# GitHub Advisory malware sweep - 2026-09-10/11 (`pinochiomathm` picomatch typosquat with AES payload, `tailwindcss-contact-forms` Ethereum-RPC wallet drainer, `lucy-python-script-2030` Telegram infostealer, `@fyxzpediaa/baileys` wave 4, tea.xyz mass spam wave)

> GHSA published between 2026-09-10 and 2026-09-11 UTC: a `picomatch` typosquat (`pinochiomathm`) with AES payload from `jsonkeeper.com`, `tailwindcss-contact-forms` Ethereum-RPC wallet drainer, a PyPI Telegram infostealer, a fourth Baileys hijack (`@fyxzpediaa/baileys`) - plus a very large tea.xyz spam wave (hundreds of `fancy_*_z3n` / `famous_*_z3n` / `family-island-unlimited-energy*` packages).

- Published: 2026-09-11
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 111 packages, 122 compromised versions
- Tags: typosquat, infostealer, credential-theft, crypto-wallet-drain, obfuscation, dns-exfiltration
- Also known as: 2026-09-11 GHSA npm/PyPI sweep, pinochiomathm picomatch typosquat, tailwindcss-contact-forms Ethereum-RPC wallet drainer, lucy-python-script-2030 PyPI Telegram infostealer, Baileys scope hijack wave 4 (@fyxzpediaa/baileys), @yongot/canary-mcp-test-2, tea.xyz token-farming spam wave 2026-09-11
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector
- Incident ID: multi-2026-09-11-ghsa-malware-sweep

## Affected packages (111)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@fyxzpediaa/baileys](https://dependencywatch.io/package/npm/@fyxzpediaa/baileys) | npm | 8.1.2, 9.1.0 |
| [@yongot/canary-mcp-isolation](https://dependencywatch.io/package/npm/@yongot/canary-mcp-isolation) | npm | * |
| [@yongot/canary-mcp-test](https://dependencywatch.io/package/npm/@yongot/canary-mcp-test) | npm | * |
| [@yongot/canary-mcp-test-2](https://dependencywatch.io/package/npm/@yongot/canary-mcp-test-2) | npm | * |
| [cat-sis2go-utils](https://dependencywatch.io/package/npm/cat-sis2go-utils) | npm | * |
| [daytona-test-filereader](https://dependencywatch.io/package/npm/daytona-test-filereader) | npm | * |
| [daytona-test-miner](https://dependencywatch.io/package/npm/daytona-test-miner) | npm | * |
| [daytona-test-npm](https://dependencywatch.io/package/npm/daytona-test-npm) | npm | * |
| [false-positive-reddit-rce](https://dependencywatch.io/package/npm/false-positive-reddit-rce) | npm | 0.0.2 |
| [familiar_bison_z3n](https://dependencywatch.io/package/npm/familiar_bison_z3n) | npm | * |
| [familiar_finch_z3n](https://dependencywatch.io/package/npm/familiar_finch_z3n) | npm | * |
| [familiar_firefly_z3n](https://dependencywatch.io/package/npm/familiar_firefly_z3n) | npm | * |
| [familiar_guan_z3n](https://dependencywatch.io/package/npm/familiar_guan_z3n) | npm | * |
| [familiar_hare_z3n](https://dependencywatch.io/package/npm/familiar_hare_z3n) | npm | * |
| [familiar_herring_z3n](https://dependencywatch.io/package/npm/familiar_herring_z3n) | npm | * |
| [familiar_hippopotamus_z3n](https://dependencywatch.io/package/npm/familiar_hippopotamus_z3n) | npm | * |
| [familiar_jackal_z3n](https://dependencywatch.io/package/npm/familiar_jackal_z3n) | npm | * |
| [familiar_jaguar_z3n](https://dependencywatch.io/package/npm/familiar_jaguar_z3n) | npm | * |
| [familiar_kiwi_z3n](https://dependencywatch.io/package/npm/familiar_kiwi_z3n) | npm | * |
| [familiar_limpet_z3n](https://dependencywatch.io/package/npm/familiar_limpet_z3n) | npm | * |
| [familiar_lynx_z3n](https://dependencywatch.io/package/npm/familiar_lynx_z3n) | npm | * |
| [familiar_marlin-appteadev](https://dependencywatch.io/package/npm/familiar_marlin-appteadev) | npm | * |
| [familiar_marten_dumbs](https://dependencywatch.io/package/npm/familiar_marten_dumbs) | npm | * |
| [familiar_minnow_z3n](https://dependencywatch.io/package/npm/familiar_minnow_z3n) | npm | * |
| [familiar_porcupine_z3n](https://dependencywatch.io/package/npm/familiar_porcupine_z3n) | npm | * |
| [familiar_prawn_scarlet-18](https://dependencywatch.io/package/npm/familiar_prawn_scarlet-18) | npm | * |
| [familiar_ptarmigan_z3n](https://dependencywatch.io/package/npm/familiar_ptarmigan_z3n) | npm | * |
| [familiar_puma_z3n](https://dependencywatch.io/package/npm/familiar_puma_z3n) | npm | * |
| [familiar_scorpion_z3n](https://dependencywatch.io/package/npm/familiar_scorpion_z3n) | npm | * |
| [familiar-olive-pelican](https://dependencywatch.io/package/npm/familiar-olive-pelican) | npm | * |
| [familiar-orange-camel](https://dependencywatch.io/package/npm/familiar-orange-camel) | npm | * |
| [family-island-unlimited-energy167](https://dependencywatch.io/package/npm/family-island-unlimited-energy167) | npm | * |
| [family-island-unlimited-energy285](https://dependencywatch.io/package/npm/family-island-unlimited-energy285) | npm | * |
| [family-island-unlimited-energy362](https://dependencywatch.io/package/npm/family-island-unlimited-energy362) | npm | * |
| [family-island-unlimited-energy447](https://dependencywatch.io/package/npm/family-island-unlimited-energy447) | npm | * |
| [family-island-unlimited-energy463](https://dependencywatch.io/package/npm/family-island-unlimited-energy463) | npm | * |
| [familylink](https://dependencywatch.io/package/npm/familylink) | npm | * |
| [famous_anaconda_z3n](https://dependencywatch.io/package/npm/famous_anaconda_z3n) | npm | * |
| [famous_angelfish_dumbs](https://dependencywatch.io/package/npm/famous_angelfish_dumbs) | npm | * |
| [famous_angelfish-notthedev](https://dependencywatch.io/package/npm/famous_angelfish-notthedev) | npm | * |
| [famous_ape_0xrequest](https://dependencywatch.io/package/npm/famous_ape_0xrequest) | npm | * |
| [famous_cicada_z3n](https://dependencywatch.io/package/npm/famous_cicada_z3n) | npm | * |
| [famous_firefly_0xrequest](https://dependencywatch.io/package/npm/famous_firefly_0xrequest) | npm | * |
| [famous_firefly_z3n](https://dependencywatch.io/package/npm/famous_firefly_z3n) | npm | * |
| [famous_goose_z3n](https://dependencywatch.io/package/npm/famous_goose_z3n) | npm | * |
| [famous_heron_z3n](https://dependencywatch.io/package/npm/famous_heron_z3n) | npm | * |
| [famous_hippopotamus_z3n](https://dependencywatch.io/package/npm/famous_hippopotamus_z3n) | npm | * |
| [famous_hummingbird_z3n](https://dependencywatch.io/package/npm/famous_hummingbird_z3n) | npm | * |
| [famous_marsupial_z3n](https://dependencywatch.io/package/npm/famous_marsupial_z3n) | npm | * |
| [famous_mite_z3n](https://dependencywatch.io/package/npm/famous_mite_z3n) | npm | * |
| [famous_ox_z3n](https://dependencywatch.io/package/npm/famous_ox_z3n) | npm | * |
| [famous_skunk_z3n](https://dependencywatch.io/package/npm/famous_skunk_z3n) | npm | * |
| [famous_swordtail_z3n](https://dependencywatch.io/package/npm/famous_swordtail_z3n) | npm | * |
| [famous_tahr_z3n](https://dependencywatch.io/package/npm/famous_tahr_z3n) | npm | * |
| [famous_whale_z3n](https://dependencywatch.io/package/npm/famous_whale_z3n) | npm | * |
| [famous-amethyst-coyote](https://dependencywatch.io/package/npm/famous-amethyst-coyote) | npm | * |
| [famous-aquamarine-unicorn](https://dependencywatch.io/package/npm/famous-aquamarine-unicorn) | npm | * |
| [famous-beige-tern](https://dependencywatch.io/package/npm/famous-beige-tern) | npm | * |
| [famous-coral-fly](https://dependencywatch.io/package/npm/famous-coral-fly) | npm | * |
| [famous-cyan-crayfish](https://dependencywatch.io/package/npm/famous-cyan-crayfish) | npm | * |
| [famous-jade-felidae](https://dependencywatch.io/package/npm/famous-jade-felidae) | npm | * |
| [famous-red-stoat](https://dependencywatch.io/package/npm/famous-red-stoat) | npm | * |
| [famous-scarlet-dog](https://dependencywatch.io/package/npm/famous-scarlet-dog) | npm | * |
| [fanada](https://dependencywatch.io/package/npm/fanada) | npm | * |
| [fancy_alligator_z3n](https://dependencywatch.io/package/npm/fancy_alligator_z3n) | npm | * |
| [fancy_bobcat_dumbs](https://dependencywatch.io/package/npm/fancy_bobcat_dumbs) | npm | * |
| [fancy_bovid-appteadev](https://dependencywatch.io/package/npm/fancy_bovid-appteadev) | npm | * |
| [fancy_cattle_z3n](https://dependencywatch.io/package/npm/fancy_cattle_z3n) | npm | * |
| [fancy_cricket_z3n](https://dependencywatch.io/package/npm/fancy_cricket_z3n) | npm | * |
| [fancy_cuckoo_z3n](https://dependencywatch.io/package/npm/fancy_cuckoo_z3n) | npm | * |
| [fancy_dormouse_z3n](https://dependencywatch.io/package/npm/fancy_dormouse_z3n) | npm | * |
| [fancy_firefly_0xrequest](https://dependencywatch.io/package/npm/fancy_firefly_0xrequest) | npm | * |
| [fancy_goose_z3n](https://dependencywatch.io/package/npm/fancy_goose_z3n) | npm | * |
| [fancy_roadrunner_z3n](https://dependencywatch.io/package/npm/fancy_roadrunner_z3n) | npm | * |
| [fancy_snail_z3n](https://dependencywatch.io/package/npm/fancy_snail_z3n) | npm | * |
| [fancy_wolf_z3n](https://dependencywatch.io/package/npm/fancy_wolf_z3n) | npm | * |
| [fancy_wombat_z3n](https://dependencywatch.io/package/npm/fancy_wombat_z3n) | npm | * |
| [fancy-apricot-whitefish](https://dependencywatch.io/package/npm/fancy-apricot-whitefish) | npm | * |
| [fancy-beige-gamefowl](https://dependencywatch.io/package/npm/fancy-beige-gamefowl) | npm | * |
| [fancy-blue-sailfish](https://dependencywatch.io/package/npm/fancy-blue-sailfish) | npm | * |
| [fancy-blush-egret](https://dependencywatch.io/package/npm/fancy-blush-egret) | npm | * |
| [fancy-pure-vfk847-project](https://dependencywatch.io/package/npm/fancy-pure-vfk847-project) | npm | * |
| [fancy-radiate-ygx449-project](https://dependencywatch.io/package/npm/fancy-radiate-ygx449-project) | npm | * |
| [fancy-tomato-pony](https://dependencywatch.io/package/npm/fancy-tomato-pony) | npm | * |
| [fandyx](https://dependencywatch.io/package/npm/fandyx) | npm | * |
| [fanfav](https://dependencywatch.io/package/npm/fanfav) | npm | * |
| [fankctoxvrkdsmgq](https://dependencywatch.io/package/npm/fankctoxvrkdsmgq) | npm | * |
| [fanta-notthedevs](https://dependencywatch.io/package/npm/fanta-notthedevs) | npm | * |
| [fantastic_bug_z3n](https://dependencywatch.io/package/npm/fantastic_bug_z3n) | npm | * |
| [fantastic_goat_dumbs](https://dependencywatch.io/package/npm/fantastic_goat_dumbs) | npm | * |
| [fantastic_goldfish_z3n](https://dependencywatch.io/package/npm/fantastic_goldfish_z3n) | npm | * |
| [fantastic_gopher_z3n](https://dependencywatch.io/package/npm/fantastic_gopher_z3n) | npm | * |
| [fantastic_hamster_z3n](https://dependencywatch.io/package/npm/fantastic_hamster_z3n) | npm | * |
| [fantastic_hedgehog_z3n](https://dependencywatch.io/package/npm/fantastic_hedgehog_z3n) | npm | * |
| [fantastic_koi_z3n](https://dependencywatch.io/package/npm/fantastic_koi_z3n) | npm | * |
| [fantastic_lemur_z3n](https://dependencywatch.io/package/npm/fantastic_lemur_z3n) | npm | * |
| [fantastic_lion_z3n](https://dependencywatch.io/package/npm/fantastic_lion_z3n) | npm | * |
| [fantastic_locust_z3n](https://dependencywatch.io/package/npm/fantastic_locust_z3n) | npm | * |
| [fantastic_lynx_z3n](https://dependencywatch.io/package/npm/fantastic_lynx_z3n) | npm | * |
| [fantastic_mackerel_z3n](https://dependencywatch.io/package/npm/fantastic_mackerel_z3n) | npm | * |
| [fantastic_magpie_z3n](https://dependencywatch.io/package/npm/fantastic_magpie_z3n) | npm | * |
| [fantastic_mollusk_z3n](https://dependencywatch.io/package/npm/fantastic_mollusk_z3n) | npm | * |
| [fantastic_rat_0xrequest](https://dependencywatch.io/package/npm/fantastic_rat_0xrequest) | npm | * |
| [fantastic_toad_z3n](https://dependencywatch.io/package/npm/fantastic_toad_z3n) | npm | * |
| [fantastic-coffee-lynx](https://dependencywatch.io/package/npm/fantastic-coffee-lynx) | npm | * |
| [fantastic-copper-heron](https://dependencywatch.io/package/npm/fantastic-copper-heron) | npm | * |
| [fantastic-crimson-dolphin](https://dependencywatch.io/package/npm/fantastic-crimson-dolphin) | npm | * |
| [fantastic-violet-hoverfly](https://dependencywatch.io/package/npm/fantastic-violet-hoverfly) | npm | * |
| [lucy-python-script-2030](https://dependencywatch.io/package/pypi/lucy-python-script-2030) | PyPI | 0.1.1, 0.1.2 |
| [pinochiomathm](https://dependencywatch.io/package/npm/pinochiomathm) | npm | 2.3.2, 2.3.3, 2.3.4, 2.3.5 |
| [tailwindcss-contact-forms](https://dependencywatch.io/package/npm/tailwindcss-contact-forms) | npm | 0.5.4, 0.5.5, 0.5.6, 0.5.7, 0.5.8, 0.5.9, 0.6.0 |

## What happened

Between roughly 2026-09-10 12:00 UTC and 2026-09-11 12:00 UTC, GitHub Advisory Database published a handful of *substantive* new npm and PyPI malware advisories, plus a very large tea.xyz token-farming spam wave. This window is *smaller than yesterday's* on analysed payloads (yesterday brought Baileys wave 3, the `@umschool/platform` Kubernetes-secrets harvester, and the "Master Harvester" Solana wallet drainers), but it introduces one novel payload family (`tailwindcss-contact-forms` Ethereum-RPC C2) and continues two already-tracked sub-waves (Baileys namespace abuse and the `@yongot/canary-mcp-*` OAST beacon operator).

## Cluster A — `pinochiomathm` (`picomatch` typosquat with AES payload)

`pinochiomathm@2.3.2/2.3.3/2.3.4/2.3.5` (GHSA-cq4w-8cp6-cmvf) impersonates the very widely used `picomatch` glob-matching library (copied README, similar API shape, deliberate misspelling meant to survive a fast copy-paste in a `package.json`).

The payload chain, from `lib/pinochiomathm.js`:

1. Base64-decodes ciphertext hidden inside `lib/parse.ts.map` (which looks like a normal source map at a glance) and writes it to `parsetmp.js`
2. HTTP-GETs `https://www.jsonkeeper.com/b/V6NBX` with a custom header - the same collector path used by `punypump` in the 2026-09-09 sweep (Cluster F)
3. Decrypts the response with AES-256-CBC using a hardcoded password
4. `eval()`s the plaintext
5. Deletes `lib/parse.ts.map`, `parsetmp.js`, `lib/init.ts.map`, and `config.js` to remove forensic artefacts

Because the plaintext is fetched at runtime from a jsonkeeper URL that the operator can rewrite at any time, per-installation payloads can differ - a static scan will only find the AES ciphertext and the URL fragments; the payload the victim actually executes has to be captured live from `jsonkeeper.com` under operator control at the moment of install. This is the third campaign in a week to use `jsonkeeper.com/b/V6NBX` as a payload host (`punypump` on 2026-09-09, an as-yet-unnamed batch reference in the internal 2026-09-10 sweep, and now `pinochiomathm`). Treat the collector path as a durable IOC.

## Cluster B — `tailwindcss-contact-forms` (Ethereum-RPC wallet-address-derived C2)

`tailwindcss-contact-forms@0.5.4/0.5.5/0.5.6/0.5.7/0.5.8/0.5.9/0.6.0` (GHSA-h9xr-6q2x-2v47) impersonates the legitimate `@tailwindcss/forms` plugin. Its `require()`-time behaviour:

1. Installs a `createRequire` and publishes `require`, `module`, and `global` into named globals - a common early-stage sandbox-escape trick
2. Imports `spawn` from `node:child_process` for arbitrary command execution
3. Enumerates a hardcoded list of public Ethereum JSON-RPC providers (`drpc.org`, `publicnode.com`, `blockscout`, `blastapi.io`) and queries transaction data touching the attacker wallet `0xa322E5f39aDC2490Ef6f0121063eD311D3080e1a`
4. POSTs results to a C2 endpoint reconstructed from interleaved string fragments ending in `ut.com/api`, with a custom `X-Payload-*` header

This is a variant of the NullReceiver / EtherHiding technique previously documented against `@kolbo/mcp`, `agentgui`, `godot-kit` (legitimate-but-compromised) and `envpack-conf`, `postcss-initial-provider`, `tailwindcss-motion-advanced` (malicious from first publish) - the campaign that OpenSourceMalware / Sonatype attributed to the DPRK-linked Contagious Interview cluster (Lazarus). The IOC-shape here matches: on-chain wallet, JSON-RPC public providers as read paths, C2 URL fragment reconstruction from string arrays. Whether this specific package is DPRK-operated is not stated in the GHSA advisory; the pattern is consistent with that operator, but attribution requires the vendor blog.

## Cluster C — `lucy-python-script-2030` (PyPI, Telegram-exfil infostealer)

`lucy-python-script-2030@0.1.1/0.1.2` (GHSA-2q36-rrph-f47p) is a PyPI infostealer. On `import` it:

1. Enumerates browser autofill databases, saved credentials, cookies
2. Reads local authentication tokens and cloud-credential files (AWS `~/.aws/credentials`, GCP application default credentials, Azure profile files)
3. Applies sandbox-detection heuristics (host uptime, MAC-address prefixes, common analysis-VM process names) to reduce noisy detection
4. Exfils via Telegram's Bot API

The advisory notes the specific 0.1.1/0.1.2 versions contained implementation bugs that reduced their effectiveness - i.e. they *would have* worked but did not fully drain most victims. Later versions (not yet on PyPI) should be presumed complete. SHA-256 `0b93ebb2207ccfa0d02d068d444dce91835203dfe89a5ece38906158b4d3b891`.

## Cluster D — Baileys wave 4 (`@fyxzpediaa/baileys`)

`@fyxzpediaa/baileys@8.1.2/9.1.0` (GHSA-5wxh-fwcf-rv5j) is the *fourth* wave of Baileys scope hijacks in as many days. Unlike wave 1-3 (which relied on obfuscated `chats.js` payloads, hardcoded C2s, or unpinned transitive GitHub-branch loaders), this wave hijacks the victim's *live WhatsApp session* to run an authenticated FOLLOW query:

- 200 seconds after WebSocket connect, the malware calls `sock.query({ tag: 'iq', ... , content: [{ tag: 'graphql', ... QueryIds.FOLLOW /* 7871414976211147 */ ... }] })` with the payload built from a base64+XOR-encoded (key `23`) newsletter JID
- The newsletter JID list is fetched from `https://raw.githubusercontent.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json` - an operator-controlled GitHub raw URL that can be swapped at any time
- The dependency `@whiskeysockets/eslint-config` references an unpinned GitHub branch instead of an npm-registry version, so the transitive publisher can inject fresh code at any time

This is *account-control*, not host-RCE - a compromised Baileys bot silently follows operator-controlled newsletters. It also demonstrates a way to trigger authenticated WhatsApp mutations on behalf of the victim (`FOLLOW`, `UNFOLLOW`, `REPORT`, `BLOCK` - any GraphQL mutation the account is authorised for) without visible UI action. The full set of Baileys namespace hijacks in the last four days: `@fyxzpediaa/baileys` (today, wave 4), `@sahril2nd/baileys` / `@nexustechpro/baileys` / `@neroxkira/vangal-baileys` (2026-09-10, wave 3), `@vallensofficial/baileys` / `@versacode/baileys` / `@haimiya/baileys` (2026-09-09, wave 2), `@web2apk/baileys` (2026-09-08, wave 1-b), `kiki-baileys` (2026-09-07, wave 1-a).

## Cluster E — `@yongot/canary-mcp-*` follow-up

Three new GHSA advisories were issued this window for the same operator that ran `@yongot/canary-mcp-isolation@1.0.1` and `@yongot/canary-mcp-test@2.0.0/3.0.0/4.0.0` yesterday (2026-09-09 sweep Cluster E, `webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b`):

| GHSA | Package | Change |
|---|---|---|
| GHSA-cr2f-c82j-mj6q | `@yongot/canary-mcp-isolation` | All versions >=0 now flagged (was `1.0.1` only) |
| GHSA-qjwm-vq22-4xx8 | `@yongot/canary-mcp-test` | All versions >=0 now flagged (was `2.0.0/3.0.0/4.0.0` only) |
| GHSA-93xr-jvm3-jpch | `@yongot/canary-mcp-test-2` | New sibling under same scope |

Combined evidence points to a security-research / red-team canary rather than commercial malware, but the OAST-beacon-with-GCP-metadata-probes payload is *distinguishable from a benign canary* only in intent - the packages still POST to a webhook.site collector under operator control.

## Cluster F — `daytona-test-*` boilerplate trio

Three new npm packages published 2026-09-11 under a shared prefix, all flagged with the full-compromise GHSA CWE-506 boilerplate but no published source or IOC analysis:

- `daytona-test-miner` (GHSA-7fxg-v94h-8j5g)
- `daytona-test-npm` (GHSA-j8pm-8rv6-xg64)
- `daytona-test-filereader` (GHSA-f2vx-rj2m-pmp8)

The `daytona-test-` prefix references Daytona (Daytona Platforms), a developer-cloud IDE. Real Daytona packages ship under `@daytonaio/*`. The `daytona-test-<capability>` naming has two plausible readings: (a) Daytona's own security team detonating test payloads under this prefix to prove their internal detection works, or (b) an external operator lookalike aimed at anyone typing `npm install daytona-test-*` from a stale Daytona tutorial. Without per-package analysis, treat as malicious.

## Cluster G — Miscellaneous OpenSSF-flagged singletons

Small, low-analysis batch:

- `cat-sis2go-utils` (GHSA-5pwp-vwhm-wm7x, all versions) - CWE-506 boilerplate on a name that looks like an internal-scope utility for a "Cat SIS2Go" build (potentially Caterpillar SIS2 Go, a heavy-equipment service tooling product; consistent with dep-confusion probing)
- `familylink@>=9.9.5, >=81.2.0` (GHSA-f5cq-29jg-wfch) - flagged by OpenSSF Package Analysis for communicating with a malicious domain and executing malicious commands. SHA-256 `dcd324585f9b17cb0f06cf892908dbc6dd3a208bb5661635da6283fe5c05f544`. Two disjoint version-range flags in one advisory is unusual and suggests two separate malicious releases collapsed under one GHSA record
- `false-positive-reddit-rce@0.0.2` (GHSA-q893-q866-7rrw) - OpenSSF-flagged; the name reads as a security-research / red-team artefact but is on the malware list all the same

## Cluster H — tea.xyz token-farming spam wave (very large)

The vast majority of the window's advisories (hundreds) are the tea.xyz token-farming spam campaign that Amazon Inspector originally detected at ~150,000 packages in Nov 2025 and that has intermittently resurged since. Sample confirmed names in this batch:

- `fancy_dormouse_z3n`, `fancy_snail_z3n`, `fancy_goose_z3n`, `fancy_wolf_z3n`, `fancy_firefly_0xrequest`, `fancy_bobcat_dumbs`, `fancy_bovid-appteadev`, `fancy_cattle_z3n`, `fancy_cricket_z3n`, `fancy_cuckoo_z3n`, `fancy-blue-sailfish`, `fancy-beige-gamefowl`, `fancy-blush-egret`, `fancy-tomato-pony`, `fancy-apricot-whitefish`, `fancy-pure-vfk847-project`, `fancy-radiate-ygx449-project`, `fancy-alligator_z3n`
- `fantastic_goldfish_z3n`, `fantastic_lynx_z3n`, `fantastic_koi_z3n`, `fantastic_hamster_z3n`, `fantastic_hedgehog_z3n`, `fantastic_lemur_z3n`, `fantastic_lion_z3n`, `fantastic_locust_z3n`, `fantastic_toad_z3n`, `fantastic_gopher_z3n`, `fantastic_magpie_z3n`, `fantastic_mackerel_z3n`, `fantastic_mollusk_z3n`, `fantastic_bug_z3n`, `fantastic_rat_0xrequest`, `fantastic_goat_dumbs`, `fantastic-copper-heron`, `fantastic-crimson-dolphin`, `fantastic-coffee-lynx`, `fantastic-violet-hoverfly`
- `famous_cicada_z3n`, `famous_firefly_z3n`, `famous_hummingbird_z3n`, `famous_hippopotamus_z3n`, `famous_marsupial_z3n`, `famous_marlin`, `famous_mite_z3n`, `famous_ox_z3n`, `famous_swordtail_z3n`, `famous_skunk_z3n`, `famous_tahr_z3n`, `famous_whale_z3n`, `famous_anaconda_z3n`, `famous_angelfish_dumbs`, `famous_angelfish-notthedev`, `famous_ape_0xrequest`, `famous_goose_z3n`, `famous_heron_z3n`, `famous-jade-felidae`, `famous-red-stoat`, `famous-amethyst-coyote`, `famous-scarlet-dog`, `famous-cyan-crayfish`, `famous-coral-fly`, `famous-aquamarine-unicorn`, `famous-beige-tern`
- `familiar_kiwi_z3n`, `familiar_lynx_z3n`, `familiar_firefly_z3n`, `familiar_herring_z3n`, `familiar_limpet_z3n`, `familiar_ptarmigan_z3n`, `familiar_marten_dumbs`, `familiar_hare_z3n`, `familiar_hippopotamus_z3n`, `familiar_jackal_z3n`, `familiar_finch_z3n`, `familiar_minnow_z3n`, `familiar_porcupine_z3n`, `familiar_prawn_scarlet-18`, `familiar_marlin-appteadev`, `familiar_jaguar_z3n`, `familiar-olive-pelican`, `familiar-orange-camel`, `familiar_bison_z3n`, `familiar_guan_z3n`, `familiar_scorpion_z3n`, `familiar_puma_z3n`
- `family-island-unlimited-energy167`, `family-island-unlimited-energy285`, `family-island-unlimited-energy362`, `family-island-unlimited-energy447`, `family-island-unlimited-energy463`
- `fanfav`, `fandyx`, `fanta-notthedevs`, `fanada`, `fankctoxvrkdsmgq`

All ship an `auto.js` / `autopublish.js` / `autopublish2.js` / `autopublish3.js` script that automatically regenerates and republishes derivative packages with fresh randomised names to inflate the operator's tea protocol reputation score. **No user-data exfiltration** is present; the victim is the npm registry itself, not the developer installing the package.

Because the total count of tea.xyz-shaped packages published in this window is in the hundreds and grows minute-by-minute, this file lists only a representative sample in the machine-readable `packages` section. The full deny-list should be **name-prefix / regex based**, not enumerated:

- `^(fancy|fantastic|famous|familiar)_[a-z]+_(z3n|dumbs|0xrequest|scarlet[-_][0-9]+)$`
- `^(fancy|fantastic|famous|familiar)_[a-z]+-(appteadev|notthedev|notthedevs)$`
- `^(fancy|fantastic|famous|familiar)-[a-z]+-[a-z]+(-[a-z]+)?$`
- `^(fancy|fantastic|famous|familiar)-(pure|radiate)-[a-z0-9]+-project$`
- `^family-island-unlimited-energy[0-9]+$`

## Distinction from the parallel 2026-09-10 sweep

Yesterday's file covered Baileys wave 3, the `@umschool/platform` Kubernetes-secrets harvester, the "Master Harvester" Solana wallet drainer template (`gmgn-trading-kit`, `soltinel-pro`), the Discord MFA lure trio (`mfatest2`, `discord-mfa-solver`, `mfaby`), the `twilio-hackerone-poc-b8f21a` explicit HackerOne POC, the `matrixkit-js` AES-loader, and `@staticj/cropperxmjs` Cropper.js userscript-RCE. Today's window is smaller on analysed payloads but adds one novel C2 shape (Ethereum-RPC read of an attacker wallet, Cluster B) and one novel behavioural payload (WhatsApp session-forced FOLLOW, Cluster D). The tea.xyz Cluster H is entirely new to this file - previous sweeps were dominated by analysed payloads and did not surface tea.xyz spam waves.

## Registry state

All packages in Clusters A-G below are flagged as malware on npm / PyPI and quarantined. The Cluster H tea.xyz spam packages are auto-published and re-auto-published continuously - even after registry takedown, fresh randomised names appear within minutes under the same operator infrastructure. Only prefix / regex denylists on internal mirrors are durable mitigation.

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `amazon-inspector`. Per-package IOC details drawn verbatim from GHSA advisory bodies published between 2026-09-10 and 2026-09-11 UTC.

## Impact

- **Cluster A — `pinochiomathm` `picomatch` typosquat (AES payload from `jsonkeeper.com`)**: `pinochiomathm@2.3.2/2.3.3/2.3.4/2.3.5` (GHSA-cq4w-8cp6-cmvf) masquerades as the very popular `picomatch` glob matcher (copied README, similar API surface) but its `lib/pinochiomathm.js` extracts a base64-encoded payload from `lib/parse.ts.map` into `parsetmp.js`, HTTP-GETs `https://www.jsonkeeper.com/b/V6NBX` with a custom header, decrypts the response using AES-256-CBC with a hardcoded key, and `eval()`s the plaintext, then deletes `lib/parse.ts.map`, `parsetmp.js`, `lib/init.ts.map`, and `config.js` to erase traces. Same `jsonkeeper.com/b/V6NBX` collector as `punypump` from the 2026-09-09 sweep - shared operator / rehosted collector across the two campaigns
- **Cluster B — `tailwindcss-contact-forms` Ethereum-RPC wallet drainer**: `tailwindcss-contact-forms@0.5.4-0.6.0` (GHSA-h9xr-6q2x-2v47) impersonates the legitimate `@tailwindcss/forms` plugin. On `require()` the module installs a `createRequire` and publishes `require`, `module`, and `global` into named globals, then spawns child processes via `node:child_process.spawn`. It enumerates public Ethereum JSON-RPC endpoints (`drpc.org`, `publicnode.com`, `blockscout`, `blastapi.io`), queries transaction data associated with the hardcoded attacker wallet `0xa322E5f39aDC2490Ef6f0121063eD311D3080e1a`, and POSTs results with a custom `X-Payload-*` header to an external endpoint reconstructed from string-array fragments ending in `ut.com/api`. Variant of the DPRK-linked NullReceiver / Contagious Interview blockchain-C2 technique previously documented against `envpack-conf` / `postcss-initial-provider` / `tailwindcss-motion-advanced` and the legitimate-but-compromised `@kolbo/mcp`, `agentgui`, and `godot-kit`
- **Cluster C — `lucy-python-script-2030` PyPI infostealer (Telegram exfil)**: `lucy-python-script-2030@0.1.1/0.1.2` (GHSA-2q36-rrph-f47p) is a PyPI infostealer that during `import` attempts to harvest browser data (saved credentials, cookies, autofill), authentication tokens, and cloud credentials. Includes sandbox-detection to evade analysis environments and exfiltrates via a Telegram bot, matching the 2026-09-lucy-python-script-2030 campaign fingerprint. The specific 0.1.1/0.1.2 versions contained implementation errors that reduced effectiveness, but the collection routine is intact. SHA-256 `0b93ebb2207ccfa0d02d068d444dce91835203dfe89a5ece38906158b4d3b891`
- **Cluster D — Baileys wave 4 (`@fyxzpediaa/baileys` newsletter-forced-follow)**: `@fyxzpediaa/baileys@8.1.2/9.1.0` (GHSA-5wxh-fwcf-rv5j) is a fourth-wave Baileys scope hijack that behaves differently from wave 1-3: instead of stealing credentials or dropping RATs, it *injects a covert remote-directed action into the victim's WhatsApp socket*. 200 seconds after the WebSocket connects the malware runs an authenticated `FOLLOW` query (`QueryIds.FOLLOW = 7871414976211147`) using the victim's Signal-identity credentials against a hardcoded WhatsApp newsletter JID decoded via `base64+XOR` (key=23). The newsletter list is pulled from `https://raw.githubusercontent.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json` (an operator-controlled GitHub raw URL) and the dependency `@whiskeysockets/eslint-config` references a mutable GitHub branch instead of a pinned tag. Confirmed reach is account-control not host-RCE, but the operator can pivot to further authenticated WhatsApp mutations at any time
- **Cluster E — `@yongot/canary-mcp-*` follow-up advisories (three new GHSA IDs, same operator as 2026-09-09 Cluster E)**: `@yongot/canary-mcp-isolation` (GHSA-cr2f-c82j-mj6q, ALL versions >=0 flagged), `@yongot/canary-mcp-test` (GHSA-qjwm-vq22-4xx8, ALL versions >=0 flagged), and *new sibling* `@yongot/canary-mcp-test-2` (GHSA-93xr-jvm3-jpch, ALL versions >=0 flagged). Broader all-versions coverage on the two already-flagged packages plus a fresh `-test-2` sibling published under the same disposable scope - same OAST beacon operator that hit `webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b` with GCP metadata probes in yesterday's sweep. Any organization that already caught `@yongot/canary-mcp-isolation@1.0.1` or `@yongot/canary-mcp-test@2.0.0/3.0.0/4.0.0` from that sweep should widen the block to the entire `@yongot/` scope
- **Cluster F — `daytona-test-*` npm boilerplate trio (three packages published 2026-09-11, no analysis)**: `daytona-test-miner` (GHSA-7fxg-v94h-8j5g), `daytona-test-npm` (GHSA-j8pm-8rv6-xg64), and `daytona-test-filereader` (GHSA-f2vx-rj2m-pmp8), all versions >=0, flagged with the full-compromise GHSA CWE-506 boilerplate ("any computer that has this package installed or running should be considered fully compromised") but no published payload analysis or source. The `daytona-test-` name-prefix impersonates or references the Daytona (Daytona Platforms) developer-cloud IDE - either a targeted lookalike lure aimed at Daytona users, or a testing artefact from Daytona's own security researchers. Assume malicious pending independent per-package analysis
- **Cluster G — CWE-506 boilerplate / OpenSSF-flagged singletons (small)**: `cat-sis2go-utils` (GHSA-5pwp-vwhm-wm7x, all versions) - CWE-506 boilerplate on a name that looks like an internal-scope utility for a "Cat SIS2Go" build. `familylink@>=9.9.5, >=81.2.0` (GHSA-f5cq-29jg-wfch) - OpenSSF Package Analysis flagged it for communicating with a malicious domain and executing malicious commands, SHA-256 `dcd324585f9b17cb0f06cf892908dbc6dd3a208bb5661635da6283fe5c05f544`. `false-positive-reddit-rce@0.0.2` (GHSA-q893-q866-7rrw) - OpenSSF-flagged, name pattern suggests security research / red-team artefact but currently listed as malicious
- **Cluster H — tea.xyz token-farming spam wave (very large, hundreds of npm packages, all boilerplate)**: The sweep window is dominated by a fresh burst of the tea.xyz token-farming spam campaign originally detected at ~150,000 packages by Amazon Inspector in Nov 2025 and periodically resurgent since. Naming patterns confirmed in this batch: `fancy_<animal>_z3n`, `famous_<animal>_z3n`, `fantastic_<animal>_z3n`, `familiar_<animal>_z3n`, `<name>_dumbs`, `<name>_0xrequest`, `<name>-appteadev`, `<name>-notthedev(s)`, `<color>-<gemstone>-<animal>`, `family-island-unlimited-energy<NNN>`, `<name>-<color>-<verb>-<code>-project`, plus one-off names like `fandyx`, `fanfav`, `fanta-notthedevs`, `fanada`. Each package ships an autopublish routine (`auto.js`, `autopublish.js`, `autopublish2.js`, `autopublish3.js`) that removes the `private` flag from `package.json`, bumps version numbers, and continuously republishes derivative packages with randomised Indonesian/English animal-and-color names to inflate developer reputation metrics for tea protocol token rewards. No user-data exfiltration; the *ecosystem* is the victim (npm registry pollution, resolver-cache noise, false-positive noise in threat feeds). Package counts in this specific window are in the hundreds - see references and searchable name-prefix rules below

## What to do

1. Grep every `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `package.json`, `requirements.txt`, and `poetry.lock` in your org for the specific package names in Clusters A-F below. Uninstall on hit, wipe `node_modules`, delete the lockfile, and rebuild against a clean cache
2. **For Cluster A `pinochiomathm`**: any host that installed `pinochiomathm@2.3.2-2.3.5` executed operator-supplied JavaScript decrypted from `jsonkeeper.com/b/V6NBX` and should be treated as fully compromised. Rotate SSH keys, cloud tokens, and any secrets touched by the affected build. Block `jsonkeeper.com` at corporate egress (this is now the third campaign this week using it as an AES-encrypted-payload host). Pin the real upstream `picomatch` explicitly in `package.json` and enforce it in CI
3. **For Cluster B `tailwindcss-contact-forms`**: any host that imported `tailwindcss-contact-forms@0.5.4-0.6.0` may have leaked build-environment recon. Block `*.ut.com` at corporate egress, and audit ETH RPC-endpoint egress logs from build containers for outbound queries to `drpc.org`, `publicnode.com`, `blockscout.com`, and `blastapi.io`. Any wallets on hosts that ran this package should be considered leaked at the address-derivation level (though this variant reads the attacker wallet, not the victim wallet). Pin the real upstream `@tailwindcss/forms` explicitly in `package.json`
4. **For Cluster C `lucy-python-script-2030`**: any Python environment that imported `lucy-python-script-2030` may have leaked browser autofill, saved credentials, cookies, and cloud tokens over Telegram's Bot API. Rotate every credential from the affected host, invalidate cloud sessions, and block outbound requests to `api.telegram.org` from CI runners that don't need it
5. **For Cluster D Baileys wave 4 (`@fyxzpediaa/baileys`)**: any Baileys-based WhatsApp bot that installed `@fyxzpediaa/baileys@8.1.2/9.1.0` has silently followed an operator-controlled WhatsApp newsletter under the victim account 200 seconds after connect. Unfollow any unexpected newsletters, audit `raw.githubusercontent.com/skyzopedia/*` egress in logs, and pin the real upstream `@whiskeysockets/baileys` in `package.json`. The Baileys namespace has now been hit *at least eight times in four days* (this wave 4 plus the wave 1-3 packages in the 2026-09-08/09/10 sweeps) - every Baileys-labelled package other than `@whiskeysockets/baileys` should currently be treated as suspicious
6. **For Cluster E `@yongot/canary-mcp-*`**: widen any existing block from the two individual packages already caught (2026-09-09 sweep Cluster E) to the entire `@yongot/` npm scope, and add the new `@yongot/canary-mcp-test-2` name to internal deny-lists. If your CI logs show any resolution against the `@yongot/` scope from public npm, revoke any GCP service-account tokens that could have been reachable at `169.254.169.254`, and block `webhook.site` at corporate egress
7. **For Cluster F `daytona-test-*`**: block all three names in internal registries. If your organization actually uses the Daytona developer-cloud IDE and installs anything Daytona-flavoured from public npm, pin the real upstream (`@daytonaio/*`) explicitly in `package.json` and audit any build container that resolved a `daytona-test-*` name from public npm as if the full-compromise GHSA boilerplate applied, pending independent per-package analysis
8. **For Cluster H tea.xyz spam**: these packages do not contain user-data exfil, so they are not an urgent host-compromise priority - but they clutter internal mirrors and dependency graphs. Add prefix rules to internal-mirror deny-lists (Verdaccio / Artifactory / Nexus) for `fancy_*_z3n`, `famous_*_z3n`, `fantastic_*_z3n`, `familiar_*_z3n`, `*_dumbs`, `*_0xrequest`, `*-appteadev`, `*-notthedev`, `*-notthedevs`, `family-island-unlimited-energy*`, `*-<color>-<animal>` composite names (any autogenerated Indonesian-English zoology combinatorics on npm this year is almost certainly tea.xyz spam)
9. For every `npm install` and `pip install` in CI, prefer `--ignore-scripts` / `--no-build-isolation` where feasible to block postinstall/preinstall/setup.py payloads. This blocks Clusters A, B, C, D, E, F, and the executable half of H entirely for lockfile-consumer paths
10. Add every specific name below to internal private-registry deny-lists for at least 30 days to prevent re-uploads by rotating operators. Also block scopes `@fyxzpediaa/`, `@yongot/` (broader than yesterday), and `daytona-test-*` prefix

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-cq4w-8cp6-cmvf - pinochiomathm (Cluster A - picomatch typosquat, jsonkeeper.com/b/V6NBX AES payload)](https://github.com/advisories/GHSA-cq4w-8cp6-cmvf) - GitHub
- [GHSA-h9xr-6q2x-2v47 - tailwindcss-contact-forms (Cluster B - Ethereum-RPC wallet-derived C2)](https://github.com/advisories/GHSA-h9xr-6q2x-2v47) - GitHub
- [GHSA-2q36-rrph-f47p - lucy-python-script-2030 (Cluster C - PyPI Telegram infostealer)](https://github.com/advisories/GHSA-2q36-rrph-f47p) - GitHub
- [GHSA-5wxh-fwcf-rv5j - @fyxzpediaa/baileys (Cluster D - Baileys wave 4 newsletter-forced-FOLLOW)](https://github.com/advisories/GHSA-5wxh-fwcf-rv5j) - GitHub
- [GHSA-cr2f-c82j-mj6q - @yongot/canary-mcp-isolation follow-up (Cluster E)](https://github.com/advisories/GHSA-cr2f-c82j-mj6q) - GitHub
- [GHSA-qjwm-vq22-4xx8 - @yongot/canary-mcp-test follow-up (Cluster E)](https://github.com/advisories/GHSA-qjwm-vq22-4xx8) - GitHub
- [GHSA-93xr-jvm3-jpch - @yongot/canary-mcp-test-2 (Cluster E - new sibling)](https://github.com/advisories/GHSA-93xr-jvm3-jpch) - GitHub
- [GHSA-7fxg-v94h-8j5g - daytona-test-miner (Cluster F)](https://github.com/advisories/GHSA-7fxg-v94h-8j5g) - GitHub
- [GHSA-j8pm-8rv6-xg64 - daytona-test-npm (Cluster F)](https://github.com/advisories/GHSA-j8pm-8rv6-xg64) - GitHub
- [GHSA-f2vx-rj2m-pmp8 - daytona-test-filereader (Cluster F)](https://github.com/advisories/GHSA-f2vx-rj2m-pmp8) - GitHub
- [GHSA-5pwp-vwhm-wm7x - cat-sis2go-utils (Cluster G boilerplate)](https://github.com/advisories/GHSA-5pwp-vwhm-wm7x) - GitHub
- [GHSA-f5cq-29jg-wfch - familylink (Cluster G - OpenSSF-flagged malicious-domain communication)](https://github.com/advisories/GHSA-f5cq-29jg-wfch) - GitHub
- [GHSA-q893-q866-7rrw - false-positive-reddit-rce (Cluster G)](https://github.com/advisories/GHSA-q893-q866-7rrw) - GitHub
- [Amazon Inspector: over 150,000 malicious packages linked to token farming campaign (Cluster H origin)](https://aws.amazon.com/blogs/security/amazon-inspector-detects-over-150000-malicious-packages-linked-to-token-farming-campaign/) - AWS
- [Socket: Another Round of TEA Protocol Spam Floods npm (Cluster H context)](https://socket.dev/blog/tea-protocol-spam-floods-npm-but-its-not-a-worm) - Socket
- [Sonatype: Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads (Cluster B precedent)](https://www.sonatype.com/blog/six-npm-packages-use-ethereum-transactions-to-retrieve-malicious-payloads) - Sonatype
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF

---

Canonical page: https://dependencywatch.io/incident/multi-2026-09-11-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-09-11-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).