DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
HighAdvisory sweepPublished 14 Sept 202658 packages · 59 versions

GitHub Advisory malware sweep - 2026-09-13/14 (`chroma-client` continues `2026-09-openaii` AI SDK typosquat wave, `python-fork` PyPI fork bomb, `job-iteration` npm CWE-506, huge `joko-*` Indonesian-food tea.xyz spam explosion with autopublish sources `joan-teadev`/`joknmax`, `joint_*_z3n`/`_0xrequest` continuation, `joker123`/`joker388` casino spam)

Summary

GHSA 2026-09-13/14: PyPI chroma-client extends the 2026-09-openaii typosquat wave (chromadb typosquat, same infostealer+cryptominer payload as openaii/langgrap/transfomers/ollamaa); PyPI python-fork is a plain import-time fork bomb; npm job-iteration flagged as CWE-506 malware. Otherwise the day is a massive tea.xyz autopublish spam wave — hundreds of joko-{Indonesian food}-{suffix} names sourced from joan-teadev/joknmax autopublish scripts, plus joint_*_z3n/joint_*_0xrequest continuation of the 2026-09-11 family_*_z3n operator and joker123/joker388 casino-themed spam.

typosquatinfostealercredential-theftobfuscationdependency-confusion
Incident type
Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis · amazon-inspector
Also known as
2026-09-14 GHSA npm/PyPI sweep · 2026-09-openaii AI SDK typosquat wave (chroma-client extends) · 2026-09-python-fork PyPI fork bomb · job-iteration npm CWE-506 · joko-* Indonesian-food tea.xyz autopublish spam wave · joan-teadev / joknmax autopublish source packages · joint_*_z3n / joint_*_0xrequest continuation (2026-09-11 family_*_z3n operator) · joker123 / joker388 casino spam
Ecosystems
npmPyPI
Packages tracked
58

What happened

Between roughly 2026-09-12 12:00 UTC and 2026-09-14 06:00 UTC, GitHub Advisory Database published one critical continuation of a live active campaign (Cluster A chroma-client — fifth confirmed package in the 2026-09-openaii AI-SDK typosquat wave that Wiz, OpenSSF, Amazon Inspector and Snyk started documenting yesterday), one small-but-real DoS package (Cluster B python-fork fork bomb), one CWE-506 boilerplate npm entry with a plausible cross-ecosystem-typosquat theory (Cluster C job-iteration), and an unusually large tea.xyz autopublish spam explosion organised around Indonesian food names (Cluster D joko-*) plus continuation of prior spam operators (Clusters E-G).

Cluster A - chroma-client (continues 2026-09-openaii AI SDK typosquat wave, chromadb typosquat)

chroma-client<=0.5.7 (GHSA-qp4x-pg53-7xh8) is a PyPI typosquat of chromadb, the official Python client for the Chroma vector database that is a standard component of retrieval-augmented-generation (RAG) pipelines. The GHSA advisory explicitly notes the package "uses exactly the same technique as other packages from the campaign aiming to mislead LLM security tools" — attributing it to the ongoing 2026-09-openaii campaign that this file series has been tracking since 2026-09-12.

Payload shape (per shared campaign fingerprint):

  1. Import-time (or .pth-triggered) hook downloads a remote script
  2. Second stage is heavily obfuscated, explicitly designed against AI-based static analysers
  3. Exfiltrates SSH keys, ~/.aws/credentials, GCP ADC, Azure profile
  4. Installs a cryptominer
  5. Installs a persistence mechanism (campaign siblings use systemd user units and shell-rc autoruns)
  6. Clears logs / covers tracks

Campaign fingerprint (five confirmed packages so far, plus a DNS-staged loader sibling):

DatePackageTyposquat ofGHSASource hash
2026-09-12langgrap@0.2.45langgraphGHSA-crjm-2g45-pq9780943fa8…744b1db9
2026-09-12openaii<=1.55.3openaiGHSA-q5h5-h6mj-vhgvc49a2850…21e79120
2026-09-12transfomers@4.44.2transformersGHSA-2p95-qvc5-6rjqc6a3963d…9befec9a
2026-09-12ollamaa@0.4.2ollamaGHSA-9gv4-vfjg-jjrm(not disclosed)
2026-09-12platform-telemetry-client@1.0.0 (DNS-staged, aborted)—GHSA-7767-763c-fxp37464733f…3cb0a0eb
2026-09-13chroma-client<=0.5.7chromadbGHSA-qp4x-pg53-7xh8f74658eb…fe2e5153

The combined pick chromadb + langgraph + openai + transformers + ollama covers the exact stack an AI-agent developer will pip install in one session. Treat this campaign as actively expanding and pin every AI/ML SDK explicitly with hash-pinned requirements files. Also see: full technical breakdown of the wave in multi-2026-09-12-ghsa-malware-sweep.ts (Cluster C).

Cluster B - python-fork (PyPI fork bomb, 2026-09-python-fork campaign)

python-fork@0.1.0/0.1.1 (GHSA-v8v2-jgrm-w335) — importing the module starts a fork bomb, exhausting the process table and CPU until the host is unresponsive or crashes. This is a pure availability attack; there is no data-theft payload. Amazon Inspector source hash 0bff8869…186c1e78. Campaign label 2026-09-python-fork (MAL-2026-16142). Reported by OpenSSF via kam193 / bad-packages.kam193.eu.

Because the fork bomb executes on import (not at install), --ignore-scripts and pip install --no-build-isolation do NOT prevent detonation on a host that later imports the module. The only reliable mitigation is not to install it in the first place — pin an explicit denylist entry on internal PyPI mirrors and require a hash-pinned requirements file for any Python-fork-adjacent dependency.

Cluster C - job-iteration (npm CWE-506 boilerplate; possible Shopify Ruby-gem lookalike)

job-iteration@* (GHSA-jh9v-79h6-prqm) — npm package flagged by OpenSSF Package Analysis with the standard CWE-506 "embedded malicious code" boilerplate. No published payload analysis, no IOCs beyond the takedown itself, MAL-2025-23828.

What makes this worth calling out separately from the general spam floor: there is no legitimate npm job-iteration publisher, and the name is a near-exact match for Shopify's widely-used job-iteration Ruby gem for iterating Sidekiq jobs safely. The most plausible read is a cross-ecosystem lookalike / dependency-confusion probe aimed at a developer who remembers "job-iteration" as a queue-iteration library and searches npm for it. Treat as medium pending payload analysis; ignore-scripts + a private-registry scope rule that blocks bare-name npm resolution for any name your org uses in another ecosystem blocks it entirely.

Cluster D - joko-{Indonesian-food}-{suffix} npm tea.xyz autopublish spam explosion (hundreds of packages, source scripts published same day)

2026-09-13 saw an unusually large tea.xyz token-farming autopublish spam wave organised around Indonesian street-food names. Naming grammar:

joko-<dish><n>-<suffix>

where the dish word is one of klanting, ketan, ketoprak, kepok, keripik, keraktelor, kemplang, botok, bakwan, asinan, or bakso; <n> is a small integer; and <suffix> cycles through breki, miaww, riris, ruro, apidev, sukiwir, sluey, remi. GHSA published hundreds of these on 2026-09-13; a representative sample is enumerated in the packages map below.

The autopublish source packages joan-teadev and joknmax were flagged the same day — these are what actually contain the loop:

  • joan-teadev@* (GHSA-rmm9-rq4q-rhh9) — hash c844cc33…01d531f3. Contains auto.js, autopublish.js, autopublish2.js, autopublish3.js; modifies package.json (removes "private": true, bumps version, publishes) and cycles derivative names.
  • joknmax@* (GHSA-rwc2-pm3r-wx4g) — hash 8111feb6…45745e4. Identical autopublish shape.

Both are attributed to the tea.xyz token-reward campaign that pays out to publishers of "distinct" npm packages regardless of content. This wave is materially larger than the 2026-09-11 fancy_*_z3n batch but uses a different naming grammar; it is the same operator category but not necessarily the same wallet. Remove the source packages first — that stops the autopublish loop faster than chasing every joko-* name individually.

Cluster E - joint_{animal}_z3n / joint_{animal}_0xrequest (continues 2026-09-11 family_*_z3n operator, new prefix)

Same tea.xyz auto-publish shape and same _z3n / _0xrequest operator-suffix conventions documented in 2026-09-11 Cluster J. New prefix joint_ with animal words (hedgehog, panther, hookworm, elephant, pony, raccoon, sheep, swan, porpoise, perch, primate, tortoise). Continue applying the _z3n$ / _0xrequest$ regex denylist from 2026-09-11 to internal mirrors; this file does not re-enumerate every name.

Cluster F - joker123 / joker388 casino-themed spam singletons

Four singletons — joker123, joker123-slot, joker123-gaming, joker388 — flagged with the standard CWE-506 boilerplate. "Joker123" and "Joker388" are real online-slot brands widely SEO-targeted in the Indonesian and broader SE-Asian online-gambling market, which is a plausible source of the naming choice (whether the intent is SEO-farm placeholders, spam, or something else, no published payload analysis is available). Ignore-scripts blocks any preinstall behaviour they might carry.

Cluster G - jnmirdcugstvxqaz random-string singleton

Single random-string name (jnmirdcugstvxqaz), CWE-506 boilerplate, no published payload. Matches the "brand-new fresh-npm-account with autogenerated name" pattern seen throughout the year. Ignore-scripts is sufficient mitigation for this class.

Cross-operator patterns worth flagging

  1. The 2026-09-openaii campaign is expanding on a daily cadence — five confirmed packages plus a DNS-staged loader in three days, targeting the exact AI/ML SDK stack RAG developers install. Pin every AI/ML SDK explicitly with hash-pinned requirements files, block the campaign names on internal mirrors, and add a strict-name-match rule for chromadb / openai / langgraph / langchain / transformers / ollama / anthropic at your organisation's Python resolution layer.
  2. Tea.xyz spam volume shows no sign of slowing — 2026-09-11 hundreds of family_*_z3n; 2026-09-13 hundreds of joko-*. Kill the SOURCE packages (joan-teadev, joknmax today; the equivalent source on 2026-09-11) rather than chasing derivatives.
  3. Cross-ecosystem lookalikes are a real subclass (Cluster C). Any name your org uses in another ecosystem should not resolve on npm from a bare name.

Registry state

All packages in Clusters A-C and the specific enumerated singletons in Clusters F/G are flagged as malware on npm / PyPI and quarantined at the time of writing. Cluster D joko-* and Cluster E joint_* tea.xyz spam is auto-republished continuously under fresh derivative names under the same operator infrastructure; only prefix / regex denylists on internal mirrors are durable mitigation.

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector (via kam193 / bad-packages.kam193.eu). Per-package IOC details drawn verbatim from GHSA advisory bodies published between 2026-09-12 and 2026-09-14 UTC.

Affected packages (58)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.jsonCheck requirements.txt

Impact

  • Cluster A — chroma-client PyPI chromadb typosquat (continues 2026-09-openaii campaign, same operator as openaii/langgrap/transfomers/ollamaa): chroma-client<=0.5.7 (GHSA-qp4x-pg53-7xh8) is a typosquat of the legitimate chromadb client (the standard Python SDK for the Chroma vector database used in RAG pipelines). The advisory explicitly notes it "uses exactly the same technique as other packages from the campaign aiming to mislead LLM security tools" — the same second-stage-download, AI-scanner-aware obfuscation, cryptomining, SSH-key/~/.aws/credentials/GCP ADC/Azure profile exfiltration, persistence, and log-clearing pattern documented in yesterday's Cluster C (2026-09-12 sweep). Amazon Inspector source hash f74658eb…fe2e5153. Campaign label 2026-09-openaii (MAL-2026-16143). This is now the fifth confirmed package in the wave (openaii, langgrap, transfomers, ollamaa on 2026-09-12, plus platform-telemetry-client on 2026-09-12; sixth counting the sibling DNS-staged loader)
  • Cluster B — python-fork PyPI fork bomb (2026-09-python-fork campaign): python-fork@0.1.0/0.1.1 (GHSA-v8v2-jgrm-w335) — importing the module starts a fork bomb, exhausting process-table and CPU resources until the host is unresponsive or crashes. Not a data-theft payload; a plain availability attack against any system that imports the package. Amazon Inspector source hash 0bff8869…186c1e78. Campaign label 2026-09-python-fork (MAL-2026-16142). Same operator infrastructure as OpenSSF bad-packages.kam193.eu PyPI batch of the same day
  • Cluster C — job-iteration npm CWE-506 boilerplate (possible job-iteration Shopify Ruby gem lookalike): job-iteration@* (GHSA-jh9v-79h6-prqm) — npm package flagged by OpenSSF Package Analysis with the standard CWE-506 "embedded malicious code" boilerplate; no published payload analysis. Name matches Shopify's widely-used job-iteration Ruby gem for iterating Sidekiq jobs. There is no legitimate npm job-iteration publisher, so this is most plausibly a cross-ecosystem lookalike / dependency-confusion probe aimed at developers searching npm for what they remember as a Ruby library. Treat as medium pending payload analysis; ignore-scripts + private-registry pinning blocks it entirely. Campaign label MAL-2025-23828
  • Cluster D — Massive joko-{Indonesian-food}-{suffix} npm tea.xyz autopublish spam (hundreds of packages, source scripts published): An unusually large 2026-09-13 wave of tea.xyz token-farming autopublish spam. Naming pattern joko-<indonesian-dish-word><small-int>-<suffix> where the dish word cycles through klanting, ketan, ketoprak, kepok, keripik, keraktelor, kemplang, botok, bakwan, asinan, bakso and the suffix cycles through breki, miaww, riris, ruro, apidev, sukiwir, sluey, remi. The AUTOPUBLISH SOURCE packages joan-teadev@* (GHSA-rmm9-rq4q-rhh9) and joknmax@* (GHSA-rwc2-pm3r-wx4g) were flagged the same day and are what actually contain the autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js); the joko-* names are the derivative packages the autopublish loop generates. joan-teadev source hash c844cc33…01d531f3; joknmax source hash 8111feb6…45745e4
  • *Cluster E — joint_{animal}_z3n / joint_{animal}_0xrequest npm continuation (2026-09-11 `family__z3n operator, new prefix)**: joint_hedgehog_z3n, joint_panther_z3n, joint_hookworm_z3n, joint_elephant_z3n, joint_pony_z3n, joint_raccoon_z3n, joint_sheep_z3n, joint_swan_z3n, joint_perch_0xrequest, joint_porpoise_0xrequest, joint_primate_0xrequest, joint_tortoise-appteadev. Same _z3n / _0xrequest suffix and same tea.xyz auto-publish shape documented in 2026-09-11 Cluster J (fancy__z3n, famous__z3n, familiar__z3n, fantastic__z3n). Continue to apply the _z3n$ / _0xrequest$` regex denylist rules from 2026-09-11 to internal mirrors; no per-name enumeration here
  • Cluster F — joker123 / joker388 npm casino-themed spam singletons: joker123@* (GHSA-6gmp-rvjx-wv93), joker123-slot@* (GHSA-3p35-jmvr-q36r), joker123-gaming@* (GHSA-w7mq-frpg-3qw6), joker388@* (GHSA-p9qp-fxrq-ch3w). Same CWE-506 boilerplate; names read as SEO-farm placeholders for Indonesian/SE-Asian online casino brands ("Joker123" / "Joker388" are real online-slot brands widely SEO-targeted in that region). No published payload analysis; treat as spam/beacon consistent with the wider tea.xyz mixed-name spam floor
  • Cluster G — jnmirdcugstvxqaz npm random-string singleton: jnmirdcugstvxqaz@* (GHSA-7r7p-23fg-8m87) — CWE-506 boilerplate flag with no published payload analysis. Random-string name shape matches the auto-generated "brand-new fresh-npm-account" pattern seen throughout the year. Treat as tea.xyz spam floor

What to do

  1. 1Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, package.json, requirements.txt, poetry.lock, and Pipfile.lock in your org for the specific package names in Clusters A-C below. Uninstall on hit, wipe node_modules / the affected venv, delete the lockfile, rebuild against a clean cache, and rotate every credential the affected host could have touched
  2. 2For Cluster A chroma-client: any Python environment that installed chroma-client<=0.5.7 executed the operator-supplied 2026-09-openaii second-stage payload, meaning SSH keys, ~/.aws/credentials, GCP ADC, and Azure profile were exfiltrated and a cryptominer + persistence were installed. Rotate every credential from the affected host and search for persistence (the campaign uses systemd user units and shell-rc autoruns). Pin the real upstream chromadb explicitly with a hash-pinned requirements file. Add chroma-client (with the wrong hyphen) to any AI/ML-stack pipeline denylist alongside langgrap/openaii/transfomers/ollamaa from yesterday
  3. 3For Cluster B python-fork: hosts that imported python-fork@0.1.0/0.1.1 may need a hard reboot to recover — this is a resource-exhaustion DoS, not a data-theft payload, so credential rotation is not required. Remove the package, then audit requirements.txt for any dependency accidentally pinning to it. --ignore-scripts does NOT block this — the fork bomb runs on import, not at install
  4. 4For Cluster C job-iteration (npm): any org that uses Shopify's job-iteration Ruby gem should audit npm dependencies for a mistaken npm install job-iteration — remove the npm package and pin the Ruby gem via Gemfile where the queue-iteration behaviour actually lives. Configure private-registry scope resolution to block bare-name npm resolution for any name your org uses in another ecosystem
  5. 5*For Cluster D `joko- tea.xyz spam**: apply regex denylist ^joko-(klanting|ketan|ketoprak|kepok|keripik|keraktelor|kemplang|botok|bakwan|asinan|bakso)\d*-(breki|miaww|riris|ruro|apidev|sukiwir|sluey|remi)$ to internal npm mirrors, and separately block joan-teadev and joknmax (the autopublish SOURCE packages that actually contain the loops). Report joan-teadev and joknmax` to npm for takedown priority — removing the source packages stops the autopublish loop faster than chasing every derivative
  6. 6*For Cluster E `joint__z3n / joint__0xrequest`*: same as 2026-09-11 Cluster J — apply _z3n$ / _0xrequest$ regex rules to internal mirrors
  7. 7For Cluster F/G joker123 etc. singletons: single-name deny is enough; no operator-durable IOC beyond the names themselves
  8. 8For every npm install and pip install in CI, prefer --ignore-scripts / --no-build-isolation (pip 23+) or an equivalent lockfile-consumer mode that blocks preinstall/postinstall/setup.py payloads. This does NOT block Cluster A (a Python .pth file loader runs on interpreter startup, and Chroma package imports run at import time) or Cluster B (import-time fork bomb). Use hash-pinned requirements files for AI/ML stacks
  9. 9Add every specific name below to internal private-registry deny-lists for at least 30 days to prevent re-uploads by rotating operators. Extend the tea.xyz prefix/regex denylist from the 2026-09-11 sweep with the joko-* and joint_* patterns from Clusters D and E

References

Back to feedSubmit a correction
multi-2026-09-14-ghsa-malware-sweep