# GitHub Advisory malware sweep - 2026-09-29 (late) + 2026-09-30 (npm `tailwind-forms-kit` EtherHiding on Ethereum mainnet with wallet `0xa322E5...63e1a`; npm `web-vitals-polyfill-core-v1` chinazhangsan service-worker hijack via DoH + Sepolia-adjacent PWA_ROUTER; pip `bfox-build-utils` GitHub-Actions workflow-injection worm; npm `dotenv-precheck` Telegram wallet-mnemonic infostealer; npm `fabric-loader-core` install-time `vm.runInContext` RCE; npm `mfahelper` unpinned-GitHub-tarball RCE; npm `get-power` self-deleting AES payload typosquatting `get-proto`; npm `jexkcode` Baileys silent WhatsApp newsletter-follow; npm `zeal-utils`/`zeal-util-hooks` aveliscare canary continuation; pip `queeuees` .py-comment vandalism; 15 npm CWE-506 boilerplate takedowns)

> GHSA 2026-09-29 (late) + 2026-09-30: 27 new advisories - 25 npm + 2 pip. Cluster A is a fresh EtherHiding sample (`tailwind-forms-kit`, ETH wallet `0xa322E5...63e1a`) on Ethereum mainnet RPCs. Cluster B extends the `chinazhangsan.ccwu.cc` service-worker hijack family (`web-vitals-polyfill-core-v1`) using DoH lookups. Cluster C is a pip GitHub-Actions worm (`bfox-build-utils`) that self-installs `.github/workflows/ci-health-check.yml`. Clusters D-J are single-package droppers, stealers, and canaries; Cluster K is 15 CWE-506 boilerplate takedowns with no analysis.

- Published: 2026-09-30
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 26 packages, 34 compromised versions
- Tags: infostealer, credential-theft, obfuscation, typosquat, dependency-confusion, ci-cd-compromise, crypto-wallet-drain, worm, dormant-domain
- Also known as: 2026-09-30 GHSA npm+pip sweep, tailwind-forms-kit npm EtherHiding Ethereum mainnet wallet 0xa322E5...63e1a, web-vitals-polyfill-core-v1 npm chinazhangsan.ccwu.cc service-worker hijack via DoH, bfox-build-utils pip GitHub-Actions workflow-injection worm, dotenv-precheck npm Telegram bot API wallet mnemonic infostealer, fabric-loader-core npm vm.runInContext install-time RCE, mfahelper npm unpinned GitHub tarball RCE node-net-pool, get-power npm self-deleting AES-256 get-proto typosquat, jexkcode npm Baileys silent WhatsApp newsletterFollow, zeal-utils zeal-util-hooks npm aveliscare canary continuation, queeuees pip .py-comment vandalism
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector
- Incident ID: multi-2026-09-30-ghsa-malware-sweep

## Affected packages (26)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@cat-gen/materia](https://dependencywatch.io/package/npm/@cat-gen/materia) | npm | * |
| [@cat-gen/material](https://dependencywatch.io/package/npm/@cat-gen/material) | npm | * |
| [@firelordzuka/pulse-poc](https://dependencywatch.io/package/npm/@firelordzuka/pulse-poc) | npm | * |
| [@larocas-bbresearch/tombstone-probe-odvz5y](https://dependencywatch.io/package/npm/@larocas-bbresearch/tombstone-probe-odvz5y) | npm | 0.0.1 |
| [@larocas-bbresearch/tp-probe-e29834ce](https://dependencywatch.io/package/npm/@larocas-bbresearch/tp-probe-e29834ce) | npm | 1.0.0, 1.0.1 |
| [@redman89405/my-module](https://dependencywatch.io/package/npm/@redman89405/my-module) | npm | * |
| [@zaka13/thing](https://dependencywatch.io/package/npm/@zaka13/thing) | npm | 1.0.0 |
| [analytics-widget](https://dependencywatch.io/package/npm/analytics-widget) | npm | * |
| [bfox-build-utils](https://dependencywatch.io/package/pypi/bfox-build-utils) | PyPI | 1.0.997 |
| [building-build](https://dependencywatch.io/package/npm/building-build) | npm | * |
| [dotenv-precheck](https://dependencywatch.io/package/npm/dotenv-precheck) | npm | 1.0.0, 1.1.0, 1.1.1 |
| [fabric-loader-core](https://dependencywatch.io/package/npm/fabric-loader-core) | npm | 1.0.0 |
| [feed-widget-helper](https://dependencywatch.io/package/npm/feed-widget-helper) | npm | * |
| [get-power](https://dependencywatch.io/package/npm/get-power) | npm | 1.0.3 |
| [iban-validator-js](https://dependencywatch.io/package/npm/iban-validator-js) | npm | * |
| [jexkcode](https://dependencywatch.io/package/npm/jexkcode) | npm | 1.0.1, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4 |
| [link-age-great](https://dependencywatch.io/package/npm/link-age-great) | npm | * |
| [link-status-page](https://dependencywatch.io/package/npm/link-status-page) | npm | * |
| [mfahelper](https://dependencywatch.io/package/npm/mfahelper) | npm | 1.0.0 |
| [queeuees](https://dependencywatch.io/package/pypi/queeuees) | PyPI | 0.0.1 |
| [radio-player-theme](https://dependencywatch.io/package/npm/radio-player-theme) | npm | * |
| [ragacateslikodi](https://dependencywatch.io/package/npm/ragacateslikodi) | npm | * |
| [tailwind-forms-kit](https://dependencywatch.io/package/npm/tailwind-forms-kit) | npm | 0.5.1 |
| [web-vitals-polyfill-core-v1](https://dependencywatch.io/package/npm/web-vitals-polyfill-core-v1) | npm | 1.0.0 |
| [zeal-util-hooks](https://dependencywatch.io/package/npm/zeal-util-hooks) | npm | 0.0.0 |
| [zeal-utils](https://dependencywatch.io/package/npm/zeal-utils) | npm | 0.0.0 |

## What happened

Between roughly 2026-09-29 12:00 UTC and 2026-09-30 12:00 UTC, the GitHub Advisory Database (with the OpenSSF malicious-packages bulk export, Amazon Inspector`s IN-MAL feed, and kam193/bad-packages) published 27 new malware advisories: 25 npm and 2 pip. The defensively noteworthy shape of this window: one fresh EtherHiding sample on Ethereum mainnet under a new wallet fingerprint (`tailwind-forms-kit`), a new-to-corpus service-worker hijack family using DoH resolution (`web-vitals-polyfill-core-v1`), a first-of-kind GitHub-Actions workflow-injection worm on pip (`bfox-build-utils`), a Telegram-exfil wallet stealer (`dotenv-precheck`), two distinct install-time RCE vehicles (`fabric-loader-core` via `vm.runInContext`, `mfahelper` via unpinned-tarball fetch), a self-deleting AES payload typosquat (`get-power`), a silent WhatsApp newsletter-follow (`jexkcode`), and continuation of the `aveliscare.com` canary operator (`zeal-utils`/`zeal-util-hooks`).

A separate named-standalone side-file, [`npm-2026-09-17-indexed-btree-sepolia-etherhiding`](https://dependencywatch.io/incident/npm-2026-09-17-indexed-btree-sepolia-etherhiding), catalogues the Checkmarx-disclosed 10-package `charlessadler25` campaign (`indexed-btree` and 9 siblings, ~2M weekly downloads at peak, runtime-triggered loader in `BTree.prototype.set()`, Ethereum Sepolia smart-contract C2, Slack + Telegram exfil, ~109 ETH in attacker wallet). That is a `critical`-severity `malicious-package` compromise of a family with real reach; it is not part of this sweep.

## Cluster A - npm `tailwind-forms-kit` EtherHiding on Ethereum mainnet (fresh wallet)

`tailwind-forms-kit@0.5.1` (GHSA-w873-w35f-2523). Obfuscator.io loader: 303-entry string array `_0x18ab`, decoder function `_0x35ba`, `node:http`, `node:https`, `node:zlib`, `node:child_process`. Reads C2 endpoint from Ethereum mainnet transaction stream against wallet `0xa322E5f39aDC2490EfD311D3080e6f0121063e1a`. Public RPC endpoints hardcoded: `publicnode.com`, `1rpc.io`, `drpc.org`, and blockscout indexers.

Sixth EtherHiding sample this corpus has recorded; first with this wallet. Distinct from `pyservercheck` (2026-09-01 sweep), the `visanduma/nova-two-factor` Packagist compromise (2026-09-17), and the newly-catalogued `indexed-btree` campaign (which uses Sepolia testnet). Classify as `malicious-package`.

## Cluster B - npm `web-vitals-polyfill-core-v1` chinazhangsan.ccwu.cc service-worker hijack via DoH

`web-vitals-polyfill-core-v1@1.0.0` has two GHSAs on the same package: GHSA-fx3x-h4mr-m28v carries the real analysis; GHSA-h475-44q2-vfjx is the CWE-506 boilerplate stub.

Primary C2 `api.chinazhangsan.ccwu.cc`; DoH resolvers `doh.pub`, `dns.alidns.com` (bypasses standard DNS blackholes); fallback payload hosts `gist.githubusercontent.com/chinazhangsan999-crypto` and `api.npoint.io`. The package installs a service worker; the service worker emits HTTP 302 redirects inside `self.PWA_ROUTER.executeTacticalRouting()` to hijack browser navigation. `package.json` declares `main: index.js` but the tarball does not ship `index.js` - no legitimate library surface, just the SW hijack payload in `disk/index.min.js`.

New to this corpus. Novel indicators to watch: `chinazhangsan*` naming, `PWA_ROUTER` global, DoH-lookup C2 resolution. Classify as `malicious-package`.

## Cluster C - pip `bfox-build-utils` GitHub-Actions workflow-injection worm

`bfox-build-utils@<=1.0.997` (GHSA-rx43-29mc-6h3f). During `setup.py install` on a runner inside a checked-out GitHub repository:

1. Reads `$GITHUB_WORKSPACE/.git/config` and base64-decodes the `Authorization` header to lift the runner`s stored GitHub credential.
2. Reads `GITHUB_TOKEN` from environment.
3. Clones the installer`s own repository with the stolen credential.
4. Creates branch `feature/ci-health-check`.
5. Injects `.github/workflows/ci-health-check.yml` as `github-actions[bot]`, **explicitly bypassing the REST-API restriction that normally prevents writing workflow files via the standard endpoint**.
6. Pushes.

Every subsequent push to the victim repository runs the attacker-controlled workflow. `bfox_build_utils.py` itself is a version stub - the payload lives elsewhere in the package.

Same GitHub-Actions self-propagation TTP as the Shai-Hulud family, but on pip - the first pip sample this corpus records. Classify as `malicious-package`.

## Cluster D - npm `dotenv-precheck` Telegram wallet/mnemonic infostealer

`dotenv-precheck@1.0.0`/`1.1.0`/`1.1.1` (GHSA-f9wq-94v3-cjrp, source SHA-256 `446a8483dbc9e696506f44c6777b7c086b1b919b2585b5e5c99ca5f6e2e19a8e`).

Postinstall trigger. Obfuscator.io hex identifiers with rotated string array, debugger/toString self-defence, base64-decoded literals. Recursively scans `~/Desktop`, `~/Documents`, `~/Downloads` for text files ≤2MB. Selectors: env vars matching `KEY|SECRET|TOKEN|PASSWORD|SEED|MNEMONIC|WALLET`; `0x`-prefixed 64-hex Ethereum private keys; Base58 WIF Bitcoin keys; 64-integer Solana key arrays; BIP-39 mnemonics validated against wordlist + SHA-256 checksum. Exfil via `api.telegram.org` Bot API multipart `sendDocument` with hardcoded bot token + chat ID (not disclosed in advisory body).

Classify as `malicious-package`.

## Cluster E - npm `fabric-loader-core` install-time RCE via `vm.runInContext`

`fabric-loader-core@1.0.0` (GHSA-xprc-xmv3-4m4p).

Postinstall runs `index.js`; HTTPS GET `https://fabric-npm.gm-service.xyz/p`; response body passed straight to `vm.runInContext` with `require`, `process`, `Buffer`, `timers`, and `console` in scope. Full-privilege Node RCE at install time. `lib/renderer.js` is stub code only. Advertised as a "native asset loader" under the Minecraft Fabric mod name - unrelated to any real Fabric project.

Separate operator from yesterday`s [`fabric-native-loader` / `fabric-render-bridge` / `fabric-asset-pipeline` Cluster D](https://dependencywatch.io/incident/multi-2026-09-29-ghsa-malware-sweep) Discord-webhook credential stealer (different C2, different mechanism). `fabric-*` is a recurring lure name across operators.

Classify as `malicious-package`.

## Cluster F - npm `mfahelper` unpinned-GitHub-tarball RCE

`mfahelper@1.0.0` (GHSA-vxqj-q8pf-p87h).

Declares `node-net-pool` as a dependency but points it at `https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz` - unpinned, attacker-controlled, no integrity check. `lib/cache.js` top-level `require("node-net-pool")` inside a suppressed try/catch triggers the payload on any downstream import. Postinstall lifecycle also pulls the tarball.

Class-of-attack: dependency-URL-fetch RCE via unpinned GitHub tarball owned by an unrelated account. Bypasses every registry-side signature scheme.

Classify as `malicious-package`.

## Cluster G - npm `get-power` self-deleting AES-256 payload typosquatting `get-proto`

`get-power@1.0.3` (GHSA-3g9w-hfq8-vr7p, source SHA-256 `30ce083fc334cc449dd01960e48fb616e7091ddb2c660a9b1179b93c4fcd9b05`, tgz SHA1 `811001a696d3b0cb1676e8522fa3d2d1694ca61c`).

Typosquats `ljharb/get-proto`. On `require()`, `index.js` base64-decodes two bundled files disguised as sourcemaps (`parse.ts.map`, `init.ts.map`) into `parsetmp.js` and `config.js`, `require()`s `parsetmp.js`, then `fs.unlink()`s all four files to erase forensics. AES-256-CBC with hardcoded password+salt; final decrypted payload runs via `eval()`. Payload host `https://www.jsonkeeper.com/b/V6NBX` (public paste service).

The self-delete-after-execute pattern defeats most tarball-scan-only detection. Classify as `malicious-package`.

## Cluster H - npm `jexkcode` Baileys silent WhatsApp newsletter-follow

`jexkcode@1.0.1`/`1.1.0`/`1.1.1`/`1.1.2`/`1.1.3`/`1.1.4` (GHSA-j72h-3h5h-43v5, MAL-2026-16220).

On every WhatsApp connection through Baileys, silently calls `newsletterFollow` against a hardcoded newsletter JID after a 3-second delay - no user consent, no config option, no logging. Versions 1.0.1-1.1.1 used a malformed JID; 1.1.2 fixed it; 1.1.4 stripped the success and failure log lines so the follow is now completely silent. Malicious commits: `d614aef`, `8d412bf`, `5cfbd91`.

Repo: `github.com/jexkpinkman/JexkCode-baileys`. Not a credential-theft class incident - class-of-harm is unauthorized modification of the victim`s WhatsApp account. Classify as `malicious-package`.

## Cluster I - npm `zeal-utils` + `zeal-util-hooks` aveliscare.com canary continuation

`zeal-utils@0.0.0` (GHSA-wr85-c4v8-8f3c) and `zeal-util-hooks@0.0.0` (GHSA-6vc3-f74w-qjh4).

Sibling packages to [`zeal-rq-hooks@0.0.0` from the 2026-08-11 sweep](https://dependencywatch.io/incident/npm-2026-08-11-ghsa-malware-sweep) - same aveliscare.com beacon infrastructure. Beacon endpoint `https://npm-canary.aveliscare.com/beacon`, overridable via `ZEAL_CANARY_URL` environment variable. Data: hostname, username, cwd, OS platform, Node.js version, npm user-agent, parent-package metadata, CI env vars `GITHUB_REPOSITORY`/`GITHUB_ACTOR`/`GITHUB_REF`/`GITHUB_RUN_ID`, plus EAS / VERCEL / BUILDKITE identifiers. Triggers at both `postinstall` and `require()`.

Advertises as `getzeal.io` in metadata but egresses to `aveliscare.com`. Reads as a security-research canary; the operator has demonstrated the deploy pipeline and could ship a real payload on a future push. Classify as `dependency-confusion`.

## Cluster J - pip `queeuees` .py-comment vandalism

`queeuees@>=0.0.1` (GHSA-m3mj-98fq-j5r3, source SHA-256 `1adc88dd9031dc991006afcf10242d1de3aa7994f6bcb4542faed95524d6ebe0`).

GHSA body: "Obfuscated code iterates over files in the system and adds a comment to every .py file found." No C2, no exfil, no wallets. Vandalism/marker campaign. Low priority but the operator has demonstrated filesystem-write capability from `pip install`. Classify as `malicious-package`.

## Cluster K - 15 npm CWE-506 boilerplate takedowns (no payload analysis)

- Naming-typosquat / generic: `feed-widget-helper`, `analytics-widget`, `link-status-page`, `link-age-great`, `radio-player-theme`, `tailwind-forms-kit` (already broken out in Cluster A), `iban-validator-js`, `building-build`, `ragacateslikodi`
- Scope-based dep-confusion probes: `@cat-gen/material`, `@cat-gen/materia`, `@firelordzuka/pulse-poc`, `@redman89405/my-module`, `@zaka13/thing`
- Bug-bounty researcher probes: `@larocas-bbresearch/tombstone-probe-odvz5y`, `@larocas-bbresearch/tp-probe-e29834ce` (naming pattern is unambiguously bug-bounty scope)

All versions quarantined, all with GHSA`s CWE-506 boilerplate advisory body and no IOCs, source-code links, or vendor write-ups. Severity `medium` for the sweep.

## Operator continuity check

- **`donutautosellsrc` / `aseity*` Polygon-C2 pip campaign**: no fresh publications today (day 3 was yesterday). Watch for day 4.
- **`hardhat-*` pino-impersonator (yesterday Cluster B)**: no new publications today.
- **`nebula-*` `.kntrat` Windows RAT, `fabric-*` Discord-webhook Minecraft stealer, `chalk-figlet` RuntimeBroker dropper, `dotenv-native`/`native-env` JPEG-EXIF chain (yesterday Clusters C-F)**: no new publications today.
- **`chinazhangsan.ccwu.cc` DoH + PWA_ROUTER hijack**: new to this corpus (Cluster B today).
- **`aveliscare.com` canary operator**: second-month continuation (Cluster I today).
- **EtherHiding technique**: sixth sample this corpus records but first with wallet `0xa322E5...63e1a` (Cluster A today). Distinct from the newly-catalogued `indexed-btree` campaign (which uses Sepolia testnet, not mainnet).
- **GitHub-Actions self-propagation worm**: first pip sample this corpus records (Cluster C today). Same TTP class as the Shai-Hulud family.

## Registry state

All 27 packages in this sweep are npm/pip-quarantined at time of writing. Active operator-side infrastructure unique to today`s batch:

- Ethereum mainnet wallet `0xa322E5f39aDC2490EfD311D3080e6f0121063e1a` (Cluster A)
- `api.chinazhangsan.ccwu.cc`, `gist.githubusercontent.com/chinazhangsan999-crypto`, `api.npoint.io` (Cluster B)
- `github.com/jexkpinkman/JexkCode-baileys` (Cluster H)
- `api.telegram.org` Bot API (Cluster D - specific bot token/chat ID not disclosed)
- `fabric-npm.gm-service.xyz` (Cluster E)
- `github.com/trktgq0wbre1/node-net-pool` (Cluster F)
- `www.jsonkeeper.com/b/V6NBX` (Cluster G)
- `npm-canary.aveliscare.com` (Cluster I - not new, second-month continuation)

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector`. Per-package IOC details drawn from GHSA advisory bodies and OpenSSF malicious-packages MAL records published between 2026-09-29 12:00 UTC and 2026-09-30 12:00 UTC.

## Impact

- **Cluster A - npm `tailwind-forms-kit` EtherHiding on Ethereum mainnet (real payload, malicious-package)**: `tailwind-forms-kit@0.5.1` (GHSA-w873-w35f-2523). Obfuscator.io loader (303-entry string array `_0x18ab`, decoder `_0x35ba`) reads C2 payload from an Ethereum mainnet transaction stream against wallet `0xa322E5f39aDC2490EfD311D3080e6f0121063e1a`; RPC endpoints hardcoded include `publicnode.com`, `1rpc.io`, `drpc.org`, and blockscout indexers. Reconstructed payload spawns via `child_process` with `node:http`, `node:https`, `node:zlib` for staging. This is the sixth EtherHiding sample this corpus has recorded and the first with a distinct wallet fingerprint - not the [`pyservercheck` PolinRider](https://dependencywatch.io/incident/multi-2026-09-01-ghsa-malware-sweep) address, not the [`visanduma/nova-two-factor`](https://dependencywatch.io/incident/packagist-2026-09-17-visanduma-nova-two-factor-polinrider) address. Treat as a new operator until proven otherwise
- **Cluster B - npm `web-vitals-polyfill-core-v1` chinazhangsan.ccwu.cc service-worker hijack family, day-N (real payload, malicious-package, 2 GHSAs on same package)**: `web-vitals-polyfill-core-v1@1.0.0` (GHSA-fx3x-h4mr-m28v carries the real analysis; GHSA-h475-44q2-vfjx is the CWE-506 boilerplate stub on the same package). Primary C2 `api.chinazhangsan.ccwu.cc`; resolves through DoH via `doh.pub` and `dns.alidns.com` (bypasses regular DNS blocks); fallback payload hosts `gist.githubusercontent.com/chinazhangsan999-crypto` and `api.npoint.io`. Installs a service worker that emits HTTP 302 redirects inside `self.PWA_ROUTER.executeTacticalRouting()` to hijack navigation for any browser bundle that transitively pulls this package. The tarball declares `main: index.js` but does not actually ship `index.js` - there is no legitimate library surface. Novel to this corpus - watch for further `web-vitals-*` / `PWA_ROUTER` / `chinazhangsan*-crypto` variants
- **Cluster C - pip `bfox-build-utils` GitHub-Actions workflow-injection worm (real payload, malicious-package)**: `bfox-build-utils@<=1.0.997` (GHSA-rx43-29mc-6h3f). During `setup.py install` on a runner inside a checked-out GitHub repo: reads `$GITHUB_WORKSPACE/.git/config`, base64-decodes the authorization header to lift the credential, reads `GITHUB_TOKEN` from env, clones the installer's own repository with the stolen creds, creates branch `feature/ci-health-check`, injects `.github/workflows/ci-health-check.yml` under the `github-actions[bot]` identity, and pushes - **explicitly bypassing the API restriction that prevents workflow files from being written via the standard REST endpoint**. Every subsequent push to the victim repo runs the attacker-controlled workflow. This is the same GitHub-Actions self-propagation TTP as the Shai-Hulud family, but on pip (not npm) - the first pip sample this corpus records
- **Cluster D - npm `dotenv-precheck` Telegram-exfil wallet/mnemonic infostealer (real payload, malicious-package)**: `dotenv-precheck@1.0.0`/`1.1.0`/`1.1.1` (GHSA-f9wq-94v3-cjrp, source SHA-256 `446a8483dbc9e696506f44c6777b7c086b1b919b2585b5e5c99ca5f6e2e19a8e`). Postinstall trigger, obfuscator.io hex identifiers with debugger/toString self-defence. Recursively scans `~/Desktop`, `~/Documents`, `~/Downloads` for text files ≤2MB, applies selectors for env vars matching `KEY|SECRET|TOKEN|PASSWORD|SEED|MNEMONIC|WALLET`, `0x`-prefixed 64-hex Ethereum private keys, Base58 WIF Bitcoin keys, 64-integer Solana key arrays, and BIP-39 mnemonics validated against the wordlist plus SHA-256 checksum. Exfil via `api.telegram.org` Bot API multipart `sendDocument`. Typosquats the ubiquitous `dotenv` package; targets developers who load env-file readers and keep wallets on their workstation
- **Cluster E - npm `fabric-loader-core` install-time `vm.runInContext` RCE (real payload, malicious-package)**: `fabric-loader-core@1.0.0` (GHSA-xprc-xmv3-4m4p). Postinstall runs `index.js`, HTTPS GETs `https://fabric-npm.gm-service.xyz/p`, and passes the response body straight to `vm.runInContext` with `require`, `process`, `Buffer`, `timers`, and `console` in scope - full-privilege Node RCE at install time. `lib/renderer.js` is stub code only and the package advertises as a "native asset loader"; naming targets the Minecraft Fabric mod ecosystem, unrelated to any real Fabric project. Separate operator from yesterday`s [`fabric-native-loader` / `fabric-render-bridge` / `fabric-asset-pipeline` Cluster D Discord-webhook credential stealer](https://dependencywatch.io/incident/multi-2026-09-29-ghsa-malware-sweep) (different C2, different mechanism) - `fabric-*` is a recurring lure name across operators
- **Cluster F - npm `mfahelper` unpinned-GitHub-tarball RCE (real payload, malicious-package)**: `mfahelper@1.0.0` (GHSA-vxqj-q8pf-p87h). Declares `node-net-pool` as a dependency but points it at `https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz` (unpinned attacker-controlled tarball, no integrity check). `lib/cache.js` top-level `require("node-net-pool")` inside a suppressed try/catch fires the payload on downstream import; postinstall lifecycle also pulls the tarball. Names imply MFA-tooling adoption - targets developers wiring MFA into their apps
- **Cluster G - npm `get-power` self-deleting AES-256 payload typosquatting `get-proto` (real payload, malicious-package)**: `get-power@1.0.3` (GHSA-3g9w-hfq8-vr7p, source SHA-256 `30ce083fc334cc449dd01960e48fb616e7091ddb2c660a9b1179b93c4fcd9b05`, tgz SHA1 `811001a696d3b0cb1676e8522fa3d2d1694ca61c`). Typosquats `ljharb/get-proto`. On `require()`: `index.js` base64-decodes two bundled files disguised as sourcemaps (`parse.ts.map`, `init.ts.map`) into `parsetmp.js` and `config.js`, requires `parsetmp.js`, then `fs.unlink()`s all four files to erase forensics. AES-256-CBC with hardcoded password+salt; final decrypted payload runs via `eval()`. Payload host `https://www.jsonkeeper.com/b/V6NBX` (public paste service). The self-delete-after-execute pattern defeats most tarball-scan-only detection
- **Cluster H - npm `jexkcode` Baileys silent WhatsApp newsletter-follow (unauthorized-account-modification, malicious-package)**: `jexkcode@1.0.1`/`1.1.0`/`1.1.1`/`1.1.2`/`1.1.3`/`1.1.4` (GHSA-j72h-3h5h-43v5). On every WhatsApp connection through Baileys, silently calls `newsletterFollow` against a hardcoded newsletter JID after a 3-second delay, without user consent, config option, or logging. `1.0.1-1.1.1` used a malformed JID; `1.1.2` fixed it; `1.1.4` stripped both success and failure log lines so the follow is now completely silent. Not a credential stealer - class-of-harm is unauthorized modification of the victim`s WhatsApp account. Repo `github.com/jexkpinkman/JexkCode-baileys`
- **Cluster I - npm `zeal-utils` + `zeal-util-hooks` aveliscare.com canary continuation (recon-beacon, dependency-confusion)**: `zeal-utils@0.0.0` (GHSA-wr85-c4v8-8f3c) and `zeal-util-hooks@0.0.0` (GHSA-6vc3-f74w-qjh4). Sibling packages to the earlier [`zeal-rq-hooks@0.0.0`](https://dependencywatch.io/incident/npm-2026-08-11-ghsa-malware-sweep) from the 2026-08-11 sweep - same aveliscare.com beacon infrastructure. Beacon endpoint `https://npm-canary.aveliscare.com/beacon` (overridable via `ZEAL_CANARY_URL` env var). Data collected: hostname, username, cwd, OS platform, Node.js version, npm user-agent, parent-package metadata, CI env vars `GITHUB_REPOSITORY`/`GITHUB_ACTOR`/`GITHUB_REF`/`GITHUB_RUN_ID`, plus EAS / VERCEL / BUILDKITE identifiers. Triggers at both `postinstall` and `require()`. Advertises as `getzeal.io` in metadata but egresses to `aveliscare.com` - reads as a security-research canary, but the same envelope could carry a real payload on a future push
- **Cluster J - pip `queeuees` .py-comment vandalism (unusual, malicious-package)**: `queeuees@>=0.0.1` (GHSA-m3mj-98fq-j5r3, source SHA-256 `1adc88dd9031dc991006afcf10242d1de3aa7994f6bcb4542faed95524d6ebe0`). "Obfuscated code iterates over files in the system and adds a comment to every .py file found" per the GHSA body. No C2, no exfil, no wallets - a marker/vandalism campaign. Low priority but worth blocklisting the name because the operator has demonstrated they can iterate over the whole filesystem from `pip install`
- **Cluster K - 15 npm CWE-506 boilerplate takedowns (mixed kinds, unclassified)**: `@cat-gen/material` (GHSA-m7x3-q6r8-p5rg), `@cat-gen/materia` (GHSA-m8g8-xcgx-j6hw), `feed-widget-helper` (GHSA-r52r-vpcc-38v2), `building-build` (GHSA-2fq4-2r26-qr64), `analytics-widget` (GHSA-548g-r2c9-6chm), `ragacateslikodi` (GHSA-mjhw-5x2v-v3wg), `@firelordzuka/pulse-poc` (GHSA-h645-43f8-g987), `link-status-page` (GHSA-5j3f-rr83-xcpq), `link-age-great` (GHSA-jmrg-vr2j-j96x), `@redman89405/my-module` (GHSA-vc53-jhh2-pwf3), `@zaka13/thing@>=1.0.0` (GHSA-fxc7-fpjq-q7vf), `radio-player-theme` (GHSA-pp2v-g64w-gm6f), `iban-validator-js` (GHSA-wg95-pj2w-mm76), `@larocas-bbresearch/tombstone-probe-odvz5y@0.0.1` (GHSA-5jx4-hhhr-9xv8), `@larocas-bbresearch/tp-probe-e29834ce@1.0.0`/`1.0.1` (GHSA-g9f7-pmrp-88h7). The two `@larocas-bbresearch/*-probe-*` names look like bug-bounty researcher scope probes; `@cat-gen/material`/`materia`, `@firelordzuka/*`, and `@redman89405/*` look like dep-confusion probes at internal scopes; the rest are typosquats. Treat as `medium` for sweep purposes
- **Operator continuity check**: no fresh `donutautosellsrc` / `aseity*` Polygon-C2 pip publications today (day 3 was yesterday - watch for day 4). No fresh `hardhat-*` pino-impersonator (Cluster B from yesterday) publications. No fresh `nebula-*` `.kntrat` Windows RAT, `fabric-*` Discord-webhook Minecraft credential stealer, `chalk-figlet` RuntimeBroker dropper, or `dotenv-native`/`native-env` JPEG-EXIF chain publications. The `chinazhangsan.ccwu.cc` DoH + PWA_ROUTER hijack (Cluster B today) is new to this corpus. The `aveliscare.com` canary operator (Cluster I) is a second-month continuation. The EtherHiding technique (Cluster A) is the sixth sample this corpus records but the first with wallet `0xa322E5...63e1a`. **Named-standalone side-file**: the `indexed-btree` + 9 siblings Checkmarx-disclosed campaign is catalogued as its own record (`npm-2026-09-17-indexed-btree-sepolia-etherhiding`) rather than in this sweep - that is a critical-severity 10-package compromise of a family that reached ~2M weekly downloads, and the runtime-triggered (`BTree.prototype.set()`) loader is a new class of TTP

## What to do

1. Grep every `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `package.json`, `requirements.txt`, `Pipfile.lock`, `poetry.lock`, and `pyproject.toml` for every package name in Clusters A through K. Uninstall on hit, wipe `node_modules`/`.venv`, delete the lockfile, rebuild against a clean cache. Clusters A through G carry confirmed real payloads (EtherHiding infostealer, SW hijack, GH Actions worm, Telegram wallet stealer, `vm.runInContext` RCE, unpinned-tarball RCE, self-deleting AES payload); a hit on any of those is a compromise, not a warning
2. **For Cluster A (npm `tailwind-forms-kit` EtherHiding on Ethereum mainnet)**: uninstall on hit. Because C2 resolves through Ethereum mainnet RPC queries against wallet `0xa322E5f39aDC2490EfD311D3080e6f0121063e1a`, a domain-only egress denylist is insufficient - block outbound HTTPS to public Ethereum mainnet RPC endpoints (`ethereum-rpc.publicnode.com`, `eth.llamarpc.com`, `1rpc.io/eth`, `eth.drpc.org`, `eth.blockscout.com`, `rpc.ankr.com/eth`, `cloudflare-eth.com`) from CI networks and any developer host that does not have a legitimate mainnet-RPC-consuming app. Rotate every credential the installer user had
3. **For Cluster B (npm `web-vitals-polyfill-core-v1` chinazhangsan.ccwu.cc service-worker hijack)**: uninstall on hit. Because C2 resolves via DoH (`doh.pub`, `dns.alidns.com`), a regular DNS-blackhole against `chinazhangsan.ccwu.cc` will not work - block those DoH resolvers at the edge OR block outbound HTTPS to `chinazhangsan.ccwu.cc`, `gist.githubusercontent.com/chinazhangsan999-crypto`, and `api.npoint.io`. Any browser bundle that pulled this package and shipped to production is compromised - treat as an XSS/navigation-hijack incident and audit visitor sessions. Add `web-vitals-*`/`PWA_ROUTER`/`chinazhangsan*` to lockfile-lint
4. **For Cluster C (pip `bfox-build-utils` GitHub-Actions worm)**: uninstall on hit AND audit every subscribed CI runner for the branch `feature/ci-health-check` and the file `.github/workflows/ci-health-check.yml`. Rotate every `GITHUB_TOKEN` and every PAT that touched the runner. If the worm succeeded in pushing to `feature/ci-health-check`, delete that branch AND revert any injected workflow file. Rotate npm/PyPI publish tokens the runner could reach. If your CI has runner-level protection against `git push` from `github-actions[bot]` to protected branches, verify it is enforcing. The workflow-file bypass proves the operator has an existing technique for evading the API restriction - review your workflow-file audit rules
5. **For Cluster D (npm `dotenv-precheck` Telegram wallet stealer)**: uninstall on hit. Rotate every wallet mnemonic, private key, and BIP-39 seed that lived on any developer host that ran an install - the stealer targets `~/Desktop`, `~/Documents`, `~/Downloads` recursively for text files ≤2MB with wallet-key selectors. Block outbound HTTPS to `api.telegram.org` from CI networks and from developer workstations that do not have a legitimate Telegram-bot use case. Reject any package named `dotenv-*` from an unknown publisher until reviewed
6. **For Cluster E (npm `fabric-loader-core` install-time RCE via `vm.runInContext`)**: uninstall on hit. `--ignore-scripts` in CI blocks the postinstall trigger. Block outbound HTTPS to `fabric-npm.gm-service.xyz` from all networks. Add `fabric-loader-core` and the whole `fabric-*` npm naming space to your lockfile-lint blocklist - both today`s operator and yesterday`s [`fabric-*` Discord-webhook Minecraft stealer](https://dependencywatch.io/incident/multi-2026-09-29-ghsa-malware-sweep) operator have used the naming lure
7. **For Cluster F (npm `mfahelper` unpinned-GitHub-tarball RCE)**: uninstall on hit. Rotate installer-user credentials. Block outbound clone/fetch access to `github.com/trktgq0wbre1/*` at the network level. Add a policy that dependencies referenced via a raw GitHub tarball URL must fail package review; if you must accept them, pin to a specific commit SHA plus an integrity hash. This class of dependency-URL-fetch RCE bypasses every registry-side signature scheme
8. **For Cluster G (npm `get-power` self-deleting AES payload)**: uninstall on hit. Rotate installer-user credentials. Block outbound HTTPS to `www.jsonkeeper.com` from CI networks and developer workstations. Reject any dependency whose install path drops `.ts.map` files that unpack into `.js` files (sourcemap-as-payload pattern). Watch for typosquats of `get-proto`, `get-parent`, `get-proto-of`, and similar utility names
9. **For Cluster H (npm `jexkcode` Baileys WhatsApp newsletter-follow)**: uninstall on hit. Any WhatsApp account that connected via a client using `jexkcode` between the malicious versions is now silently following the operator`s newsletter - check the account`s subscribed newsletters and unsubscribe. Not a credential-theft class incident but a class of unauthorized account modification
10. **For Cluster I (npm `zeal-utils` / `zeal-util-hooks` aveliscare canary)**: uninstall on hit. If the beacon reached `npm-canary.aveliscare.com`, treat as a demonstrated internal-scope enumeration - review any `@zeal*`/`zeal-*` internal package name that your team uses for potential dep-confusion collisions with the operator`s next push. Block outbound to `*.aveliscare.com` from CI networks
11. **For Cluster J (pip `queeuees` .py-comment vandalism)**: uninstall on hit. Grep any Python codebase that had this installed for unexpected identical comments on the top line of every `.py` file (the vandalism marker). No credential rotation needed if the payload is confirmed comment-only
12. **For Cluster K (npm CWE-506 boilerplate batch)**: uninstall on hit. Without payload analysis assume real infostealer/RCE at time of quarantine - image the host, rotate installer-user credentials, check outbound telemetry from the install window. Add all 15 names to lockfile-lint. `@larocas-bbresearch/*-probe-*` names are almost certainly bug-bounty researcher scope; safe to add to blocklist regardless
13. Keep prior egress blocks in place: `ltidi.storage.googleapis.com`, `oob.algamil7x.xyz`, `eo8f3m3ho26a0nm.m.pipedream.net`, `mkicom.com`, `124.221.154.135`, `104.234.65.75`, `65.87.7.132`, `ipinfo-encrypted-v1.vercel.app`, `game.spawnrealm.com`, `nee1ahnaw7.xsses.link`, `*.oast.fun`, `*.oastify.com`, Discord webhook `1554065488726990909`, Polygon RPC endpoints. Add for today: Ethereum mainnet RPC endpoints (targeted denylist per Cluster A), `chinazhangsan.ccwu.cc`, `gist.githubusercontent.com/chinazhangsan999-crypto`, `api.npoint.io`, `api.telegram.org` (from CI), `fabric-npm.gm-service.xyz`, `www.jsonkeeper.com`, `github.com/trktgq0wbre1`, `npm-canary.aveliscare.com`, ETH wallet `0xa322E5f39aDC2490EfD311D3080e6f0121063e1a`. See standalone incident [`indexed-btree` + 9 siblings](https://dependencywatch.io/incident/npm-2026-09-17-indexed-btree-sepolia-etherhiding) for the Checkmarx-disclosed BTree.prototype.set() runtime-loader campaign

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-w873-w35f-2523 - npm tailwind-forms-kit (Cluster A - EtherHiding on Ethereum mainnet, wallet 0xa322E5...63e1a)](https://github.com/advisories/GHSA-w873-w35f-2523) - GitHub
- [GHSA-fx3x-h4mr-m28v - npm web-vitals-polyfill-core-v1 (Cluster B - chinazhangsan.ccwu.cc SW hijack via DoH, PWA_ROUTER)](https://github.com/advisories/GHSA-fx3x-h4mr-m28v) - GitHub
- [GHSA-h475-44q2-vfjx - npm web-vitals-polyfill-core-v1 (Cluster B - CWE-506 boilerplate stub, same package)](https://github.com/advisories/GHSA-h475-44q2-vfjx) - GitHub
- [GHSA-rx43-29mc-6h3f - pip bfox-build-utils (Cluster C - GitHub-Actions workflow-injection worm)](https://github.com/advisories/GHSA-rx43-29mc-6h3f) - GitHub
- [GHSA-f9wq-94v3-cjrp - npm dotenv-precheck (Cluster D - Telegram bot API wallet/mnemonic infostealer)](https://github.com/advisories/GHSA-f9wq-94v3-cjrp) - GitHub
- [GHSA-xprc-xmv3-4m4p - npm fabric-loader-core (Cluster E - vm.runInContext install-time RCE, fabric-npm.gm-service.xyz)](https://github.com/advisories/GHSA-xprc-xmv3-4m4p) - GitHub
- [GHSA-vxqj-q8pf-p87h - npm mfahelper (Cluster F - unpinned GitHub tarball RCE via node-net-pool)](https://github.com/advisories/GHSA-vxqj-q8pf-p87h) - GitHub
- [GHSA-3g9w-hfq8-vr7p - npm get-power (Cluster G - self-deleting AES-256 payload, get-proto typosquat)](https://github.com/advisories/GHSA-3g9w-hfq8-vr7p) - GitHub
- [MAL-2026-16156 - npm get-power OSV record (Cluster G IOCs + hashes)](https://osv.dev/vulnerability/MAL-2026-16156) - OSV
- [GHSA-j72h-3h5h-43v5 - npm jexkcode (Cluster H - Baileys silent WhatsApp newsletterFollow)](https://github.com/advisories/GHSA-j72h-3h5h-43v5) - GitHub
- [MAL-2026-16220 - npm jexkcode OSV record (Cluster H analysis)](https://osv.dev/vulnerability/MAL-2026-16220) - OSV
- [GHSA-wr85-c4v8-8f3c - npm zeal-utils (Cluster I - aveliscare.com canary continuation)](https://github.com/advisories/GHSA-wr85-c4v8-8f3c) - GitHub
- [GHSA-6vc3-f74w-qjh4 - npm zeal-util-hooks (Cluster I - sibling to zeal-utils, same infrastructure)](https://github.com/advisories/GHSA-6vc3-f74w-qjh4) - GitHub
- [GHSA-m3mj-98fq-j5r3 - pip queeuees (Cluster J - .py-comment vandalism)](https://github.com/advisories/GHSA-m3mj-98fq-j5r3) - GitHub
- [GHSA-m7x3-q6r8-p5rg - npm @cat-gen/material (Cluster K - CWE-506 boilerplate)](https://github.com/advisories/GHSA-m7x3-q6r8-p5rg) - GitHub
- [GHSA-m8g8-xcgx-j6hw - npm @cat-gen/materia (Cluster K - CWE-506 boilerplate)](https://github.com/advisories/GHSA-m8g8-xcgx-j6hw) - GitHub
- [GHSA-r52r-vpcc-38v2 - npm feed-widget-helper (Cluster K - CWE-506 boilerplate)](https://github.com/advisories/GHSA-r52r-vpcc-38v2) - GitHub
- [GHSA-2fq4-2r26-qr64 - npm building-build (Cluster K - CWE-506 boilerplate)](https://github.com/advisories/GHSA-2fq4-2r26-qr64) - GitHub
- [GHSA-548g-r2c9-6chm - npm analytics-widget (Cluster K - CWE-506 boilerplate)](https://github.com/advisories/GHSA-548g-r2c9-6chm) - GitHub
- [GHSA-mjhw-5x2v-v3wg - npm ragacateslikodi (Cluster K - CWE-506 boilerplate)](https://github.com/advisories/GHSA-mjhw-5x2v-v3wg) - GitHub
- [GHSA-h645-43f8-g987 - npm @firelordzuka/pulse-poc (Cluster K - CWE-506 boilerplate, scope-probe)](https://github.com/advisories/GHSA-h645-43f8-g987) - GitHub
- [GHSA-5j3f-rr83-xcpq - npm link-status-page (Cluster K - CWE-506 boilerplate)](https://github.com/advisories/GHSA-5j3f-rr83-xcpq) - GitHub
- [GHSA-jmrg-vr2j-j96x - npm link-age-great (Cluster K - CWE-506 boilerplate)](https://github.com/advisories/GHSA-jmrg-vr2j-j96x) - GitHub
- [GHSA-vc53-jhh2-pwf3 - npm @redman89405/my-module (Cluster K - CWE-506 boilerplate, scope-probe)](https://github.com/advisories/GHSA-vc53-jhh2-pwf3) - GitHub
- [GHSA-fxc7-fpjq-q7vf - npm @zaka13/thing (Cluster K - CWE-506 boilerplate, scope-probe)](https://github.com/advisories/GHSA-fxc7-fpjq-q7vf) - GitHub
- [GHSA-pp2v-g64w-gm6f - npm radio-player-theme (Cluster K - CWE-506 boilerplate)](https://github.com/advisories/GHSA-pp2v-g64w-gm6f) - GitHub
- [GHSA-wg95-pj2w-mm76 - npm iban-validator-js (Cluster K - CWE-506 boilerplate)](https://github.com/advisories/GHSA-wg95-pj2w-mm76) - GitHub
- [GHSA-5jx4-hhhr-9xv8 - npm @larocas-bbresearch/tombstone-probe-odvz5y (Cluster K - bug-bounty probe scope)](https://github.com/advisories/GHSA-5jx4-hhhr-9xv8) - GitHub
- [GHSA-g9f7-pmrp-88h7 - npm @larocas-bbresearch/tp-probe-e29834ce (Cluster K - bug-bounty probe scope)](https://github.com/advisories/GHSA-g9f7-pmrp-88h7) - GitHub

---

Canonical page: https://dependencywatch.io/incident/multi-2026-09-30-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-09-30-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).