZYGPsJy2Y, downloads a payload to os.tmpdir(), and detonates it with new Worker(tmp) - also disables TLS verification (rejectUnauthorized:false) on Discord traffic
  • Cluster F — Corporate-namespace / pentest dep-confusion probes: twilio-hackerone-poc-b8f21a@1.0.0/1.0.1 (GHSA-wpq4-r5p3-386q) is an EXPLICIT HackerOne bug-bounty POC - the name embeds the report identifier, and the postinstall enumerates AC[0-9a-f]{32} Twilio account directories to identify co-tenants on shared build infrastructure, then POSTs recon (env vars, id, whoami, /proc/self/cgroup, AWS IMDS, ECS agent probes) via a Cloudflare Quick Tunnel at https://encryption-watch-tubes-finger.trycloudflare.com/poc-v101-escape. On PyPI: bq-sdist-probe-vrp@0.0.1 (GHSA-xhgv-6q3g-2824) and bq-build-probe-vrp-2026@0.2.0 (GHSA-f69f-h5mx-9x8p) are coordinated BigQuery-build probes whose setup.py queries GCP metadata (http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token), filters env for token|secret|key|pass|auth|google|project|docker|kube|metadata, and persists findings as JSON inside the package directory. databricks-webapp-navigation-homepage@999.0.0 (GHSA-5c43-fq29-3rx9) is a Databricks-internal dep-confusion pentest fingerprinted as the "GENERIC-standard-pypi-install-pentest" campaign. @convertics/script (GHSA-c74p-4c5p-6v9r) all versions is boilerplate-flagged on the @convertics corporate scope
  • Cluster G — Miscellaneous obfuscated payloads and typosquats: matrixkit-js@1.0.0 (GHSA-j34m-r83h-m38q) markets itself as a dense-matrix math library; its matrix.js loads a 112-entry rotated-array string decoder in src/init.js that decrypts AES-256-GCM ciphertext (src/statMatrix.min.d.js ~1.15 MB base64→~862 KB high-entropy) with scryptSync/createDecipheriv, writes it to a temp file and runs it - post-build injection unrelated to the source-map contents. @staticj/cropperxmjs@1.6.0 (GHSA-8vj5-qr9w-p6p2) impersonates Cropper.js and reconstructs https://u.myquickcash.shop/api/spt/upgrade from interleaved string fragments, then abuses Tampermonkey/Greasemonkey privileges (GM_xmlhttpRequest, GM_info.script) to eval() operator-supplied JavaScript with 15-req/day rate-limit tracking (GM_setValue 'sp_req_daily') - any userscript that bundles this file exposes end users to RCE
  • Cluster H — CWE-506 boilerplate takedowns, no published analysis (eight packages): chai-as-testkit (GHSA-wg38-qj68-8g87), sams-text-style (GHSA-xqx8-w483-rq8x), sams-run-style (GHSA-2r8h-5pr4-fr3v), graphql-js-client-transform (GHSA-xm59-fwxf-vq6g), react-remove-properties (GHSA-m8m4-9m7c-742j), crypto-validates (GHSA-v5v6-h869-g34f), polygon-toolkits-validator (GHSA-cmwm-j5px-xrpf), raydium-clmm-sdk (GHSA-cq4p-x9wg-m5wv) - all >=0, all flagged with the full-compromise GHSA boilerplate and no source code or IOC published. Assume malicious pending independent analysis; crypto-validates, polygon-toolkits-validator, and raydium-clmm-sdk name-shape suggests targeted Solana/Polygon/crypto lures
What to do

Clean-up steps

  1. Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, package.json, requirements.txt, and poetry.lock in your org for the names below. Uninstall on hit, wipe node_modules, delete the lockfile, and rebuild against a clean cache
  2. For Cluster A Baileys wave 3: audit every WhatsApp/Baileys-based Node bot repo for @sahril2nd/baileys, @nexustechpro/baileys, @neroxkira/vangal-baileys (and the previous 4 from the 2026-09-08/09 sweeps). Pin the real upstream @whiskeysockets/baileys explicitly in package.json and enforce it in CI. Block fiora.nixel.my.id at the egress proxy. Assume any host that resolved one of these scope hijacks is fully compromised, especially given the deep authState / signed-pre-key / noise-key placement in @nexustechpro/baileys
  3. For Cluster C @umschool/platform K8s harvester: assume every Kubernetes cluster where a build ran that resolved @umschool/platform@999.x from public npm has leaked its service-account tokens and, via them, the contents of the cluster's Secret objects. Rotate every K8s Secret, revoke every ServiceAccount token, rotate every cloud-instance role that IMDS returned (AWS/Azure/GCP/Yandex), and add @umschool/ scope to internal-mirror deny-lists. Block akko.requestcatcher.com at corporate egress
  4. For Cluster D "Master Harvester" wallet drainers: any host that ran gmgn-trading-kit or soltinel-pro has leaked SSH private keys, Solana keypairs, .netrc, .git-credentials, .blockrun wallet files, and every .env up the tree matching KEY|SECRET|PRIVATE|TOKEN. Rotate SSH keys and Git credentials, move any Solana funds to a fresh keypair generated on a clean host, block webhook.site at corporate egress. The "Master Harvester" template comment strongly implies more packages this week using an identical routine - watch the daily sweep for new Solana / crypto-trading lures
  5. For Cluster E Discord MFA lures: block github.com/trktgq0wbre1 (the disposable GitHub account for the node-net-pool loader stub) and limbomail.com at the egress proxy. Any project or Electron app that bundled these packages should treat Discord user tokens as leaked - rotate them and force-invalidate active Discord sessions. The rejectUnauthorized:false in mfaby means TLS pinning cannot detect the leak in transit
  6. For Cluster F pentest / dep-confusion probes: the twilio-hackerone-poc-b8f21a name embeds a HackerOne report ID (b8f21a) - Twilio's response is expected via that report. Twilio SDK consumers should explicitly pin twilio in package.json. Databricks customers: audit any pip installs of databricks-webapp-* against an internal mirror. Google Cloud CI users: block outbound requests to metadata.google.internal from build containers that shouldn't need them, and add webhook.site, *.trycloudflare.com (attacker Quick Tunnels), oastify.com, oast.me, and requestcatcher.com to egress deny-lists
  7. For Cluster G matrixkit-js and @staticj/cropperxmjs: any host that imported matrixkit-js executed AES-decrypted operator code with runtime-supplied keys - treat as fully compromised. Any Tampermonkey/Greasemonkey userscript bundling @staticj/cropperxmjs exposes the end user (not just the developer) to eval-based RCE via u.myquickcash.shop - notify users of any distributed script that pulled a Cropper library from npm and block myquickcash.shop
  8. For every npm install and pip install in CI, prefer --ignore-scripts / --no-build-isolation where feasible to block postinstall/preinstall/setup.py payloads. This blocks Clusters C, D, E, F entirely for lockfile-consumer paths
  9. Add every name below to internal private-registry (Verdaccio / Artifactory / Nexus) deny-lists for at least 30 days to prevent re-uploads by rotating operators. Also block scopes @auction-fe/, @convertics/, @nexustechpro/, @sahril2nd/, @neroxkira/, @umschool/, @staticj/
References

Sources

multi-2026-09-10-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents