# GitHub Advisory malware sweep - 2026-09-09/10 (Baileys wave 3, `@umschool/platform` K8s harvester, "Master Harvester" Solana wallet drainers, Discord MFA lures)

> Between 2026-09-09 and 2026-09-10 UTC GHSA published ~26 new npm/PyPI malware advisories: a third Baileys WhatsApp scope-hijack wave, a `@umschool/platform` follow-up that adds a live Kubernetes-secrets + cloud-metadata harvester, a shared "Master Harvester" template hitting Solana wallets via `gmgn-trading-kit` and `soltinel-pro`, a coordinated Discord MFA lure trio, plus BigQuery/Databricks PyPI probes and boilerplate takedowns.

- Published: 2026-09-10
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 28 packages, 38 compromised versions
- Tags: typosquat, dependency-confusion, credential-theft, crypto-wallet-drain, obfuscation, ci-cd-compromise, infostealer
- Also known as: 2026-09-10 GHSA npm/PyPI sweep, Baileys scope hijack wave 3 2026-09-10, @umschool/platform Kubernetes secrets harvester, Master Harvester Solana wallet drainer template, Discord MFA lure trio (mfatest2 / mfaby / discord-mfa-solver)
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector
- Incident ID: multi-2026-09-10-ghsa-malware-sweep

## Affected packages (28)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@auction-fe/base](https://dependencywatch.io/package/npm/@auction-fe/base) | npm | * |
| [@auction-fe/portal](https://dependencywatch.io/package/npm/@auction-fe/portal) | npm | * |
| [@auction-fe/reporting-system](https://dependencywatch.io/package/npm/@auction-fe/reporting-system) | npm | * |
| [@auction-fe/ui-kit](https://dependencywatch.io/package/npm/@auction-fe/ui-kit) | npm | * |
| [@convertics/script](https://dependencywatch.io/package/npm/@convertics/script) | npm | * |
| [@neroxkira/vangal-baileys](https://dependencywatch.io/package/npm/@neroxkira/vangal-baileys) | npm | 1.0.0, 1.0.1 |
| [@nexustechpro/baileys](https://dependencywatch.io/package/npm/@nexustechpro/baileys) | npm | 2.2.7 |
| [@sahril2nd/baileys](https://dependencywatch.io/package/npm/@sahril2nd/baileys) | npm | 1.0.21 |
| [@staticj/cropperxmjs](https://dependencywatch.io/package/npm/@staticj/cropperxmjs) | npm | 1.6.0 |
| [@umschool/platform](https://dependencywatch.io/package/npm/@umschool/platform) | npm | 999.0.0, 999.0.1, 999.0.2 |
| [bq-build-probe-vrp-2026](https://dependencywatch.io/package/pypi/bq-build-probe-vrp-2026) | PyPI | 0.2.0 |
| [bq-sdist-probe-vrp](https://dependencywatch.io/package/pypi/bq-sdist-probe-vrp) | PyPI | 0.0.1 |
| [chai-as-testkit](https://dependencywatch.io/package/npm/chai-as-testkit) | npm | * |
| [crypto-validates](https://dependencywatch.io/package/npm/crypto-validates) | npm | * |
| [databricks-webapp-navigation-homepage](https://dependencywatch.io/package/pypi/databricks-webapp-navigation-homepage) | PyPI | 999.0.0 |
| [discord-mfa-solver](https://dependencywatch.io/package/npm/discord-mfa-solver) | npm | 1.0.0, 1.0.1, 1.0.2 |
| [gmgn-trading-kit](https://dependencywatch.io/package/npm/gmgn-trading-kit) | npm | 1.7.0, 1.7.1, 1.7.2 |
| [graphql-js-client-transform](https://dependencywatch.io/package/npm/graphql-js-client-transform) | npm | * |
| [matrixkit-js](https://dependencywatch.io/package/npm/matrixkit-js) | npm | 1.0.0 |
| [mfaby](https://dependencywatch.io/package/npm/mfaby) | npm | 1.0.0 |
| [mfatest2](https://dependencywatch.io/package/npm/mfatest2) | npm | 1.0.0 |
| [polygon-toolkits-validator](https://dependencywatch.io/package/npm/polygon-toolkits-validator) | npm | * |
| [raydium-clmm-sdk](https://dependencywatch.io/package/npm/raydium-clmm-sdk) | npm | * |
| [react-remove-properties](https://dependencywatch.io/package/npm/react-remove-properties) | npm | * |
| [sams-run-style](https://dependencywatch.io/package/npm/sams-run-style) | npm | * |
| [sams-text-style](https://dependencywatch.io/package/npm/sams-text-style) | npm | * |
| [soltinel-pro](https://dependencywatch.io/package/npm/soltinel-pro) | npm | 0.2.0, 0.2.1, 0.2.2 |
| [twilio-hackerone-poc-b8f21a](https://dependencywatch.io/package/npm/twilio-hackerone-poc-b8f21a) | npm | 1.0.0, 1.0.1 |

## What happened

Between roughly 2026-09-09 12:00 UTC and 2026-09-10 12:00 UTC, GitHub Advisory Database published ~26 new npm and PyPI malware advisories. Unlike yesterday's window (which was headlined by the coordinated `sonner` typosquat trio and the `rojo-rbx` Windows Run-key persistence chain), today's drop is dominated by *follow-through* on ongoing sub-waves and by shared harvester templates being ported into new lures.

## Cluster A — Baileys WhatsApp scope hijacks wave 3

Three more Baileys-namespace scope hijacks, each with a different tradecraft variant:

| Package | GHSA | Tradecraft |
|---|---|---|
| `@sahril2nd/baileys@1.0.21` | GHSA-j2h4-4g8c-mqh9 | Hardcoded C2 (`fiora.nixel.my.id`) hidden as `String.fromCharCode(...)` decimal-ASCII array in `messages-send.js` |
| `@nexustechpro/baileys@2.2.7` | GHSA-pv55-pgr3-jjrj | ~270 KB obfuscator.io payload in `chats.js` (authState / Signal identity keys code path) + `"whatsapp-rust-bridge": "latest"` unpinned |
| `@neroxkira/vangal-baileys@1.0.0/1.0.1` | GHSA-8g69-mcxv-f88g | Unpinned `github:RILLYZY/libsignal-node` dependency (attacker account unrelated to signalapp) |

Combined with `@vallensofficial/baileys`, `@versacode/baileys`, `@haimiya/baileys` (2026-09-09), `kiki-baileys` (2026-09-08), and the earlier `WhiskeySAML/baileys`, the Baileys namespace has now been hit **at least seven times in three days**. The real upstream is `@whiskeysockets/baileys`; every other Baileys-labelled package on npm should currently be treated as suspicious.

## Cluster C — `@umschool/platform` (Kubernetes-secrets harvester)

The `@umschool` scope was flagged yesterday for `@umschool/analytics@999.0.0-999.0.4`, which only carried the GHSA full-compromise boilerplate. Today's **`@umschool/platform@999.0.0/999.0.1/999.0.2`** (GHSA-vj55-82hp-jrcm) publishes the full payload analysis and it is materially more advanced than yesterday's beacon-only Cluster D probes:

1. Reads Kubernetes service-account tokens from `/var/run/secrets/kubernetes.io/serviceaccount/`
2. Queries AWS IMDS (169.254.169.254), ECS credentials endpoint (169.254.170.2), Azure IMDS, and Yandex/GCP metadata services
3. Calls the in-cluster Kubernetes API at `https://kubernetes.default.svc/api/v1/secrets` with the harvested service-account credentials to enumerate every Secret the pod can read
4. Scans up to 8 parent directories for `.env` files and filters `process.env` for `token|secret|key|pass|cred|auth|aws|jwt|api|stripe|sendgrid|twilio`
5. POSTs everything base64-encoded to `https://akko.requestcatcher.com/dep-confusion-v2`

Any Kubernetes cluster where a build container resolved `@umschool/platform` from public npm has almost certainly leaked its Secret objects. The `dep-confusion-v2` collector path suggests the operator is running this as a second-generation campaign iteration and not merely a pentest artefact.

## Cluster D — Shared "Master Harvester" template

`gmgn-trading-kit@1.7.x` (GMGN Solana trading toolkit lure) and `soltinel-pro@0.2.x` (Solana trading bot lure) both ship a `postinstall.cjs` with a self-identifying header comment:

> "Master Harvester — injectable into any npm package via postinstall"

Collection routine is identical between them: SSH keys (`id_rsa`, `id_ed25519`, `*_rsa`, `*_ed25519`), `.netrc`, `.git-credentials`, Solana CLI keypairs (default paths), `~/.config` wallet/env/credentials files, `.blockrun` wallet directories, and every `.env` up the tree filtered for `KEY|SECRET|PRIVATE|TOKEN`. Exfil goes over HTTPS POST to a hardcoded webhook.site collector (rotating per package).

The template is deliberately reusable - expect more packages this week using the exact same routine and a rotating webhook.site collector. This is a signature to hunt for in future daily sweeps.

## Cluster E — Coordinated Discord MFA lure trio

`mfatest2@1.0.0` and `discord-mfa-solver@1.0.0-1.0.2` are the same operator: both declare `"node-net-pool": "github:trktgq0wbre1/node-net-pool"` (an attacker-controlled GitHub account) and both load it via the identical `module['require']('node-net-pool')` obfuscated dynamic-require inside a swallowed try/catch in `lib/cache.js`. Once loaded, the transitive dep downloads a remote "runtime patch asset" and detaches it via `child_process.execFile` - the shipped tarball contains only a loader stub, so a `.js`-only scan of the top-level package will miss the payload.

`mfaby@1.0.0` is a separate but adjacent operator - base64-hidden URL `https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKl3RalN_TVUZYGPsJy2Y`, download to `os.tmpdir()`, execute with `new Worker(tmp)`, and explicit `rejectUnauthorized:false` on Discord traffic so TLS pinning cannot detect the credential leak.

All three claim to be Discord MFA helpers; the theme is credential/session harvesting from Discord token stores.

## Cluster F — Corporate-namespace / pentest dep-confusion probes

Today's dep-confusion probe cluster is smaller than yesterday's (Cluster D of `multi-2026-09-09-ghsa-malware-sweep`) but has one item worth calling out:

**`twilio-hackerone-poc-b8f21a@1.0.0/1.0.1`** (GHSA-wpq4-r5p3-386q) is an *explicit* HackerOne bug-bounty POC (the name embeds a HackerOne report ID `b8f21a`). It enumerates `AC[0-9a-f]{32}` Twilio account directories to identify co-tenants on shared build infrastructure, and reports via a Cloudflare Quick Tunnel (`encryption-watch-tubes-finger.trycloudflare.com`) - ephemeral, anonymous, and hard to block-list. Even if the underlying report is closed, the package remains publicly installable until the registry removes it.

On PyPI, `bq-sdist-probe-vrp@0.0.1` and `bq-build-probe-vrp-2026@0.2.0` are coordinated BigQuery-build probes (`bq-` prefix, `-probe-vrp` suffix consistent with a single "Vulnerability Reporting Program" naming convention) whose `setup.py` queries GCE metadata for OAuth tokens and service-account emails. `databricks-webapp-navigation-homepage@999.0.0` is fingerprinted as the "GENERIC-standard-pypi-install-pentest" campaign.

## Cluster G — Miscellaneous obfuscated payloads

`matrixkit-js` is interesting because the AES-256-GCM decryption uses `scryptSync` with runtime-supplied passwords - meaning static analysis cannot recover the plaintext even if the ciphertext files are extracted. The obfuscation resists both source-scanner and dynamic yara-in-node approaches.

`@staticj/cropperxmjs` is the only package in this batch that targets *end users* rather than developers: any userscript that bundles it inherits the Tampermonkey/Greasemonkey privileges of the running browser, and exfils the userscript's `updateURL` so the operator can pivot to targeted supply-chain follow-up (poisoning the userscript's own auto-update channel).

## Cluster H — Boilerplate takedowns

Eight npm packages flagged with the full-compromise GHSA boilerplate and no published payload analysis or source code. Include them in scans and deny-lists but note that any specific IOC discussion requires independent per-package analysis - the GHSA entry alone is not sufficient. Package names to watch: `chai-as-testkit`, `sams-text-style`, `sams-run-style`, `graphql-js-client-transform`, `react-remove-properties`, `crypto-validates`, `polygon-toolkits-validator`, `raydium-clmm-sdk`.

## Distinction from parallel same-day PR (2026-09-09 sweep)

Yesterday's `multi-2026-09-09-ghsa-malware-sweep` covered the coordinated `sonner` React-toast typosquat trio, three earlier Baileys scope hijacks, `rojo-rbx` Windows Run-key persistence, dep-confusion probes at `unifi-credential-server`/`twilio-functions`/`@umschool/analytics`, several OAST beacons (`@yongot/canary-mcp-*`, `alloy-graphql`, `@aspect-adv-ui/consent-manager`), remote-code-loader droppers (`tailwind-aspect-styles`, `tailwindcss-aspectratio-styles`, `selfcerts`, `punypump`, `bx-ui-view`), the `toru-ultimate` Facebook credential harvester, `vinzz-wcli` hardcoded-JID backdoor, and the destructive `express-session-timer`. Today's window continues the Baileys and `@umschool` scope-abuse threads and adds new payload templates (Master Harvester, node-net-pool loader).

## Registry state

All packages listed below are flagged as malware on npm / PyPI and quarantined. Private mirrors that cached tarballs before quarantine will keep serving them - explicit deny-listing of every name below plus the `@auction-fe/`, `@convertics/`, `@nexustechpro/`, `@sahril2nd/`, `@neroxkira/`, `@umschool/`, and `@staticj/` scopes is the durable mitigation.

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `amazon-inspector`. Per-package IOC details (URLs, IPs, hashes, hardcoded webhook tokens, hardcoded JIDs) drawn verbatim from GHSA advisory bodies published between 2026-09-09 and 2026-09-10.

## Impact

- **Cluster A — Baileys WhatsApp scope hijacks wave 3 (three more packages)**: `@sahril2nd/baileys@1.0.21` (GHSA-j2h4-4g8c-mqh9) hides a hardcoded C2 URL inside `lib/Socket/messages-send.js` as a `String.fromCharCode(...)` decimal-ASCII array that reconstructs to `https://fiora.nixel.my.id/` at lines 425/436 of message-send. `@nexustechpro/baileys@2.2.7` (GHSA-pv55-pgr3-jjrj) ships a ~270 KB obfuscator.io-obfuscated `lib/Socket/chats.js` (~2,772-entry string array, hex-escaped imports, integer-arithmetic control flow) sitting exactly in the authState / Signal-identity-keys / noise-keys code path, and declares `"whatsapp-rust-bridge": "latest"` unpinned so the dependency publisher can ship arbitrary install-time code. `@neroxkira/vangal-baileys@1.0.0/1.0.1` (GHSA-8g69-mcxv-f88g) declares `libsignal` as an unpinned GitHub dep `github:RILLYZY/libsignal-node` unrelated to the real signalapp upstream. Continues the pattern from `@vallensofficial/@versacode/@haimiya/baileys` (2026-09-09 sweep) and `kiki-baileys` (2026-09-08 sweep) - Baileys namespace abuse is now the highest-volume single lookalike target on npm this month
- **Cluster B — `@auction-fe/*` corporate-namespace boilerplate cluster**: four coordinated npm packages published under the same `@auction-fe` scope on 2026-09-09 with the standard GHSA full-compromise boilerplate ("any computer that has this package installed or running should be considered fully compromised") and no published payload analysis: `@auction-fe/portal` (GHSA-qmw2-mp2f-cgg3), `@auction-fe/base` (GHSA-w6hj-c25h-wgh7), `@auction-fe/ui-kit` (GHSA-2r37-886p-hj65), `@auction-fe/reporting-system` (GHSA-4x79-pcqv-r9rf), all versions. Shape matches an internal-frontend dep-confusion probe against an "auction-fe" corporate scope, but with no IOC published we treat it as boilerplate flagging
- **Cluster C — `@umschool/platform` follow-up (live Kubernetes + cloud-metadata harvester)**: `@umschool/platform@999.0.0/999.0.1/999.0.2` (GHSA-vj55-82hp-jrcm) is the SAME `@umschool` scope that yesterday's sweep flagged via `@umschool/analytics@999.x`, but the payload is materially more advanced: `postinstall.js` reads Kubernetes service-account tokens from `/var/run/secrets/kubernetes.io/serviceaccount/`, queries AWS IMDS (169.254.169.254), the ECS credentials endpoint (169.254.170.2), Azure IMDS, and Yandex/GCP metadata services, then calls `https://kubernetes.default.svc/api/v1/secrets` using the harvested service-account credentials, scans up to 8 parent directories for `.env` files, and POSTs everything base64-encoded to `https://akko.requestcatcher.com/dep-confusion-v2` (same requestcatcher subdomain as yesterday). This is a functioning K8s-cluster-secrets exfiltration chain, not a beacon
- **Cluster D — Shared "Master Harvester" Solana wallet drainers**: `gmgn-trading-kit@1.7.0/1.7.1/1.7.2` (GHSA-g6w4-rgw8-65r7) impersonates the GMGN Solana trading toolkit and runs a `postinstall.cjs` that scans `$HOME` for SSH private keys (`id_rsa`, `id_ed25519`, `*_rsa`, `*_ed25519`), `.netrc`, `.git-credentials`, Solana keypairs, `.blockrun` wallet files, walks upward from install-dir reading every `.env` for `KEY|SECRET|PRIVATE|TOKEN`, POSTs everything to `https://webhook.site/d7ab73fe-7cbc-4ed3-bf8e-7207eb06875b`. `soltinel-pro@0.2.0/0.2.1/0.2.2` (GHSA-69g5-q5j6-cxx4) is a Solana trading-bot lure with the SAME self-identifying header comment ("Master Harvester — injectable into any npm package via postinstall") - a reusable harvester template being ported into new lures, so expect more packages this week using the exact same collection routine and a rotating webhook.site collector
- **Cluster E — Coordinated Discord MFA lure trio**: three npm packages published 2026-09-09 that all disguise a hidden dependency loader as a Discord multi-factor-auth helper. `mfatest2@1.0.0` (GHSA-2cf3-8wq3-f2xq) declares `"node-net-pool": "github:trktgq0wbre1/node-net-pool"` (an attacker-controlled GitHub account unrelated to any legitimate node-net-pool) and loads it via the obfuscated `module['require']('node-net-pool')` inside a swallowed try/catch in `lib/cache.js`, then downloads a remote "runtime patch asset" and detaches it via `child_process.execFile`. `discord-mfa-solver@1.0.0/1.0.1/1.0.2` (GHSA-f5p4-vw6q-5w28) is the same operator - identical `module['require']('node-net-pool')` loader stub in `lib/cache.js`, plus explicit Discord-abuse tooling exercising `/api/v9/guilds/0/vanity-url` and `/api/v9/mfa/finish`. `mfaby@1.0.0` (GHSA-x3f6-cx35-q6mw) is a separate strain: a base64-hidden URL `https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKl3RalN_TVUZYGPsJy2Y`, downloads a payload to `os.tmpdir()`, and detonates it with `new Worker(tmp)` - also disables TLS verification (`rejectUnauthorized:false`) on Discord traffic
- **Cluster F — Corporate-namespace / pentest dep-confusion probes**: `twilio-hackerone-poc-b8f21a@1.0.0/1.0.1` (GHSA-wpq4-r5p3-386q) is an EXPLICIT HackerOne bug-bounty POC - the name embeds the report identifier, and the postinstall enumerates `AC[0-9a-f]{32}` Twilio account directories to identify co-tenants on shared build infrastructure, then POSTs recon (env vars, `id`, `whoami`, `/proc/self/cgroup`, AWS IMDS, ECS agent probes) via a Cloudflare Quick Tunnel at `https://encryption-watch-tubes-finger.trycloudflare.com/poc-v101-escape`. On PyPI: `bq-sdist-probe-vrp@0.0.1` (GHSA-xhgv-6q3g-2824) and `bq-build-probe-vrp-2026@0.2.0` (GHSA-f69f-h5mx-9x8p) are coordinated BigQuery-build probes whose `setup.py` queries GCP metadata (`http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token`), filters env for `token|secret|key|pass|auth|google|project|docker|kube|metadata`, and persists findings as JSON inside the package directory. `databricks-webapp-navigation-homepage@999.0.0` (GHSA-5c43-fq29-3rx9) is a Databricks-internal dep-confusion pentest fingerprinted as the "GENERIC-standard-pypi-install-pentest" campaign. `@convertics/script` (GHSA-c74p-4c5p-6v9r) all versions is boilerplate-flagged on the `@convertics` corporate scope
- **Cluster G — Miscellaneous obfuscated payloads and typosquats**: `matrixkit-js@1.0.0` (GHSA-j34m-r83h-m38q) markets itself as a dense-matrix math library; its `matrix.js` loads a 112-entry rotated-array string decoder in `src/init.js` that decrypts AES-256-GCM ciphertext (`src/statMatrix.min.d.js` ~1.15 MB base64→~862 KB high-entropy) with `scryptSync`/`createDecipheriv`, writes it to a temp file and runs it - post-build injection unrelated to the source-map contents. `@staticj/cropperxmjs@1.6.0` (GHSA-8vj5-qr9w-p6p2) impersonates Cropper.js and reconstructs `https://u.myquickcash.shop/api/spt/upgrade` from interleaved string fragments, then abuses Tampermonkey/Greasemonkey privileges (`GM_xmlhttpRequest`, `GM_info.script`) to `eval()` operator-supplied JavaScript with 15-req/day rate-limit tracking (`GM_setValue 'sp_req_daily'`) - any userscript that bundles this file exposes end users to RCE
- **Cluster H — CWE-506 boilerplate takedowns, no published analysis (eight packages)**: `chai-as-testkit` (GHSA-wg38-qj68-8g87), `sams-text-style` (GHSA-xqx8-w483-rq8x), `sams-run-style` (GHSA-2r8h-5pr4-fr3v), `graphql-js-client-transform` (GHSA-xm59-fwxf-vq6g), `react-remove-properties` (GHSA-m8m4-9m7c-742j), `crypto-validates` (GHSA-v5v6-h869-g34f), `polygon-toolkits-validator` (GHSA-cmwm-j5px-xrpf), `raydium-clmm-sdk` (GHSA-cq4p-x9wg-m5wv) - all >=0, all flagged with the full-compromise GHSA boilerplate and no source code or IOC published. Assume malicious pending independent analysis; `crypto-validates`, `polygon-toolkits-validator`, and `raydium-clmm-sdk` name-shape suggests targeted Solana/Polygon/crypto lures

## What to do

1. Grep every `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `package.json`, `requirements.txt`, and `poetry.lock` in your org for the names below. Uninstall on hit, wipe `node_modules`, delete the lockfile, and rebuild against a clean cache
2. **For Cluster A Baileys wave 3**: audit every WhatsApp/Baileys-based Node bot repo for `@sahril2nd/baileys`, `@nexustechpro/baileys`, `@neroxkira/vangal-baileys` (and the previous 4 from the 2026-09-08/09 sweeps). Pin the real upstream `@whiskeysockets/baileys` explicitly in `package.json` and enforce it in CI. Block `fiora.nixel.my.id` at the egress proxy. Assume any host that resolved one of these scope hijacks is fully compromised, especially given the deep authState / signed-pre-key / noise-key placement in `@nexustechpro/baileys`
3. **For Cluster C `@umschool/platform` K8s harvester**: assume every Kubernetes cluster where a build ran that resolved `@umschool/platform@999.x` from public npm has leaked its service-account tokens and, via them, the contents of the cluster's Secret objects. Rotate every K8s Secret, revoke every ServiceAccount token, rotate every cloud-instance role that IMDS returned (AWS/Azure/GCP/Yandex), and add `@umschool/` scope to internal-mirror deny-lists. Block `akko.requestcatcher.com` at corporate egress
4. **For Cluster D "Master Harvester" wallet drainers**: any host that ran `gmgn-trading-kit` or `soltinel-pro` has leaked SSH private keys, Solana keypairs, `.netrc`, `.git-credentials`, `.blockrun` wallet files, and every `.env` up the tree matching `KEY|SECRET|PRIVATE|TOKEN`. Rotate SSH keys and Git credentials, move any Solana funds to a fresh keypair generated on a clean host, block `webhook.site` at corporate egress. The "Master Harvester" template comment strongly implies more packages this week using an identical routine - watch the daily sweep for new Solana / crypto-trading lures
5. **For Cluster E Discord MFA lures**: block `github.com/trktgq0wbre1` (the disposable GitHub account for the `node-net-pool` loader stub) and `limbomail.com` at the egress proxy. Any project or Electron app that bundled these packages should treat Discord user tokens as leaked - rotate them and force-invalidate active Discord sessions. The `rejectUnauthorized:false` in `mfaby` means TLS pinning cannot detect the leak in transit
6. **For Cluster F pentest / dep-confusion probes**: the `twilio-hackerone-poc-b8f21a` name embeds a HackerOne report ID (`b8f21a`) - Twilio's response is expected via that report. Twilio SDK consumers should explicitly pin `twilio` in `package.json`. Databricks customers: audit any pip installs of `databricks-webapp-*` against an internal mirror. Google Cloud CI users: block outbound requests to `metadata.google.internal` from build containers that shouldn't need them, and add `webhook.site`, `*.trycloudflare.com` (attacker Quick Tunnels), `oastify.com`, `oast.me`, and `requestcatcher.com` to egress deny-lists
7. **For Cluster G `matrixkit-js` and `@staticj/cropperxmjs`**: any host that imported `matrixkit-js` executed AES-decrypted operator code with runtime-supplied keys - treat as fully compromised. Any Tampermonkey/Greasemonkey userscript bundling `@staticj/cropperxmjs` exposes the *end user* (not just the developer) to `eval`-based RCE via `u.myquickcash.shop` - notify users of any distributed script that pulled a Cropper library from npm and block `myquickcash.shop`
8. For every `npm install` and `pip install` in CI, prefer `--ignore-scripts` / `--no-build-isolation` where feasible to block postinstall/preinstall/setup.py payloads. This blocks Clusters C, D, E, F entirely for lockfile-consumer paths
9. Add every name below to internal private-registry (Verdaccio / Artifactory / Nexus) deny-lists for at least 30 days to prevent re-uploads by rotating operators. Also block scopes `@auction-fe/`, `@convertics/`, `@nexustechpro/`, `@sahril2nd/`, `@neroxkira/`, `@umschool/`, `@staticj/`

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-j2h4-4g8c-mqh9 - @sahril2nd/baileys (Cluster A - fiora.nixel.my.id String.fromCharCode)](https://github.com/advisories/GHSA-j2h4-4g8c-mqh9) - GitHub
- [GHSA-pv55-pgr3-jjrj - @nexustechpro/baileys (Cluster A - obfuscated chats.js + whatsapp-rust-bridge unpinned)](https://github.com/advisories/GHSA-pv55-pgr3-jjrj) - GitHub
- [GHSA-8g69-mcxv-f88g - @neroxkira/vangal-baileys (Cluster A - RILLYZY/libsignal-node unpinned)](https://github.com/advisories/GHSA-8g69-mcxv-f88g) - GitHub
- [GHSA-qmw2-mp2f-cgg3 - @auction-fe/portal (Cluster B)](https://github.com/advisories/GHSA-qmw2-mp2f-cgg3) - GitHub
- [GHSA-w6hj-c25h-wgh7 - @auction-fe/base (Cluster B)](https://github.com/advisories/GHSA-w6hj-c25h-wgh7) - GitHub
- [GHSA-2r37-886p-hj65 - @auction-fe/ui-kit (Cluster B)](https://github.com/advisories/GHSA-2r37-886p-hj65) - GitHub
- [GHSA-4x79-pcqv-r9rf - @auction-fe/reporting-system (Cluster B)](https://github.com/advisories/GHSA-4x79-pcqv-r9rf) - GitHub
- [GHSA-vj55-82hp-jrcm - @umschool/platform (Cluster C - K8s secrets + cloud metadata harvester)](https://github.com/advisories/GHSA-vj55-82hp-jrcm) - GitHub
- [GHSA-g6w4-rgw8-65r7 - gmgn-trading-kit (Cluster D - Master Harvester Solana lure)](https://github.com/advisories/GHSA-g6w4-rgw8-65r7) - GitHub
- [GHSA-69g5-q5j6-cxx4 - soltinel-pro (Cluster D - Master Harvester Solana lure)](https://github.com/advisories/GHSA-69g5-q5j6-cxx4) - GitHub
- [GHSA-2cf3-8wq3-f2xq - mfatest2 (Cluster E - Discord MFA lure, node-net-pool loader)](https://github.com/advisories/GHSA-2cf3-8wq3-f2xq) - GitHub
- [GHSA-f5p4-vw6q-5w28 - discord-mfa-solver (Cluster E - same operator as mfatest2)](https://github.com/advisories/GHSA-f5p4-vw6q-5w28) - GitHub
- [GHSA-x3f6-cx35-q6mw - mfaby (Cluster E - limbomail.com base64 loader, TLS pinning bypass)](https://github.com/advisories/GHSA-x3f6-cx35-q6mw) - GitHub
- [GHSA-wpq4-r5p3-386q - twilio-hackerone-poc-b8f21a (Cluster F - explicit HackerOne POC, Cloudflare Quick Tunnel)](https://github.com/advisories/GHSA-wpq4-r5p3-386q) - GitHub
- [GHSA-xhgv-6q3g-2824 - bq-sdist-probe-vrp (Cluster F - PyPI BigQuery build probe)](https://github.com/advisories/GHSA-xhgv-6q3g-2824) - GitHub
- [GHSA-f69f-h5mx-9x8p - bq-build-probe-vrp-2026 (Cluster F - PyPI BigQuery probe advanced)](https://github.com/advisories/GHSA-f69f-h5mx-9x8p) - GitHub
- [GHSA-5c43-fq29-3rx9 - databricks-webapp-navigation-homepage (Cluster F - PyPI Databricks pentest)](https://github.com/advisories/GHSA-5c43-fq29-3rx9) - GitHub
- [GHSA-c74p-4c5p-6v9r - @convertics/script (Cluster F)](https://github.com/advisories/GHSA-c74p-4c5p-6v9r) - GitHub
- [GHSA-j34m-r83h-m38q - matrixkit-js (Cluster G - AES-256-GCM statMatrix payload)](https://github.com/advisories/GHSA-j34m-r83h-m38q) - GitHub
- [GHSA-8vj5-qr9w-p6p2 - @staticj/cropperxmjs (Cluster G - Cropper.js typosquat, userscript RCE)](https://github.com/advisories/GHSA-8vj5-qr9w-p6p2) - GitHub
- [GHSA-wg38-qj68-8g87 - chai-as-testkit (Cluster H boilerplate)](https://github.com/advisories/GHSA-wg38-qj68-8g87) - GitHub
- [GHSA-xqx8-w483-rq8x - sams-text-style (Cluster H boilerplate)](https://github.com/advisories/GHSA-xqx8-w483-rq8x) - GitHub
- [GHSA-2r8h-5pr4-fr3v - sams-run-style (Cluster H boilerplate)](https://github.com/advisories/GHSA-2r8h-5pr4-fr3v) - GitHub
- [GHSA-xm59-fwxf-vq6g - graphql-js-client-transform (Cluster H boilerplate)](https://github.com/advisories/GHSA-xm59-fwxf-vq6g) - GitHub
- [GHSA-m8m4-9m7c-742j - react-remove-properties (Cluster H boilerplate)](https://github.com/advisories/GHSA-m8m4-9m7c-742j) - GitHub
- [GHSA-v5v6-h869-g34f - crypto-validates (Cluster H boilerplate)](https://github.com/advisories/GHSA-v5v6-h869-g34f) - GitHub
- [GHSA-cmwm-j5px-xrpf - polygon-toolkits-validator (Cluster H boilerplate)](https://github.com/advisories/GHSA-cmwm-j5px-xrpf) - GitHub
- [GHSA-cq4p-x9wg-m5wv - raydium-clmm-sdk (Cluster H boilerplate)](https://github.com/advisories/GHSA-cq4p-x9wg-m5wv) - GitHub
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF

---

Canonical page: https://dependencywatch.io/incident/multi-2026-09-10-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-09-10-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).