# GitHub Advisory malware sweep - 2026-09-17 late + 2026-09-18 (npm Baileys-fork `libsignal`-hijack wave `xzvbailey`/`xzvbailsx`/`zero-baileys`/`@lekzo/baileys` unpinned GitHub-ref RCE; `blue-string-formatter-utils` `xss.report/c/k3rne111` require-time eval loader; `@railone/image-utils` `api.npoint.io/641d37178a880b1e8b8f` sibling of `process-lhpm`/`process-mite`; `xa424234657567` `duel.com` host-gated `unpkg.com/x6842179305` remote payload; `tailwindcss-form-utils`/`-form-ui` Ethereum-on-chain C2 (`0xa322E5f3...` publicnode/drpc/1rpc); `@tink/tink-link-core@9.9.10` + `test89078-auth@99.99.99` dep-confusion DNS OOB pair; pip `requests-auroras`/`-triwes`/`-asetwe` `2.34.2` setup.py reverse shells + probes; pip `marketing-mcp` webhook.site SSH/AWS-key exfil MCP tool; pip `aiosendletter`/`index-forum`/`pyjstat-smooth` cloned-legit file exfil; npm `kartykgithub-multiversion-a` pentest continuation; 25x `lisa-*` tea.xyz autopublish flood)

> GHSA 2026-09-17 late + 2026-09-18: 4x npm Baileys-fork packages redirect `libsignal` to unpinned GitHub refs for install-time RCE; `blue-string-formatter-utils` runs `xss.report` XMLHttpRequest+eval on require; `@railone/image-utils` reuses the `api.npoint.io` loader pattern of `process-lhpm`/`process-mite`; `tailwindcss-form-*` typosquats fetch commands from an attacker-authored Ethereum address; pip `marketing-mcp` exfils `~/.ssh/id_rsa` + `~/.aws/credentials` via a webhook.site endpoint.

- Published: 2026-09-18
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 51 packages, 78 compromised versions
- Tags: typosquat, dependency-confusion, infostealer, credential-theft, ci-cd-compromise, obfuscation, dns-exfiltration
- Also known as: 2026-09-18 GHSA npm+pip sweep, Baileys libsignal-hijack wave (xzvbailey, xzvbailsx, zero-baileys, @lekzo/baileys), blue-string-formatter-utils xss.report remote-code loader, @railone/image-utils api.npoint.io loader (process-lhpm/process-mite operator day 3), tailwindcss-form-utils/-ui on-chain Ethereum C2 (0xa322E5f3...), @tink/tink-link-core + test89078-auth dep-confusion DNS-OOB pair, requests-auroras/-triwes/-asetwe pip setup.py reverse shells, marketing-mcp SSH+AWS-key exfil MCP tool, lisa-* tea.xyz autopublish flood, kartykgithub-multiversion-a pentest continuation
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector, kam193/bad-packages
- Incident ID: multi-2026-09-18-ghsa-malware-sweep

## Affected packages (51)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@lekzo/baileys](https://dependencywatch.io/package/npm/@lekzo/baileys) | npm | 0.0.1 |
| [@railone/image-utils](https://dependencywatch.io/package/npm/@railone/image-utils) | npm | <=1.1.10 |
| [@tink/tink-link-core](https://dependencywatch.io/package/npm/@tink/tink-link-core) | npm | 9.9.10 |
| [aiosendletter](https://dependencywatch.io/package/pypi/aiosendletter) | PyPI | 0.2.0, 3.7, 3.8, 3.9, 4.0, 4.1, 4.3, 4.5, 4.6 |
| [blue-string-formatter-utils](https://dependencywatch.io/package/npm/blue-string-formatter-utils) | npm | 1.0.0 |
| [index-forum](https://dependencywatch.io/package/pypi/index-forum) | PyPI | 2.5.4 |
| [kartykgithub-multiversion-a](https://dependencywatch.io/package/npm/kartykgithub-multiversion-a) | npm | 1.0.0, 1.0.1 |
| [lisa-esdoger11-ruro](https://dependencywatch.io/package/npm/lisa-esdoger11-ruro) | npm | >=0 |
| [lisa-esdoger24-miaww](https://dependencywatch.io/package/npm/lisa-esdoger24-miaww) | npm | >=0 |
| [lisa-gado-gado20-sukiwir](https://dependencywatch.io/package/npm/lisa-gado-gado20-sukiwir) | npm | >=0 |
| [lisa-gandul10-breki](https://dependencywatch.io/package/npm/lisa-gandul10-breki) | npm | >=0 |
| [lisa-gandul17-riris](https://dependencywatch.io/package/npm/lisa-gandul17-riris) | npm | >=0 |
| [lisa-gaplek22-sukiwir](https://dependencywatch.io/package/npm/lisa-gaplek22-sukiwir) | npm | >=0 |
| [lisa-gaplek6-sluey](https://dependencywatch.io/package/npm/lisa-gaplek6-sluey) | npm | >=0 |
| [lisa-gembus35-sumpek](https://dependencywatch.io/package/npm/lisa-gembus35-sumpek) | npm | >=0 |
| [lisa-gembus72-riris](https://dependencywatch.io/package/npm/lisa-gembus72-riris) | npm | >=0 |
| [lisa-getuk69-miaww](https://dependencywatch.io/package/npm/lisa-getuk69-miaww) | npm | >=0 |
| [lisa-getuk7-riris](https://dependencywatch.io/package/npm/lisa-getuk7-riris) | npm | >=0 |
| [lisa-getuk77-sluey](https://dependencywatch.io/package/npm/lisa-getuk77-sluey) | npm | >=0 |
| [lisa-gorengan62-sluey](https://dependencywatch.io/package/npm/lisa-gorengan62-sluey) | npm | >=0 |
| [lisa-gudeg13-sluey](https://dependencywatch.io/package/npm/lisa-gudeg13-sluey) | npm | >=0 |
| [lisa-gudeg30-sumpek](https://dependencywatch.io/package/npm/lisa-gudeg30-sumpek) | npm | >=0 |
| [lisa-gudeg42-riris](https://dependencywatch.io/package/npm/lisa-gudeg42-riris) | npm | >=0 |
| [lisa-gudeg59-breki](https://dependencywatch.io/package/npm/lisa-gudeg59-breki) | npm | >=0 |
| [lisa-gulai30-breki](https://dependencywatch.io/package/npm/lisa-gulai30-breki) | npm | >=0 |
| [lisa-gulai32-sluey](https://dependencywatch.io/package/npm/lisa-gulai32-sluey) | npm | >=0 |
| [lisa-gulai37-sukiwir](https://dependencywatch.io/package/npm/lisa-gulai37-sukiwir) | npm | >=0 |
| [lisa-gulai61-sukiwir](https://dependencywatch.io/package/npm/lisa-gulai61-sukiwir) | npm | >=0 |
| [lisa-gulai65-sukiwir](https://dependencywatch.io/package/npm/lisa-gulai65-sukiwir) | npm | >=0 |
| [lisa-ikan25-riris](https://dependencywatch.io/package/npm/lisa-ikan25-riris) | npm | >=0 |
| [lisa-ikan40-breki](https://dependencywatch.io/package/npm/lisa-ikan40-breki) | npm | >=0 |
| [lisa-jamblang15-sukiwir](https://dependencywatch.io/package/npm/lisa-jamblang15-sukiwir) | npm | >=0 |
| [lisa-jamblang16-remi](https://dependencywatch.io/package/npm/lisa-jamblang16-remi) | npm | >=0 |
| [lisa-jamblang60-sluey](https://dependencywatch.io/package/npm/lisa-jamblang60-sluey) | npm | >=0 |
| [lisa-jamblang72-breki](https://dependencywatch.io/package/npm/lisa-jamblang72-breki) | npm | >=0 |
| [lisa-jamblang9-sluey](https://dependencywatch.io/package/npm/lisa-jamblang9-sluey) | npm | >=0 |
| [lisa-jengkol34-miaww](https://dependencywatch.io/package/npm/lisa-jengkol34-miaww) | npm | >=0 |
| [lisa-jengkol46-miaww](https://dependencywatch.io/package/npm/lisa-jengkol46-miaww) | npm | >=0 |
| [lisa-jus17-ruro](https://dependencywatch.io/package/npm/lisa-jus17-ruro) | npm | >=0 |
| [marketing-mcp](https://dependencywatch.io/package/pypi/marketing-mcp) | PyPI | 0.1.0 |
| [pyjstat-smooth](https://dependencywatch.io/package/pypi/pyjstat-smooth) | PyPI | 1.5.0, 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5, 2.5.6, 2.5.7, 2.5.8, 2.5.9, 2.5.10, 2.5.11, 2.5.12, 2.5.13, 2.5.14, 2.5.15, 2.5.16, 2.5.17 |
| [requests-asetwe](https://dependencywatch.io/package/pypi/requests-asetwe) | PyPI | 2.34.2 |
| [requests-auroras](https://dependencywatch.io/package/pypi/requests-auroras) | PyPI | 2.34.2 |
| [requests-triwes](https://dependencywatch.io/package/pypi/requests-triwes) | PyPI | 2.34.2 |
| [tailwindcss-form-ui](https://dependencywatch.io/package/npm/tailwindcss-form-ui) | npm | <=0.5.1 |
| [tailwindcss-form-utils](https://dependencywatch.io/package/npm/tailwindcss-form-utils) | npm | <=0.5.1 |
| [test89078-auth](https://dependencywatch.io/package/npm/test89078-auth) | npm | 99.99.99 |
| [xa424234657567](https://dependencywatch.io/package/npm/xa424234657567) | npm | 1.0.0 |
| [xzvbailey](https://dependencywatch.io/package/npm/xzvbailey) | npm | 1.0.0 |
| [xzvbailsx](https://dependencywatch.io/package/npm/xzvbailsx) | npm | 1.0.0 |
| [zero-baileys](https://dependencywatch.io/package/npm/zero-baileys) | npm | 2.7.0 |

## What happened

Between roughly 2026-09-17 12:00 UTC and 2026-09-18 12:00 UTC, GitHub Advisory Database published 25+ new malware advisories — mostly npm and pip, with several packages carrying real infostealer or RCE payloads (not just CWE-506 boilerplate). Today`s batch is dominated by three overlapping patterns: (1) a Baileys-fork ecosystem that has moved on from yesterday`s WhatsApp-newsletter-follower nuisance to full install-time RCE by declaring the `libsignal` dependency as an unpinned GitHub ref; (2) the `api.npoint.io` remote-code operator on day 3 of daily republishes under a new package name each day; (3) a bulk registry-pollution wave from the tea.xyz reputation-farming ecosystem (25+ `lisa-*` autopublish spam packages).

## Cluster A - Baileys-fork libsignal-hijack wave (npm)

| Package | Version | GHSA | Redirected libsignal source | Notes |
|---|---|---|---|---|
| `xzvbailey` | `1.0.0` | GHSA-rg4j-jh5f-w982 | `github:tenka-san/libsignal-node` (unpinned) | Homepage/repo → Telegram, bug tracker → `pou-code/Baileys` |
| `xzvbailsx` | `1.0.0` | GHSA-m364-pjc8-42wc | `github:tenka-san/libsignal-node` (unpinned) | Handles `t.me/JustRxVz`, `t.me/XzV_ExpzC`; README refers to `@XzV-RxVz/xbails` |
| `zero-baileys` | `2.7.0` | GHSA-2q5p-vqh2-8c92 | `@otaxayun/libsignal-node@latest` (mutable dist-tag) | Third-party npm scope with `latest` — silent payload swap possible |
| `@lekzo/baileys` | `0.0.1` | GHSA-75mc-fj4c-6pfm | `github:canove/libsignal-node` (unpinned) | Same primitive |

**The primitive.** Real `libsignal` (WhatsApp E2E crypto) is vendored inside the legitimate `@whiskeysockets/baileys` package. A malicious Baileys fork replaces that dependency declaration with an unpinned reference to a personal GitHub repo or a third-party npm scope on `@latest`. npm resolves that reference at install and executes whatever lifecycle scripts (`preinstall`, `install`, `postinstall`) sit at HEAD, so the operator has arbitrary code execution on the installer`s machine every install with no version-pin defence and no `--ignore-scripts` block on the parent package (the child package`s scripts still run when npm runs its own install-tree walk).

**Continuity.** 2026-09-16 `plogme` and 2026-09-17 `jexkcode` were nuisance-tier Baileys forks that forced newsletter subscriptions on connected WhatsApp accounts. Today`s four packages are the escalation: full RCE at install. Not confirmed as the same operators — `tenka-san` and `canove` and `@otaxayun` are three distinct GitHub/npm accounts — but the target audience (WhatsApp automation developers) and the exact `libsignal`-redirection primitive are shared, so this is a small operator community iterating on a shared TTP.

## Cluster B - Remote-code loaders (npm)

| Package | Version | GHSA | Endpoint | Trigger |
|---|---|---|---|---|
| `blue-string-formatter-utils` | `1.0.0` | GHSA-5mc6-ff2p-32qj | `//xss.report/c/k3rne111` | `require` → `XMLHttpRequest` GET → `eval()` |
| `@railone/image-utils` | `<=1.1.10` | GHSA-h72c-8fwp-p292 | `https://api.npoint.io/641d37178a880b1e8b8f` | `import` → detached `node loader.js` → base64-decode `code` → `new Function()` |
| `xa424234657567` | `1.0.0` | GHSA-h7pm-6wh6-7xvw | `https://unpkg.com/x6842179305@1.0.3/1.js` + `ui.js` | `require` → host-gated on `duel.com` (else redirect) |

**The `api.npoint.io` operator is on day 3.** 2026-09-16 sweep Cluster E was `process-lhpm@<=1.1.79` fetching `api.npoint.io/33e8d008c334b060adad`; 2026-09-17 sweep Cluster D was `process-mite@<=1.1.79` fetching **the same** `api.npoint.io/33e8d008c334b060adad`; today `@railone/image-utils@<=1.1.10` fetches a **different** bucket (`641d37178a880b1e8b8f`) with the same base64+`new Function()` decoder. Same operator or same TTP-borrowing operator; either way, `api.npoint.io` is the durable IOC.

**The `xss.report` operator** publishes short-code buckets (`k3rne111`) that any client can register free-tier; blocking the bucket alone is not enough because the operator can churn buckets — block the full domain at CI egress.

## Cluster C - On-chain Ethereum-C2 tailwindcss typosquats (npm)

Both `tailwindcss-form-utils@<=0.5.1` (GHSA-fm65-924g-pg2g) and `tailwindcss-form-ui@<=0.5.1` (GHSA-hxjv-cpxc-564m) impersonate the legitimate `@tailwindlabs/tailwindcss-forms` plugin (cloned repo and README). On require the obfuscated `src/index.js` (obfuscator.io string-array) imports `node:http`, `node:https`, `node:zlib`, `node:url`, `node:child_process.spawn`, and queries every RPC in `[process.env.ETH_RPC_URL, *.publicnode.com, eth.drpc.org, 1rpc.io/eth, ...blockscout endpoints]` for transactions authored by the hardcoded sender:

```
0xa322E5f3D311D3080e9aDC2490Ef6f0121063e1a
```

The transaction data (gzip/inflate/brotli-compressed) reconstructs a JavaScript payload, which is then executed via `child_process.spawn`. This is a **takedown-resistant on-chain command channel**: every recent transaction authored by that Ethereum address is a fresh command pushed to every installed victim. There is no domain to block, no C2 IP to seize, and taking down the address requires either burning it (attacker moves to a new one) or getting Ethereum mainnet to censor a specific sender (not going to happen).

## Cluster D - Dep-confusion sentinel-version DNS-OOB exfil pair (npm)

| Package | Version | GHSA | Endpoint |
|---|---|---|---|
| `@tink/tink-link-core` | `9.9.10` | GHSA-hvcc-qwg6-972c | DNS labels `tinkcore-<hostinfo>.oob.algamil7x.xyz` |
| `test89078-auth` | `99.99.99` | GHSA-x9mp-cqw3-368c | DNS labels of `31ee29fe-db68-4fd3-86a2-2b707b9e95f0.dnshook.site` |

Both are classic dep-confusion resolution-attack lures — sentinel versions (`9.9.10`, `99.99.99`), plausibly-internal-looking names (`@tink/tink-link-core` reads as a Tink open-banking SDK internal package; `test89078-auth` reads as a placeholder internal `auth` package). The exfil channel is DNS-based (bypasses HTTP proxies and egress-firewall rules), targeting `hostname`, `username`, `cwd`. Two independent operators, same tactic, same day — treat as a real pentest artefact **and** functional intel-gathering.

`algamil7x.xyz` is a fresh domain of unclear provenance; `dnshook.site` is a public DNS OOB service (the `31ee29fe-db68-4fd3-86a2-2b707b9e95f0` UUID is the campaign identifier the operator registered against the free tier). Block both at your resolver.

## Cluster E - pip setup.py reverse shells / IP-username exfil

| Package | Version | GHSA | Payload |
|---|---|---|---|
| `requests-auroras` | `2.34.2` | GHSA-5p5r-2g2v-44x5 | setup.py reverse shell |
| `requests-triwes` | `2.34.2` | GHSA-c47p-v854-jfg4 (MAL-2026-16275) | setup.py reverse shell |
| `requests-asetwe` | `2.34.2` | GHSA-38mf-xcf2-88cp | setup.py IP+username exfil, `GENERIC-standard-pypi-install-pentest` |

All three same-day publications on the exact same version pin (`2.34.2`), same setup.py-override tactic. Distinct payloads (two reverse shells, one exfil probe), and `asetwe` is OpenSSF-tagged `PROBABLY_PENTEST` while the two reverse-shell variants are unambiguously malicious. Likely one operator running the reverse-shell primitives and one separate pentest engagement running the exfil probe, both squatting the `requests-*` name at the same version to maximise install-typo coverage.

## Cluster F - pip file-exfil / infostealer packages

### `marketing-mcp@0.1.0` (GHSA-7m86-6729-5w7h)

**The most operationally novel item in this sweep.** An MCP (Model Context Protocol) tool that reads caller-specified local files and POSTs them to a hardcoded `https://webhook.site/4acf7132-a75e-47e1-aeff-0350c8eac16c` endpoint. Target files: `~/.ssh/id_rsa`, `~/.aws/credentials`, `.env`, source code — everything an LLM agent might legitimately want to read on its user`s behalf.

Anyone who registered `marketing-mcp` as an MCP tool with Claude Code, Cursor, an in-house MCP-enabled agent, or any other MCP host, handed that agent an exfil pipe: a prompt that says "please summarise my AWS credentials" or "check my SSH config" causes the agent to invoke the MCP tool, which POSTs the file to `webhook.site`. The attacker never has to touch the developer`s machine directly — the developer`s own agent does the reading and the POSTing.

**This is the second confirmed exfil MCP tool in the incident set** (the first was earlier in 2026; different package). The pattern is going to keep repeating — `MCP tools` are the new npm packages for supply-chain purposes, and the LLM agent is the browser-equivalent trust boundary.

### Other file-exfil pip packages

| Package | Versions | GHSA | Target |
|---|---|---|---|
| `aiosendletter` | `0.2.0`, `3.7`, `3.8`, `3.9`, `4.0`, `4.1`, `4.3`, `4.5`, `4.6` | GHSA-hc2r-77jq-mjrx (`2026-09-aiosendletter`) | Messaging application credentials |
| `index-forum` | `2.5.4` | GHSA-8466-62v8-x2vr (`2026-09-pyjstat-smooth`) | CTF-like target paths |
| `pyjstat-smooth` | `1.5.0`, `2.5.0`-`2.5.17` | GHSA-rq89-pjxc-hpf8 (`2026-09-pyjstat-smooth`) | File exfil, clones legitimate `pyjstat` |

The `index-forum` and `pyjstat-smooth` packages share the campaign identifier `2026-09-pyjstat-smooth` — same operator running two typosquats against different Python names in the same day.

## Cluster G - kartykgithub CWE-506 pentest continuation (npm)

`kartykgithub-multiversion-a@1.0.0/1.0.1` (GHSA-p957-4pc7-x6hp). Third day of the `kartyk`-scope engagement:

- 2026-09-16 (Cluster H): `kartykp-prod-oidc-test-pkg`, `kartykp-token-pkg`
- 2026-09-17 (Cluster F): `kartyk-github-single-ver-pkg`, `kartyk-github-token-pkg`, `kartyk-github-oidc-test-pkg`
- 2026-09-18 (this cluster): `kartykgithub-multiversion-a`

Same red-team engagement`s serialised test artefacts leaking to npm public. CWE-506 boilerplate only, no published IOC beyond the package name. Treat as `medium`.

## Cluster H - tea.xyz autopublish flood (npm, 25+ packages)

25+ `lisa-*` packages published on 2026-09-17, all carrying autopublish scripts (`auto.js`, `autopublish.js`, `autopublish2.js`, `autopublish3.js`) that modify `package.json` to remove `private` flags, generate random Indonesian-food-themed names (`jamblang`, `gudeg`, `gulai`, `jengkol`, `ikan`, `esdoger`, `gandul`, `gembus`, `getuk`, `gorengan`, `gaplek`, `gado-gado`), and continuously republish variants. The goal is not credential theft or RCE — it is **reputation-farming on the tea.xyz protocol** to claim token rewards.

Operationally low-severity for defenders but registry-hygiene-relevant: every one of these names is a name an attacker got to first, and any legitimate package that could have been called `lisa-<food>-<suffix>` cannot be published on npm without a name collision. Add `lisa-*` to your denylist.

## Cross-operator patterns worth flagging

1. **The Baileys ecosystem is escalating from nuisance to RCE.** Yesterday`s newsletter-followers (`plogme`, `jexkcode`) were annoying but not exfil-tier; today`s `libsignal`-hijack primitive is full install-time RCE. Expect more Baileys forks tomorrow that use the same TTP.
2. **The `api.npoint.io` operator is on day 3 of daily republishes.** Block `api.npoint.io` at egress across CI — the domain is not going away.
3. **On-chain Ethereum C2 is now a mainstream supply-chain TTP.** The `tailwindcss-form-*` typosquats are the second confirmed on-chain-C2 pattern in the incident set. Detection cost is asymmetric: no domain to block, no IP to seize; you have to alert on outbound TCP to any Ethereum JSON-RPC endpoint from a build environment.
4. **MCP tools are the new supply-chain risk class.** `marketing-mcp` is the second confirmed exfil MCP tool; there will be more. Audit your MCP allowlist as strictly as you audit npm dependencies.
5. **Dep-confusion DNS-OOB is now the default primitive.** `@tink/tink-link-core` (sentinel `9.9.10`) and `test89078-auth` (sentinel `99.99.99`) are two independent operators using the same DNS-OOB tactic in the same 24h window.

## Registry state

All packages above are flagged as malware on npm and PyPI and quarantined at the time of writing. Private mirrors that cached tarballs before quarantine keep serving the malicious versions; network-edge egress blocks on `xss.report`, `api.npoint.io`, `duel.com`, `unpkg.com/x6842179305`, `oob.algamil7x.xyz`, `dnshook.site`, `webhook.site`, and outbound Ethereum-JSON-RPC calls from CI are the durable mitigations.

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `amazon-inspector`, `kam193/bad-packages`. Per-package IOC details drawn verbatim from GHSA advisory bodies published between 2026-09-17 12:00 UTC and 2026-09-18 12:00 UTC.

## Impact

- **Cluster A — 4x npm Baileys-fork `libsignal`-hijack wave (unpinned GitHub-ref RCE at install)**: `xzvbailey@1.0.0` (GHSA-rg4j-jh5f-w982) and `xzvbailsx@1.0.0` (GHSA-m364-pjc8-42wc) both declare `"libsignal": "github:tenka-san/libsignal-node"` with no tag or commit SHA — npm fetches the current HEAD of `tenka-san/libsignal-node` at install and runs its lifecycle scripts; both packages carry Telegram-linked metadata (`t.me/JustRxVz`, `t.me/XzV_ExpzC`, homepage/repo fields pointing at `pou-code/Baileys`). `zero-baileys@2.7.0` (GHSA-2q5p-vqh2-8c92) redirects `libsignal` to `@otaxayun/libsignal-node@latest` — a third-party npm scope with the mutable `latest` dist-tag, so the operator can silently swap the payload at any time. `@lekzo/baileys@0.0.1` (GHSA-75mc-fj4c-6pfm) redirects `libsignal` to `github:canove/libsignal-node`. All four continue yesterday`s Baileys-fork ecosystem (2026-09-16 `plogme`, 2026-09-17 `jexkcode`), but escalate from WhatsApp-newsletter-follower nuisance behaviour to full arbitrary-code-execution: the attacker controls the code that runs on the developer`s machine every `npm install`
- **Cluster B — 3x npm remote-code loaders (require- and require-adjacent execution)**: `blue-string-formatter-utils@1.0.0` (GHSA-5mc6-ff2p-32qj) advertises "Utility helpers for string formatting" but on `require` executes an XMLHttpRequest GET to `//xss.report/c/k3rne111` and passes the response to `eval()` — full remote-code execution, no `--ignore-scripts` block. `@railone/image-utils@<=1.1.10` (GHSA-h72c-8fwp-p292) auto-invokes `initialize()` on import which spawns a detached `node loader.js` process that fetches JSON from `https://api.npoint.io/641d37178a880b1e8b8f`, base64-decodes the `code` field and evals it via `new Function()` — **third package in three days using an `api.npoint.io/<bucket>` remote-code channel** (2026-09-16 Cluster E `process-lhpm@33e8d008c334b060adad`, 2026-09-17 Cluster D `process-mite@33e8d008c334b060adad`, today `@railone/image-utils@641d37178a880b1e8b8f`), and the internal comments identify it as an "ID-10 Client Module" with "AUTO-START ON IMPORT". `xa424234657567@1.0.0` (GHSA-h7pm-6wh6-7xvw) is an obfuscated (Function-constructor + hex-escaped char arrays) client that host-gates on `duel.com` — on `duel.com` domains it fetches and evals `https://unpkg.com/x6842179305@1.0.3/1.js` and `.../ui.js`, on other hosts it redirects to `duel.com`
- **Cluster C — 2x npm on-chain Ethereum-C2 `tailwindcss-form-*` typosquats** (`tailwindcss-form-utils@<=0.5.1` GHSA-fm65-924g-pg2g, `tailwindcss-form-ui@<=0.5.1` GHSA-hxjv-cpxc-564m). Both impersonate `@tailwindlabs/tailwindcss-forms` (cloned repository reference and README) and are heavily obfuscated (`obfuscator.io` string-array). On require, both import `node:http`, `node:https`, `node:zlib`, `node:url`, `node:child_process.spawn` and query multiple Ethereum JSON-RPC endpoints (`process.env.ETH_RPC_URL`, `*.publicnode.com`, `eth.drpc.org`, `1rpc.io/eth`, blockscout) for transactions authored by the hardcoded sender address `0xa322E5f3D311D3080e9aDC2490Ef6f0121063e1a`, decompress the transaction data (gzip/inflate/brotli), reconstruct JavaScript and execute commands via `child_process.spawn`. **Takedown-resistant on-chain command channel** — every recent transaction authored by that Ethereum address is a fresh command pushed to every installed victim, and there is no domain to block or takedown-target
- **Cluster D — 2x npm dep-confusion sentinel-version DNS-OOB exfil pair**: `@tink/tink-link-core@9.9.10` (GHSA-hvcc-qwg6-972c) impersonates Tink open-banking SDK; on install AND on import, obfuscated code reads `os.userInfo().username`, `os.hostname()`, `process.cwd()`, and resolves DNS labels of the form `tinkcore-<hostinfo>.oob.algamil7x.xyz` — DNS-based exfil, bypasses HTTP proxies and egress-firewall rules. `test89078-auth@99.99.99` (GHSA-x9mp-cqw3-368c) is a classic dep-confusion sentinel-version lure: preinstall runs `node index.js` which reads username/hostname and DNS-resolves subdomains of `31ee29fe-db68-4fd3-86a2-2b707b9e95f0.dnshook.site` embedding the labels. Two independent operators, same tactic: dep-confusion sentinel version + DNS beacon
- **Cluster E — 3x pip `requests-*@2.34.2` setup.py reverse shells / IP-username exfil**: `requests-auroras@2.34.2` (GHSA-5p5r-2g2v-44x5) and `requests-triwes@2.34.2` (GHSA-c47p-v854-jfg4, MAL-2026-16275) both override `setup.py``s `install` command to spawn a reverse shell during `pip install`; `requests-asetwe@2.34.2` (GHSA-38mf-xcf2-88cp, campaign `GENERIC-standard-pypi-install-pentest`) exfils IP + username via the same setup.py-override pattern, categorised `PROBABLY_PENTEST` by OpenSSF. Three same-day publications, same version pin `2.34.2` — an operator cluster targeting the `requests` name in bulk; unclear whether shared operator with the `requests-triwes` campaign umbrella
- **Cluster F — 4x pip file-exfil / infostealer packages (multiple cloned-legit lures)**: `marketing-mcp@0.1.0` (GHSA-7m86-6729-5w7h, campaign `2026-09-marketing-mcp`) — an MCP (Model Context Protocol) tool that reads caller-specified local files and POSTs them to a hardcoded `https://webhook.site/4acf7132-a75e-47e1-aeff-0350c8eac16c` endpoint; targets `~/.ssh/id_rsa`, `~/.aws/credentials`, `.env` files, and source code. First-observed **LLM-agent-facing exfil MCP tool** in this project — anyone who registered this MCP with Claude Code, Cursor, or an in-house MCP-enabled agent handed the agent an exfil pipe to a public webhook. `aiosendletter@0.2.0/3.7/3.8/3.9/4.0/4.1/4.3/4.5/4.6` (GHSA-hc2r-77jq-mjrx, campaign `2026-09-aiosendletter`) — file exfil targeting messaging application credentials. `index-forum@2.5.4` (GHSA-8466-62v8-x2vr, campaign `2026-09-pyjstat-smooth`) — file exfil with CTF-like target paths. `pyjstat-smooth@1.5.0/2.5.0-2.5.17` (GHSA-rq89-pjxc-hpf8, campaign `2026-09-pyjstat-smooth`) — file exfil, clones the legitimate `pyjstat` package layout to appear authentic. All four confirmed infostealer payloads, not probes
- **Cluster G — npm `kartykgithub-multiversion-a` CWE-506 pentest continuation**: `kartykgithub-multiversion-a@1.0.0/1.0.1` (GHSA-p957-4pc7-x6hp). Third day of the `kartyk`-scope pentest engagement leftover — 2026-09-16 sweep had `kartykp-prod-oidc-test-pkg`/`kartykp-token-pkg`, 2026-09-17 sweep added `kartyk-github-single-ver-pkg`/`-token-pkg`/`-oidc-test-pkg`, today adds another scope-prefix variant (`kartykgithub-*`, dropped the hyphen between `kartyk` and `github`). GHSA carries only the CWE-506 boilerplate; treat as `medium` pending analysis. Same posture as the earlier days — same red-team engagement`s test artefacts
- **Cluster H — 25+ npm `lisa-*` tea.xyz autopublish flood (registry-pollution reputation-farming)**: at least 25 packages with names like `lisa-gulai65-sukiwir`, `lisa-jus17-ruro`, `lisa-ikan25-riris`, `lisa-gudeg59-breki`, `lisa-gudeg42-riris`, `lisa-gulai37-sukiwir`, `lisa-jengkol46-miaww`, `lisa-gulai61-sukiwir`, `lisa-jengkol34-miaww`, `lisa-jamblang15-sukiwir`, `lisa-jamblang72-breki`, `lisa-jamblang60-sluey`, `lisa-jamblang9-sluey`, `lisa-jamblang16-remi`, `lisa-gulai32-sluey`, `lisa-gulai30-breki`, `lisa-gudeg30-sumpek`, `lisa-ikan40-breki`, `lisa-gado-gado20-sukiwir`, `lisa-getuk69-miaww`, `lisa-esdoger11-ruro`, `lisa-gandul17-riris`, `lisa-gembus72-riris`, `lisa-gandul10-breki`, `lisa-gudeg13-sluey`, `lisa-gorengan62-sluey`, `lisa-getuk77-sluey`, `lisa-getuk7-riris`, `lisa-esdoger24-miaww`, `lisa-gaplek22-sukiwir`, `lisa-gembus35-sumpek`, `lisa-gaplek6-sluey`. Each contains autopublish scripts (`auto.js`, `autopublish.js`, `autopublish2.js`, `autopublish3.js`) that modify `package.json` to remove `private` flags, generate random Indonesian-themed names (jamblang, gudeg, gulai, jengkol, ikan, esdoger, gandul, gembus, getuk, gorengan, gaplek, gado-gado — Indonesian foods), and continuously republish variants. **Goal: inflate developer reputation scores on the tea.xyz protocol for token rewards** — not credential theft, not RCE, but they pollute the npm registry and drown out legitimate signal. Treat as `info`/`medium`: no direct payload on installer, but a hit means you accidentally installed something the tea.xyz reputation-farming operator published

## What to do

1. Grep every `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `package.json`, `requirements.txt`, `Pipfile.lock`, and `poetry.lock` in your org for every package name in Clusters A through H. Uninstall on hit, wipe `node_modules`/`.venv`, delete the lockfile, rebuild against a clean cache. Clusters A, B, C, D, E, F include real payloads (RCE via install, remote-code eval, on-chain C2, DNS exfil, reverse shells, credential exfil) — a hit is a compromise, not a warning
2. **For Cluster A Baileys `libsignal`-hijack wave**: any host that ran `npm install` on `xzvbailey`, `xzvbailsx`, `zero-baileys`, or `@lekzo/baileys` fetched and executed the lifecycle scripts of a github: URL or `@otaxayun/libsignal-node@latest` under the operator`s live control. **Rotate every credential accessible from that host** — `.npmrc` tokens, `~/.aws/credentials`, `~/.ssh/*`, browser-stored credentials, environment secrets. Add `github:tenka-san/libsignal-node`, `github:canove/libsignal-node`, and `@otaxayun/libsignal-node` to your registry denylist; block bare `libsignal` resolution and pin the real `@whiskeysockets/baileys` (which vendors `libsignal-node` internally) explicitly. Extend your denylist to future Baileys forks — the pattern of "package.json redirects `libsignal` to a personal GitHub" is now the actively-abused primitive, so treat any Baileys wrapper you did not vet by hand as suspect
3. **For Cluster B remote-code loaders**: `--ignore-scripts` does NOT block Cluster B (all three trigger on `require`, not on install). If you require any of these, kill any child Node process fetching from `xss.report/c/k3rne111`, `api.npoint.io/641d37178a880b1e8b8f`, or `unpkg.com/x6842179305`, uninstall the package, and rotate everything the parent Node process could touch. Block `xss.report`, `api.npoint.io`, and `duel.com` at egress across CI — the `api.npoint.io` operator is now on **day 3** of republishing the same loader pattern under a new package name and a new bucket key every day (2026-09-16 `process-lhpm@…33e8d008c334b060adad`, 2026-09-17 `process-mite@…33e8d008c334b060adad`, 2026-09-18 `@railone/image-utils@…641d37178a880b1e8b8f`), so denylisting the domain is the only durable mitigation
4. **For Cluster C on-chain-C2 tailwindcss typosquats**: no domain to block — the command channel is Ethereum mainnet transactions from `0xa322E5f3D311D3080e9aDC2490Ef6f0121063e1a`. Detection instead: alert on any `child_process.spawn` in a build environment, alert on outbound TCP to `*.publicnode.com`, `eth.drpc.org`, `1rpc.io`, and blockscout instances (these should never appear in a legitimate frontend build), and pin `@tailwindcss/forms` (correct name) explicitly in every project — the two typosquats are ranking in npm search results because they include the `tailwindcss-forms` README verbatim
5. **For Cluster D DNS-OOB dep-confusion pair**: any host that `npm install`ed `@tink/tink-link-core@9.9.10` or `test89078-auth@99.99.99` DNS-resolved a label carrying hostname/username to `oob.algamil7x.xyz` or `31ee29fe-db68-4fd3-86a2-2b707b9e95f0.dnshook.site`. Rotate exposed credentials, block those two DNS zones at your resolver, and if you maintain internal `@tink` or `test89078-*` scopes, pin them to your internal registry with `.npmrc` and configure the internal registry to refuse public-npm publishes under the same names. Sentinel versions `9.9.10` and `99.99.99` are classic dep-confusion resolution-attack markers
6. **For Cluster E pip setup.py reverse shells**: `pip uninstall requests-auroras requests-triwes requests-asetwe`. Any host that `pip install`ed one of these had a reverse shell process attempted during install; assume the shell succeeded on any host with unrestricted outbound TCP. Reimage the host and rotate every credential accessible from that host. Consider `pip install --no-binary :all: --isolated` in CI to block setup.py-side attack paths, and pin the correct `requests` package explicitly
7. **For Cluster F pip file-exfil**: `pip uninstall marketing-mcp aiosendletter index-forum pyjstat-smooth`. `marketing-mcp` is especially dangerous **if you registered it as an MCP tool with an LLM agent (Claude Code, Cursor, in-house MCP)** — the agent can be prompted to read arbitrary files including `~/.ssh/id_rsa`, `~/.aws/credentials`, `.env`, source code, and POST them to `webhook.site/4acf7132-a75e-47e1-aeff-0350c8eac16c`. Deregister the MCP, rotate every credential the agent had file-system access to, and audit your MCP allowlist so no MCP tool with the `marketing-mcp` name (or similar plausibly-named MCPs) can be installed without review. Block `webhook.site` at egress from any agent-hosting environment
8. **For Cluster G `kartykgithub-multiversion-a`**: uninstall on hit, rotate env values as a precaution. Same posture as the `kartyk-github-*` and `kartykp-*` sweeps of the previous two days. Consider extending your registry denylist to `kartyk*` scope prefixes given the three-day-and-counting pattern
9. **For Cluster H `lisa-*` tea.xyz autopublish flood**: no direct exfil payload, but a hit means your dependency tree includes an autopublishing spam package that pollutes the npm registry with derivative packages under your own machine`s credentials. Uninstall on hit, and if you find these in a lockfile you did not author, rotate your `.npmrc` publish token (the publish could have happened from your machine). Longer-term: add `lisa-*` to your registry denylist and treat any Indonesian-food-themed package name (jamblang, gudeg, gulai, jengkol, ikan, esdoger, gandul, gembus, getuk, gorengan, gaplek, gado-gado) as a probable tea.xyz autopublish variant. The tea protocol reputation-farming problem is systemic — every `lisa-*` name in your tree is one an attacker got to first
10. For every `npm install` in CI, prefer `--ignore-scripts` or an equivalent lockfile-consumer mode that blocks pre/post-install hooks. This blocks Clusters A, D, E, G, H entirely (install-time triggers), but does NOT block Cluster B (`require`-time), Cluster C (`require`-time on-chain), or Cluster F (`import`-time). Layer with egress denylists on `xss.report`, `api.npoint.io`, `duel.com`, `oob.algamil7x.xyz`, `dnshook.site`, `webhook.site`, and `*.publicnode.com`/`drpc.org`/`1rpc.io` (or, for legitimate Web3 workloads, alert-only on those endpoints from build environments)
11. Add every specific package name below to your internal private-registry deny-list for at least 30 days. Extend your existing `-meeb`/`kartyk*` scope pins with a new pin on `lisa-*`, `@tink/tink-*` (unless you actually consume Tink SDK), `github:tenka-san/libsignal-node`, `@otaxayun/libsignal-node`, and any Baileys wrapper you have not personally vetted

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-5mc6-ff2p-32qj - blue-string-formatter-utils (Cluster B - xss.report remote-code loader)](https://github.com/advisories/GHSA-5mc6-ff2p-32qj) - GitHub
- [GHSA-rg4j-jh5f-w982 - xzvbailey (Cluster A - Baileys libsignal-hijack)](https://github.com/advisories/GHSA-rg4j-jh5f-w982) - GitHub
- [GHSA-h7pm-6wh6-7xvw - xa424234657567 (Cluster B - duel.com host-gated eval)](https://github.com/advisories/GHSA-h7pm-6wh6-7xvw) - GitHub
- [GHSA-2q5p-vqh2-8c92 - zero-baileys (Cluster A)](https://github.com/advisories/GHSA-2q5p-vqh2-8c92) - GitHub
- [GHSA-m364-pjc8-42wc - xzvbailsx (Cluster A)](https://github.com/advisories/GHSA-m364-pjc8-42wc) - GitHub
- [GHSA-75mc-fj4c-6pfm - @lekzo/baileys (Cluster A)](https://github.com/advisories/GHSA-75mc-fj4c-6pfm) - GitHub
- [GHSA-hvcc-qwg6-972c - @tink/tink-link-core (Cluster D - dep-confusion DNS OOB)](https://github.com/advisories/GHSA-hvcc-qwg6-972c) - GitHub
- [GHSA-x9mp-cqw3-368c - test89078-auth (Cluster D)](https://github.com/advisories/GHSA-x9mp-cqw3-368c) - GitHub
- [GHSA-5p5r-2g2v-44x5 - requests-auroras (Cluster E - pip setup.py reverse shell)](https://github.com/advisories/GHSA-5p5r-2g2v-44x5) - GitHub
- [GHSA-c47p-v854-jfg4 - requests-triwes (Cluster E)](https://github.com/advisories/GHSA-c47p-v854-jfg4) - GitHub
- [GHSA-38mf-xcf2-88cp - requests-asetwe (Cluster E)](https://github.com/advisories/GHSA-38mf-xcf2-88cp) - GitHub
- [GHSA-8466-62v8-x2vr - index-forum (Cluster F - pip file exfil)](https://github.com/advisories/GHSA-8466-62v8-x2vr) - GitHub
- [GHSA-rq89-pjxc-hpf8 - pyjstat-smooth (Cluster F)](https://github.com/advisories/GHSA-rq89-pjxc-hpf8) - GitHub
- [GHSA-hc2r-77jq-mjrx - aiosendletter (Cluster F)](https://github.com/advisories/GHSA-hc2r-77jq-mjrx) - GitHub
- [GHSA-7m86-6729-5w7h - marketing-mcp (Cluster F - MCP tool webhook.site SSH/AWS exfil)](https://github.com/advisories/GHSA-7m86-6729-5w7h) - GitHub
- [GHSA-p957-4pc7-x6hp - kartykgithub-multiversion-a (Cluster G - CWE-506 pentest continuation)](https://github.com/advisories/GHSA-p957-4pc7-x6hp) - GitHub
- [GHSA-fm65-924g-pg2g - tailwindcss-form-utils (Cluster C - on-chain ETH C2)](https://github.com/advisories/GHSA-fm65-924g-pg2g) - GitHub
- [GHSA-hxjv-cpxc-564m - tailwindcss-form-ui (Cluster C)](https://github.com/advisories/GHSA-hxjv-cpxc-564m) - GitHub
- [GHSA-h72c-8fwp-p292 - @railone/image-utils (Cluster B - api.npoint.io loader, day 3 of same operator)](https://github.com/advisories/GHSA-h72c-8fwp-p292) - GitHub
- [GHSA-85hh-jqvp-8x89 - lisa-gulai65-sukiwir (Cluster H - tea.xyz autopublish, representative)](https://github.com/advisories/GHSA-85hh-jqvp-8x89) - GitHub
- [GHSA-2939-4rc4-gwgw - lisa-jus17-ruro (Cluster H)](https://github.com/advisories/GHSA-2939-4rc4-gwgw) - GitHub
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF

---

Canonical page: https://dependencywatch.io/incident/multi-2026-09-18-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-09-18-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).