GitHub Advisory malware sweep - 2026-09-28 (late) + 2026-09-29 (donutautosellsrc campaign extends to pip `aseitylab` day 3; npm `hardhat-*` pino-impersonator Ethereum-dev lure; npm `nebula-*` Windows `.kntrat` RAT dropper family; npm `fabric-*` Minecraft credential stealer via Discord webhook; npm `chalk-figlet` family Windows RuntimeBroker.exe dropper; npm `dotenv`-lookalike JPEG-EXIF steganography → PowerShell chain; npm `simple-date-formatter-new-12` OAST SSRF probe)

What happened

Between roughly 2026-09-28 12:00 UTC and 2026-09-29 12:00 UTC, the GitHub Advisory Database (with the OpenSSF malicious-packages bulk export, Amazon Inspectors IN-MAL feed, and kam193/bad-packages) published 26 new malware advisories: 25 npm and 1 pip. The defensively noteworthy shape of this window is a clear split: (a) the pip donutautosellsrc Polygon-blockchain-C2 campaign has now run for 3 consecutive days across 6 named packages under one wallet; (b) four distinct npm operators launched on 2026-09-28 with multi-package families (hardhat pino-impersonator, nebula- Windows RAT, fabric- Minecraft credential stealer, chalk-figlet RuntimeBroker dropper); (c) two unrelated Windows droppers (native-env/dotenv-native JPEG-EXIF chain, test-agency-assignment` process-hollowing chain) reuse the wscript.exe → PowerShell delivery pattern that has been common in this corpus.

Cluster A - pip aseitylab extends the donutautosellsrc Polygon-blockchain campaign to day 3

aseitylab@0.1.0/0.1.1 (GHSA-jv9w-2v63-767g, MAL-2026-17240) publishes today with the same primitive stack as the 2026-09-27 donutautosellsrc origin and the 2026-09-28 aseity/coinscan/donutpromotion/claudedashbord extension:

1. Steganography - image with executable bytes hidden in image data.
2. Native Python C-extension infostealer - drops compiled .so/.pyd modules carrying the obfuscated stealer.
3. Polygon-blockchain-resolved C2 - queries a public Polygon RPC endpoint for the transaction history of attacker-controlled wallet 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a and parses the C2 endpoint from transaction metadata.

Same payload SHA-256 d03c42c275f0dbc617428441508c49ae1adcbbc95af4eeb094bca4e4f8943f3e as yesterdays four. Naming reads as a variant expansion of aseity` (yesterday) - the operator is re-using lure names with suffixes.

Classify as malicious-package (fresh name, real payload). The campaign is now known to span 6 pip packages across 3 days. Yesterdays record already covers the domain/hash/IOC set; todays addition is that the operator continues to publish without disruption.

Cluster B - npm hardhat-* pino-impersonator Ethereum-developer lure

Four npm packages under names close-adjacent to the Nomic Foundation hardhat Ethereum development framework:

• hardhat-lock@2.21.0 (GHSA-crqg-xv46-qmmw): impersonates pino (README, LICENSE, docs/ copied verbatim). Ships a ~4MB lib/config.js obfuscated with a 23,981-entry rotated string array, hex-escaped tokens, control-flow flattening, 40,131+ inline decoder replacements. Executes automatically at import.
• hardhat-zet@2.0.1 (GHSA-qqvr-prmw-6pq2): same pino impersonation. 4,498,609-byte obfuscated lib/config with 26,113-entry rotated string array and hex-encoded identifiers. Public no-op Express middleware surface. Author claimed as Robert King <hello@jsonspack.com>, bug tracker jsonspack.com/issues. Source SHA-256 37cd33c0908189c0085fba153be1c42776411968aa5ad652dd7ffdef88b318bc.
• mini-hardhat@<=1.1.4 (GHSA-wxx2-jv4c-38wh): pino-like JSON logger surface, but spawns a detached child process lib/caller.js that survives parent termination. Base64-decoded C2 https://ipinfo-encrypted-v1.vercel.app/api/auth/f1f097d93c318c92f0c5, RCE via new Function.constructor("require", s)(require), up to 5 retry attempts. Source SHA-256 fbdfc97da008f90f11ae03963e75237c8bb746cf93f9cdc5da43ba5807ed6c1e.
• hardhat-cap@* (GHSA-3jrx-49jf-x2rp) from 2026-09-28: CWE-506 boilerplate, no analysis. Grouped here on name-family and same-window publication.

Same class of Hardhat impersonation that Socket flagged in January 2025 targeting Ethereum developers with private-key and mnemonic exfil. The operator has resumed after months of quiet. Ethereum tooling developers should treat any Hardhat-adjacent dependency name with pino-copied documentation as compromised until proven otherwise.

Classify each as malicious-package.

Cluster C - npm nebula-* Windows .kntrat RAT dropper family

Five npm packages under nebula names, at least four confirmed same-operator by IOC:

• nebula-llm@1.0.0 (GHSA-5ph8-m4r7-g739): preinstall.cjs decompresses base64+zlib-encoded 257KB Windows PE binary, writes to %LOCALAPPDATA%\Microsoft\Conhost\conhost.exe, executes silently. PE contains section .kntrat. External references: 65.87.7.132, github.com/syskiel/kntrat-e. Source SHA-256 b33da6aef41209f654f8f76cc56074a7b827599f42f941e3917326da1f4d2566.
• nebulaai-sdk@>=1.0.0 (GHSA-57f4-h93r-jvh6): same preinstall pattern, same drop path, same C2 IP, same .kntrat section, same GitHub reference. Source SHA-256 dc906b81107141fbd85dcabf89fd2f5112c4e4a134045c90d6a35abb4b67d16e.
• nebula-sdk@* (GHSA-fm5g-6rr8-p9vq): CWE-506 boilerplate; grouped on name.
• nebulajs-api@* (GHSA-2gr6-gxvx-3594): CWE-506 boilerplate; grouped on name.
• llm-nebula@1.0.0 (GHSA-8g48-f52v-xggv): different mechanism - ~232KB obfuscated preinstall.cjs blob using TEA/xorshift cryptographic constants (0x9e3779b9, 0x243f6a88, 0x6a09e667) with Function-constructor and custom string decoders. Grouped on name proximity and same-day publication; may be the same operator experimenting with delivery.

The .kntrat PE section is a strong fingerprint for a known RAT family and the syskiel/kntrat-e GitHub reference gives defenders a proper hunting anchor. On Windows, watch for %LOCALAPPDATA%\Microsoft\Conhost\conhost.exe execution (the legitimate conhost.exe lives only in %SystemRoot%\System32\conhost.exe).

Classify each as malicious-package.

Cluster D - npm fabric-* Minecraft-launcher credential stealer via Discord webhook

Three npm packages under fabric names (the Minecraft modding framework), same webhook, same behaviour:

• fabric-native-loader@1.0.0 (GHSA-h76r-hhqx-cjq3): postinstall reads Minecraft launcher credential stores, extracts accessTokens/refreshTokens/clientTokens, exfiltrates over HTTPS POST to discord.com/api/webhooks/1554065488726990909/[token]. Source SHA-256 d289ae71736f05158f45d6636730641e82b5a774bf99bf1b587155d31c73daaa.
• fabric-render-bridge@<=1.0.0 (GHSA-r54m-4q33-rjvr): same class of behaviour, same webhook ID. Reads official launcher, PrismLauncher, MultiMC, TLauncher, Modrinth, PolyMC, GDLauncher. Source SHA-256 c2715ef0b07fbf0ca24fb8dadec44f2fcfdc273421a49ad2201bf8e40d3e2c01.
• fabric-asset-pipeline@1.0.0/1.0.1 (GHSA-2h5p-2j55-g9r4): obfuscator.io string rotation with base64+RC4 decoding. Functions stealLauncherAccounts(), stealAltLaunchers(), readSessionDump(), sendInfo(). Webhook URL is RC4-decoded at runtime. Source SHA-256 bb92787d766d5bfa0c384cc04909689215fa0d3e869630422caa8bedd303038a.

The shared webhook ID 1554065488726990909 is a strong operator fingerprint. Block that specific webhook ID at your egress; consider blocking discord.com/api/webhooks/* from CI networks entirely.

Classify each as malicious-package.

Cluster E - npm chalk-figlet family Windows RuntimeBroker.exe dropper

• chalk-figlet@>=1.2.0 (GHSA-85m5-qg46-qg28): postinstall (node example.js → require index.js) runs a _syncTelemetry function that hex-decodes a URL and filename, downloads via axios.get, executes via child_process.exec with windowsHide and detached. Source SHA-256 66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b.
• figlet-chalk-render@<=1.2.1 (GHSA-frpq-rj8q-hpr4): same class - top-level IIFE on require, char-code arrays and hex escapes hide the module and method names, HTTPS GET piped to file stream. Source SHA-256 992cf49b88be09149971d4ac18fe2a4b61d242186f553cb3283a26970b886d7f.

Both drop RuntimeBroker.exe to %TEMP% from http://104.234.65.75:700/setup.exe and execute it. Both gate execution to skip environments where CI, SANDBOX, GITHUB_ACTIONS, or TRAVIS env vars are set - only real developer workstations get the payload. This is the same 104.234.65.75 operator whose infrastructure the 2026-09-28 sweep operator-continuity block warned to keep blocked; they`re active again.

Classify each as malicious-package.

Cluster F - npm dotenv-lookalike JPEG-EXIF steganography → wscript.exe → PowerShell

• native-env@1.0.1 (GHSA-9p6x-527c-vh8p): bundle is really node-env-buffer@2.2.6. Extracts hidden code from dist/stest.jpg APP13 marker segment, writes VBS relay to temp, spawns wscript.exe → PowerShell with encoded command. Obfuscator.io-style RC4 decryption. Source SHA-256 8e9c612513357181c7e4d504f94a2a8c03de64724e2593217216de8fef4e7166.
• dotenv-native@1.0.1 (GHSA-438j-7xq6-grfr): same bundle identity, same JPEG (287KB), same chain. Uses the APP1/EXIF 0xFFED marker instead of APP13. Loader persists in both dist/index.cjs (library) and dist/cli.cjs (dot2env CLI). Source SHA-256 4369c7fa886fc7d315922759932056664863d71157bcdece943fa53339586f03.

Windows-only. Both target dotenv users by name. Note that both entry-points carry the loader - --ignore-scripts alone does not prevent the payload firing at first import.

Classify each as malicious-package.

Cluster G - npm test-agency-assignment process-hollowing dropper

test-agency-assignment@<=1.0.2 (GHSA-7x83-rfhr-656r) advertises as a "Device Telemetry Aggregator". Postinstall triggers wscript.exe 4444.vbs. The VBS is a multi-layer decoder (Base64 → XOR-masked AES S-box → ChaCha20-IETF → additional XOR) that reconstructs a PowerShell loader in %TEMP%\pf<rand>.dat and invokes it. Comments in the source reference "process hollowing" - the payload is designed to inject into a hollowed legitimate process. Source SHA-256 dcdf62e1c1eb44ca7a29ed37c12bdb71883025a46c5066e58c9228f0dfe782c2. Windows-only.

Classify as malicious-package.

Cluster H - npm items-validator in-process persistent loader

items-validator@<=1.0.5 (GHSA-hvv9-35pw-8qvf): install spawns a persistent background process polling https://game.spawnrealm.com/api/item-realtime?key=abcdef123456 for JSON payloads and evaluating them with full Node.js capabilities. Cross-platform (in-process, no OS gate). Source SHA-256 a8e49b1abd7c566b17104c5a2823251df2ca253a0fa509d7c19db1c1942ad13d.

Because the loader runs in-process, npm uninstall alone does not stop it - the Node process must be killed.

Classify as malicious-package.

Cluster I - npm rai6jaisahthaghee5ou-loader-package browser XSS/injection loader

rai6jaisahthaghee5ou-loader-package@>=1.0.0 (GHSA-hhf7-grh4-575w): IIFE injects a <script> element pointing at https://nee1ahnaw7.xsses.link into document. Random-string name characteristic of research artefacts. Source SHA-256 6de53fbd264f685e033789fe5929c63f322366219d80707ec419a48a85e253c9.

Browser-only impact (server-side Node has no document). Bundling this into a client app exposes every visitor to arbitrary JavaScript in the app`s security context.

Classify as malicious-package.

Cluster J - npm simple-date-formatter-new-12 OAST SSRF probe

simple-date-formatter-new-12@1.0.0 (GHSA-v6p6-9wrj-f56p): postinstall curls internal Baidu host http://bsrc-ssrf.n.baidu-int.com/, writes response to /tmp/bsrc.txt, POSTs contents to pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun. Bug-bounty or pentest SSRF probe. Source SHA-256 bd79db99adb8878673dd85db5a29661432808fa8fcc5e3d750b907418df8ae5f.

The naming pattern re-uses simple-date-formatter-new-<N> from the earlier 124.221.154.135 SSH-beacon operator, but the mechanism is different: this is the same .oast.fun operator as the 2026-09-27 Cluster D cma-self-hosted-sandbox-cf package.

Classify as dependency-confusion (probe-only, no confirmed payload). Severity medium per calibration.

Cluster K - 4-package npm CWE-506 boilerplate batch

• @digift/cli (GHSA-xp76-38xh-m8wc): dep-confusion at internal scope
• img-to-native (GHSA-pv7p-ghgv-268x): native-* naming adjacency to Cluster F
• native-runner (GHSA-jxw5-69p3-hpm4): native-* naming adjacency to Cluster F
• vite-plugin-crypto (GHSA-mh9w-qr45-6wrq): generic Vite plugin lure

All versions quarantined, all CWE-506 boilerplate advisory bodies, no IOCs. If Amazon Inspector or a vendor blog lands payload analysis on any of these later they may re-split.

Severity medium for sweep purposes.

Operator continuity check

• Cluster A donutautosellsrc Polygon-C2 campaign: day 3, still publishing, wallet unchanged.
• Cluster E 104.234.65.75:700 RuntimeBroker operator: returns after a one-day quiet - same infrastructure the 2026-09-28 sweep warned to keep blocked.
• Cluster J .oast.fun OAST operator: re-uses the simple-date-formatter-new-<N> naming lineage from the earlier SSH-beacon operator.
• ltidi.storage.googleapis.com (2026-09-26 Cluster D GCS-tarball loader): no fresh @airbnb-extended/*/ltidisafe* today.
• oob.algamil7x.xyz: no new day-N additions.
• eo8f3m3ho26a0nm.m.pipedream.net (2026-09-26 Cluster E shoplist-app): no new Pipedream-beaconing packages.
• *`n8n-nodes- mkicom.com`**: no new packages.

Egress blocks remain durable on all of the above. Add for today: 65.87.7.132, ipinfo-encrypted-v1.vercel.app, game.spawnrealm.com, nee1ahnaw7.xsses.link, Discord webhook ID 1554065488726990909.

Registry state

All 26 packages in this sweep are npm/pip-quarantined at time of writing. Active operator-side infrastructure unique to today`s batch:

• Polygon wallet 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a (Cluster A - day 3)
• ipinfo-encrypted-v1.vercel.app (Cluster B mini-hardhat)
• 65.87.7.132, GitHub reference github.com/syskiel/kntrat-e (Cluster C)
• Discord webhook 1554065488726990909 (Cluster D)
• 104.234.65.75:700 (Cluster E - not new but re-active)
• game.spawnrealm.com (Cluster H)
• nee1ahnaw7.xsses.link (Cluster I)
• pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun (Cluster J)

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector. Per-package IOC details drawn from GHSA advisory bodies published between 2026-09-28 12:00 UTC and 2026-09-29 12:00 UTC.

Affected packages (25)

Impact

• Cluster A - pip aseitylab extends the donutautosellsrc Polygon-blockchain C2 campaign to day 3 (real payload, malicious-package): aseitylab@0.1.0/0.1.1 (GHSA-jv9w-2v63-767g, MAL-2026-17240). Same primitive stack as the 2026-09-27 and 2026-09-28 sweeps: steganographic image loader, native Python C-extension infostealer, and command-and-control server addresses read from Polygon blockchain transaction history for attacker wallet 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a. Same payload SHA-256 d03c42c275f0dbc617428441508c49ae1adcbbc95af4eeb094bca4e4f8943f3e as the yesterdays Cluster A four packages. The campaign now spans at least 6 pip packages under this wallet across 3 days: donutautosellsrc@0.3.7/0.3.8/0.3.9, aseity@0.1.0, coinscan@0.1.0, donutpromotion@<=0.1.0, claudedashbord@0.1.0-0.1.3, and todays aseitylab@0.1.0/0.1.1. The -lab suffix on aseitylab reads as a variant-name expansion of yesterdays aseity` - the operator is iterating the same lure names
• *Cluster B - npm hardhat- pino-impersonator Ethereum-developer lure (real payload, malicious-package, at least 4 packages)*: hardhat-lock@2.21.0 (GHSA-crqg-xv46-qmmw, source SHA-256 not stated; ~4MB obfuscated lib/config.js with 23,981-entry rotated string array, executes on import), hardhat-zet@2.0.1 (GHSA-qqvr-prmw-6pq2, source SHA-256 37cd33c0908189c0085fba153be1c42776411968aa5ad652dd7ffdef88b318bc; 4,498,609-byte obfuscated lib/config with 26,113-entry string array, author claimed as "Robert King <hello@jsonspack.com>" with bug tracker jsonspack.com/issues), mini-hardhat@<=1.1.4 (GHSA-wxx2-jv4c-38wh, source SHA-256 fbdfc97da008f90f11ae03963e75237c8bb746cf93f9cdc5da43ba5807ed6c1e; C2 https://ipinfo-encrypted-v1.vercel.app/api/auth/f1f097d93c318c92f0c5, spawns detached lib/caller.js that survives parent termination, RCE via new Function.constructor("require", s)(require) with up to 5 retry attempts). All three impersonate the unrelated pino JSON-logger project (README, LICENSE, docs/ tree copied verbatim) under a name adjacent to the Nomic Foundation hardhat Ethereum development framework - the lure is Ethereum developers reaching for Hardhat plugins. Also in the family from 2026-09-28: `hardhat-cap@` (GHSA-3jrx-49jf-x2rp; CWE-506 boilerplate with no published analysis). This is the same class of Hardhat/Ethereum-developer lure that Socket flagged in 2025-01 - the operator has resumed after months of quiet
• *Cluster C - npm nebula- Windows .kntrat RAT dropper family (real payload, malicious-package, at least 4 packages)*: nebula-llm@1.0.0 (GHSA-5ph8-m4r7-g739, source SHA-256 b33da6aef41209f654f8f76cc56074a7b827599f42f941e3917326da1f4d2566), nebulaai-sdk@>=1.0.0 (GHSA-57f4-h93r-jvh6, source SHA-256 dc906b81107141fbd85dcabf89fd2f5112c4e4a134045c90d6a35abb4b67d16e), `nebula-sdk@ (GHSA-fm5g-6rr8-p9vq, CWE-506 boilerplate but named-family confirms), nebulajs-api@* (GHSA-2gr6-gxvx-3594, CWE-506 boilerplate but named-family confirms), and adjacent llm-nebula@1.0.0 (GHSA-8g48-f52v-xggv, source SHA-256 0eee293a9973027154eea71635c14e8a4cb2ad8a1e4f80a65399ad874afcb669; ~232KB obfuscated preinstall.cjs blob using TEA/xorshift constants 0x9e3779b9, 0x243f6a88, 0x6a09e667). The nebula-llm/nebulaai-sdk variants embed a ~257KB Windows PE binary as a base64+zlib-compressed string in preinstall.cjs/preinstall.js, decompress it, and write it to %LOCALAPPDATA%\Microsoft\Conhost\conhost.exe mimicking the legitimate Windows Console Host, then spawn it silently via child_process.spawn with hidden window. Decoded PE contains a section named .kntrat and references external host 65.87.7.132 and GitHub repository github.com/syskiel/kntrat-e - consistent with a native RAT-family tool. The llm-nebula` variant differs in mechanism (obfuscated JS preinstall instead of embedded PE) but shares the naming pattern and window, suggesting the same operator experimenting with delivery
• *Cluster D - npm fabric- Minecraft-launcher credential stealer via Discord webhook (real payload, malicious-package, at least 3 packages)**: fabric-native-loader@1.0.0 (GHSA-h76r-hhqx-cjq3, source SHA-256 d289ae71736f05158f45d6636730641e82b5a774bf99bf1b587155d31c73daaa, Discord webhook discord.com/api/webhooks/1554065488726990909/), fabric-render-bridge@<=1.0.0 (GHSA-r54m-4q33-rjvr, source SHA-256 c2715ef0b07fbf0ca24fb8dadec44f2fcfdc273421a49ad2201bf8e40d3e2c01, same webhook ID), fabric-asset-pipeline@1.0.0/1.0.1 (GHSA-2h5p-2j55-g9r4, source SHA-256 bb92787d766d5bfa0c384cc04909689215fa0d3e869630422caa8bedd303038a, RC4-decoded webhook URL). Postinstall hook reads Minecraft launcher credential stores across official launcher, PrismLauncher, MultiMC, TLauncher, Modrinth, PolyMC, and GDLauncher; extracts Mojang/Microsoft accessTokens, refreshTokens, clientTokens, account usernames; and exfiltrates over HTTPS POST to the hardcoded Discord webhook alongside hostname, username, platform, OS release info. The name fabric is the Minecraft modding framework - lure is Minecraft mod developers. All three use the same webhook ID 1554065488726990909
• Cluster E - npm chalk-figlet family Windows RuntimeBroker.exe dropper via bare-IP HTTP (real payload, malicious-package, 2 packages): chalk-figlet@>=1.2.0 (GHSA-85m5-qg46-qg28, source SHA-256 66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b), figlet-chalk-render@<=1.2.1 (GHSA-frpq-rj8q-hpr4, source SHA-256 992cf49b88be09149971d4ac18fe2a4b61d242186f553cb3283a26970b886d7f). Postinstall/require-time IIFE decodes a hex-obfuscated URL http://104.234.65.75:700/setup.exe (bare IP, unencrypted HTTP), downloads the payload via axios.get, writes it to the OS temp directory as RuntimeBroker.exe (impersonating the legitimate Windows binary), and executes it via child_process.exec with stealth (windowsHide: true, detached). Execution is gated to SKIP environments where CI, SANDBOX, GITHUB_ACTIONS, or TRAVIS env vars are set - evades sandbox and CI analysis, real developer workstations are the target. Both packages advertise as chalk+figlet wrappers - lure is Node.js CLI-tool developers. Same bare-IP 104.234.65.75:700 C2 that the 2026-09-28 sweep operator-continuity block warned to keep durable
• Cluster F - npm dotenv-lookalike Windows JPEG-EXIF steganography → wscript.exe → PowerShell dropper (real payload, malicious-package, 2 packages): native-env@1.0.1 (GHSA-9p6x-527c-vh8p, source SHA-256 8e9c612513357181c7e4d504f94a2a8c03de64724e2593217216de8fef4e7166, JPEG APP13 marker), dotenv-native@1.0.1 (GHSA-438j-7xq6-grfr, source SHA-256 4369c7fa886fc7d315922759932056664863d71157bcdece943fa53339586f03, JPEG APP1/EXIF 0xFFED marker). Both bundle a fake package identity of node-env-buffer@2.2.6 under names that impersonate the ubiquitous dotenv library. Attack chain: import or CLI call → open bundled dist/stest.jpg (287KB payload carrier) → scan JPEG segments for the APP1/EXIF or APP13 marker → extract marker contents as UTF-8 string → write relay_*.vbs to temp directory → spawn wscript.exe → wscript launches powershell.exe with base64-encoded command → payload executes. Obfuscator.io-style RC4 decryption and runtime string concatenation hide the loader. Windows-only. Loader persists in both dist/index.cjs (library import) and dist/cli.cjs (dot2env CLI entry) so both require("dotenv-native") and the CLI trip the payload
• Cluster G - npm test-agency-assignment Windows postinstall wscript.exe → PowerShell → process-hollowing dropper (real payload, malicious-package): test-agency-assignment@<=1.0.2 (GHSA-7x83-rfhr-656r, source SHA-256 dcdf62e1c1eb44ca7a29ed37c12bdb71883025a46c5066e58c9228f0dfe782c2). Package advertises as a "Device Telemetry Aggregator". Postinstall triggers wscript.exe 4444.vbs on npm install. The VBS is a multi-layer decoder: Base64 → XOR-masked AES S-box → ChaCha20-IETF → additional XOR to extract PowerShell loader, written to %TEMP%\pf<rand>.dat, invoked via powershell.exe. Embedded source-code comments reference "process hollowing" (injecting the payload into a hollowed legitimate process for detection evasion and persistence). Windows-only. Watch for unexpected wscript.exe and powershell.exe execution during npm install, and temporary files matching pf<rand>.dat in %TEMP%
• Cluster H - npm items-validator Node.js in-process persistent-loader (real payload, malicious-package): items-validator@<=1.0.5 (GHSA-hvv9-35pw-8qvf, source SHA-256 a8e49b1abd7c566b17104c5a2823251df2ca253a0fa509d7c19db1c1942ad13d). Launches a persistent background process on install that polls https://game.spawnrealm.com/api/item-realtime?key=abcdef123456 for JSON payloads and evaluates them with full Node.js capabilities. Cross-platform (Node.js in-process, no OS gate). The C2 game.spawnrealm.com is a novel domain for this corpus. Because the loader runs in-process rather than via a separate binary, uninstall alone may leave the running Node process still polling until the process is killed
• Cluster I - npm rai6jaisahthaghee5ou-loader-package browser-context XSS/injection loader (real payload, malicious-package): rai6jaisahthaghee5ou-loader-package@>=1.0.0 (GHSA-hhf7-grh4-575w, source SHA-256 6de53fbd264f685e033789fe5929c63f322366219d80707ec419a48a85e253c9). IIFE at import time injects a <script> element pointing at https://nee1ahnaw7.xsses.link and appends it to document. The random-string name (rai6jaisahthaghee5ou-) reads as a Diceware/passphrase-generator output and is characteristic of research-artefact or pentest-tooling naming. Because the payload targets document, this is a browser-bundle-only loader - Node-side install has no filesystem or network impact, but any web app that pulls this into a bundle exposes every visitor to arbitrary attacker JavaScript in the app`s security context (credential theft, DOM manipulation, follow-on delivery)
• Cluster J - npm simple-date-formatter-new-12 OAST SSRF probe (dependency-confusion/probe): simple-date-formatter-new-12@1.0.0 (GHSA-v6p6-9wrj-f56p, source SHA-256 bd79db99adb8878673dd85db5a29661432808fa8fcc5e3d750b907418df8ae5f). Postinstall uses curl to fetch internal Baidu host http://bsrc-ssrf.n.baidu-int.com/, writes response to /tmp/bsrc.txt, POSTs contents to attacker-controlled interactsh collector at pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun. Reads as a Baidu-scoped bug-bounty or pentest SSRF probe. Note the naming pattern re-uses simple-date-formatter-new-<N> from the earlier 124.221.154.135 SSH-beacon operator, but the C2 mechanism is different - this is the same .oast.fun (Burp Collaborator OOB zone) operator as 2026-09-27 Cluster D cma-self-hosted-sandbox-cf, reusing an established naming skeleton
• Cluster K - 4-package npm CWE-506 boilerplate batch, no published analysis (mixed kinds, unclassified): @digift/cli (GHSA-xp76-38xh-m8wc), img-to-native (GHSA-pv7p-ghgv-268x), native-runner (GHSA-jxw5-69p3-hpm4), vite-plugin-crypto (GHSA-mh9w-qr45-6wrq) - all versions quarantined, all with GHSAs CWE-506 boilerplate advisory body and no IOCs, source-code link, or vendor write-up. Names read as: dep-confusion at internal scope (@digift/cli), native-* typosquat family adjacent to Cluster F (img-to-native, native-runner - could be the same operator preparing follow-ons), and generic Vite plugin lure (vite-plugin-crypto). Treat as medium` for the sweep purposes; if Amazon Inspector/OpenSSF/kam193 lands payload analysis later, may re-split
• Operator continuity check: 2026-09-27 donutautosellsrc Polygon-C2 campaign continues in Cluster A. 2026-09-28 104.234.65.75:700 RuntimeBroker operator returns after a one-day quiet in Cluster E. The simple-date-formatter-new-<N> naming lineage is re-used by the OAST operator in Cluster J. No fresh ltidi.storage.googleapis.com (2026-09-26 GCS-tarball loader), oob.algamil7x.xyz, eo8f3m3ho26a0nm.m.pipedream.net Pipedream beacon, or mkicom.com n8n-nodes-* operator activity in this window - the egress blocks remain durable. Discord webhook 1554065488726990909 (Cluster D) and Polygon wallet 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a (Cluster A) are the two new durable operator-fingerprint IOCs from today

What to do

1. 1Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, package.json, requirements.txt, Pipfile.lock, poetry.lock, and pyproject.toml for every package name in Clusters A through K. Uninstall on hit, wipe node_modules/.venv, delete the lockfile, rebuild against a clean cache. Clusters A through I carry confirmed real payloads (blockchain-C2 infostealer, Windows RAT, credential stealers, dropper chains); a hit on any of those is a compromise, not a warning
2. 2For Cluster A (pip aseitylab donutautosellsrc campaign extension): uninstall on hit and image the host - the native C-extension infostealer landed compiled binary code on disk, so a Python uninstall does not clean it. Rotate every credential the installer user had access to. Because C2 resolves through a Polygon RPC query against wallet 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a, a domain-only egress denylist is insufficient - block the IOC domains from yesterdays record (thisisafalsepositive.st, sltnnt.ru) AND block outbound Polygon RPC (polygon-rpc.com, rpc-mainnet.matic.network, polygon-mainnet.g.alchemy.com, polygon-mainnet.infura.io`) from build/CI networks. Add a lockfile-lint rule for the 6 known package names now. The campaign is scaling - expect further packages
3. 3*For Cluster B (npm hardhat- pino-impersonator Ethereum lure)**: uninstall hardhat-lock, hardhat-zet, mini-hardhat, hardhat-cap on hit. Because auto-execution happens on require, presence in node_modules after npm install is enough to consider the host compromised even without invoking the package explicitly. Rotate every credential accessible from the developer workstation, including any Ethereum wallets, mnemonic phrases, private keys, and CI/CD tokens - the historical Hardhat-lure campaigns explicitly targeted these. Block outbound HTTPS to ipinfo-encrypted-v1.vercel.app from developer and CI networks. Reject any dependency author claiming hello@jsonspack.com or jsonspack.com as a bug tracker. Consider auditing every internal Hardhat plugin dependency by hand - the operator will iterate names
4. 4*For Cluster C (npm nebula- .kntrat Windows RAT dropper)**: uninstall nebula-llm, nebulaai-sdk, nebula-sdk, nebulajs-api, llm-nebula on hit and image any Windows host that ran an install - the RAT is running as %LOCALAPPDATA%\Microsoft\Conhost\conhost.exe masquerading as the real Console Host. Rotate everything the installer user had access to. Block outbound HTTPS/TCP to 65.87.7.132 from developer and CI networks. Add a Sysmon/EDR rule for %LOCALAPPDATA%\Microsoft\Conhost\conhost.exe execution (the real conhost lives in %SystemRoot%\System32) and PE files with a section named .kntrat. Consider hunting historical process trees for the impersonator path
5. 5*For Cluster D (npm fabric- Minecraft credential stealer)*: uninstall fabric-native-loader, fabric-render-bridge, fabric-asset-pipeline on hit. Rotate all Mojang/Microsoft Minecraft launcher credentials from a clean device - the stealer extracts accessTokens, refreshTokens, and clientTokens from official launcher, PrismLauncher, MultiMC, TLauncher, Modrinth, PolyMC, GDLauncher. Block outbound HTTPS to `discord.com/api/webhooks/1554065488726990909/ (this specific webhook ID) at the network level; consider blocking discord.com/api/webhooks/*` from CI networks entirely as a durable defence against Discord-webhook-based exfil. Add the 3 package names to your lockfile-lint blocklist
6. 6For Cluster E (npm chalk-figlet family RuntimeBroker.exe dropper): uninstall chalk-figlet, figlet-chalk-render on hit. Block outbound HTTP to http://104.234.65.75:700/* at the network level (bare-IP, port 700 - trivially blockable). Add a Sysmon/EDR rule for a file named RuntimeBroker.exe executed from %TEMP%/%LOCALAPPDATA%\Temp (the real RuntimeBroker.exe lives only in %SystemRoot%\System32). The CI-env-detection gate means CI runs will report a clean install - do not use CI logs as the exclusive detection surface for these packages
7. 7For Cluster F (npm native-env + dotenv-native JPEG-EXIF steganography): uninstall both on hit. Windows-only, but the payload dispatcher is a stealthy wscript.exe → PowerShell chain that most default EDR rules do not flag. Block or audit wscript.exe spawned as a child of node.exe or npm.exe in EDR. Rotate every credential the installer user had. Because the loader lives in both the library import and the CLI entry, a require("dotenv-native") OR a dot2env CLI call is enough - a npm install --ignore-scripts alone does NOT prevent the payload firing at first import. Reject the fake package identity node-env-buffer@2.2.6 as a dependency name - it is a common bundle-name lure
8. 8For Cluster G (npm test-agency-assignment process-hollowing dropper): uninstall on hit. Windows-only. --ignore-scripts in CI blocks the postinstall trigger but not manual runs. Watch for wscript.exe 4444.vbs execution paths and %TEMP%\pf<rand>.dat files in EDR. The process-hollowing intent means a compromised host may show a running legitimate-looking process with malicious code inside - assume compromise on any install
9. 9For Cluster H (npm items-validator in-process persistent loader): uninstall AND kill any Node.js process that ran items-validator code - the loader polls game.spawnrealm.com in-process, so npm uninstall alone is not enough. Block outbound HTTPS to game.spawnrealm.com and audit any Node process still holding that reference
10. 10For Cluster I (npm rai6jaisahthaghee5ou-loader-package browser XSS loader): uninstall on hit. If the package was included in a browser bundle that shipped to production, treat as a full XSS incident: rotate any auth tokens visitors could have leaked, audit for suspicious sessions, block outbound HTTPS to nee1ahnaw7.xsses.link at the edge. Because the loader targets document, server-only Node use had no filesystem impact - the risk is exclusively client-side
11. 11For Cluster J (npm simple-date-formatter-new-12 OAST SSRF probe): uninstall on hit. Recon-only payload (SSRF response echoed to .oast.fun collector), so the risk is that the operator has a map of your CI hosts and network topology near Baidu-internal ranges. Block outbound to *.oast.fun and *.oastify.com (Burp Collaborator zones) from CI. Add the package name to your lockfile-lint blocklist; watch for further simple-date-formatter-new-<N> iterations
12. 12For Cluster K (npm CWE-506 boilerplate batch): uninstall on hit. Without payload analysis assume real infostealer/RCE at time of quarantine - image the host, rotate installer-user credentials, check outbound telemetry from the install window. Add all 4 names to lockfile-lint. img-to-native and native-runner are close-adjacent to Cluster F - watch for a payload write-up landing on either
13. 13For every npm install in CI, prefer --ignore-scripts and enforce at runner level; that blocks Clusters E, F, G postinstall triggers but not Clusters B, H, I (which fire at import). For every pip install, prefer resolving from a curated internal mirror. Reject packages whose install-time or import-time behaviour includes a network fetch. Keep prior egress blocks in place: ltidi.storage.googleapis.com, oob.algamil7x.xyz, eo8f3m3ho26a0nm.m.pipedream.net, mkicom.com, 124.221.154.135, 104.234.65.75, *.oast.fun, *.oastify.com, Polygon RPC endpoints. Add for today: 65.87.7.132, ipinfo-encrypted-v1.vercel.app, game.spawnrealm.com, nee1ahnaw7.xsses.link, Discord webhook ID 1554065488726990909

References

• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub
• GHSA-jv9w-2v63-767g - pip aseitylab (Cluster A - donutautosellsrc campaign day 3, same wallet + payload hash)

  github.com
  GitHub
• MAL-2026-17240 - pip aseitylab campaign metadata

  osv.dev
  OSV
• GHSA-crqg-xv46-qmmw - npm hardhat-lock (Cluster B - pino-impersonator Ethereum-dev lure, 4MB obfuscated blob)

  github.com
  GitHub
• GHSA-qqvr-prmw-6pq2 - npm hardhat-zet (Cluster B - pino impersonator, "Robert King" jsonspack.com attribution)

  github.com
  GitHub
• GHSA-wxx2-jv4c-38wh - npm mini-hardhat (Cluster B - detached child process, ipinfo-encrypted-v1.vercel.app C2)

  github.com
  GitHub
• GHSA-3jrx-49jf-x2rp - npm hardhat-cap (Cluster B - CWE-506 boilerplate, likely same operator family)

  github.com
  GitHub
• MAL-2026-17236 - npm mini-hardhat OSV record

  osv.dev
  OSV
• GHSA-5ph8-m4r7-g739 - npm nebula-llm (Cluster C - .kntrat Windows PE RAT dropper, 65.87.7.132 C2)

  github.com
  GitHub
• GHSA-57f4-h93r-jvh6 - npm nebulaai-sdk (Cluster C - same .kntrat RAT pattern, 65.87.7.132 C2, syskiel/kntrat-e reference)

  github.com
  GitHub
• GHSA-fm5g-6rr8-p9vq - npm nebula-sdk (Cluster C - CWE-506 boilerplate, same operator name family)

  github.com
  GitHub
• GHSA-2gr6-gxvx-3594 - npm nebulajs-api (Cluster C - CWE-506 boilerplate, same operator name family)

  github.com
  GitHub
• GHSA-8g48-f52v-xggv - npm llm-nebula (Cluster C-adjacent - obfuscated preinstall variant, TEA/xorshift constants)

  github.com
  GitHub
• GHSA-h76r-hhqx-cjq3 - npm fabric-native-loader (Cluster D - Minecraft credential stealer, Discord webhook 1554065488726990909)

  github.com
  GitHub
• GHSA-r54m-4q33-rjvr - npm fabric-render-bridge (Cluster D - Minecraft credential stealer, same webhook)

  github.com
  GitHub
• GHSA-2h5p-2j55-g9r4 - npm fabric-asset-pipeline (Cluster D - RC4-decoded Discord webhook, Minecraft launcher account theft)

  github.com
  GitHub
• GHSA-85m5-qg46-qg28 - npm chalk-figlet (Cluster E - RuntimeBroker.exe dropper, 104.234.65.75:700 bare-IP HTTP)

  github.com
  GitHub
• GHSA-frpq-rj8q-hpr4 - npm figlet-chalk-render (Cluster E - same 104.234.65.75:700 dropper, CI-detection gate)

  github.com
  GitHub
• GHSA-9p6x-527c-vh8p - npm native-env (Cluster F - JPEG APP13 steganography, node-env-buffer bundle identity)

  github.com
  GitHub
• GHSA-438j-7xq6-grfr - npm dotenv-native (Cluster F - JPEG APP1/EXIF 0xFFED steganography, dotenv typosquat)

  github.com
  GitHub
• GHSA-7x83-rfhr-656r - npm test-agency-assignment (Cluster G - wscript.exe → PowerShell process-hollowing dropper)

  github.com
  GitHub
• GHSA-hvv9-35pw-8qvf - npm items-validator (Cluster H - in-process persistent loader, game.spawnrealm.com C2)

  github.com
  GitHub
• GHSA-hhf7-grh4-575w - npm rai6jaisahthaghee5ou-loader-package (Cluster I - browser XSS injector, nee1ahnaw7.xsses.link)

  github.com
  GitHub
• GHSA-v6p6-9wrj-f56p - npm simple-date-formatter-new-12 (Cluster J - Baidu SSRF probe, .oast.fun OOB)

  github.com
  GitHub
• GHSA-xp76-38xh-m8wc - npm @digift/cli (Cluster K - CWE-506 boilerplate, likely dep-confusion)

  github.com
  GitHub
• GHSA-pv7p-ghgv-268x - npm img-to-native (Cluster K - CWE-506 boilerplate, native-* naming adjacency)

  github.com
  GitHub
• GHSA-jxw5-69p3-hpm4 - npm native-runner (Cluster K - CWE-506 boilerplate, native-* naming adjacency)

  github.com
  GitHub
• GHSA-mh9w-qr45-6wrq - npm vite-plugin-crypto (Cluster K - CWE-506 boilerplate, Vite plugin lure)

  github.com
  GitHub
• Polygonscan - donutautosellsrc campaign wallet 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a

  polygonscan.com
  PolygonScan
• Socket - Malicious npm Package Targets Ethereum Developers (historical Hardhat lure context)

  socket.dev
  Socket