# GitHub Advisory malware sweep - 2026-09-13/14 (`chroma-client` continues `2026-09-openaii` AI SDK typosquat wave, `python-fork` PyPI fork bomb, `job-iteration` npm CWE-506, huge `joko-*` Indonesian-food tea.xyz spam explosion with autopublish sources `joan-teadev`/`joknmax`, `joint_*_z3n`/`_0xrequest` continuation, `joker123`/`joker388` casino spam)

> GHSA 2026-09-13/14: PyPI `chroma-client` extends the `2026-09-openaii` typosquat wave (`chromadb` typosquat, same infostealer+cryptominer payload as `openaii`/`langgrap`/`transfomers`/`ollamaa`); PyPI `python-fork` is a plain import-time fork bomb; npm `job-iteration` flagged as CWE-506 malware. Otherwise the day is a massive tea.xyz autopublish spam wave — hundreds of `joko-{Indonesian food}-{suffix}` names sourced from `joan-teadev`/`joknmax` autopublish scripts, plus `joint_*_z3n`/`joint_*_0xrequest` continuation of the 2026-09-11 `family_*_z3n` operator and `joker123`/`joker388` casino-themed spam.

- Published: 2026-09-14
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 58 packages, 59 compromised versions
- Tags: typosquat, infostealer, credential-theft, obfuscation, dependency-confusion
- Also known as: 2026-09-14 GHSA npm/PyPI sweep, 2026-09-openaii AI SDK typosquat wave (chroma-client extends), 2026-09-python-fork PyPI fork bomb, job-iteration npm CWE-506, joko-* Indonesian-food tea.xyz autopublish spam wave, joan-teadev / joknmax autopublish source packages, joint_*_z3n / joint_*_0xrequest continuation (2026-09-11 family_*_z3n operator), joker123 / joker388 casino spam
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector
- Incident ID: multi-2026-09-14-ghsa-malware-sweep

## Affected packages (58)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [chroma-client](https://dependencywatch.io/package/pypi/chroma-client) | PyPI | <=0.5.7 |
| [jnmirdcugstvxqaz](https://dependencywatch.io/package/npm/jnmirdcugstvxqaz) | npm | * |
| [joan-teadev](https://dependencywatch.io/package/npm/joan-teadev) | npm | * |
| [job-iteration](https://dependencywatch.io/package/npm/job-iteration) | npm | * |
| [joint_elephant_z3n](https://dependencywatch.io/package/npm/joint_elephant_z3n) | npm | * |
| [joint_hedgehog_z3n](https://dependencywatch.io/package/npm/joint_hedgehog_z3n) | npm | * |
| [joint_hookworm_z3n](https://dependencywatch.io/package/npm/joint_hookworm_z3n) | npm | * |
| [joint_panther_z3n](https://dependencywatch.io/package/npm/joint_panther_z3n) | npm | * |
| [joint_perch_0xrequest](https://dependencywatch.io/package/npm/joint_perch_0xrequest) | npm | * |
| [joint_pony_z3n](https://dependencywatch.io/package/npm/joint_pony_z3n) | npm | * |
| [joint_porpoise_0xrequest](https://dependencywatch.io/package/npm/joint_porpoise_0xrequest) | npm | * |
| [joint_primate_0xrequest](https://dependencywatch.io/package/npm/joint_primate_0xrequest) | npm | * |
| [joint_raccoon_z3n](https://dependencywatch.io/package/npm/joint_raccoon_z3n) | npm | * |
| [joint_sheep_z3n](https://dependencywatch.io/package/npm/joint_sheep_z3n) | npm | * |
| [joint_swan_z3n](https://dependencywatch.io/package/npm/joint_swan_z3n) | npm | * |
| [joint_tortoise-appteadev](https://dependencywatch.io/package/npm/joint_tortoise-appteadev) | npm | * |
| [joker123](https://dependencywatch.io/package/npm/joker123) | npm | * |
| [joker123-gaming](https://dependencywatch.io/package/npm/joker123-gaming) | npm | * |
| [joker123-slot](https://dependencywatch.io/package/npm/joker123-slot) | npm | * |
| [joker388](https://dependencywatch.io/package/npm/joker388) | npm | * |
| [joknmax](https://dependencywatch.io/package/npm/joknmax) | npm | * |
| [joko-asinan24-riris](https://dependencywatch.io/package/npm/joko-asinan24-riris) | npm | * |
| [joko-asinan36-riris](https://dependencywatch.io/package/npm/joko-asinan36-riris) | npm | * |
| [joko-asinan56-sluey](https://dependencywatch.io/package/npm/joko-asinan56-sluey) | npm | * |
| [joko-asinan6-sluey](https://dependencywatch.io/package/npm/joko-asinan6-sluey) | npm | * |
| [joko-asinan99-breki](https://dependencywatch.io/package/npm/joko-asinan99-breki) | npm | * |
| [joko-bakso14-miaww](https://dependencywatch.io/package/npm/joko-bakso14-miaww) | npm | * |
| [joko-bakso39-sukiwir](https://dependencywatch.io/package/npm/joko-bakso39-sukiwir) | npm | * |
| [joko-bakso41-sukiwir](https://dependencywatch.io/package/npm/joko-bakso41-sukiwir) | npm | * |
| [joko-bakso42-breki](https://dependencywatch.io/package/npm/joko-bakso42-breki) | npm | * |
| [joko-bakwan60-breki](https://dependencywatch.io/package/npm/joko-bakwan60-breki) | npm | * |
| [joko-bakwan85-riris](https://dependencywatch.io/package/npm/joko-bakwan85-riris) | npm | * |
| [joko-botok25-sluey](https://dependencywatch.io/package/npm/joko-botok25-sluey) | npm | * |
| [joko-botok45-breki](https://dependencywatch.io/package/npm/joko-botok45-breki) | npm | * |
| [joko-keraktelor64-breki](https://dependencywatch.io/package/npm/joko-keraktelor64-breki) | npm | * |
| [joko-keraktelor75-breki](https://dependencywatch.io/package/npm/joko-keraktelor75-breki) | npm | * |
| [joko-keripik1-apidev](https://dependencywatch.io/package/npm/joko-keripik1-apidev) | npm | * |
| [joko-keripik33-riris](https://dependencywatch.io/package/npm/joko-keripik33-riris) | npm | * |
| [joko-keripik43-sukiwir](https://dependencywatch.io/package/npm/joko-keripik43-sukiwir) | npm | * |
| [joko-keripik55-sluey](https://dependencywatch.io/package/npm/joko-keripik55-sluey) | npm | * |
| [joko-keripik64-sluey](https://dependencywatch.io/package/npm/joko-keripik64-sluey) | npm | * |
| [joko-keripik88-riris](https://dependencywatch.io/package/npm/joko-keripik88-riris) | npm | * |
| [joko-keripik89-sluey](https://dependencywatch.io/package/npm/joko-keripik89-sluey) | npm | * |
| [joko-keripik93-miaww](https://dependencywatch.io/package/npm/joko-keripik93-miaww) | npm | * |
| [joko-ketan28-sukiwir](https://dependencywatch.io/package/npm/joko-ketan28-sukiwir) | npm | * |
| [joko-ketan29-breki](https://dependencywatch.io/package/npm/joko-ketan29-breki) | npm | * |
| [joko-ketan40-breki](https://dependencywatch.io/package/npm/joko-ketan40-breki) | npm | * |
| [joko-ketan94-breki](https://dependencywatch.io/package/npm/joko-ketan94-breki) | npm | * |
| [joko-ketoprak31-breki](https://dependencywatch.io/package/npm/joko-ketoprak31-breki) | npm | * |
| [joko-ketoprak39-breki](https://dependencywatch.io/package/npm/joko-ketoprak39-breki) | npm | * |
| [joko-ketoprak70-breki](https://dependencywatch.io/package/npm/joko-ketoprak70-breki) | npm | * |
| [joko-ketoprak89-breki](https://dependencywatch.io/package/npm/joko-ketoprak89-breki) | npm | * |
| [joko-klanting28-sluey](https://dependencywatch.io/package/npm/joko-klanting28-sluey) | npm | * |
| [joko-klanting55-breki](https://dependencywatch.io/package/npm/joko-klanting55-breki) | npm | * |
| [joko-klanting57-breki](https://dependencywatch.io/package/npm/joko-klanting57-breki) | npm | * |
| [joko-klanting70-riris](https://dependencywatch.io/package/npm/joko-klanting70-riris) | npm | * |
| [joko-klanting72-miaww](https://dependencywatch.io/package/npm/joko-klanting72-miaww) | npm | * |
| [python-fork](https://dependencywatch.io/package/pypi/python-fork) | PyPI | 0.1.0, 0.1.1 |

## What happened

Between roughly 2026-09-12 12:00 UTC and 2026-09-14 06:00 UTC, GitHub Advisory Database published one **critical continuation** of a live active campaign (Cluster A `chroma-client` — fifth confirmed package in the `2026-09-openaii` AI-SDK typosquat wave that Wiz, OpenSSF, Amazon Inspector and Snyk started documenting yesterday), one small-but-real DoS package (Cluster B `python-fork` fork bomb), one CWE-506 boilerplate npm entry with a plausible cross-ecosystem-typosquat theory (Cluster C `job-iteration`), and an **unusually large tea.xyz autopublish spam explosion** organised around Indonesian food names (Cluster D `joko-*`) plus continuation of prior spam operators (Clusters E-G).

## Cluster A - `chroma-client` (continues `2026-09-openaii` AI SDK typosquat wave, `chromadb` typosquat)

`chroma-client<=0.5.7` (GHSA-qp4x-pg53-7xh8) is a PyPI typosquat of `chromadb`, the official Python client for the [Chroma vector database](https://www.trychroma.com/) that is a standard component of retrieval-augmented-generation (RAG) pipelines. The GHSA advisory explicitly notes the package "uses exactly the same technique as other packages from the campaign aiming to mislead LLM security tools" — attributing it to the ongoing `2026-09-openaii` campaign that this file series has been tracking since 2026-09-12.

Payload shape (per shared campaign fingerprint):

1. Import-time (or `.pth`-triggered) hook downloads a remote script
2. Second stage is heavily obfuscated, explicitly designed against AI-based static analysers
3. Exfiltrates SSH keys, `~/.aws/credentials`, GCP ADC, Azure profile
4. Installs a cryptominer
5. Installs a persistence mechanism (campaign siblings use systemd user units and shell-rc autoruns)
6. Clears logs / covers tracks

Campaign fingerprint (five confirmed packages so far, plus a DNS-staged loader sibling):

| Date | Package | Typosquat of | GHSA | Source hash |
|---|---|---|---|---|
| 2026-09-12 | `langgrap@0.2.45` | `langgraph` | GHSA-crjm-2g45-pq97 | `80943fa8…744b1db9` |
| 2026-09-12 | `openaii<=1.55.3` | `openai` | GHSA-q5h5-h6mj-vhgv | `c49a2850…21e79120` |
| 2026-09-12 | `transfomers@4.44.2` | `transformers` | GHSA-2p95-qvc5-6rjq | `c6a3963d…9befec9a` |
| 2026-09-12 | `ollamaa@0.4.2` | `ollama` | GHSA-9gv4-vfjg-jjrm | (not disclosed) |
| 2026-09-12 | `platform-telemetry-client@1.0.0` (DNS-staged, aborted) | — | GHSA-7767-763c-fxp3 | `7464733f…3cb0a0eb` |
| **2026-09-13** | **`chroma-client<=0.5.7`** | **`chromadb`** | **GHSA-qp4x-pg53-7xh8** | **`f74658eb…fe2e5153`** |

The combined pick `chromadb` + `langgraph` + `openai` + `transformers` + `ollama` covers the exact stack an AI-agent developer will `pip install` in one session. Treat this campaign as **actively expanding** and pin every AI/ML SDK explicitly with hash-pinned requirements files. Also see: full technical breakdown of the wave in `multi-2026-09-12-ghsa-malware-sweep.ts` (Cluster C).

## Cluster B - `python-fork` (PyPI fork bomb, `2026-09-python-fork` campaign)

`python-fork@0.1.0/0.1.1` (GHSA-v8v2-jgrm-w335) — importing the module starts a fork bomb, exhausting the process table and CPU until the host is unresponsive or crashes. This is a pure availability attack; there is no data-theft payload. Amazon Inspector source hash `0bff8869…186c1e78`. Campaign label `2026-09-python-fork` (MAL-2026-16142). Reported by OpenSSF via `kam193 / bad-packages.kam193.eu`.

Because the fork bomb executes on `import` (not at install), `--ignore-scripts` and `pip install --no-build-isolation` do NOT prevent detonation on a host that later imports the module. The only reliable mitigation is not to install it in the first place — pin an explicit denylist entry on internal PyPI mirrors and require a hash-pinned requirements file for any Python-fork-adjacent dependency.

## Cluster C - `job-iteration` (npm CWE-506 boilerplate; possible Shopify Ruby-gem lookalike)

`job-iteration@*` (GHSA-jh9v-79h6-prqm) — npm package flagged by OpenSSF Package Analysis with the standard CWE-506 "embedded malicious code" boilerplate. No published payload analysis, no IOCs beyond the takedown itself, MAL-2025-23828.

What makes this worth calling out separately from the general spam floor: **there is no legitimate npm `job-iteration` publisher**, and the name is a near-exact match for [Shopify's widely-used `job-iteration` Ruby gem](https://github.com/Shopify/job-iteration) for iterating Sidekiq jobs safely. The most plausible read is a **cross-ecosystem lookalike / dependency-confusion probe** aimed at a developer who remembers "job-iteration" as a queue-iteration library and searches npm for it. Treat as `medium` pending payload analysis; ignore-scripts + a private-registry scope rule that blocks bare-name npm resolution for any name your org uses in another ecosystem blocks it entirely.

## Cluster D - `joko-{Indonesian-food}-{suffix}` npm tea.xyz autopublish spam explosion (hundreds of packages, source scripts published same day)

2026-09-13 saw an unusually large tea.xyz token-farming autopublish spam wave organised around **Indonesian street-food names**. Naming grammar:

```
joko-<dish><n>-<suffix>
```

where the dish word is one of `klanting`, `ketan`, `ketoprak`, `kepok`, `keripik`, `keraktelor`, `kemplang`, `botok`, `bakwan`, `asinan`, or `bakso`; `<n>` is a small integer; and `<suffix>` cycles through `breki`, `miaww`, `riris`, `ruro`, `apidev`, `sukiwir`, `sluey`, `remi`. GHSA published hundreds of these on 2026-09-13; a representative sample is enumerated in the `packages` map below.

**The autopublish source packages `joan-teadev` and `joknmax` were flagged the same day** — these are what actually contain the loop:

- `joan-teadev@*` (GHSA-rmm9-rq4q-rhh9) — hash `c844cc33…01d531f3`. Contains `auto.js`, `autopublish.js`, `autopublish2.js`, `autopublish3.js`; modifies `package.json` (removes `"private": true`, bumps version, publishes) and cycles derivative names.
- `joknmax@*` (GHSA-rwc2-pm3r-wx4g) — hash `8111feb6…45745e4`. Identical autopublish shape.

Both are attributed to the tea.xyz token-reward campaign that pays out to publishers of "distinct" npm packages regardless of content. This wave is materially larger than the 2026-09-11 `fancy_*_z3n` batch but uses a different naming grammar; it is the same *operator category* but not necessarily the same wallet. Remove the source packages first — that stops the autopublish loop faster than chasing every joko-* name individually.

## Cluster E - `joint_{animal}_z3n` / `joint_{animal}_0xrequest` (continues 2026-09-11 `family_*_z3n` operator, new prefix)

Same tea.xyz auto-publish shape and same `_z3n` / `_0xrequest` operator-suffix conventions documented in 2026-09-11 Cluster J. New prefix `joint_` with animal words (`hedgehog`, `panther`, `hookworm`, `elephant`, `pony`, `raccoon`, `sheep`, `swan`, `porpoise`, `perch`, `primate`, `tortoise`). Continue applying the `_z3n$` / `_0xrequest$` regex denylist from 2026-09-11 to internal mirrors; this file does not re-enumerate every name.

## Cluster F - `joker123` / `joker388` casino-themed spam singletons

Four singletons — `joker123`, `joker123-slot`, `joker123-gaming`, `joker388` — flagged with the standard CWE-506 boilerplate. "Joker123" and "Joker388" are real online-slot brands widely SEO-targeted in the Indonesian and broader SE-Asian online-gambling market, which is a plausible source of the naming choice (whether the intent is SEO-farm placeholders, spam, or something else, no published payload analysis is available). Ignore-scripts blocks any preinstall behaviour they might carry.

## Cluster G - `jnmirdcugstvxqaz` random-string singleton

Single random-string name (`jnmirdcugstvxqaz`), CWE-506 boilerplate, no published payload. Matches the "brand-new fresh-npm-account with autogenerated name" pattern seen throughout the year. Ignore-scripts is sufficient mitigation for this class.

## Cross-operator patterns worth flagging

1. **The `2026-09-openaii` campaign is expanding on a daily cadence** — five confirmed packages plus a DNS-staged loader in three days, targeting the exact AI/ML SDK stack RAG developers install. Pin every AI/ML SDK explicitly with hash-pinned requirements files, block the campaign names on internal mirrors, and add a strict-name-match rule for `chromadb` / `openai` / `langgraph` / `langchain` / `transformers` / `ollama` / `anthropic` at your organisation's Python resolution layer.
2. **Tea.xyz spam volume shows no sign of slowing** — 2026-09-11 hundreds of `family_*_z3n`; 2026-09-13 hundreds of `joko-*`. Kill the SOURCE packages (`joan-teadev`, `joknmax` today; the equivalent source on 2026-09-11) rather than chasing derivatives.
3. **Cross-ecosystem lookalikes are a real subclass** (Cluster C). Any name your org uses in another ecosystem should not resolve on npm from a bare name.

## Registry state

All packages in Clusters A-C and the specific enumerated singletons in Clusters F/G are flagged as malware on npm / PyPI and quarantined at the time of writing. Cluster D `joko-*` and Cluster E `joint_*` tea.xyz spam is auto-republished continuously under fresh derivative names under the same operator infrastructure; only prefix / regex denylists on internal mirrors are durable mitigation.

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `amazon-inspector` (via kam193 / bad-packages.kam193.eu). Per-package IOC details drawn verbatim from GHSA advisory bodies published between 2026-09-12 and 2026-09-14 UTC.

## Impact

- **Cluster A — `chroma-client` PyPI `chromadb` typosquat (continues `2026-09-openaii` campaign, same operator as `openaii`/`langgrap`/`transfomers`/`ollamaa`)**: `chroma-client<=0.5.7` (GHSA-qp4x-pg53-7xh8) is a typosquat of the legitimate `chromadb` client (the standard Python SDK for the Chroma vector database used in RAG pipelines). The advisory explicitly notes it "uses exactly the same technique as other packages from the campaign aiming to mislead LLM security tools" — the same second-stage-download, AI-scanner-aware obfuscation, cryptomining, SSH-key/`~/.aws/credentials`/GCP ADC/Azure profile exfiltration, persistence, and log-clearing pattern documented in yesterday's Cluster C (2026-09-12 sweep). Amazon Inspector source hash `f74658eb…fe2e5153`. Campaign label `2026-09-openaii` (MAL-2026-16143). This is now the **fifth confirmed package** in the wave (`openaii`, `langgrap`, `transfomers`, `ollamaa` on 2026-09-12, plus `platform-telemetry-client` on 2026-09-12; sixth counting the sibling DNS-staged loader)
- **Cluster B — `python-fork` PyPI fork bomb (`2026-09-python-fork` campaign)**: `python-fork@0.1.0/0.1.1` (GHSA-v8v2-jgrm-w335) — importing the module starts a fork bomb, exhausting process-table and CPU resources until the host is unresponsive or crashes. Not a data-theft payload; a plain availability attack against any system that imports the package. Amazon Inspector source hash `0bff8869…186c1e78`. Campaign label `2026-09-python-fork` (MAL-2026-16142). Same operator infrastructure as OpenSSF `bad-packages.kam193.eu` PyPI batch of the same day
- **Cluster C — `job-iteration` npm CWE-506 boilerplate (possible `job-iteration` Shopify Ruby gem lookalike)**: `job-iteration@*` (GHSA-jh9v-79h6-prqm) — npm package flagged by OpenSSF Package Analysis with the standard CWE-506 "embedded malicious code" boilerplate; no published payload analysis. Name matches Shopify's widely-used `job-iteration` Ruby gem for iterating Sidekiq jobs. There is no legitimate npm `job-iteration` publisher, so this is most plausibly a **cross-ecosystem lookalike / dependency-confusion probe** aimed at developers searching npm for what they remember as a Ruby library. Treat as `medium` pending payload analysis; ignore-scripts + private-registry pinning blocks it entirely. Campaign label MAL-2025-23828
- **Cluster D — Massive `joko-{Indonesian-food}-{suffix}` npm tea.xyz autopublish spam (hundreds of packages, source scripts published)**: An unusually large 2026-09-13 wave of tea.xyz token-farming autopublish spam. Naming pattern `joko-<indonesian-dish-word><small-int>-<suffix>` where the dish word cycles through `klanting`, `ketan`, `ketoprak`, `kepok`, `keripik`, `keraktelor`, `kemplang`, `botok`, `bakwan`, `asinan`, `bakso` and the suffix cycles through `breki`, `miaww`, `riris`, `ruro`, `apidev`, `sukiwir`, `sluey`, `remi`. The AUTOPUBLISH SOURCE packages `joan-teadev@*` (GHSA-rmm9-rq4q-rhh9) and `joknmax@*` (GHSA-rwc2-pm3r-wx4g) were flagged the same day and are what actually contain the autopublish scripts (`auto.js`, `autopublish.js`, `autopublish2.js`, `autopublish3.js`); the joko-* names are the derivative packages the autopublish loop generates. `joan-teadev` source hash `c844cc33…01d531f3`; `joknmax` source hash `8111feb6…45745e4`
- **Cluster E — `joint_{animal}_z3n` / `joint_{animal}_0xrequest` npm continuation (2026-09-11 `family_*_z3n` operator, new prefix)**: `joint_hedgehog_z3n`, `joint_panther_z3n`, `joint_hookworm_z3n`, `joint_elephant_z3n`, `joint_pony_z3n`, `joint_raccoon_z3n`, `joint_sheep_z3n`, `joint_swan_z3n`, `joint_perch_0xrequest`, `joint_porpoise_0xrequest`, `joint_primate_0xrequest`, `joint_tortoise-appteadev`. Same `_z3n` / `_0xrequest` suffix and same tea.xyz auto-publish shape documented in 2026-09-11 Cluster J (`fancy_*_z3n`, `famous_*_z3n`, `familiar_*_z3n`, `fantastic_*_z3n`). Continue to apply the `_z3n$` / `_0xrequest$` regex denylist rules from 2026-09-11 to internal mirrors; no per-name enumeration here
- **Cluster F — `joker123` / `joker388` npm casino-themed spam singletons**: `joker123@*` (GHSA-6gmp-rvjx-wv93), `joker123-slot@*` (GHSA-3p35-jmvr-q36r), `joker123-gaming@*` (GHSA-w7mq-frpg-3qw6), `joker388@*` (GHSA-p9qp-fxrq-ch3w). Same CWE-506 boilerplate; names read as SEO-farm placeholders for Indonesian/SE-Asian online casino brands ("Joker123" / "Joker388" are real online-slot brands widely SEO-targeted in that region). No published payload analysis; treat as spam/beacon consistent with the wider tea.xyz mixed-name spam floor
- **Cluster G — `jnmirdcugstvxqaz` npm random-string singleton**: `jnmirdcugstvxqaz@*` (GHSA-7r7p-23fg-8m87) — CWE-506 boilerplate flag with no published payload analysis. Random-string name shape matches the auto-generated "brand-new fresh-npm-account" pattern seen throughout the year. Treat as tea.xyz spam floor

## What to do

1. Grep every `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `package.json`, `requirements.txt`, `poetry.lock`, and `Pipfile.lock` in your org for the specific package names in Clusters A-C below. Uninstall on hit, wipe `node_modules` / the affected venv, delete the lockfile, rebuild against a clean cache, and rotate every credential the affected host could have touched
2. **For Cluster A `chroma-client`**: any Python environment that installed `chroma-client<=0.5.7` executed the operator-supplied `2026-09-openaii` second-stage payload, meaning SSH keys, `~/.aws/credentials`, GCP ADC, and Azure profile were exfiltrated and a cryptominer + persistence were installed. Rotate every credential from the affected host and search for persistence (the campaign uses systemd user units and shell-rc autoruns). Pin the real upstream `chromadb` explicitly with a hash-pinned requirements file. Add `chroma-client` (with the wrong hyphen) to any AI/ML-stack pipeline denylist alongside `langgrap`/`openaii`/`transfomers`/`ollamaa` from yesterday
3. **For Cluster B `python-fork`**: hosts that imported `python-fork@0.1.0`/`0.1.1` may need a hard reboot to recover — this is a resource-exhaustion DoS, not a data-theft payload, so credential rotation is not required. Remove the package, then audit `requirements.txt` for any dependency accidentally pinning to it. `--ignore-scripts` does NOT block this — the fork bomb runs on import, not at install
4. **For Cluster C `job-iteration` (npm)**: any org that uses Shopify's `job-iteration` Ruby gem should audit npm dependencies for a mistaken `npm install job-iteration` — remove the npm package and pin the Ruby gem via `Gemfile` where the queue-iteration behaviour actually lives. Configure private-registry scope resolution to block bare-name npm resolution for any name your org uses in another ecosystem
5. **For Cluster D `joko-*` tea.xyz spam**: apply regex denylist `^joko-(klanting|ketan|ketoprak|kepok|keripik|keraktelor|kemplang|botok|bakwan|asinan|bakso)\d*-(breki|miaww|riris|ruro|apidev|sukiwir|sluey|remi)$` to internal npm mirrors, and separately block `joan-teadev` and `joknmax` (the autopublish SOURCE packages that actually contain the loops). Report `joan-teadev` and `joknmax` to npm for takedown priority — removing the source packages stops the autopublish loop faster than chasing every derivative
6. **For Cluster E `joint_*_z3n` / `joint_*_0xrequest`**: same as 2026-09-11 Cluster J — apply `_z3n$` / `_0xrequest$` regex rules to internal mirrors
7. **For Cluster F/G `joker123` etc. singletons**: single-name deny is enough; no operator-durable IOC beyond the names themselves
8. For every `npm install` and `pip install` in CI, prefer `--ignore-scripts` / `--no-build-isolation` (pip 23+) or an equivalent lockfile-consumer mode that blocks preinstall/postinstall/setup.py payloads. This does NOT block Cluster A (a Python `.pth` file loader runs on interpreter startup, and Chroma package imports run at import time) or Cluster B (import-time fork bomb). Use hash-pinned requirements files for AI/ML stacks
9. Add every specific name below to internal private-registry deny-lists for at least 30 days to prevent re-uploads by rotating operators. Extend the tea.xyz prefix/regex denylist from the 2026-09-11 sweep with the `joko-*` and `joint_*` patterns from Clusters D and E

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-qp4x-pg53-7xh8 - chroma-client (Cluster A - 2026-09-openaii AI SDK typosquat wave, chromadb typosquat)](https://github.com/advisories/GHSA-qp4x-pg53-7xh8) - GitHub
- [GHSA-v8v2-jgrm-w335 - python-fork (Cluster B - PyPI fork bomb)](https://github.com/advisories/GHSA-v8v2-jgrm-w335) - GitHub
- [GHSA-jh9v-79h6-prqm - job-iteration (Cluster C - npm CWE-506 boilerplate)](https://github.com/advisories/GHSA-jh9v-79h6-prqm) - GitHub
- [GHSA-rmm9-rq4q-rhh9 - joan-teadev (Cluster D - tea.xyz autopublish SOURCE package)](https://github.com/advisories/GHSA-rmm9-rq4q-rhh9) - GitHub
- [GHSA-rwc2-pm3r-wx4g - joknmax (Cluster D - tea.xyz autopublish SOURCE package)](https://github.com/advisories/GHSA-rwc2-pm3r-wx4g) - GitHub
- [GHSA-6gmp-rvjx-wv93 - joker123 (Cluster F - casino-themed spam)](https://github.com/advisories/GHSA-6gmp-rvjx-wv93) - GitHub
- [GHSA-3p35-jmvr-q36r - joker123-slot (Cluster F)](https://github.com/advisories/GHSA-3p35-jmvr-q36r) - GitHub
- [GHSA-w7mq-frpg-3qw6 - joker123-gaming (Cluster F)](https://github.com/advisories/GHSA-w7mq-frpg-3qw6) - GitHub
- [GHSA-p9qp-fxrq-ch3w - joker388 (Cluster F)](https://github.com/advisories/GHSA-p9qp-fxrq-ch3w) - GitHub
- [GHSA-7r7p-23fg-8m87 - jnmirdcugstvxqaz (Cluster G - random-string singleton)](https://github.com/advisories/GHSA-7r7p-23fg-8m87) - GitHub
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF
- [Prior day: 2026-09-openaii wave technical breakdown (Cluster C in the 2026-09-12 sweep)](https://github.com/advisories/GHSA-q5h5-h6mj-vhgv) - GitHub

---

Canonical page: https://dependencywatch.io/incident/multi-2026-09-14-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-09-14-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).