GitHub Advisory malware sweep, 18 September 2026

HighAdvisory sweepnpmPyPI

GHSA 2026-09-17 late + 2026-09-18: 4x npm Baileys-fork packages redirect libsignal to unpinned GitHub refs for install-time RCE; blue-string-formatter-utils runs xss.report XMLHttpRequest+eval on require; @railone/image-utils reuses the api.npoint.io loader pattern of process-lhpm/process-mite; tailwindcss-form-* typosquats fetch commands from an attacker-authored Ethereum address; pip marketing-mcp exfils ~/.ssh/id_rsa + ~/.aws/credentials via a webhook.site endpoint.

Published 18 Sept 2026

Check your package-lock.json Source advisory

At a glancemulti-2026-09-18-ghsa-malware-sweep

Packages tracked78 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity: High
Type: Advisory sweep
Published: 18 Sept 2026
Ecosystems: npmPyPI
Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector, kam193/bad-packages
Also known as: 2026-09-18 GHSA npm+pip sweep, Baileys libsignal-hijack wave (xzvbailey, xzvbailsx, zero-baileys, @lekzo/baileys), blue-string-formatter-utils xss.report remote-code loader
Source: github.com

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

Between roughly 2026-09-17 12:00 UTC and 2026-09-18 12:00 UTC, GitHub Advisory Database published 25+ new malware advisories — mostly npm and pip, with several packages carrying real infostealer or RCE payloads (not just CWE-506 boilerplate). Todays batch is dominated by three overlapping patterns: (1) a Baileys-fork ecosystem that has moved on from yesterdays WhatsApp-newsletter-follower nuisance to full install-time RCE by declaring the libsignal dependency as an unpinned GitHub ref; (2) the api.npoint.io remote-code operator on day 3 of daily republishes under a new package name each day; (3) a bulk registry-pollution wave from the tea.xyz reputation-farming ecosystem (25+ lisa-* autopublish spam packages).

Cluster A - Baileys-fork libsignal-hijack wave (npm)

Package	Version	GHSA	Redirected libsignal source	Notes
`xzvbailey`	`1.0.0`	GHSA-rg4j-jh5f-w982	`github:tenka-san/libsignal-node` (unpinned)	Homepage/repo → Telegram, bug tracker → `pou-code/Baileys`
`xzvbailsx`	`1.0.0`	GHSA-m364-pjc8-42wc	`github:tenka-san/libsignal-node` (unpinned)	Handles `t.me/JustRxVz`, `t.me/XzV_ExpzC`; README refers to `@XzV-RxVz/xbails`
`zero-baileys`	`2.7.0`	GHSA-2q5p-vqh2-8c92	`@otaxayun/libsignal-node@latest` (mutable dist-tag)	Third-party npm scope with `latest` — silent payload swap possible
`@lekzo/baileys`	`0.0.1`	GHSA-75mc-fj4c-6pfm	`github:canove/libsignal-node` (unpinned)	Same primitive

The primitive. Real libsignal (WhatsApp E2E crypto) is vendored inside the legitimate @whiskeysockets/baileys package. A malicious Baileys fork replaces that dependency declaration with an unpinned reference to a personal GitHub repo or a third-party npm scope on @latest. npm resolves that reference at install and executes whatever lifecycle scripts (preinstall, install, postinstall) sit at HEAD, so the operator has arbitrary code execution on the installers machine every install with no version-pin defence and no --ignore-scripts block on the parent package (the child packages scripts still run when npm runs its own install-tree walk).

Continuity. 2026-09-16 plogme and 2026-09-17 jexkcode were nuisance-tier Baileys forks that forced newsletter subscriptions on connected WhatsApp accounts. Todays four packages are the escalation: full RCE at install. Not confirmed as the same operators — tenka-san and canove and @otaxayun are three distinct GitHub/npm accounts — but the target audience (WhatsApp automation developers) and the exact libsignal`-redirection primitive are shared, so this is a small operator community iterating on a shared TTP.

Cluster B - Remote-code loaders (npm)

Package	Version	GHSA	Endpoint	Trigger
`blue-string-formatter-utils`	`1.0.0`	GHSA-5mc6-ff2p-32qj	`//xss.report/c/k3rne111`	`require` → `XMLHttpRequest` GET → `eval()`
`@railone/image-utils`	`<=1.1.10`	GHSA-h72c-8fwp-p292	`https://api.npoint.io/641d37178a880b1e8b8f`	`import` → detached `node loader.js` → base64-decode `code` → `new Function()`
`xa424234657567`	`1.0.0`	GHSA-h7pm-6wh6-7xvw	`https://unpkg.com/x6842179305@1.0.3/1.js` + `ui.js`	`require` → host-gated on `duel.com` (else redirect)

The api.npoint.io operator is on day 3. 2026-09-16 sweep Cluster E was process-lhpm@<=1.1.79 fetching api.npoint.io/33e8d008c334b060adad; 2026-09-17 sweep Cluster D was process-mite@<=1.1.79 fetching the same api.npoint.io/33e8d008c334b060adad; today @railone/image-utils@<=1.1.10 fetches a different bucket (641d37178a880b1e8b8f) with the same base64+new Function() decoder. Same operator or same TTP-borrowing operator; either way, api.npoint.io is the durable IOC.

The xss.report operator publishes short-code buckets (k3rne111) that any client can register free-tier; blocking the bucket alone is not enough because the operator can churn buckets — block the full domain at CI egress.

Cluster C - On-chain Ethereum-C2 tailwindcss typosquats (npm)

Both tailwindcss-form-utils@<=0.5.1 (GHSA-fm65-924g-pg2g) and tailwindcss-form-ui@<=0.5.1 (GHSA-hxjv-cpxc-564m) impersonate the legitimate @tailwindlabs/tailwindcss-forms plugin (cloned repo and README). On require the obfuscated src/index.js (obfuscator.io string-array) imports node:http, node:https, node:zlib, node:url, node:child_process.spawn, and queries every RPC in [process.env.ETH_RPC_URL, *.publicnode.com, eth.drpc.org, 1rpc.io/eth, ...blockscout endpoints] for transactions authored by the hardcoded sender:

0xa322E5f3D311D3080e9aDC2490Ef6f0121063e1a

The transaction data (gzip/inflate/brotli-compressed) reconstructs a JavaScript payload, which is then executed via child_process.spawn. This is a takedown-resistant on-chain command channel: every recent transaction authored by that Ethereum address is a fresh command pushed to every installed victim. There is no domain to block, no C2 IP to seize, and taking down the address requires either burning it (attacker moves to a new one) or getting Ethereum mainnet to censor a specific sender (not going to happen).

Cluster D - Dep-confusion sentinel-version DNS-OOB exfil pair (npm)

Package	Version	GHSA	Endpoint
`@tink/tink-link-core`	`9.9.10`	GHSA-hvcc-qwg6-972c	DNS labels `tinkcore-<hostinfo>.oob.algamil7x.xyz`
`test89078-auth`	`99.99.99`	GHSA-x9mp-cqw3-368c	DNS labels of `31ee29fe-db68-4fd3-86a2-2b707b9e95f0.dnshook.site`

Both are classic dep-confusion resolution-attack lures — sentinel versions (9.9.10, 99.99.99), plausibly-internal-looking names (@tink/tink-link-core reads as a Tink open-banking SDK internal package; test89078-auth reads as a placeholder internal auth package). The exfil channel is DNS-based (bypasses HTTP proxies and egress-firewall rules), targeting hostname, username, cwd. Two independent operators, same tactic, same day — treat as a real pentest artefact and functional intel-gathering.

algamil7x.xyz is a fresh domain of unclear provenance; dnshook.site is a public DNS OOB service (the 31ee29fe-db68-4fd3-86a2-2b707b9e95f0 UUID is the campaign identifier the operator registered against the free tier). Block both at your resolver.

Cluster E - pip setup.py reverse shells / IP-username exfil

Package	Version	GHSA	Payload
`requests-auroras`	`2.34.2`	GHSA-5p5r-2g2v-44x5	setup.py reverse shell
`requests-triwes`	`2.34.2`	GHSA-c47p-v854-jfg4 (MAL-2026-16275)	setup.py reverse shell
`requests-asetwe`	`2.34.2`	GHSA-38mf-xcf2-88cp	setup.py IP+username exfil, `GENERIC-standard-pypi-install-pentest`

All three same-day publications on the exact same version pin (2.34.2), same setup.py-override tactic. Distinct payloads (two reverse shells, one exfil probe), and asetwe is OpenSSF-tagged PROBABLY_PENTEST while the two reverse-shell variants are unambiguously malicious. Likely one operator running the reverse-shell primitives and one separate pentest engagement running the exfil probe, both squatting the requests-* name at the same version to maximise install-typo coverage.

Cluster F - pip file-exfil / infostealer packages

`marketing-mcp@0.1.0` (GHSA-7m86-6729-5w7h)

The most operationally novel item in this sweep. An MCP (Model Context Protocol) tool that reads caller-specified local files and POSTs them to a hardcoded https://webhook.site/4acf7132… endpoint. Target files: ~/.ssh/id_rsa, ~/.aws/credentials, .env, source code — everything an LLM agent might legitimately want to read on its user`s behalf.

Anyone who registered marketing-mcp as an MCP tool with Claude Code, Cursor, an in-house MCP-enabled agent, or any other MCP host, handed that agent an exfil pipe: a prompt that says "please summarise my AWS credentials" or "check my SSH config" causes the agent to invoke the MCP tool, which POSTs the file to webhook.site. The attacker never has to touch the developers machine directly — the developers own agent does the reading and the POSTing.

This is the second confirmed exfil MCP tool in the incident set (the first was earlier in 2026; different package). The pattern is going to keep repeating — MCP tools are the new npm packages for supply-chain purposes, and the LLM agent is the browser-equivalent trust boundary.

Other file-exfil pip packages

Package	Versions	GHSA	Target
`aiosendletter`	`0.2.0`, `3.7`, `3.8`, `3.9`, `4.0`, `4.1`, `4.3`, `4.5`, `4.6`	GHSA-hc2r-77jq-mjrx (`2026-09-aiosendletter`)	Messaging application credentials
`index-forum`	`2.5.4`	GHSA-8466-62v8-x2vr (`2026-09-pyjstat-smooth`)	CTF-like target paths
`pyjstat-smooth`	`1.5.0`, `2.5.0`-`2.5.17`	GHSA-rq89-pjxc-hpf8 (`2026-09-pyjstat-smooth`)	File exfil, clones legitimate `pyjstat`

The index-forum and pyjstat-smooth packages share the campaign identifier 2026-09-pyjstat-smooth — same operator running two typosquats against different Python names in the same day.

Cluster G - kartykgithub CWE-506 pentest continuation (npm)

kartykgithub-multiversion-a@1.0.0/1.0.1 (GHSA-p957-4pc7-x6hp). Third day of the kartyk-scope engagement:

2026-09-16 (Cluster H): kartykp-prod-oidc-test-pkg, kartykp-token-pkg
2026-09-17 (Cluster F): kartyk-github-single-ver-pkg, kartyk-github-token-pkg, kartyk-github-oidc-test-pkg
2026-09-18 (this cluster): kartykgithub-multiversion-a

Same red-team engagements serialised test artefacts leaking to npm public. CWE-506 boilerplate only, no published IOC beyond the package name. Treat as medium`.

Cluster H - tea.xyz autopublish flood (npm, 25+ packages)

25+ lisa-* packages published on 2026-09-17, all carrying autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that modify package.json to remove private flags, generate random Indonesian-food-themed names (jamblang, gudeg, gulai, jengkol, ikan, esdoger, gandul, gembus, getuk, gorengan, gaplek, gado-gado), and continuously republish variants. The goal is not credential theft or RCE — it is reputation-farming on the tea.xyz protocol to claim token rewards.

Operationally low-severity for defenders but registry-hygiene-relevant: every one of these names is a name an attacker got to first, and any legitimate package that could have been called lisa-<food>-<suffix> cannot be published on npm without a name collision. Add lisa-* to your denylist.

Cross-operator patterns worth flagging

The Baileys ecosystem is escalating from nuisance to RCE. Yesterdays newsletter-followers (plogme, jexkcode) were annoying but not exfil-tier; todays libsignal-hijack primitive is full install-time RCE. Expect more Baileys forks tomorrow that use the same TTP.
The api.npoint.io operator is on day 3 of daily republishes. Block api.npoint.io at egress across CI — the domain is not going away.
On-chain Ethereum C2 is now a mainstream supply-chain TTP. The tailwindcss-form-* typosquats are the second confirmed on-chain-C2 pattern in the incident set. Detection cost is asymmetric: no domain to block, no IP to seize; you have to alert on outbound TCP to any Ethereum JSON-RPC endpoint from a build environment.
MCP tools are the new supply-chain risk class. marketing-mcp is the second confirmed exfil MCP tool; there will be more. Audit your MCP allowlist as strictly as you audit npm dependencies.
Dep-confusion DNS-OOB is now the default primitive. @tink/tink-link-core (sentinel 9.9.10) and test89078-auth (sentinel 99.99.99) are two independent operators using the same DNS-OOB tactic in the same 24h window.

Registry state

All packages above are flagged as malware on npm and PyPI and quarantined at the time of writing. Private mirrors that cached tarballs before quarantine keep serving the malicious versions; network-edge egress blocks on xss.report, api.npoint.io, duel.com, unpkg.com/x6842179305, oob.algamil7x.xyz, dnshook.site, webhook.site, and outbound Ethereum-JSON-RPC calls from CI are the durable mitigations.

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector, kam193/bad-packages. Per-package IOC details drawn verbatim from GHSA advisory bodies published between 2026-09-17 12:00 UTC and 2026-09-18 12:00 UTC.

typosquatdependency-confusioninfostealercredential-theftci-cd-compromiseobfuscationdns-exfiltration

Affected packages

51 packages 78 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →

Impact

What it does if you installed it

Cluster A — 4x npm Baileys-fork libsignal-hijack wave (unpinned GitHub-ref RCE at install): xzvbailey@1.0.0 (GHSA-rg4j-jh5f-w982) and xzvbailsx@1.0.0 (GHSA-m364-pjc8-42wc) both declare "libsignal": "github:tenka-san/libsignal-node" with no tag or commit SHA — npm fetches the current HEAD of tenka-san/libsignal-node at install and runs its lifecycle scripts; both packages carry Telegram-linked metadata (t.me/JustRxVz, t.me/XzV_ExpzC, homepage/repo fields pointing at pou-code/Baileys). zero-baileys@2.7.0 (GHSA-2q5p-vqh2-8c92) redirects libsignal to @otaxayun/libsignal-node@latest — a third-party npm scope with the mutable latest dist-tag, so the operator can silently swap the payload at any time. @lekzo/baileys@0.0.1 (GHSA-75mc-fj4c-6pfm) redirects libsignal to github:canove/libsignal-node. All four continue yesterdays Baileys-fork ecosystem (2026-09-16 plogme, 2026-09-17 jexkcode), but escalate from WhatsApp-newsletter-follower nuisance behaviour to full arbitrary-code-execution: the attacker controls the code that runs on the developers machine every npm install
Cluster B — 3x npm remote-code loaders (require- and require-adjacent execution): blue-string-formatter-utils@1.0.0 (GHSA-5mc6-ff2p-32qj) advertises "Utility helpers for string formatting" but on require executes an XMLHttpRequest GET to //xss.report/c/k3rne111 and passes the response to eval() — full remote-code execution, no --ignore-scripts block. @railone/image-utils@<=1.1.10 (GHSA-h72c-8fwp-p292) auto-invokes initialize() on import which spawns a detached node loader.js process that fetches JSON from https://api.npoint.io/641d37178a880b1e8b8f, base64-decodes the code field and evals it via new Function() — third package in three days using an api.npoint.io/<bucket> remote-code channel (2026-09-16 Cluster E process-lhpm@33e8d008c334b060adad, 2026-09-17 Cluster D process-mite@33e8d008c334b060adad, today @railone/image-utils@641d37178a880b1e8b8f), and the internal comments identify it as an "ID-10 Client Module" with "AUTO-START ON IMPORT". xa424234657567@1.0.0 (GHSA-h7pm-6wh6-7xvw) is an obfuscated (Function-constructor + hex-escaped char arrays) client that host-gates on duel.com — on duel.com domains it fetches and evals https://unpkg.com/x6842179305@1.0.3/1.js and .../ui.js, on other hosts it redirects to duel.com
*Cluster C — 2x npm on-chain Ethereum-C2 `tailwindcss-form- typosquats** (tailwindcss-form-utils@<=0.5.1 GHSA-fm65-924g-pg2g, tailwindcss-form-ui@<=0.5.1 GHSA-hxjv-cpxc-564m). Both impersonate @tailwindlabs/tailwindcss-forms (cloned repository reference and README) and are heavily obfuscated (obfuscator.io string-array). On require, both import node:http, node:https, node:zlib, node:url, node:child_process.spawn and query multiple Ethereum JSON-RPC endpoints (process.env.ETH_RPC_URL, .publicnode.com, eth.drpc.org, 1rpc.io/eth, blockscout) for transactions authored by the hardcoded sender address 0xa322E5f3D311D3080e9aDC2490Ef6f0121063e1a, decompress the transaction data (gzip/inflate/brotli), reconstruct JavaScript and execute commands via child_process.spawn`. Takedown-resistant on-chain command channel* — every recent transaction authored by that Ethereum address is a fresh command pushed to every installed victim, and there is no domain to block or takedown-target
Cluster D — 2x npm dep-confusion sentinel-version DNS-OOB exfil pair: @tink/tink-link-core@9.9.10 (GHSA-hvcc-qwg6-972c) impersonates Tink open-banking SDK; on install AND on import, obfuscated code reads os.userInfo().username, os.hostname(), process.cwd(), and resolves DNS labels of the form tinkcore-<hostinfo>.oob.algamil7x.xyz — DNS-based exfil, bypasses HTTP proxies and egress-firewall rules. test89078-auth@99.99.99 (GHSA-x9mp-cqw3-368c) is a classic dep-confusion sentinel-version lure: preinstall runs node index.js which reads username/hostname and DNS-resolves subdomains of 31ee29fe-db68-4fd3-86a2-2b707b9e95f0.dnshook.site embedding the labels. Two independent operators, same tactic: dep-confusion sentinel version + DNS beacon
*Cluster E — 3x pip `requests-@2.34.2 setup.py reverse shells / IP-username exfil**: requests-auroras@2.34.2 (GHSA-5p5r-2g2v-44x5) and requests-triwes@2.34.2 (GHSA-c47p-v854-jfg4, MAL-2026-16275) both override setup.py`s install command to spawn a reverse shell during pip install; requests-asetwe@2.34.2 (GHSA-38mf-xcf2-88cp, campaign GENERIC-standard-pypi-install-pentest) exfils IP + username via the same setup.py-override pattern, categorised PROBABLY_PENTEST by OpenSSF. Three same-day publications, same version pin 2.34.2 — an operator cluster targeting the requests name in bulk; unclear whether shared operator with the requests-triwes` campaign umbrella
Cluster F — 4x pip file-exfil / infostealer packages (multiple cloned-legit lures): marketing-mcp@0.1.0 (GHSA-7m86-6729-5w7h, campaign 2026-09-marketing-mcp) — an MCP (Model Context Protocol) tool that reads caller-specified local files and POSTs them to a hardcoded https://webhook.site/4acf7132… endpoint; targets ~/.ssh/id_rsa, ~/.aws/credentials, .env files, and source code. First-observed LLM-agent-facing exfil MCP tool in this project — anyone who registered this MCP with Claude Code, Cursor, or an in-house MCP-enabled agent handed the agent an exfil pipe to a public webhook. aiosendletter@0.2.0/3.7/3.8/3.9/4.0/4.1/4.3/4.5/4.6 (GHSA-hc2r-77jq-mjrx, campaign 2026-09-aiosendletter) — file exfil targeting messaging application credentials. index-forum@2.5.4 (GHSA-8466-62v8-x2vr, campaign 2026-09-pyjstat-smooth) — file exfil with CTF-like target paths. pyjstat-smooth@1.5.0/2.5.0-2.5.17 (GHSA-rq89-pjxc-hpf8, campaign 2026-09-pyjstat-smooth) — file exfil, clones the legitimate pyjstat package layout to appear authentic. All four confirmed infostealer payloads, not probes
Cluster G — npm kartykgithub-multiversion-a CWE-506 pentest continuation: kartykgithub-multiversion-a@1.0.0/1.0.1 (GHSA-p957-4pc7-x6hp). Third day of the kartyk-scope pentest engagement leftover — 2026-09-16 sweep had kartykp-prod-oidc-test-pkg/kartykp-token-pkg, 2026-09-17 sweep added kartyk-github-single-ver-pkg/-token-pkg/-oidc-test-pkg, today adds another scope-prefix variant (kartykgithub-*, dropped the hyphen between kartyk and github). GHSA carries only the CWE-506 boilerplate; treat as medium pending analysis. Same posture as the earlier days — same red-team engagement`s test artefacts
*Cluster H — 25+ npm `lisa- tea.xyz autopublish flood (registry-pollution reputation-farming)**: at least 25 packages with names like lisa-gulai65-sukiwir, lisa-jus17-ruro, lisa-ikan25-riris, lisa-gudeg59-breki, lisa-gudeg42-riris, lisa-gulai37-sukiwir, lisa-jengkol46-miaww, lisa-gulai61-sukiwir, lisa-jengkol34-miaww, lisa-jamblang15-sukiwir, lisa-jamblang72-breki, lisa-jamblang60-sluey, lisa-jamblang9-sluey, lisa-jamblang16-remi, lisa-gulai32-sluey, lisa-gulai30-breki, lisa-gudeg30-sumpek, lisa-ikan40-breki, lisa-gado-gado20-sukiwir, lisa-getuk69-miaww, lisa-esdoger11-ruro, lisa-gandul17-riris, lisa-gembus72-riris, lisa-gandul10-breki, lisa-gudeg13-sluey, lisa-gorengan62-sluey, lisa-getuk77-sluey, lisa-getuk7-riris, lisa-esdoger24-miaww, lisa-gaplek22-sukiwir, lisa-gembus35-sumpek, lisa-gaplek6-sluey. Each contains autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that modify package.json to remove private flags, generate random Indonesian-themed names (jamblang, gudeg, gulai, jengkol, ikan, esdoger, gandul, gembus, getuk, gorengan, gaplek, gado-gado — Indonesian foods), and continuously republish variants. **Goal: inflate developer reputation scores on the tea.xyz protocol for token rewards** — not credential theft, not RCE, but they pollute the npm registry and drown out legitimate signal. Treat as info/medium`: no direct payload on installer, but a hit means you accidentally installed something the tea.xyz reputation-farming operator published

What to do

Clean-up steps

Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, package.json, requirements.txt, Pipfile.lock, and poetry.lock in your org for every package name in Clusters A through H. Uninstall on hit, wipe node_modules/.venv, delete the lockfile, rebuild against a clean cache. Clusters A, B, C, D, E, F include real payloads (RCE via install, remote-code eval, on-chain C2, DNS exfil, reverse shells, credential exfil) — a hit is a compromise, not a warning
For Cluster A Baileys libsignal-hijack wave: any host that ran npm install on xzvbailey, xzvbailsx, zero-baileys, or @lekzo/baileys fetched and executed the lifecycle scripts of a github: URL or @otaxayun/libsignal-node@latest under the operators live control. **Rotate every credential accessible from that host** — .npmrc tokens, ~/.aws/credentials, ~/.ssh/*, browser-stored credentials, environment secrets. Add github:tenka-san/libsignal-node, github:canove/libsignal-node, and @otaxayun/libsignal-node to your registry denylist; block bare libsignal resolution and pin the real @whiskeysockets/baileys (which vendors libsignal-node internally) explicitly. Extend your denylist to future Baileys forks — the pattern of "package.json redirects libsignal` to a personal GitHub" is now the actively-abused primitive, so treat any Baileys wrapper you did not vet by hand as suspect
For Cluster B remote-code loaders: --ignore-scripts does NOT block Cluster B (all three trigger on require, not on install). If you require any of these, kill any child Node process fetching from xss.report/c/k3rne111, api.npoint.io/641d37178a880b1e8b8f, or unpkg.com/x6842179305, uninstall the package, and rotate everything the parent Node process could touch. Block xss.report, api.npoint.io, and duel.com at egress across CI — the api.npoint.io operator is now on day 3 of republishing the same loader pattern under a new package name and a new bucket key every day (2026-09-16 process-lhpm@…33e8d008c334b060adad, 2026-09-17 process-mite@…33e8d008c334b060adad, 2026-09-18 @railone/image-utils@…641d37178a880b1e8b8f), so denylisting the domain is the only durable mitigation
For Cluster C on-chain-C2 tailwindcss typosquats: no domain to block — the command channel is Ethereum mainnet transactions from 0xa322E5f3D311D3080e9aDC2490Ef6f0121063e1a. Detection instead: alert on any child_process.spawn in a build environment, alert on outbound TCP to *.publicnode.com, eth.drpc.org, 1rpc.io, and blockscout instances (these should never appear in a legitimate frontend build), and pin @tailwindcss/forms (correct name) explicitly in every project — the two typosquats are ranking in npm search results because they include the tailwindcss-forms README verbatim
For Cluster D DNS-OOB dep-confusion pair: any host that npm installed @tink/tink-link-core@9.9.10 or test89078-auth@99.99.99 DNS-resolved a label carrying hostname/username to oob.algamil7x.xyz or 31ee29fe-db68-4fd3-86a2-2b707b9e95f0.dnshook.site. Rotate exposed credentials, block those two DNS zones at your resolver, and if you maintain internal @tink or test89078-* scopes, pin them to your internal registry with .npmrc and configure the internal registry to refuse public-npm publishes under the same names. Sentinel versions 9.9.10 and 99.99.99 are classic dep-confusion resolution-attack markers
For Cluster E pip setup.py reverse shells: pip uninstall requests-auroras requests-triwes requests-asetwe. Any host that pip installed one of these had a reverse shell process attempted during install; assume the shell succeeded on any host with unrestricted outbound TCP. Reimage the host and rotate every credential accessible from that host. Consider pip install --no-binary :all: --isolated in CI to block setup.py-side attack paths, and pin the correct requests package explicitly
For Cluster F pip file-exfil: pip uninstall marketing-mcp aiosendletter index-forum pyjstat-smooth. marketing-mcp is especially dangerous if you registered it as an MCP tool with an LLM agent (Claude Code, Cursor, in-house MCP) — the agent can be prompted to read arbitrary files including ~/.ssh/id_rsa, ~/.aws/credentials, .env, source code, and POST them to webhook.site/4acf7132…. Deregister the MCP, rotate every credential the agent had file-system access to, and audit your MCP allowlist so no MCP tool with the marketing-mcp name (or similar plausibly-named MCPs) can be installed without review. Block webhook.site at egress from any agent-hosting environment
For Cluster G kartykgithub-multiversion-a: uninstall on hit, rotate env values as a precaution. Same posture as the kartyk-github-* and kartykp-* sweeps of the previous two days. Consider extending your registry denylist to kartyk* scope prefixes given the three-day-and-counting pattern
*For Cluster H `lisa- tea.xyz autopublish flood**: no direct exfil payload, but a hit means your dependency tree includes an autopublishing spam package that pollutes the npm registry with derivative packages under your own machines credentials. Uninstall on hit, and if you find these in a lockfile you did not author, rotate your .npmrc publish token (the publish could have happened from your machine). Longer-term: add lisa-* to your registry denylist and treat any Indonesian-food-themed package name (jamblang, gudeg, gulai, jengkol, ikan, esdoger, gandul, gembus, getuk, gorengan, gaplek, gado-gado) as a probable tea.xyz autopublish variant. The tea protocol reputation-farming problem is systemic — every lisa-* name in your tree is one an attacker got to first
For every npm install in CI, prefer --ignore-scripts or an equivalent lockfile-consumer mode that blocks pre/post-install hooks. This blocks Clusters A, D, E, G, H entirely (install-time triggers), but does NOT block Cluster B (require-time), Cluster C (require-time on-chain), or Cluster F (import-time). Layer with egress denylists on xss.report, api.npoint.io, duel.com, oob.algamil7x.xyz, dnshook.site, webhook.site, and *.publicnode.com/drpc.org/1rpc.io (or, for legitimate Web3 workloads, alert-only on those endpoints from build environments)
Add every specific package name below to your internal private-registry deny-list for at least 30 days. Extend your existing -meeb/kartyk* scope pins with a new pin on lisa-*, @tink/tink-* (unless you actually consume Tink SDK), github:tenka-san/libsignal-node, @otaxayun/libsignal-node, and any Baileys wrapper you have not personally vetted

References

Sources

multi-2026-09-18-ghsa-malware-sweepBack to incidents Submit a correction

Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.json All incidents