# GitHub Advisory malware sweep - 2026-09-28 (late) + 2026-09-29 (donutautosellsrc campaign extends to pip `aseitylab` day 3; npm `hardhat-*` pino-impersonator Ethereum-dev lure; npm `nebula-*` Windows `.kntrat` RAT dropper family; npm `fabric-*` Minecraft credential stealer via Discord webhook; npm `chalk-figlet` family Windows RuntimeBroker.exe dropper; npm `dotenv`-lookalike JPEG-EXIF steganography → PowerShell chain; npm `simple-date-formatter-new-12` OAST SSRF probe)

> GHSA 2026-09-28 (late) + 2026-09-29: 26 new advisories - 25 npm + 1 pip. Cluster A extends the `donutautosellsrc` Polygon-blockchain-C2 pip campaign to `aseitylab` (day 3, 6 packages now under wallet `0x9c0a507300fd902787bb193d80fca5ce6e1bff9a`). Clusters B-F are four distinct npm operators active in the window: hardhat pino-impersonator, `nebula-*` Windows `.kntrat` RAT, `fabric-*` Minecraft-credential Discord-webhook stealer, `chalk-figlet` RuntimeBroker.exe dropper. Cluster K is 4 npm CWE-506 boilerplate takedowns with no analysis.

- Published: 2026-09-29
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 25 packages, 27 compromised versions
- Tags: infostealer, credential-theft, obfuscation, typosquat, dependency-confusion, ci-cd-compromise, crypto-wallet-drain
- Also known as: 2026-09-29 GHSA npm+pip sweep, donutautosellsrc Polygon-blockchain C2 campaign day 3 (aseitylab), hardhat-* npm pino-impersonator Ethereum-developer lure, nebula-* npm .kntrat Windows RAT dropper family, fabric-* npm Minecraft credential stealer Discord webhook 1554065488726990909, chalk-figlet figlet-chalk-render npm RuntimeBroker.exe dropper 104.234.65.75, native-env dotenv-native npm JPEG-EXIF steganography wscript.exe PowerShell, test-agency-assignment npm process-hollowing dropper, items-validator npm game.spawnrealm.com in-process persistent loader, rai6jaisahthaghee5ou-loader-package npm browser XSS injector nee1ahnaw7.xsses.link, simple-date-formatter-new-12 npm Baidu SSRF probe .oast.fun
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector
- Incident ID: multi-2026-09-29-ghsa-malware-sweep

## Affected packages (25)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@digift/cli](https://dependencywatch.io/package/npm/@digift/cli) | npm | * |
| [aseitylab](https://dependencywatch.io/package/pypi/aseitylab) | PyPI | 0.1.0, 0.1.1 |
| [chalk-figlet](https://dependencywatch.io/package/npm/chalk-figlet) | npm | 1.2.0 |
| [dotenv-native](https://dependencywatch.io/package/npm/dotenv-native) | npm | 1.0.1 |
| [fabric-asset-pipeline](https://dependencywatch.io/package/npm/fabric-asset-pipeline) | npm | 1.0.0, 1.0.1 |
| [fabric-native-loader](https://dependencywatch.io/package/npm/fabric-native-loader) | npm | 1.0.0 |
| [fabric-render-bridge](https://dependencywatch.io/package/npm/fabric-render-bridge) | npm | 1.0.0 |
| [figlet-chalk-render](https://dependencywatch.io/package/npm/figlet-chalk-render) | npm | 1.2.1 |
| [hardhat-cap](https://dependencywatch.io/package/npm/hardhat-cap) | npm | * |
| [hardhat-lock](https://dependencywatch.io/package/npm/hardhat-lock) | npm | 2.21.0 |
| [hardhat-zet](https://dependencywatch.io/package/npm/hardhat-zet) | npm | 2.0.1 |
| [img-to-native](https://dependencywatch.io/package/npm/img-to-native) | npm | * |
| [items-validator](https://dependencywatch.io/package/npm/items-validator) | npm | 1.0.5 |
| [llm-nebula](https://dependencywatch.io/package/npm/llm-nebula) | npm | 1.0.0 |
| [mini-hardhat](https://dependencywatch.io/package/npm/mini-hardhat) | npm | 1.1.4 |
| [native-env](https://dependencywatch.io/package/npm/native-env) | npm | 1.0.1 |
| [native-runner](https://dependencywatch.io/package/npm/native-runner) | npm | * |
| [nebula-llm](https://dependencywatch.io/package/npm/nebula-llm) | npm | 1.0.0 |
| [nebula-sdk](https://dependencywatch.io/package/npm/nebula-sdk) | npm | * |
| [nebulaai-sdk](https://dependencywatch.io/package/npm/nebulaai-sdk) | npm | 1.0.0 |
| [nebulajs-api](https://dependencywatch.io/package/npm/nebulajs-api) | npm | * |
| [rai6jaisahthaghee5ou-loader-package](https://dependencywatch.io/package/npm/rai6jaisahthaghee5ou-loader-package) | npm | 1.0.0 |
| [simple-date-formatter-new-12](https://dependencywatch.io/package/npm/simple-date-formatter-new-12) | npm | 1.0.0 |
| [test-agency-assignment](https://dependencywatch.io/package/npm/test-agency-assignment) | npm | 1.0.2 |
| [vite-plugin-crypto](https://dependencywatch.io/package/npm/vite-plugin-crypto) | npm | * |

## What happened

Between roughly 2026-09-28 12:00 UTC and 2026-09-29 12:00 UTC, the GitHub Advisory Database (with the OpenSSF malicious-packages bulk export, Amazon Inspector`s IN-MAL feed, and kam193/bad-packages) published 26 new malware advisories: 25 npm and 1 pip. The defensively noteworthy shape of this window is a clear split: (a) the pip `donutautosellsrc` Polygon-blockchain-C2 campaign has now run for 3 consecutive days across 6 named packages under one wallet; (b) four distinct npm operators launched on 2026-09-28 with multi-package families (hardhat pino-impersonator, `nebula-*` Windows RAT, `fabric-*` Minecraft credential stealer, `chalk-figlet` RuntimeBroker dropper); (c) two unrelated Windows droppers (`native-env`/`dotenv-native` JPEG-EXIF chain, `test-agency-assignment` process-hollowing chain) reuse the wscript.exe → PowerShell delivery pattern that has been common in this corpus.

## Cluster A - pip `aseitylab` extends the `donutautosellsrc` Polygon-blockchain campaign to day 3

`aseitylab@0.1.0`/`0.1.1` (GHSA-jv9w-2v63-767g, MAL-2026-17240) publishes today with the same primitive stack as the 2026-09-27 `donutautosellsrc` origin and the 2026-09-28 `aseity`/`coinscan`/`donutpromotion`/`claudedashbord` extension:

1. **Steganography** - image with executable bytes hidden in image data.
2. **Native Python C-extension infostealer** - drops compiled `.so`/`.pyd` modules carrying the obfuscated stealer.
3. **Polygon-blockchain-resolved C2** - queries a public Polygon RPC endpoint for the transaction history of attacker-controlled wallet `0x9c0a507300fd902787bb193d80fca5ce6e1bff9a` and parses the C2 endpoint from transaction metadata.

Same payload SHA-256 `d03c42c275f0dbc617428441508c49ae1adcbbc95af4eeb094bca4e4f8943f3e` as yesterday`s four. Naming reads as a variant expansion of `aseity` (yesterday) - the operator is re-using lure names with suffixes.

Classify as `malicious-package` (fresh name, real payload). The campaign is now known to span 6 pip packages across 3 days. Yesterday`s record already covers the domain/hash/IOC set; today`s addition is that the operator continues to publish without disruption.

## Cluster B - npm hardhat-* pino-impersonator Ethereum-developer lure

Four npm packages under names close-adjacent to the Nomic Foundation `hardhat` Ethereum development framework:

- `hardhat-lock@2.21.0` (GHSA-crqg-xv46-qmmw): impersonates `pino` (README, LICENSE, docs/ copied verbatim). Ships a ~4MB `lib/config.js` obfuscated with a 23,981-entry rotated string array, hex-escaped tokens, control-flow flattening, 40,131+ inline decoder replacements. Executes automatically at import.
- `hardhat-zet@2.0.1` (GHSA-qqvr-prmw-6pq2): same pino impersonation. 4,498,609-byte obfuscated `lib/config` with 26,113-entry rotated string array and hex-encoded identifiers. Public no-op Express middleware surface. Author claimed as `Robert King <hello@jsonspack.com>`, bug tracker `jsonspack.com/issues`. Source SHA-256 `37cd33c0908189c0085fba153be1c42776411968aa5ad652dd7ffdef88b318bc`.
- `mini-hardhat@<=1.1.4` (GHSA-wxx2-jv4c-38wh): pino-like JSON logger surface, but spawns a detached child process `lib/caller.js` that survives parent termination. Base64-decoded C2 `https://ipinfo-encrypted-v1.vercel.app/api/auth/f1f097d93c318c92f0c5`, RCE via `new Function.constructor("require", s)(require)`, up to 5 retry attempts. Source SHA-256 `fbdfc97da008f90f11ae03963e75237c8bb746cf93f9cdc5da43ba5807ed6c1e`.
- `hardhat-cap@*` (GHSA-3jrx-49jf-x2rp) from 2026-09-28: CWE-506 boilerplate, no analysis. Grouped here on name-family and same-window publication.

Same class of Hardhat impersonation that Socket flagged in [January 2025](https://socket.dev/blog/malicious-npm-package-targets-ethereum-developers) targeting Ethereum developers with private-key and mnemonic exfil. The operator has resumed after months of quiet. Ethereum tooling developers should treat any Hardhat-adjacent dependency name with pino-copied documentation as compromised until proven otherwise.

Classify each as `malicious-package`.

## Cluster C - npm nebula-* Windows `.kntrat` RAT dropper family

Five npm packages under `nebula` names, at least four confirmed same-operator by IOC:

- `nebula-llm@1.0.0` (GHSA-5ph8-m4r7-g739): preinstall.cjs decompresses base64+zlib-encoded 257KB Windows PE binary, writes to `%LOCALAPPDATA%\Microsoft\Conhost\conhost.exe`, executes silently. PE contains section `.kntrat`. External references: `65.87.7.132`, `github.com/syskiel/kntrat-e`. Source SHA-256 `b33da6aef41209f654f8f76cc56074a7b827599f42f941e3917326da1f4d2566`.
- `nebulaai-sdk@>=1.0.0` (GHSA-57f4-h93r-jvh6): same preinstall pattern, same drop path, same C2 IP, same `.kntrat` section, same GitHub reference. Source SHA-256 `dc906b81107141fbd85dcabf89fd2f5112c4e4a134045c90d6a35abb4b67d16e`.
- `nebula-sdk@*` (GHSA-fm5g-6rr8-p9vq): CWE-506 boilerplate; grouped on name.
- `nebulajs-api@*` (GHSA-2gr6-gxvx-3594): CWE-506 boilerplate; grouped on name.
- `llm-nebula@1.0.0` (GHSA-8g48-f52v-xggv): different mechanism - ~232KB obfuscated preinstall.cjs blob using TEA/xorshift cryptographic constants (`0x9e3779b9`, `0x243f6a88`, `0x6a09e667`) with Function-constructor and custom string decoders. Grouped on name proximity and same-day publication; may be the same operator experimenting with delivery.

The `.kntrat` PE section is a strong fingerprint for a known RAT family and the `syskiel/kntrat-e` GitHub reference gives defenders a proper hunting anchor. On Windows, watch for `%LOCALAPPDATA%\Microsoft\Conhost\conhost.exe` execution (the legitimate `conhost.exe` lives only in `%SystemRoot%\System32\conhost.exe`).

Classify each as `malicious-package`.

## Cluster D - npm fabric-* Minecraft-launcher credential stealer via Discord webhook

Three npm packages under `fabric` names (the Minecraft modding framework), same webhook, same behaviour:

- `fabric-native-loader@1.0.0` (GHSA-h76r-hhqx-cjq3): postinstall reads Minecraft launcher credential stores, extracts accessTokens/refreshTokens/clientTokens, exfiltrates over HTTPS POST to `discord.com/api/webhooks/1554065488726990909/[token]`. Source SHA-256 `d289ae71736f05158f45d6636730641e82b5a774bf99bf1b587155d31c73daaa`.
- `fabric-render-bridge@<=1.0.0` (GHSA-r54m-4q33-rjvr): same class of behaviour, same webhook ID. Reads official launcher, PrismLauncher, MultiMC, TLauncher, Modrinth, PolyMC, GDLauncher. Source SHA-256 `c2715ef0b07fbf0ca24fb8dadec44f2fcfdc273421a49ad2201bf8e40d3e2c01`.
- `fabric-asset-pipeline@1.0.0`/`1.0.1` (GHSA-2h5p-2j55-g9r4): obfuscator.io string rotation with base64+RC4 decoding. Functions `stealLauncherAccounts()`, `stealAltLaunchers()`, `readSessionDump()`, `sendInfo()`. Webhook URL is RC4-decoded at runtime. Source SHA-256 `bb92787d766d5bfa0c384cc04909689215fa0d3e869630422caa8bedd303038a`.

The shared webhook ID `1554065488726990909` is a strong operator fingerprint. Block that specific webhook ID at your egress; consider blocking `discord.com/api/webhooks/*` from CI networks entirely.

Classify each as `malicious-package`.

## Cluster E - npm chalk-figlet family Windows RuntimeBroker.exe dropper

- `chalk-figlet@>=1.2.0` (GHSA-85m5-qg46-qg28): postinstall (`node example.js` → `require index.js`) runs a `_syncTelemetry` function that hex-decodes a URL and filename, downloads via `axios.get`, executes via `child_process.exec` with `windowsHide` and detached. Source SHA-256 `66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b`.
- `figlet-chalk-render@<=1.2.1` (GHSA-frpq-rj8q-hpr4): same class - top-level IIFE on require, char-code arrays and hex escapes hide the module and method names, HTTPS GET piped to file stream. Source SHA-256 `992cf49b88be09149971d4ac18fe2a4b61d242186f553cb3283a26970b886d7f`.

Both drop `RuntimeBroker.exe` to `%TEMP%` from `http://104.234.65.75:700/setup.exe` and execute it. Both gate execution to skip environments where `CI`, `SANDBOX`, `GITHUB_ACTIONS`, or `TRAVIS` env vars are set - only real developer workstations get the payload. This is the same `104.234.65.75` operator whose infrastructure the 2026-09-28 sweep operator-continuity block warned to keep blocked; they`re active again.

Classify each as `malicious-package`.

## Cluster F - npm dotenv-lookalike JPEG-EXIF steganography → wscript.exe → PowerShell

- `native-env@1.0.1` (GHSA-9p6x-527c-vh8p): bundle is really `node-env-buffer@2.2.6`. Extracts hidden code from `dist/stest.jpg` APP13 marker segment, writes VBS relay to temp, spawns `wscript.exe` → PowerShell with encoded command. Obfuscator.io-style RC4 decryption. Source SHA-256 `8e9c612513357181c7e4d504f94a2a8c03de64724e2593217216de8fef4e7166`.
- `dotenv-native@1.0.1` (GHSA-438j-7xq6-grfr): same bundle identity, same JPEG (287KB), same chain. Uses the APP1/EXIF `0xFFED` marker instead of APP13. Loader persists in both `dist/index.cjs` (library) and `dist/cli.cjs` (`dot2env` CLI). Source SHA-256 `4369c7fa886fc7d315922759932056664863d71157bcdece943fa53339586f03`.

Windows-only. Both target `dotenv` users by name. Note that both entry-points carry the loader - `--ignore-scripts` alone does not prevent the payload firing at first import.

Classify each as `malicious-package`.

## Cluster G - npm `test-agency-assignment` process-hollowing dropper

`test-agency-assignment@<=1.0.2` (GHSA-7x83-rfhr-656r) advertises as a "Device Telemetry Aggregator". Postinstall triggers `wscript.exe 4444.vbs`. The VBS is a multi-layer decoder (Base64 → XOR-masked AES S-box → ChaCha20-IETF → additional XOR) that reconstructs a PowerShell loader in `%TEMP%\pf<rand>.dat` and invokes it. Comments in the source reference "process hollowing" - the payload is designed to inject into a hollowed legitimate process. Source SHA-256 `dcdf62e1c1eb44ca7a29ed37c12bdb71883025a46c5066e58c9228f0dfe782c2`. Windows-only.

Classify as `malicious-package`.

## Cluster H - npm `items-validator` in-process persistent loader

`items-validator@<=1.0.5` (GHSA-hvv9-35pw-8qvf): install spawns a persistent background process polling `https://game.spawnrealm.com/api/item-realtime?key=abcdef123456` for JSON payloads and evaluating them with full Node.js capabilities. Cross-platform (in-process, no OS gate). Source SHA-256 `a8e49b1abd7c566b17104c5a2823251df2ca253a0fa509d7c19db1c1942ad13d`.

Because the loader runs in-process, `npm uninstall` alone does not stop it - the Node process must be killed.

Classify as `malicious-package`.

## Cluster I - npm `rai6jaisahthaghee5ou-loader-package` browser XSS/injection loader

`rai6jaisahthaghee5ou-loader-package@>=1.0.0` (GHSA-hhf7-grh4-575w): IIFE injects a `<script>` element pointing at `https://nee1ahnaw7.xsses.link` into `document`. Random-string name characteristic of research artefacts. Source SHA-256 `6de53fbd264f685e033789fe5929c63f322366219d80707ec419a48a85e253c9`.

Browser-only impact (server-side Node has no `document`). Bundling this into a client app exposes every visitor to arbitrary JavaScript in the app`s security context.

Classify as `malicious-package`.

## Cluster J - npm `simple-date-formatter-new-12` OAST SSRF probe

`simple-date-formatter-new-12@1.0.0` (GHSA-v6p6-9wrj-f56p): postinstall `curl`s internal Baidu host `http://bsrc-ssrf.n.baidu-int.com/`, writes response to `/tmp/bsrc.txt`, POSTs contents to `pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun`. Bug-bounty or pentest SSRF probe. Source SHA-256 `bd79db99adb8878673dd85db5a29661432808fa8fcc5e3d750b907418df8ae5f`.

The naming pattern re-uses `simple-date-formatter-new-<N>` from the earlier `124.221.154.135` SSH-beacon operator, but the mechanism is different: this is the same `.oast.fun` operator as the [2026-09-27](https://dependencywatch.io/incident/multi-2026-09-27-ghsa-malware-sweep) Cluster D `cma-self-hosted-sandbox-cf` package.

Classify as `dependency-confusion` (probe-only, no confirmed payload). Severity `medium` per calibration.

## Cluster K - 4-package npm CWE-506 boilerplate batch

- `@digift/cli` (GHSA-xp76-38xh-m8wc): dep-confusion at internal scope
- `img-to-native` (GHSA-pv7p-ghgv-268x): `native-*` naming adjacency to Cluster F
- `native-runner` (GHSA-jxw5-69p3-hpm4): `native-*` naming adjacency to Cluster F
- `vite-plugin-crypto` (GHSA-mh9w-qr45-6wrq): generic Vite plugin lure

All versions quarantined, all CWE-506 boilerplate advisory bodies, no IOCs. If Amazon Inspector or a vendor blog lands payload analysis on any of these later they may re-split.

Severity `medium` for sweep purposes.

## Operator continuity check

- **Cluster A `donutautosellsrc` Polygon-C2 campaign**: day 3, still publishing, wallet unchanged.
- **Cluster E `104.234.65.75:700` RuntimeBroker operator**: returns after a one-day quiet - same infrastructure the 2026-09-28 sweep warned to keep blocked.
- **Cluster J `.oast.fun` OAST operator**: re-uses the `simple-date-formatter-new-<N>` naming lineage from the earlier SSH-beacon operator.
- **`ltidi.storage.googleapis.com`** (2026-09-26 Cluster D GCS-tarball loader): no fresh `@airbnb-extended/*`/`ltidisafe*` today.
- **`oob.algamil7x.xyz`**: no new day-N additions.
- **`eo8f3m3ho26a0nm.m.pipedream.net`** (2026-09-26 Cluster E `shoplist-app`): no new Pipedream-beaconing packages.
- **`n8n-nodes-*` `mkicom.com`**: no new packages.

Egress blocks remain durable on all of the above. Add for today: `65.87.7.132`, `ipinfo-encrypted-v1.vercel.app`, `game.spawnrealm.com`, `nee1ahnaw7.xsses.link`, Discord webhook ID `1554065488726990909`.

## Registry state

All 26 packages in this sweep are npm/pip-quarantined at time of writing. Active operator-side infrastructure unique to today`s batch:

- Polygon wallet `0x9c0a507300fd902787bb193d80fca5ce6e1bff9a` (Cluster A - day 3)
- `ipinfo-encrypted-v1.vercel.app` (Cluster B mini-hardhat)
- `65.87.7.132`, GitHub reference `github.com/syskiel/kntrat-e` (Cluster C)
- Discord webhook `1554065488726990909` (Cluster D)
- `104.234.65.75:700` (Cluster E - not new but re-active)
- `game.spawnrealm.com` (Cluster H)
- `nee1ahnaw7.xsses.link` (Cluster I)
- `pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun` (Cluster J)

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector`. Per-package IOC details drawn from GHSA advisory bodies published between 2026-09-28 12:00 UTC and 2026-09-29 12:00 UTC.

## Impact

- **Cluster A - pip `aseitylab` extends the `donutautosellsrc` Polygon-blockchain C2 campaign to day 3 (real payload, malicious-package)**: `aseitylab@0.1.0`/`0.1.1` (GHSA-jv9w-2v63-767g, MAL-2026-17240). Same primitive stack as the [2026-09-27](https://dependencywatch.io/incident/multi-2026-09-27-ghsa-malware-sweep) and [2026-09-28](https://dependencywatch.io/incident/multi-2026-09-28-ghsa-malware-sweep) sweeps: steganographic image loader, native Python C-extension infostealer, and command-and-control server addresses read from Polygon blockchain transaction history for attacker wallet `0x9c0a507300fd902787bb193d80fca5ce6e1bff9a`. Same payload SHA-256 `d03c42c275f0dbc617428441508c49ae1adcbbc95af4eeb094bca4e4f8943f3e` as the yesterday`s Cluster A four packages. The campaign now spans at least 6 pip packages under this wallet across 3 days: `donutautosellsrc@0.3.7`/`0.3.8`/`0.3.9`, `aseity@0.1.0`, `coinscan@0.1.0`, `donutpromotion@<=0.1.0`, `claudedashbord@0.1.0-0.1.3`, and today`s `aseitylab@0.1.0`/`0.1.1`. The `-lab` suffix on `aseitylab` reads as a variant-name expansion of yesterday`s `aseity` - the operator is iterating the same lure names
- **Cluster B - npm hardhat-* pino-impersonator Ethereum-developer lure (real payload, malicious-package, at least 4 packages)**: `hardhat-lock@2.21.0` (GHSA-crqg-xv46-qmmw, source SHA-256 not stated; ~4MB obfuscated `lib/config.js` with 23,981-entry rotated string array, executes on import), `hardhat-zet@2.0.1` (GHSA-qqvr-prmw-6pq2, source SHA-256 `37cd33c0908189c0085fba153be1c42776411968aa5ad652dd7ffdef88b318bc`; 4,498,609-byte obfuscated `lib/config` with 26,113-entry string array, author claimed as "Robert King <hello@jsonspack.com>" with bug tracker `jsonspack.com/issues`), `mini-hardhat@<=1.1.4` (GHSA-wxx2-jv4c-38wh, source SHA-256 `fbdfc97da008f90f11ae03963e75237c8bb746cf93f9cdc5da43ba5807ed6c1e`; C2 `https://ipinfo-encrypted-v1.vercel.app/api/auth/f1f097d93c318c92f0c5`, spawns detached `lib/caller.js` that survives parent termination, RCE via `new Function.constructor("require", s)(require)` with up to 5 retry attempts). All three impersonate the unrelated `pino` JSON-logger project (README, LICENSE, docs/ tree copied verbatim) under a name adjacent to the Nomic Foundation `hardhat` Ethereum development framework - the lure is Ethereum developers reaching for Hardhat plugins. Also in the family from 2026-09-28: `hardhat-cap@*` (GHSA-3jrx-49jf-x2rp; CWE-506 boilerplate with no published analysis). This is the same class of Hardhat/Ethereum-developer lure that Socket flagged in 2025-01 - the operator has resumed after months of quiet
- **Cluster C - npm nebula-* Windows `.kntrat` RAT dropper family (real payload, malicious-package, at least 4 packages)**: `nebula-llm@1.0.0` (GHSA-5ph8-m4r7-g739, source SHA-256 `b33da6aef41209f654f8f76cc56074a7b827599f42f941e3917326da1f4d2566`), `nebulaai-sdk@>=1.0.0` (GHSA-57f4-h93r-jvh6, source SHA-256 `dc906b81107141fbd85dcabf89fd2f5112c4e4a134045c90d6a35abb4b67d16e`), `nebula-sdk@*` (GHSA-fm5g-6rr8-p9vq, CWE-506 boilerplate but named-family confirms), `nebulajs-api@*` (GHSA-2gr6-gxvx-3594, CWE-506 boilerplate but named-family confirms), and adjacent `llm-nebula@1.0.0` (GHSA-8g48-f52v-xggv, source SHA-256 `0eee293a9973027154eea71635c14e8a4cb2ad8a1e4f80a65399ad874afcb669`; ~232KB obfuscated preinstall.cjs blob using TEA/xorshift constants `0x9e3779b9`, `0x243f6a88`, `0x6a09e667`). The `nebula-llm`/`nebulaai-sdk` variants embed a ~257KB Windows PE binary as a base64+zlib-compressed string in `preinstall.cjs`/`preinstall.js`, decompress it, and write it to `%LOCALAPPDATA%\Microsoft\Conhost\conhost.exe` mimicking the legitimate Windows Console Host, then spawn it silently via `child_process.spawn` with hidden window. Decoded PE contains a section named `.kntrat` and references external host `65.87.7.132` and GitHub repository `github.com/syskiel/kntrat-e` - consistent with a native RAT-family tool. The `llm-nebula` variant differs in mechanism (obfuscated JS preinstall instead of embedded PE) but shares the naming pattern and window, suggesting the same operator experimenting with delivery
- **Cluster D - npm fabric-* Minecraft-launcher credential stealer via Discord webhook (real payload, malicious-package, at least 3 packages)**: `fabric-native-loader@1.0.0` (GHSA-h76r-hhqx-cjq3, source SHA-256 `d289ae71736f05158f45d6636730641e82b5a774bf99bf1b587155d31c73daaa`, Discord webhook `discord.com/api/webhooks/1554065488726990909/`), `fabric-render-bridge@<=1.0.0` (GHSA-r54m-4q33-rjvr, source SHA-256 `c2715ef0b07fbf0ca24fb8dadec44f2fcfdc273421a49ad2201bf8e40d3e2c01`, same webhook ID), `fabric-asset-pipeline@1.0.0`/`1.0.1` (GHSA-2h5p-2j55-g9r4, source SHA-256 `bb92787d766d5bfa0c384cc04909689215fa0d3e869630422caa8bedd303038a`, RC4-decoded webhook URL). Postinstall hook reads Minecraft launcher credential stores across official launcher, PrismLauncher, MultiMC, TLauncher, Modrinth, PolyMC, and GDLauncher; extracts Mojang/Microsoft accessTokens, refreshTokens, clientTokens, account usernames; and exfiltrates over HTTPS POST to the hardcoded Discord webhook alongside hostname, username, platform, OS release info. The name `fabric` is the Minecraft modding framework - lure is Minecraft mod developers. All three use the same webhook ID `1554065488726990909`
- **Cluster E - npm chalk-figlet family Windows RuntimeBroker.exe dropper via bare-IP HTTP (real payload, malicious-package, 2 packages)**: `chalk-figlet@>=1.2.0` (GHSA-85m5-qg46-qg28, source SHA-256 `66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b`), `figlet-chalk-render@<=1.2.1` (GHSA-frpq-rj8q-hpr4, source SHA-256 `992cf49b88be09149971d4ac18fe2a4b61d242186f553cb3283a26970b886d7f`). Postinstall/require-time IIFE decodes a hex-obfuscated URL `http://104.234.65.75:700/setup.exe` (bare IP, unencrypted HTTP), downloads the payload via `axios.get`, writes it to the OS temp directory as `RuntimeBroker.exe` (impersonating the legitimate Windows binary), and executes it via `child_process.exec` with stealth (`windowsHide: true`, detached). Execution is gated to SKIP environments where `CI`, `SANDBOX`, `GITHUB_ACTIONS`, or `TRAVIS` env vars are set - evades sandbox and CI analysis, real developer workstations are the target. Both packages advertise as chalk+figlet wrappers - lure is Node.js CLI-tool developers. Same bare-IP `104.234.65.75:700` C2 that the [2026-09-28 sweep](https://dependencywatch.io/incident/multi-2026-09-28-ghsa-malware-sweep) operator-continuity block warned to keep durable
- **Cluster F - npm dotenv-lookalike Windows JPEG-EXIF steganography → wscript.exe → PowerShell dropper (real payload, malicious-package, 2 packages)**: `native-env@1.0.1` (GHSA-9p6x-527c-vh8p, source SHA-256 `8e9c612513357181c7e4d504f94a2a8c03de64724e2593217216de8fef4e7166`, JPEG APP13 marker), `dotenv-native@1.0.1` (GHSA-438j-7xq6-grfr, source SHA-256 `4369c7fa886fc7d315922759932056664863d71157bcdece943fa53339586f03`, JPEG APP1/EXIF `0xFFED` marker). Both bundle a fake package identity of `node-env-buffer@2.2.6` under names that impersonate the ubiquitous `dotenv` library. Attack chain: import or CLI call → open bundled `dist/stest.jpg` (287KB payload carrier) → scan JPEG segments for the APP1/EXIF or APP13 marker → extract marker contents as UTF-8 string → write `relay_*.vbs` to temp directory → spawn `wscript.exe` → wscript launches `powershell.exe` with base64-encoded command → payload executes. Obfuscator.io-style RC4 decryption and runtime string concatenation hide the loader. Windows-only. Loader persists in both `dist/index.cjs` (library import) and `dist/cli.cjs` (`dot2env` CLI entry) so both `require("dotenv-native")` and the CLI trip the payload
- **Cluster G - npm `test-agency-assignment` Windows postinstall wscript.exe → PowerShell → process-hollowing dropper (real payload, malicious-package)**: `test-agency-assignment@<=1.0.2` (GHSA-7x83-rfhr-656r, source SHA-256 `dcdf62e1c1eb44ca7a29ed37c12bdb71883025a46c5066e58c9228f0dfe782c2`). Package advertises as a "Device Telemetry Aggregator". Postinstall triggers `wscript.exe 4444.vbs` on `npm install`. The VBS is a multi-layer decoder: Base64 → XOR-masked AES S-box → ChaCha20-IETF → additional XOR to extract PowerShell loader, written to `%TEMP%\pf<rand>.dat`, invoked via `powershell.exe`. Embedded source-code comments reference "process hollowing" (injecting the payload into a hollowed legitimate process for detection evasion and persistence). Windows-only. Watch for unexpected `wscript.exe` and `powershell.exe` execution during `npm install`, and temporary files matching `pf<rand>.dat` in `%TEMP%`
- **Cluster H - npm `items-validator` Node.js in-process persistent-loader (real payload, malicious-package)**: `items-validator@<=1.0.5` (GHSA-hvv9-35pw-8qvf, source SHA-256 `a8e49b1abd7c566b17104c5a2823251df2ca253a0fa509d7c19db1c1942ad13d`). Launches a persistent background process on install that polls `https://game.spawnrealm.com/api/item-realtime?key=abcdef123456` for JSON payloads and evaluates them with full Node.js capabilities. Cross-platform (Node.js in-process, no OS gate). The C2 `game.spawnrealm.com` is a novel domain for this corpus. Because the loader runs in-process rather than via a separate binary, uninstall alone may leave the running Node process still polling until the process is killed
- **Cluster I - npm `rai6jaisahthaghee5ou-loader-package` browser-context XSS/injection loader (real payload, malicious-package)**: `rai6jaisahthaghee5ou-loader-package@>=1.0.0` (GHSA-hhf7-grh4-575w, source SHA-256 `6de53fbd264f685e033789fe5929c63f322366219d80707ec419a48a85e253c9`). IIFE at import time injects a `<script>` element pointing at `https://nee1ahnaw7.xsses.link` and appends it to `document`. The random-string name (`rai6jaisahthaghee5ou-`) reads as a Diceware/passphrase-generator output and is characteristic of research-artefact or pentest-tooling naming. Because the payload targets `document`, this is a browser-bundle-only loader - Node-side install has no filesystem or network impact, but any web app that pulls this into a bundle exposes every visitor to arbitrary attacker JavaScript in the app`s security context (credential theft, DOM manipulation, follow-on delivery)
- **Cluster J - npm `simple-date-formatter-new-12` OAST SSRF probe (dependency-confusion/probe)**: `simple-date-formatter-new-12@1.0.0` (GHSA-v6p6-9wrj-f56p, source SHA-256 `bd79db99adb8878673dd85db5a29661432808fa8fcc5e3d750b907418df8ae5f`). Postinstall uses `curl` to fetch internal Baidu host `http://bsrc-ssrf.n.baidu-int.com/`, writes response to `/tmp/bsrc.txt`, POSTs contents to attacker-controlled interactsh collector at `pdxkwzizhzzdpzpgcieqk6d1v7ynqsgfo.oast.fun`. Reads as a Baidu-scoped bug-bounty or pentest SSRF probe. Note the naming pattern re-uses `simple-date-formatter-new-<N>` from the earlier `124.221.154.135` SSH-beacon operator, but the C2 mechanism is different - this is the same `.oast.fun` (Burp Collaborator OOB zone) operator as [2026-09-27](https://dependencywatch.io/incident/multi-2026-09-27-ghsa-malware-sweep) Cluster D `cma-self-hosted-sandbox-cf`, reusing an established naming skeleton
- **Cluster K - 4-package npm CWE-506 boilerplate batch, no published analysis (mixed kinds, unclassified)**: `@digift/cli` (GHSA-xp76-38xh-m8wc), `img-to-native` (GHSA-pv7p-ghgv-268x), `native-runner` (GHSA-jxw5-69p3-hpm4), `vite-plugin-crypto` (GHSA-mh9w-qr45-6wrq) - all versions quarantined, all with GHSA`s CWE-506 boilerplate advisory body and no IOCs, source-code link, or vendor write-up. Names read as: dep-confusion at internal scope (`@digift/cli`), `native-*` typosquat family adjacent to Cluster F (`img-to-native`, `native-runner` - could be the same operator preparing follow-ons), and generic Vite plugin lure (`vite-plugin-crypto`). Treat as `medium` for the sweep purposes; if Amazon Inspector/OpenSSF/kam193 lands payload analysis later, may re-split
- **Operator continuity check**: 2026-09-27 `donutautosellsrc` Polygon-C2 campaign continues in Cluster A. 2026-09-28 `104.234.65.75:700` RuntimeBroker operator returns after a one-day quiet in Cluster E. The `simple-date-formatter-new-<N>` naming lineage is re-used by the OAST operator in Cluster J. No fresh `ltidi.storage.googleapis.com` (2026-09-26 GCS-tarball loader), `oob.algamil7x.xyz`, `eo8f3m3ho26a0nm.m.pipedream.net` Pipedream beacon, or `mkicom.com` `n8n-nodes-*` operator activity in this window - the egress blocks remain durable. Discord webhook `1554065488726990909` (Cluster D) and Polygon wallet `0x9c0a507300fd902787bb193d80fca5ce6e1bff9a` (Cluster A) are the two new durable operator-fingerprint IOCs from today

## What to do

1. Grep every `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `package.json`, `requirements.txt`, `Pipfile.lock`, `poetry.lock`, and `pyproject.toml` for every package name in Clusters A through K. Uninstall on hit, wipe `node_modules`/`.venv`, delete the lockfile, rebuild against a clean cache. Clusters A through I carry confirmed real payloads (blockchain-C2 infostealer, Windows RAT, credential stealers, dropper chains); a hit on any of those is a compromise, not a warning
2. **For Cluster A (pip `aseitylab` donutautosellsrc campaign extension)**: uninstall on hit and image the host - the native C-extension infostealer landed compiled binary code on disk, so a Python uninstall does not clean it. Rotate every credential the installer user had access to. Because C2 resolves through a Polygon RPC query against wallet `0x9c0a507300fd902787bb193d80fca5ce6e1bff9a`, a domain-only egress denylist is insufficient - block the IOC domains from yesterday`s record (`thisisafalsepositive.st`, `sltnnt.ru`) AND block outbound Polygon RPC (`polygon-rpc.com`, `rpc-mainnet.matic.network`, `polygon-mainnet.g.alchemy.com`, `polygon-mainnet.infura.io`) from build/CI networks. Add a lockfile-lint rule for the 6 known package names now. The campaign is scaling - expect further packages
3. **For Cluster B (npm hardhat-* pino-impersonator Ethereum lure)**: uninstall `hardhat-lock`, `hardhat-zet`, `mini-hardhat`, `hardhat-cap` on hit. Because auto-execution happens on `require`, presence in `node_modules` after `npm install` is enough to consider the host compromised even without invoking the package explicitly. Rotate every credential accessible from the developer workstation, including any Ethereum wallets, mnemonic phrases, private keys, and CI/CD tokens - the historical Hardhat-lure campaigns explicitly targeted these. Block outbound HTTPS to `ipinfo-encrypted-v1.vercel.app` from developer and CI networks. Reject any dependency author claiming `hello@jsonspack.com` or `jsonspack.com` as a bug tracker. Consider auditing every internal Hardhat plugin dependency by hand - the operator will iterate names
4. **For Cluster C (npm nebula-* `.kntrat` Windows RAT dropper)**: uninstall `nebula-llm`, `nebulaai-sdk`, `nebula-sdk`, `nebulajs-api`, `llm-nebula` on hit and image any Windows host that ran an install - the RAT is running as `%LOCALAPPDATA%\Microsoft\Conhost\conhost.exe` masquerading as the real Console Host. Rotate everything the installer user had access to. Block outbound HTTPS/TCP to `65.87.7.132` from developer and CI networks. Add a Sysmon/EDR rule for `%LOCALAPPDATA%\Microsoft\Conhost\conhost.exe` execution (the real conhost lives in `%SystemRoot%\System32`) and PE files with a section named `.kntrat`. Consider hunting historical process trees for the impersonator path
5. **For Cluster D (npm fabric-* Minecraft credential stealer)**: uninstall `fabric-native-loader`, `fabric-render-bridge`, `fabric-asset-pipeline` on hit. Rotate all Mojang/Microsoft Minecraft launcher credentials from a clean device - the stealer extracts accessTokens, refreshTokens, and clientTokens from official launcher, PrismLauncher, MultiMC, TLauncher, Modrinth, PolyMC, GDLauncher. Block outbound HTTPS to `discord.com/api/webhooks/1554065488726990909/*` (this specific webhook ID) at the network level; consider blocking `discord.com/api/webhooks/*` from CI networks entirely as a durable defence against Discord-webhook-based exfil. Add the 3 package names to your lockfile-lint blocklist
6. **For Cluster E (npm chalk-figlet family RuntimeBroker.exe dropper)**: uninstall `chalk-figlet`, `figlet-chalk-render` on hit. Block outbound HTTP to `http://104.234.65.75:700/*` at the network level (bare-IP, port 700 - trivially blockable). Add a Sysmon/EDR rule for a file named `RuntimeBroker.exe` executed from `%TEMP%`/`%LOCALAPPDATA%\Temp` (the real RuntimeBroker.exe lives only in `%SystemRoot%\System32`). The CI-env-detection gate means CI runs will report a clean install - do not use CI logs as the exclusive detection surface for these packages
7. **For Cluster F (npm `native-env` + `dotenv-native` JPEG-EXIF steganography)**: uninstall both on hit. Windows-only, but the payload dispatcher is a stealthy wscript.exe → PowerShell chain that most default EDR rules do not flag. Block or audit `wscript.exe` spawned as a child of `node.exe` or `npm.exe` in EDR. Rotate every credential the installer user had. Because the loader lives in both the library import and the CLI entry, a `require("dotenv-native")` OR a `dot2env` CLI call is enough - a `npm install --ignore-scripts` alone does NOT prevent the payload firing at first import. Reject the fake package identity `node-env-buffer@2.2.6` as a dependency name - it is a common bundle-name lure
8. **For Cluster G (npm `test-agency-assignment` process-hollowing dropper)**: uninstall on hit. Windows-only. `--ignore-scripts` in CI blocks the postinstall trigger but not manual runs. Watch for `wscript.exe 4444.vbs` execution paths and `%TEMP%\pf<rand>.dat` files in EDR. The process-hollowing intent means a compromised host may show a running legitimate-looking process with malicious code inside - assume compromise on any install
9. **For Cluster H (npm `items-validator` in-process persistent loader)**: uninstall AND kill any Node.js process that ran `items-validator` code - the loader polls `game.spawnrealm.com` in-process, so `npm uninstall` alone is not enough. Block outbound HTTPS to `game.spawnrealm.com` and audit any Node process still holding that reference
10. **For Cluster I (npm `rai6jaisahthaghee5ou-loader-package` browser XSS loader)**: uninstall on hit. If the package was included in a browser bundle that shipped to production, treat as a full XSS incident: rotate any auth tokens visitors could have leaked, audit for suspicious sessions, block outbound HTTPS to `nee1ahnaw7.xsses.link` at the edge. Because the loader targets `document`, server-only Node use had no filesystem impact - the risk is exclusively client-side
11. **For Cluster J (npm `simple-date-formatter-new-12` OAST SSRF probe)**: uninstall on hit. Recon-only payload (SSRF response echoed to `.oast.fun` collector), so the risk is that the operator has a map of your CI hosts and network topology near Baidu-internal ranges. Block outbound to `*.oast.fun` and `*.oastify.com` (Burp Collaborator zones) from CI. Add the package name to your lockfile-lint blocklist; watch for further `simple-date-formatter-new-<N>` iterations
12. **For Cluster K (npm CWE-506 boilerplate batch)**: uninstall on hit. Without payload analysis assume real infostealer/RCE at time of quarantine - image the host, rotate installer-user credentials, check outbound telemetry from the install window. Add all 4 names to lockfile-lint. `img-to-native` and `native-runner` are close-adjacent to Cluster F - watch for a payload write-up landing on either
13. For every `npm install` in CI, prefer `--ignore-scripts` and enforce at runner level; that blocks Clusters E, F, G postinstall triggers but not Clusters B, H, I (which fire at import). For every `pip install`, prefer resolving from a curated internal mirror. Reject packages whose install-time or import-time behaviour includes a network fetch. Keep prior egress blocks in place: `ltidi.storage.googleapis.com`, `oob.algamil7x.xyz`, `eo8f3m3ho26a0nm.m.pipedream.net`, `mkicom.com`, `124.221.154.135`, `104.234.65.75`, `*.oast.fun`, `*.oastify.com`, Polygon RPC endpoints. Add for today: `65.87.7.132`, `ipinfo-encrypted-v1.vercel.app`, `game.spawnrealm.com`, `nee1ahnaw7.xsses.link`, Discord webhook ID `1554065488726990909`

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-jv9w-2v63-767g - pip aseitylab (Cluster A - donutautosellsrc campaign day 3, same wallet + payload hash)](https://github.com/advisories/GHSA-jv9w-2v63-767g) - GitHub
- [MAL-2026-17240 - pip aseitylab campaign metadata](https://osv.dev/vulnerability/MAL-2026-17240) - OSV
- [GHSA-crqg-xv46-qmmw - npm hardhat-lock (Cluster B - pino-impersonator Ethereum-dev lure, 4MB obfuscated blob)](https://github.com/advisories/GHSA-crqg-xv46-qmmw) - GitHub
- [GHSA-qqvr-prmw-6pq2 - npm hardhat-zet (Cluster B - pino impersonator, "Robert King" jsonspack.com attribution)](https://github.com/advisories/GHSA-qqvr-prmw-6pq2) - GitHub
- [GHSA-wxx2-jv4c-38wh - npm mini-hardhat (Cluster B - detached child process, ipinfo-encrypted-v1.vercel.app C2)](https://github.com/advisories/GHSA-wxx2-jv4c-38wh) - GitHub
- [GHSA-3jrx-49jf-x2rp - npm hardhat-cap (Cluster B - CWE-506 boilerplate, likely same operator family)](https://github.com/advisories/GHSA-3jrx-49jf-x2rp) - GitHub
- [MAL-2026-17236 - npm mini-hardhat OSV record](https://osv.dev/vulnerability/MAL-2026-17236) - OSV
- [GHSA-5ph8-m4r7-g739 - npm nebula-llm (Cluster C - .kntrat Windows PE RAT dropper, 65.87.7.132 C2)](https://github.com/advisories/GHSA-5ph8-m4r7-g739) - GitHub
- [GHSA-57f4-h93r-jvh6 - npm nebulaai-sdk (Cluster C - same .kntrat RAT pattern, 65.87.7.132 C2, syskiel/kntrat-e reference)](https://github.com/advisories/GHSA-57f4-h93r-jvh6) - GitHub
- [GHSA-fm5g-6rr8-p9vq - npm nebula-sdk (Cluster C - CWE-506 boilerplate, same operator name family)](https://github.com/advisories/GHSA-fm5g-6rr8-p9vq) - GitHub
- [GHSA-2gr6-gxvx-3594 - npm nebulajs-api (Cluster C - CWE-506 boilerplate, same operator name family)](https://github.com/advisories/GHSA-2gr6-gxvx-3594) - GitHub
- [GHSA-8g48-f52v-xggv - npm llm-nebula (Cluster C-adjacent - obfuscated preinstall variant, TEA/xorshift constants)](https://github.com/advisories/GHSA-8g48-f52v-xggv) - GitHub
- [GHSA-h76r-hhqx-cjq3 - npm fabric-native-loader (Cluster D - Minecraft credential stealer, Discord webhook 1554065488726990909)](https://github.com/advisories/GHSA-h76r-hhqx-cjq3) - GitHub
- [GHSA-r54m-4q33-rjvr - npm fabric-render-bridge (Cluster D - Minecraft credential stealer, same webhook)](https://github.com/advisories/GHSA-r54m-4q33-rjvr) - GitHub
- [GHSA-2h5p-2j55-g9r4 - npm fabric-asset-pipeline (Cluster D - RC4-decoded Discord webhook, Minecraft launcher account theft)](https://github.com/advisories/GHSA-2h5p-2j55-g9r4) - GitHub
- [GHSA-85m5-qg46-qg28 - npm chalk-figlet (Cluster E - RuntimeBroker.exe dropper, 104.234.65.75:700 bare-IP HTTP)](https://github.com/advisories/GHSA-85m5-qg46-qg28) - GitHub
- [GHSA-frpq-rj8q-hpr4 - npm figlet-chalk-render (Cluster E - same 104.234.65.75:700 dropper, CI-detection gate)](https://github.com/advisories/GHSA-frpq-rj8q-hpr4) - GitHub
- [GHSA-9p6x-527c-vh8p - npm native-env (Cluster F - JPEG APP13 steganography, node-env-buffer bundle identity)](https://github.com/advisories/GHSA-9p6x-527c-vh8p) - GitHub
- [GHSA-438j-7xq6-grfr - npm dotenv-native (Cluster F - JPEG APP1/EXIF 0xFFED steganography, dotenv typosquat)](https://github.com/advisories/GHSA-438j-7xq6-grfr) - GitHub
- [GHSA-7x83-rfhr-656r - npm test-agency-assignment (Cluster G - wscript.exe → PowerShell process-hollowing dropper)](https://github.com/advisories/GHSA-7x83-rfhr-656r) - GitHub
- [GHSA-hvv9-35pw-8qvf - npm items-validator (Cluster H - in-process persistent loader, game.spawnrealm.com C2)](https://github.com/advisories/GHSA-hvv9-35pw-8qvf) - GitHub
- [GHSA-hhf7-grh4-575w - npm rai6jaisahthaghee5ou-loader-package (Cluster I - browser XSS injector, nee1ahnaw7.xsses.link)](https://github.com/advisories/GHSA-hhf7-grh4-575w) - GitHub
- [GHSA-v6p6-9wrj-f56p - npm simple-date-formatter-new-12 (Cluster J - Baidu SSRF probe, .oast.fun OOB)](https://github.com/advisories/GHSA-v6p6-9wrj-f56p) - GitHub
- [GHSA-xp76-38xh-m8wc - npm @digift/cli (Cluster K - CWE-506 boilerplate, likely dep-confusion)](https://github.com/advisories/GHSA-xp76-38xh-m8wc) - GitHub
- [GHSA-pv7p-ghgv-268x - npm img-to-native (Cluster K - CWE-506 boilerplate, native-* naming adjacency)](https://github.com/advisories/GHSA-pv7p-ghgv-268x) - GitHub
- [GHSA-jxw5-69p3-hpm4 - npm native-runner (Cluster K - CWE-506 boilerplate, native-* naming adjacency)](https://github.com/advisories/GHSA-jxw5-69p3-hpm4) - GitHub
- [GHSA-mh9w-qr45-6wrq - npm vite-plugin-crypto (Cluster K - CWE-506 boilerplate, Vite plugin lure)](https://github.com/advisories/GHSA-mh9w-qr45-6wrq) - GitHub
- [Polygonscan - donutautosellsrc campaign wallet 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a](https://polygonscan.com/address/0x9c0a507300fd902787bb193d80fca5ce6e1bff9a) - PolygonScan
- [Socket - Malicious npm Package Targets Ethereum Developers (historical Hardhat lure context)](https://socket.dev/blog/malicious-npm-package-targets-ethereum-developers) - Socket

---

Canonical page: https://dependencywatch.io/incident/multi-2026-09-29-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-09-29-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).