GitHub Advisory malware sweep - 2026-09-29 (late) + 2026-09-30 (npm `tailwind-forms-kit` EtherHiding on Ethereum mainnet with wallet `0xa322E5...63e1a`; npm `web-vitals-polyfill-core-v1` chinazhangsan service-worker hijack via DoH + Sepolia-adjacent PWA_ROUTER; pip `bfox-build-utils` GitHub-Actions workflow-injection worm; npm `dotenv-precheck` Telegram wallet-mnemonic infostealer; npm `fabric-loader-core` install-time `vm.runInContext` RCE; npm `mfahelper` unpinned-GitHub-tarball RCE; npm `get-power` self-deleting AES payload typosquatting `get-proto`; npm `jexkcode` Baileys silent WhatsApp newsletter-follow; npm `zeal-utils`/`zeal-util-hooks` aveliscare canary continuation; pip `queeuees` .py-comment vandalism; 15 npm CWE-506 boilerplate takedowns)

What happened

Between roughly 2026-09-29 12:00 UTC and 2026-09-30 12:00 UTC, the GitHub Advisory Database (with the OpenSSF malicious-packages bulk export, Amazon Inspectors IN-MAL feed, and kam193/bad-packages) published 27 new malware advisories: 25 npm and 2 pip. The defensively noteworthy shape of this window: one fresh EtherHiding sample on Ethereum mainnet under a new wallet fingerprint (tailwind-forms-kit), a new-to-corpus service-worker hijack family using DoH resolution (web-vitals-polyfill-core-v1), a first-of-kind GitHub-Actions workflow-injection worm on pip (bfox-build-utils), a Telegram-exfil wallet stealer (dotenv-precheck), two distinct install-time RCE vehicles (fabric-loader-core via vm.runInContext, mfahelper via unpinned-tarball fetch), a self-deleting AES payload typosquat (get-power), a silent WhatsApp newsletter-follow (jexkcode), and continuation of the aveliscare.com canary operator (zeal-utils/zeal-util-hooks`).

A separate named-standalone side-file, npm-2026-09-17-indexed-btree-sepolia-etherhiding, catalogues the Checkmarx-disclosed 10-package charlessadler25 campaign (indexed-btree and 9 siblings, ~2M weekly downloads at peak, runtime-triggered loader in BTree.prototype.set(), Ethereum Sepolia smart-contract C2, Slack + Telegram exfil, ~109 ETH in attacker wallet). That is a critical-severity malicious-package compromise of a family with real reach; it is not part of this sweep.

Cluster A - npm tailwind-forms-kit EtherHiding on Ethereum mainnet (fresh wallet)

tailwind-forms-kit@0.5.1 (GHSA-w873-w35f-2523). Obfuscator.io loader: 303-entry string array _0x18ab, decoder function _0x35ba, node:http, node:https, node:zlib, node:child_process. Reads C2 endpoint from Ethereum mainnet transaction stream against wallet 0xa322E5f39aDC2490EfD311D3080e6f0121063e1a. Public RPC endpoints hardcoded: publicnode.com, 1rpc.io, drpc.org, and blockscout indexers.

Sixth EtherHiding sample this corpus has recorded; first with this wallet. Distinct from pyservercheck (2026-09-01 sweep), the visanduma/nova-two-factor Packagist compromise (2026-09-17), and the newly-catalogued indexed-btree campaign (which uses Sepolia testnet). Classify as malicious-package.

Cluster B - npm web-vitals-polyfill-core-v1 chinazhangsan.ccwu.cc service-worker hijack via DoH

web-vitals-polyfill-core-v1@1.0.0 has two GHSAs on the same package: GHSA-fx3x-h4mr-m28v carries the real analysis; GHSA-h475-44q2-vfjx is the CWE-506 boilerplate stub.

Primary C2 api.chinazhangsan.ccwu.cc; DoH resolvers doh.pub, dns.alidns.com (bypasses standard DNS blackholes); fallback payload hosts gist.githubusercontent.com/chinazhangsan999-crypto and api.npoint.io. The package installs a service worker; the service worker emits HTTP 302 redirects inside self.PWA_ROUTER.executeTacticalRouting() to hijack browser navigation. package.json declares main: index.js but the tarball does not ship index.js - no legitimate library surface, just the SW hijack payload in disk/index.min.js.

New to this corpus. Novel indicators to watch: chinazhangsan* naming, PWA_ROUTER global, DoH-lookup C2 resolution. Classify as malicious-package.

Cluster C - pip bfox-build-utils GitHub-Actions workflow-injection worm

bfox-build-utils@<=1.0.997 (GHSA-rx43-29mc-6h3f). During setup.py install on a runner inside a checked-out GitHub repository:

1. Reads $GITHUB_WORKSPACE/.git/config and base64-decodes the Authorization header to lift the runner`s stored GitHub credential.
2. Reads GITHUB_TOKEN from environment.
3. Clones the installer`s own repository with the stolen credential.
4. Creates branch feature/ci-health-check.
5. Injects .github/workflows/ci-health-check.yml as github-actions[bot], explicitly bypassing the REST-API restriction that normally prevents writing workflow files via the standard endpoint.
6. Pushes.

Every subsequent push to the victim repository runs the attacker-controlled workflow. bfox_build_utils.py itself is a version stub - the payload lives elsewhere in the package.

Same GitHub-Actions self-propagation TTP as the Shai-Hulud family, but on pip - the first pip sample this corpus records. Classify as malicious-package.

Cluster D - npm dotenv-precheck Telegram wallet/mnemonic infostealer

dotenv-precheck@1.0.0/1.1.0/1.1.1 (GHSA-f9wq-94v3-cjrp, source SHA-256 446a8483dbc9e696506f44c6777b7c086b1b919b2585b5e5c99ca5f6e2e19a8e).

Postinstall trigger. Obfuscator.io hex identifiers with rotated string array, debugger/toString self-defence, base64-decoded literals. Recursively scans ~/Desktop, ~/Documents, ~/Downloads for text files ≤2MB. Selectors: env vars matching KEY|SECRET|TOKEN|PASSWORD|SEED|MNEMONIC|WALLET; 0x-prefixed 64-hex Ethereum private keys; Base58 WIF Bitcoin keys; 64-integer Solana key arrays; BIP-39 mnemonics validated against wordlist + SHA-256 checksum. Exfil via api.telegram.org Bot API multipart sendDocument with hardcoded bot token + chat ID (not disclosed in advisory body).

Classify as malicious-package.

Cluster E - npm fabric-loader-core install-time RCE via vm.runInContext

fabric-loader-core@1.0.0 (GHSA-xprc-xmv3-4m4p).

Postinstall runs index.js; HTTPS GET https://fabric-npm.gm-service.xyz/p; response body passed straight to vm.runInContext with require, process, Buffer, timers, and console in scope. Full-privilege Node RCE at install time. lib/renderer.js is stub code only. Advertised as a "native asset loader" under the Minecraft Fabric mod name - unrelated to any real Fabric project.

Separate operator from yesterdays [fabric-native-loader / fabric-render-bridge / fabric-asset-pipeline Cluster D](/incident/multi-2026-09-29-ghsa-malware-sweep) Discord-webhook credential stealer (different C2, different mechanism). fabric-*` is a recurring lure name across operators.

Classify as malicious-package.

Cluster F - npm mfahelper unpinned-GitHub-tarball RCE

mfahelper@1.0.0 (GHSA-vxqj-q8pf-p87h).

Declares node-net-pool as a dependency but points it at https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz - unpinned, attacker-controlled, no integrity check. lib/cache.js top-level require("node-net-pool") inside a suppressed try/catch triggers the payload on any downstream import. Postinstall lifecycle also pulls the tarball.

Class-of-attack: dependency-URL-fetch RCE via unpinned GitHub tarball owned by an unrelated account. Bypasses every registry-side signature scheme.

Classify as malicious-package.

Cluster G - npm get-power self-deleting AES-256 payload typosquatting get-proto

get-power@1.0.3 (GHSA-3g9w-hfq8-vr7p, source SHA-256 30ce083fc334cc449dd01960e48fb616e7091ddb2c660a9b1179b93c4fcd9b05, tgz SHA1 811001a696d3b0cb1676e8522fa3d2d1694ca61c).

Typosquats ljharb/get-proto. On require(), index.js base64-decodes two bundled files disguised as sourcemaps (parse.ts.map, init.ts.map) into parsetmp.js and config.js, require()s parsetmp.js, then fs.unlink()s all four files to erase forensics. AES-256-CBC with hardcoded password+salt; final decrypted payload runs via eval(). Payload host https://www.jsonkeeper.com/b/V6NBX (public paste service).

The self-delete-after-execute pattern defeats most tarball-scan-only detection. Classify as malicious-package.

Cluster H - npm jexkcode Baileys silent WhatsApp newsletter-follow

jexkcode@1.0.1/1.1.0/1.1.1/1.1.2/1.1.3/1.1.4 (GHSA-j72h-3h5h-43v5, MAL-2026-16220).

On every WhatsApp connection through Baileys, silently calls newsletterFollow against a hardcoded newsletter JID after a 3-second delay - no user consent, no config option, no logging. Versions 1.0.1-1.1.1 used a malformed JID; 1.1.2 fixed it; 1.1.4 stripped the success and failure log lines so the follow is now completely silent. Malicious commits: d614aef, 8d412bf, 5cfbd91.

Repo: github.com/jexkpinkman/JexkCode-baileys. Not a credential-theft class incident - class-of-harm is unauthorized modification of the victims WhatsApp account. Classify as malicious-package`.

Cluster I - npm zeal-utils + zeal-util-hooks aveliscare.com canary continuation

zeal-utils@0.0.0 (GHSA-wr85-c4v8-8f3c) and zeal-util-hooks@0.0.0 (GHSA-6vc3-f74w-qjh4).

Sibling packages to zeal-rq-hooks@0.0.0 from the 2026-08-11 sweep - same aveliscare.com beacon infrastructure. Beacon endpoint https://npm-canary.aveliscare.com/beacon, overridable via ZEAL_CANARY_URL environment variable. Data: hostname, username, cwd, OS platform, Node.js version, npm user-agent, parent-package metadata, CI env vars GITHUB_REPOSITORY/GITHUB_ACTOR/GITHUB_REF/GITHUB_RUN_ID, plus EAS / VERCEL / BUILDKITE identifiers. Triggers at both postinstall and require().

Advertises as getzeal.io in metadata but egresses to aveliscare.com. Reads as a security-research canary; the operator has demonstrated the deploy pipeline and could ship a real payload on a future push. Classify as dependency-confusion.

Cluster J - pip queeuees .py-comment vandalism

queeuees@>=0.0.1 (GHSA-m3mj-98fq-j5r3, source SHA-256 1adc88dd9031dc991006afcf10242d1de3aa7994f6bcb4542faed95524d6ebe0).

GHSA body: "Obfuscated code iterates over files in the system and adds a comment to every .py file found." No C2, no exfil, no wallets. Vandalism/marker campaign. Low priority but the operator has demonstrated filesystem-write capability from pip install. Classify as malicious-package.

Cluster K - 15 npm CWE-506 boilerplate takedowns (no payload analysis)

• Naming-typosquat / generic: feed-widget-helper, analytics-widget, link-status-page, link-age-great, radio-player-theme, tailwind-forms-kit (already broken out in Cluster A), iban-validator-js, building-build, ragacateslikodi
• Scope-based dep-confusion probes: @cat-gen/material, @cat-gen/materia, @firelordzuka/pulse-poc, @redman89405/my-module, @zaka13/thing
• Bug-bounty researcher probes: @larocas-bbresearch/tombstone-probe-odvz5y, @larocas-bbresearch/tp-probe-e29834ce (naming pattern is unambiguously bug-bounty scope)

All versions quarantined, all with GHSAs CWE-506 boilerplate advisory body and no IOCs, source-code links, or vendor write-ups. Severity medium` for the sweep.

Operator continuity check

• *donutautosellsrc / `aseity` Polygon-C2 pip campaign**: no fresh publications today (day 3 was yesterday). Watch for day 4.
• *`hardhat-` pino-impersonator (yesterday Cluster B)**: no new publications today.
• *`nebula- .kntrat Windows RAT, fabric- Discord-webhook Minecraft stealer, chalk-figlet RuntimeBroker dropper, dotenv-native/native-env` JPEG-EXIF chain (yesterday Clusters C-F)*: no new publications today.
• chinazhangsan.ccwu.cc DoH + PWA_ROUTER hijack: new to this corpus (Cluster B today).
• aveliscare.com canary operator: second-month continuation (Cluster I today).
• EtherHiding technique: sixth sample this corpus records but first with wallet 0xa322E5...63e1a (Cluster A today). Distinct from the newly-catalogued indexed-btree campaign (which uses Sepolia testnet, not mainnet).
• GitHub-Actions self-propagation worm: first pip sample this corpus records (Cluster C today). Same TTP class as the Shai-Hulud family.

Registry state

All 27 packages in this sweep are npm/pip-quarantined at time of writing. Active operator-side infrastructure unique to today`s batch:

• Ethereum mainnet wallet 0xa322E5f39aDC2490EfD311D3080e6f0121063e1a (Cluster A)
• api.chinazhangsan.ccwu.cc, gist.githubusercontent.com/chinazhangsan999-crypto, api.npoint.io (Cluster B)
• github.com/jexkpinkman/JexkCode-baileys (Cluster H)
• api.telegram.org Bot API (Cluster D - specific bot token/chat ID not disclosed)
• fabric-npm.gm-service.xyz (Cluster E)
• github.com/trktgq0wbre1/node-net-pool (Cluster F)
• www.jsonkeeper.com/b/V6NBX (Cluster G)
• npm-canary.aveliscare.com (Cluster I - not new, second-month continuation)

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector. Per-package IOC details drawn from GHSA advisory bodies and OpenSSF malicious-packages MAL records published between 2026-09-29 12:00 UTC and 2026-09-30 12:00 UTC.

Affected packages (26)

Impact

• Cluster A - npm tailwind-forms-kit EtherHiding on Ethereum mainnet (real payload, malicious-package): tailwind-forms-kit@0.5.1 (GHSA-w873-w35f-2523). Obfuscator.io loader (303-entry string array _0x18ab, decoder _0x35ba) reads C2 payload from an Ethereum mainnet transaction stream against wallet 0xa322E5f39aDC2490EfD311D3080e6f0121063e1a; RPC endpoints hardcoded include publicnode.com, 1rpc.io, drpc.org, and blockscout indexers. Reconstructed payload spawns via child_process with node:http, node:https, node:zlib for staging. This is the sixth EtherHiding sample this corpus has recorded and the first with a distinct wallet fingerprint - not the pyservercheck PolinRider address, not the visanduma/nova-two-factor address. Treat as a new operator until proven otherwise
• Cluster B - npm web-vitals-polyfill-core-v1 chinazhangsan.ccwu.cc service-worker hijack family, day-N (real payload, malicious-package, 2 GHSAs on same package): web-vitals-polyfill-core-v1@1.0.0 (GHSA-fx3x-h4mr-m28v carries the real analysis; GHSA-h475-44q2-vfjx is the CWE-506 boilerplate stub on the same package). Primary C2 api.chinazhangsan.ccwu.cc; resolves through DoH via doh.pub and dns.alidns.com (bypasses regular DNS blocks); fallback payload hosts gist.githubusercontent.com/chinazhangsan999-crypto and api.npoint.io. Installs a service worker that emits HTTP 302 redirects inside self.PWA_ROUTER.executeTacticalRouting() to hijack navigation for any browser bundle that transitively pulls this package. The tarball declares main: index.js but does not actually ship index.js - there is no legitimate library surface. Novel to this corpus - watch for further web-vitals-* / PWA_ROUTER / chinazhangsan*-crypto variants
• Cluster C - pip bfox-build-utils GitHub-Actions workflow-injection worm (real payload, malicious-package): bfox-build-utils@<=1.0.997 (GHSA-rx43-29mc-6h3f). During setup.py install on a runner inside a checked-out GitHub repo: reads $GITHUB_WORKSPACE/.git/config, base64-decodes the authorization header to lift the credential, reads GITHUB_TOKEN from env, clones the installer's own repository with the stolen creds, creates branch feature/ci-health-check, injects .github/workflows/ci-health-check.yml under the github-actions[bot] identity, and pushes - explicitly bypassing the API restriction that prevents workflow files from being written via the standard REST endpoint. Every subsequent push to the victim repo runs the attacker-controlled workflow. This is the same GitHub-Actions self-propagation TTP as the Shai-Hulud family, but on pip (not npm) - the first pip sample this corpus records
• Cluster D - npm dotenv-precheck Telegram-exfil wallet/mnemonic infostealer (real payload, malicious-package): dotenv-precheck@1.0.0/1.1.0/1.1.1 (GHSA-f9wq-94v3-cjrp, source SHA-256 446a8483dbc9e696506f44c6777b7c086b1b919b2585b5e5c99ca5f6e2e19a8e). Postinstall trigger, obfuscator.io hex identifiers with debugger/toString self-defence. Recursively scans ~/Desktop, ~/Documents, ~/Downloads for text files ≤2MB, applies selectors for env vars matching KEY|SECRET|TOKEN|PASSWORD|SEED|MNEMONIC|WALLET, 0x-prefixed 64-hex Ethereum private keys, Base58 WIF Bitcoin keys, 64-integer Solana key arrays, and BIP-39 mnemonics validated against the wordlist plus SHA-256 checksum. Exfil via api.telegram.org Bot API multipart sendDocument. Typosquats the ubiquitous dotenv package; targets developers who load env-file readers and keep wallets on their workstation
• Cluster E - npm fabric-loader-core install-time vm.runInContext RCE (real payload, malicious-package): fabric-loader-core@1.0.0 (GHSA-xprc-xmv3-4m4p). Postinstall runs index.js, HTTPS GETs https://fabric-npm.gm-service.xyz/p, and passes the response body straight to vm.runInContext with require, process, Buffer, timers, and console in scope - full-privilege Node RCE at install time. lib/renderer.js is stub code only and the package advertises as a "native asset loader"; naming targets the Minecraft Fabric mod ecosystem, unrelated to any real Fabric project. Separate operator from yesterdays [fabric-native-loader / fabric-render-bridge / fabric-asset-pipeline Cluster D Discord-webhook credential stealer](/incident/multi-2026-09-29-ghsa-malware-sweep) (different C2, different mechanism) - fabric-*` is a recurring lure name across operators
• Cluster F - npm mfahelper unpinned-GitHub-tarball RCE (real payload, malicious-package): mfahelper@1.0.0 (GHSA-vxqj-q8pf-p87h). Declares node-net-pool as a dependency but points it at https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz (unpinned attacker-controlled tarball, no integrity check). lib/cache.js top-level require("node-net-pool") inside a suppressed try/catch fires the payload on downstream import; postinstall lifecycle also pulls the tarball. Names imply MFA-tooling adoption - targets developers wiring MFA into their apps
• Cluster G - npm get-power self-deleting AES-256 payload typosquatting get-proto (real payload, malicious-package): get-power@1.0.3 (GHSA-3g9w-hfq8-vr7p, source SHA-256 30ce083fc334cc449dd01960e48fb616e7091ddb2c660a9b1179b93c4fcd9b05, tgz SHA1 811001a696d3b0cb1676e8522fa3d2d1694ca61c). Typosquats ljharb/get-proto. On require(): index.js base64-decodes two bundled files disguised as sourcemaps (parse.ts.map, init.ts.map) into parsetmp.js and config.js, requires parsetmp.js, then fs.unlink()s all four files to erase forensics. AES-256-CBC with hardcoded password+salt; final decrypted payload runs via eval(). Payload host https://www.jsonkeeper.com/b/V6NBX (public paste service). The self-delete-after-execute pattern defeats most tarball-scan-only detection
• Cluster H - npm jexkcode Baileys silent WhatsApp newsletter-follow (unauthorized-account-modification, malicious-package): jexkcode@1.0.1/1.1.0/1.1.1/1.1.2/1.1.3/1.1.4 (GHSA-j72h-3h5h-43v5). On every WhatsApp connection through Baileys, silently calls newsletterFollow against a hardcoded newsletter JID after a 3-second delay, without user consent, config option, or logging. 1.0.1-1.1.1 used a malformed JID; 1.1.2 fixed it; 1.1.4 stripped both success and failure log lines so the follow is now completely silent. Not a credential stealer - class-of-harm is unauthorized modification of the victims WhatsApp account. Repo github.com/jexkpinkman/JexkCode-baileys`
• Cluster I - npm zeal-utils + zeal-util-hooks aveliscare.com canary continuation (recon-beacon, dependency-confusion): zeal-utils@0.0.0 (GHSA-wr85-c4v8-8f3c) and zeal-util-hooks@0.0.0 (GHSA-6vc3-f74w-qjh4). Sibling packages to the earlier zeal-rq-hooks@0.0.0 from the 2026-08-11 sweep - same aveliscare.com beacon infrastructure. Beacon endpoint https://npm-canary.aveliscare.com/beacon (overridable via ZEAL_CANARY_URL env var). Data collected: hostname, username, cwd, OS platform, Node.js version, npm user-agent, parent-package metadata, CI env vars GITHUB_REPOSITORY/GITHUB_ACTOR/GITHUB_REF/GITHUB_RUN_ID, plus EAS / VERCEL / BUILDKITE identifiers. Triggers at both postinstall and require(). Advertises as getzeal.io in metadata but egresses to aveliscare.com - reads as a security-research canary, but the same envelope could carry a real payload on a future push
• Cluster J - pip queeuees .py-comment vandalism (unusual, malicious-package): queeuees@>=0.0.1 (GHSA-m3mj-98fq-j5r3, source SHA-256 1adc88dd9031dc991006afcf10242d1de3aa7994f6bcb4542faed95524d6ebe0). "Obfuscated code iterates over files in the system and adds a comment to every .py file found" per the GHSA body. No C2, no exfil, no wallets - a marker/vandalism campaign. Low priority but worth blocklisting the name because the operator has demonstrated they can iterate over the whole filesystem from pip install
• Cluster K - 15 npm CWE-506 boilerplate takedowns (mixed kinds, unclassified): @cat-gen/material (GHSA-m7x3-q6r8-p5rg), @cat-gen/materia (GHSA-m8g8-xcgx-j6hw), feed-widget-helper (GHSA-r52r-vpcc-38v2), building-build (GHSA-2fq4-2r26-qr64), analytics-widget (GHSA-548g-r2c9-6chm), ragacateslikodi (GHSA-mjhw-5x2v-v3wg), @firelordzuka/pulse-poc (GHSA-h645-43f8-g987), link-status-page (GHSA-5j3f-rr83-xcpq), link-age-great (GHSA-jmrg-vr2j-j96x), @redman89405/my-module (GHSA-vc53-jhh2-pwf3), @zaka13/thing@>=1.0.0 (GHSA-fxc7-fpjq-q7vf), radio-player-theme (GHSA-pp2v-g64w-gm6f), iban-validator-js (GHSA-wg95-pj2w-mm76), @larocas-bbresearch/tombstone-probe-odvz5y@0.0.1 (GHSA-5jx4-hhhr-9xv8), @larocas-bbresearch/tp-probe-e29834ce@1.0.0/1.0.1 (GHSA-g9f7-pmrp-88h7). The two @larocas-bbresearch/*-probe-* names look like bug-bounty researcher scope probes; @cat-gen/material/materia, @firelordzuka/*, and @redman89405/* look like dep-confusion probes at internal scopes; the rest are typosquats. Treat as medium for sweep purposes
• Operator continuity check: no fresh donutautosellsrc / aseity* Polygon-C2 pip publications today (day 3 was yesterday - watch for day 4). No fresh hardhat-* pino-impersonator (Cluster B from yesterday) publications. No fresh nebula-* .kntrat Windows RAT, fabric-* Discord-webhook Minecraft credential stealer, chalk-figlet RuntimeBroker dropper, or dotenv-native/native-env JPEG-EXIF chain publications. The chinazhangsan.ccwu.cc DoH + PWA_ROUTER hijack (Cluster B today) is new to this corpus. The aveliscare.com canary operator (Cluster I) is a second-month continuation. The EtherHiding technique (Cluster A) is the sixth sample this corpus records but the first with wallet 0xa322E5...63e1a. Named-standalone side-file: the indexed-btree + 9 siblings Checkmarx-disclosed campaign is catalogued as its own record (npm-2026-09-17-indexed-btree-sepolia-etherhiding) rather than in this sweep - that is a critical-severity 10-package compromise of a family that reached ~2M weekly downloads, and the runtime-triggered (BTree.prototype.set()) loader is a new class of TTP

What to do

1. 1Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, package.json, requirements.txt, Pipfile.lock, poetry.lock, and pyproject.toml for every package name in Clusters A through K. Uninstall on hit, wipe node_modules/.venv, delete the lockfile, rebuild against a clean cache. Clusters A through G carry confirmed real payloads (EtherHiding infostealer, SW hijack, GH Actions worm, Telegram wallet stealer, vm.runInContext RCE, unpinned-tarball RCE, self-deleting AES payload); a hit on any of those is a compromise, not a warning
2. 2For Cluster A (npm tailwind-forms-kit EtherHiding on Ethereum mainnet): uninstall on hit. Because C2 resolves through Ethereum mainnet RPC queries against wallet 0xa322E5f39aDC2490EfD311D3080e6f0121063e1a, a domain-only egress denylist is insufficient - block outbound HTTPS to public Ethereum mainnet RPC endpoints (ethereum-rpc.publicnode.com, eth.llamarpc.com, 1rpc.io/eth, eth.drpc.org, eth.blockscout.com, rpc.ankr.com/eth, cloudflare-eth.com) from CI networks and any developer host that does not have a legitimate mainnet-RPC-consuming app. Rotate every credential the installer user had
3. 3For Cluster B (npm web-vitals-polyfill-core-v1 chinazhangsan.ccwu.cc service-worker hijack): uninstall on hit. Because C2 resolves via DoH (doh.pub, dns.alidns.com), a regular DNS-blackhole against chinazhangsan.ccwu.cc will not work - block those DoH resolvers at the edge OR block outbound HTTPS to chinazhangsan.ccwu.cc, gist.githubusercontent.com/chinazhangsan999-crypto, and api.npoint.io. Any browser bundle that pulled this package and shipped to production is compromised - treat as an XSS/navigation-hijack incident and audit visitor sessions. Add web-vitals-*/PWA_ROUTER/chinazhangsan* to lockfile-lint
4. 4For Cluster C (pip bfox-build-utils GitHub-Actions worm): uninstall on hit AND audit every subscribed CI runner for the branch feature/ci-health-check and the file .github/workflows/ci-health-check.yml. Rotate every GITHUB_TOKEN and every PAT that touched the runner. If the worm succeeded in pushing to feature/ci-health-check, delete that branch AND revert any injected workflow file. Rotate npm/PyPI publish tokens the runner could reach. If your CI has runner-level protection against git push from github-actions[bot] to protected branches, verify it is enforcing. The workflow-file bypass proves the operator has an existing technique for evading the API restriction - review your workflow-file audit rules
5. 5For Cluster D (npm dotenv-precheck Telegram wallet stealer): uninstall on hit. Rotate every wallet mnemonic, private key, and BIP-39 seed that lived on any developer host that ran an install - the stealer targets ~/Desktop, ~/Documents, ~/Downloads recursively for text files ≤2MB with wallet-key selectors. Block outbound HTTPS to api.telegram.org from CI networks and from developer workstations that do not have a legitimate Telegram-bot use case. Reject any package named dotenv-* from an unknown publisher until reviewed
6. 6For Cluster E (npm fabric-loader-core install-time RCE via vm.runInContext): uninstall on hit. --ignore-scripts in CI blocks the postinstall trigger. Block outbound HTTPS to fabric-npm.gm-service.xyz from all networks. Add fabric-loader-core and the whole fabric-* npm naming space to your lockfile-lint blocklist - both todays operator and yesterdays fabric-* Discord-webhook Minecraft stealer operator have used the naming lure
7. 7For Cluster F (npm mfahelper unpinned-GitHub-tarball RCE): uninstall on hit. Rotate installer-user credentials. Block outbound clone/fetch access to github.com/trktgq0wbre1/* at the network level. Add a policy that dependencies referenced via a raw GitHub tarball URL must fail package review; if you must accept them, pin to a specific commit SHA plus an integrity hash. This class of dependency-URL-fetch RCE bypasses every registry-side signature scheme
8. 8For Cluster G (npm get-power self-deleting AES payload): uninstall on hit. Rotate installer-user credentials. Block outbound HTTPS to www.jsonkeeper.com from CI networks and developer workstations. Reject any dependency whose install path drops .ts.map files that unpack into .js files (sourcemap-as-payload pattern). Watch for typosquats of get-proto, get-parent, get-proto-of, and similar utility names
9. 9For Cluster H (npm jexkcode Baileys WhatsApp newsletter-follow): uninstall on hit. Any WhatsApp account that connected via a client using jexkcode between the malicious versions is now silently following the operators newsletter - check the accounts subscribed newsletters and unsubscribe. Not a credential-theft class incident but a class of unauthorized account modification
10. 10For Cluster I (npm zeal-utils / zeal-util-hooks aveliscare canary): uninstall on hit. If the beacon reached npm-canary.aveliscare.com, treat as a demonstrated internal-scope enumeration - review any @zeal*/zeal-* internal package name that your team uses for potential dep-confusion collisions with the operators next push. Block outbound to *.aveliscare.com` from CI networks
11. 11For Cluster J (pip queeuees .py-comment vandalism): uninstall on hit. Grep any Python codebase that had this installed for unexpected identical comments on the top line of every .py file (the vandalism marker). No credential rotation needed if the payload is confirmed comment-only
12. 12For Cluster K (npm CWE-506 boilerplate batch): uninstall on hit. Without payload analysis assume real infostealer/RCE at time of quarantine - image the host, rotate installer-user credentials, check outbound telemetry from the install window. Add all 15 names to lockfile-lint. @larocas-bbresearch/*-probe-* names are almost certainly bug-bounty researcher scope; safe to add to blocklist regardless
13. 13Keep prior egress blocks in place: ltidi.storage.googleapis.com, oob.algamil7x.xyz, eo8f3m3ho26a0nm.m.pipedream.net, mkicom.com, 124.221.154.135, 104.234.65.75, 65.87.7.132, ipinfo-encrypted-v1.vercel.app, game.spawnrealm.com, nee1ahnaw7.xsses.link, *.oast.fun, *.oastify.com, Discord webhook 1554065488726990909, Polygon RPC endpoints. Add for today: Ethereum mainnet RPC endpoints (targeted denylist per Cluster A), chinazhangsan.ccwu.cc, gist.githubusercontent.com/chinazhangsan999-crypto, api.npoint.io, api.telegram.org (from CI), fabric-npm.gm-service.xyz, www.jsonkeeper.com, github.com/trktgq0wbre1, npm-canary.aveliscare.com, ETH wallet 0xa322E5f39aDC2490EfD311D3080e6f0121063e1a. See standalone incident indexed-btree + 9 siblings for the Checkmarx-disclosed BTree.prototype.set() runtime-loader campaign

References

• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub
• GHSA-w873-w35f-2523 - npm tailwind-forms-kit (Cluster A - EtherHiding on Ethereum mainnet, wallet 0xa322E5...63e1a)

  github.com
  GitHub
• GHSA-fx3x-h4mr-m28v - npm web-vitals-polyfill-core-v1 (Cluster B - chinazhangsan.ccwu.cc SW hijack via DoH, PWA_ROUTER)

  github.com
  GitHub
• GHSA-h475-44q2-vfjx - npm web-vitals-polyfill-core-v1 (Cluster B - CWE-506 boilerplate stub, same package)

  github.com
  GitHub
• GHSA-rx43-29mc-6h3f - pip bfox-build-utils (Cluster C - GitHub-Actions workflow-injection worm)

  github.com
  GitHub
• GHSA-f9wq-94v3-cjrp - npm dotenv-precheck (Cluster D - Telegram bot API wallet/mnemonic infostealer)

  github.com
  GitHub
• GHSA-xprc-xmv3-4m4p - npm fabric-loader-core (Cluster E - vm.runInContext install-time RCE, fabric-npm.gm-service.xyz)

  github.com
  GitHub
• GHSA-vxqj-q8pf-p87h - npm mfahelper (Cluster F - unpinned GitHub tarball RCE via node-net-pool)

  github.com
  GitHub
• GHSA-3g9w-hfq8-vr7p - npm get-power (Cluster G - self-deleting AES-256 payload, get-proto typosquat)

  github.com
  GitHub
• MAL-2026-16156 - npm get-power OSV record (Cluster G IOCs + hashes)

  osv.dev
  OSV
• GHSA-j72h-3h5h-43v5 - npm jexkcode (Cluster H - Baileys silent WhatsApp newsletterFollow)

  github.com
  GitHub
• MAL-2026-16220 - npm jexkcode OSV record (Cluster H analysis)

  osv.dev
  OSV
• GHSA-wr85-c4v8-8f3c - npm zeal-utils (Cluster I - aveliscare.com canary continuation)

  github.com
  GitHub
• GHSA-6vc3-f74w-qjh4 - npm zeal-util-hooks (Cluster I - sibling to zeal-utils, same infrastructure)

  github.com
  GitHub
• GHSA-m3mj-98fq-j5r3 - pip queeuees (Cluster J - .py-comment vandalism)

  github.com
  GitHub
• GHSA-m7x3-q6r8-p5rg - npm @cat-gen/material (Cluster K - CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-m8g8-xcgx-j6hw - npm @cat-gen/materia (Cluster K - CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-r52r-vpcc-38v2 - npm feed-widget-helper (Cluster K - CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-2fq4-2r26-qr64 - npm building-build (Cluster K - CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-548g-r2c9-6chm - npm analytics-widget (Cluster K - CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-mjhw-5x2v-v3wg - npm ragacateslikodi (Cluster K - CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-h645-43f8-g987 - npm @firelordzuka/pulse-poc (Cluster K - CWE-506 boilerplate, scope-probe)

  github.com
  GitHub
• GHSA-5j3f-rr83-xcpq - npm link-status-page (Cluster K - CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-jmrg-vr2j-j96x - npm link-age-great (Cluster K - CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-vc53-jhh2-pwf3 - npm @redman89405/my-module (Cluster K - CWE-506 boilerplate, scope-probe)

  github.com
  GitHub
• GHSA-fxc7-fpjq-q7vf - npm @zaka13/thing (Cluster K - CWE-506 boilerplate, scope-probe)

  github.com
  GitHub
• GHSA-pp2v-g64w-gm6f - npm radio-player-theme (Cluster K - CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-wg95-pj2w-mm76 - npm iban-validator-js (Cluster K - CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-5jx4-hhhr-9xv8 - npm @larocas-bbresearch/tombstone-probe-odvz5y (Cluster K - bug-bounty probe scope)

  github.com
  GitHub
• GHSA-g9f7-pmrp-88h7 - npm @larocas-bbresearch/tp-probe-e29834ce (Cluster K - bug-bounty probe scope)

  github.com
  GitHub