GitHub Advisory malware sweep - 2026-09-19 late + 2026-09-20 (pip `urc@99.99.99` install-time host-info exfil probe; light day, one entry)

What happened

Between roughly 2026-09-19 12:00 UTC and 2026-09-20 12:00 UTC, GitHub Advisory Database published exactly one new malware advisory: pip urc@99.99.99 (GHSA-3c7m-3qhf-wqrr, MAL-2026-16298). No new npm advisories in the window. This is the lightest sweep day since the ingest cadence began; the corresponding jaschadub/compromised-packages-check PR #134 confirms the single-entry count as "Sep 19-20 2026 sweep: urc PyPI host-info exfiltrator".

Cluster A - pip urc@99.99.99 install-time host-info exfiltrator

The package overrides setup.py's install command to execute during pip install. The overridden install collects the installer's IP address and username and POSTs them to a remote endpoint. GHSA advisory text: "installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose".

The single sentinel version 99.99.99 on a three-letter package name is a classic dep-confusion resolution-attack marker. The GHSA classification (PROBABLY_PENTEST) matches the shape: a bug-bounty or red-team engagement iterating dep-confusion probes against internal urc names. The exfiltrated data (IP + username) is what shows up on a Burp Collaborator or DNSHook-style OOB log; there is no persistent payload.

Why the light day

Today's single-entry sweep contrasts with yesterday's 20-entry batch (multi-2026-09-19-ghsa-malware-sweep). The recent algamil7x.xyz DNS-OOB operator, the tailwindcss-form* on-chain-C2 operator, the test89*-auth dep-confusion pentest, and the Baileys wave all appear to have paused for the day. Expect the cadence to resume tomorrow - none of those operators has publicly stood down.

Cross-reference: also disclosed this week but NOT in GHSA today

Socket published a separate analysis of the PolinRider Packagist compromise targeting visanduma/nova-two-factor (four dev-* branches). That disclosure is not in GHSA and is catalogued as its own named incident (packagist-2026-09-17-visanduma-nova-two-factor-polinrider) rather than in this sweep - the campaign is a genuine compromise of a legitimate 700K-download package and belongs as a standalone record.

Registry state

urc@99.99.99 is flagged as malware on PyPI and quarantined at the time of writing. No stable release exists.

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, kam193/bad-packages, jaschadub/compromised-packages-check (PR #134).

Affected packages (1)

Impact

• Cluster A - pip urc@99.99.99 install-time host-info exfiltrator (probable pentest artefact): GHSA-3c7m-3qhf-wqrr, MAL-2026-16298, campaign GENERIC-standard-pypi-install-pentest. The package overrides setup.py's install command to execute during pip install; it collects the installer's IP address and username and POSTs them to a remote endpoint. GHSA classifies the package as PROBABLY_PENTEST - "installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose". The single sentinel version 99.99.99 on a three-letter internal-name-shaped package name is a classic dep-confusion resolution-attack marker. Treat as medium - a beacon-only probe with limited confirmed reach against anyone whose internal PyPI mirror does not shadow the urc name

What to do

1. 1Grep every requirements.txt, Pipfile.lock, and poetry.lock in your org for urc. Uninstall on hit and wipe the .venv; a hit at version 99.99.99 means the operator has your host's IP and username on their beacon log. Rotate any credential accessible from that host as a precaution and pin the internal urc name in your private mirror
2. 2For pip install in CI, prefer --no-binary :all: --isolated (blocks the setup.py-side attack path) or an equivalent lockfile-only mode. Alert on outbound HTTPS from build environments to unfamiliar hosts
3. 3Sentinel version 99.99.99 on a plausibly-internal three-letter name is the diagnostic marker for this dep-confusion class - if your org maintains any three-letter or short-name internal package, pin it to your internal registry with .npmrc/pip.conf and configure the registry to refuse public-PyPI publishes under that name

References

• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub
• GHSA-3c7m-3qhf-wqrr - urc (Cluster A - pip install-time host-info exfil probe)

  github.com
  GitHub
• jaschadub/compromised-packages-check - Sep 19-20 2026 sweep (PR #134)

  github.com
  jaschadub
• OpenSSF malicious-packages repository

  github.com
  OpenSSF
• bad-packages.kam193.eu - pip/urc

  bad-packages.kam193.eu
  kam193