# GitHub Advisory malware sweep - 2026-09-19 late + 2026-09-20 (pip `urc@99.99.99` install-time host-info exfil probe; light day, one entry)

> GHSA 2026-09-19 late + 2026-09-20: only one new advisory in the 24h window - pip `urc@99.99.99` (GHSA-3c7m-3qhf-wqrr, MAL-2026-16298), a `setup.py`-override install-time host-info exfiltrator (IP + username) flagged by GHSA as `PROBABLY_PENTEST` under campaign `GENERIC-standard-pypi-install-pentest`. Cataloguing depth reserved for the corresponding named incident when a payload appears; no worm / hijack / typosquat cluster in this window.

- Published: 2026-09-20
- Severity: medium
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: PyPI
- Scope: 1 package, 1 compromised version
- Tags: dependency-confusion, credential-theft, dns-exfiltration
- Also known as: 2026-09-20 GHSA pip sweep (single entry), urc PyPI GENERIC-standard-pypi-install-pentest
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, kam193/bad-packages, jaschadub/compromised-packages-check
- Incident ID: multi-2026-09-20-ghsa-malware-sweep

## Affected packages (1)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [urc](https://dependencywatch.io/package/pypi/urc) | PyPI | 99.99.99 |

## What happened

Between roughly 2026-09-19 12:00 UTC and 2026-09-20 12:00 UTC, GitHub Advisory Database published exactly one new malware advisory: pip `urc@99.99.99` (GHSA-3c7m-3qhf-wqrr, MAL-2026-16298). No new npm advisories in the window. This is the lightest sweep day since the ingest cadence began; the corresponding `jaschadub/compromised-packages-check` PR #134 confirms the single-entry count as "Sep 19-20 2026 sweep: urc PyPI host-info exfiltrator".

## Cluster A - pip `urc@99.99.99` install-time host-info exfiltrator

| Field | Value |
|---|---|
| GHSA | GHSA-3c7m-3qhf-wqrr |
| MAL | MAL-2026-16298 |
| Package | `urc` (PyPI) |
| Version | `99.99.99` |
| Campaign | `GENERIC-standard-pypi-install-pentest` |
| Class (per GHSA) | `PROBABLY_PENTEST` |

The package overrides `setup.py`'s `install` command to execute during `pip install`. The overridden `install` collects the installer's IP address and username and POSTs them to a remote endpoint. GHSA advisory text: "installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose".

The single sentinel version `99.99.99` on a three-letter package name is a classic dep-confusion resolution-attack marker. The GHSA classification (`PROBABLY_PENTEST`) matches the shape: a bug-bounty or red-team engagement iterating dep-confusion probes against internal `urc` names. The exfiltrated data (IP + username) is what shows up on a Burp Collaborator or DNSHook-style OOB log; there is no persistent payload.

## Why the light day

Today's single-entry sweep contrasts with yesterday's 20-entry batch (`multi-2026-09-19-ghsa-malware-sweep`). The recent `algamil7x.xyz` DNS-OOB operator, the `tailwindcss-form*` on-chain-C2 operator, the `test89*-auth` dep-confusion pentest, and the Baileys wave all appear to have paused for the day. Expect the cadence to resume tomorrow - none of those operators has publicly stood down.

## Cross-reference: also disclosed this week but NOT in GHSA today

Socket published a separate analysis of the **PolinRider Packagist compromise** targeting `visanduma/nova-two-factor` (four dev-* branches). That disclosure is not in GHSA and is catalogued as its own named incident (`packagist-2026-09-17-visanduma-nova-two-factor-polinrider`) rather than in this sweep - the campaign is a genuine `compromise` of a legitimate 700K-download package and belongs as a standalone record.

## Registry state

`urc@99.99.99` is flagged as malware on PyPI and quarantined at the time of writing. No stable release exists.

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `kam193/bad-packages`, `jaschadub/compromised-packages-check` (PR #134).

## Impact

- **Cluster A - pip `urc@99.99.99` install-time host-info exfiltrator (probable pentest artefact)**: GHSA-3c7m-3qhf-wqrr, MAL-2026-16298, campaign `GENERIC-standard-pypi-install-pentest`. The package overrides `setup.py`'s `install` command to execute during `pip install`; it collects the installer's IP address and username and POSTs them to a remote endpoint. GHSA classifies the package as `PROBABLY_PENTEST` - "installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose". The single sentinel version `99.99.99` on a three-letter internal-name-shaped package name is a classic dep-confusion resolution-attack marker. Treat as `medium` - a beacon-only probe with limited confirmed reach against anyone whose internal PyPI mirror does not shadow the `urc` name

## What to do

1. Grep every `requirements.txt`, `Pipfile.lock`, and `poetry.lock` in your org for `urc`. Uninstall on hit and wipe the `.venv`; a hit at version `99.99.99` means the operator has your host's IP and username on their beacon log. Rotate any credential accessible from that host as a precaution and pin the internal `urc` name in your private mirror
2. For `pip install` in CI, prefer `--no-binary :all: --isolated` (blocks the setup.py-side attack path) or an equivalent lockfile-only mode. Alert on outbound HTTPS from build environments to unfamiliar hosts
3. Sentinel version `99.99.99` on a plausibly-internal three-letter name is the diagnostic marker for this dep-confusion class - if your org maintains any three-letter or short-name internal package, pin it to your internal registry with `.npmrc`/`pip.conf` and configure the registry to refuse public-PyPI publishes under that name

## Check your own dependencies

- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-3c7m-3qhf-wqrr - urc (Cluster A - pip install-time host-info exfil probe)](https://github.com/advisories/GHSA-3c7m-3qhf-wqrr) - GitHub
- [jaschadub/compromised-packages-check - Sep 19-20 2026 sweep (PR #134)](https://github.com/jaschadub/compromised-packages-check/pull/134) - jaschadub
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF
- [bad-packages.kam193.eu - pip/urc](https://bad-packages.kam193.eu/pypi/package/urc) - kam193

---

Canonical page: https://dependencywatch.io/incident/multi-2026-09-20-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-09-20-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).