GitHub Advisory malware sweep - 2026-09-30 (late) + 2026-10-01 (pip `beautifytext` import-time RAT; pip `friendly-greeting-tools` Snowflake credential theft to attacker-controlled S3; npm `noverojs` Baileys silent WhatsApp follow family continuation; npm `com.epi.e2e_test` dep-confusion reconnaissance beacon to `meta.brs.cx`; 7 npm Epic Games Store scope dep-confusion probes (`set-egs-backend`, `qa-egs-rollback`, `generator-epic-react`, `player-support-tools-ui`, `mod-manager`, `ssp-config-management-tool`, `store-service-worker`); 6 npm `mms-*` scope dep-confusion probes; 8 npm CWE-506 boilerplate bug-bounty researcher probes)

What happened

Between roughly 2026-09-30 12:00 UTC and 2026-10-01 12:00 UTC, the GitHub Advisory Database (with the OpenSSF malicious-packages bulk export, Amazon Inspectors IN-MAL feed, and kam193/bad-packages) published 26 new malware advisories: 24 npm and 2 pip. The defensively noteworthy shape of this window is heavier on dep-confusion scope-probe batches than yesterday - two co-published probe clusters (Epic Games Store naming in Cluster E, mms-* internal-stack naming in Cluster F) account for 13 of the 24 npm entries - but two confirmed-payload pip samples (beautifytext RAT, friendly-greeting-tools Snowflake credential-theft chain) raise the sweep severity to high`.

Cluster A - pip beautifytext import-time RAT

beautifytext@1.0.3/1.0.4/1.0.7 (GHSA-j7g2-8pxv-8gv2, OpenSSF campaign 2026-07-beautifytext, source SHA-256 cba19cfc0b2bdeec177fafdffa10e730769079a14ece3bb4740bfc0ded9fef3b).

On import beautifytext, "silently spawns a separate process that waits for and executes remote commands" per the GHSA body. Classified as remote-access-trojan by OpenSSF kam193. The campaign slug (2026-07) is older than the publish date - the sample was identified by kam193/bad-packages in July 2026 and only reached GHSA on 2026-09-30. Any pip install from that window carries the RAT.

Classify as malicious-package.

Cluster B - pip friendly-greeting-tools Snowflake credential theft to attacker-controlled S3

friendly-greeting-tools@0.1.0/0.1.1/0.2/0.3/0.3.1-0.3.7 (GHSA-97c4-9mc7-j7wv, OpenSSF campaign 2026-09-friendly-greeting-tools, amazon-inspector hash 4d584c571cf5d112735aefd07c78bc19659af32f5950b1331a4970cba97c9707, kam193 hash e15a50ec5b7be580dec5d1edefa80860b4c650d552f69a1a9ba3dc9bd8edbc9d).

Two-phase payload. Both stages are base64+gzip-encoded Python blobs executed via exec():

1. Phase 1 - credential harvest. Reads /snowflake/session/token, /root/.snowflake/connections.toml, /root/.dbt/profiles.yml, /snowflake/secrets/pip.conf. Fernet-encrypts the collected files, wraps the Fernet key under an attacker-controlled RSA public key, stages the bundle to /workspace/.
2. Phase 2 - Snowflake exfil. Uses the harvested Snowflake credentials to connect to the victims warehouse, creates an external stage pointing at s3://pkusinski-external/ with IAM role arn:aws:iam::631484165566:role/pentests_s3_role, then COPY INTO` the stage from victim tables.

The S3 bucket name (pkusinski-external) and the IAM role name (pentests_s3_role) strongly suggest a bug-bounty or pentest operation, but the exfil capability is real: a successful run moves production Snowflake table data under attacker control. Package name is a deliberate decoy ("friendly-greeting-tools" implies a trivial text utility).

Classify as malicious-package.

Cluster C - npm noverojs Baileys silent WhatsApp follow family continuation

noverojs@1.0.1/1.0.4 (GHSA-wj4h-927q-m5xv).

Patches a Baileys socket-connect routine. Several seconds after every WhatsApp connection, the patched routine fires a w:mex FOLLOW query (query ID 7871414976211147) that silently subscribes the victim to attacker-controlled newsletter channels - no user consent, no config option, no logging. Target JIDs are obscured via plain string literals, base64, base64+XOR, and runtime char-code reconstruction. Some variants fetch the target JID dynamically from attacker-hosted JSON/JS, so the follow target can rotate without a new npm publish.

GHSA calls out that noverojs is part of a "large family (100+ identified)" of near-identical Baileys forks sharing the same injection mechanism. Same class-of-harm as jexkcode from yesterday`s sweep: unauthorized modification of the victim`s WhatsApp account.

Classify as malicious-package.

Cluster D - npm com.epi.e2e_test meta.brs.cx dep-confusion reconnaissance beacon

com.epi.e2e_test@1.2.2 (GHSA-76w7-xhq5-w327, source SHA-256 5a0c1068af335818f2b9d905f2d39ebe594f84a6c63e470877692554bc95103b).

Preinstall script collects:

• $HOME path
• hostname
• current username
• DNS server list
• cwd
• parent package.json contents

POSTs the bundle over HTTPS to meta.brs.cx. The com.epi.* prefix is atypical for public-npm names (it reads as a reverse-DNS style used in Java and in some corporate internal registries); combined with the beacon-only payload, this is a classic dep-confusion recon probe. First meta.brs.cx beacon in corpus.

Classify as dependency-confusion.

Cluster E - npm Epic Games Store scope dep-confusion probe batch (7 packages)

All CWE-506 boilerplate GHSAs; all Amazon-Inspector-detected; all 0.0.1-security + 1.0.0 sentinel-version co-publications. No published payload analysis - the Amazon-Inspector hashes are below for forensic correlation but the OpenSSF repository does not yet carry per-package IOC details:

• set-egs-backend (GHSA-whwx-38wq-2f27, hash bbceb6929d59ced3a4df01c1d61f7da54d4d0a85e467329fecd5f44e59d43f32)
• qa-egs-rollback (GHSA-p4fw-q7gp-3mq3, hash f069cbe096962a4415247fec584da742da87006805e2e0a12d2e0a080936479d)
• generator-epic-react (GHSA-g46p-chgx-c83v, hash b7ce6d820d3b2380b3b4cba48d41e31b26d0fc74dd18635e0e01ad7a94c8ba0f)
• player-support-tools-ui (GHSA-2p95-xv34-387r, hash 43e35bb951aab567fdb15daabc8db34691f937b3fefbf102bc1e19657c88aa72, MAL-2025-49234)
• mod-manager (GHSA-c34f-w6mj-2346, hash 8ec890b586ea0ff47a8ba914ff95c535bdeebbdfaf6788b6357a5afae32c9463, MAL-2025-49233)
• ssp-config-management-tool (GHSA-68gm-434m-pfmj, hash db3d336f799326b6b1dfcbb9485d62b5d02423f9c6a7e7dbb4c29940c22e0ef5)
• store-service-worker (GHSA-pp63-g67g-4hxq, hash 96644928dc5cfc92d966ad6cbd2a16820b0ad6951971e35c226f31e2e594f687, MAL-2025-49239)

Naming reads as Epic Games Store or adjacent game-storefront internal scope (-egs-, epic-react, player-support-tools, store-service-worker, generator-*, qa-egs-*, set-egs-*, ssp-*, mod-manager). The sibling Cluster D com.epi.e2e_test recon beacon targets the same employer-brand naming space but with a concrete payload (meta.brs.cx beacon); whether Cluster E and Cluster D are the same operator is not disclosed.

Classify as dependency-confusion. Severity medium within the sweep until payload is analysed.

Cluster F - npm mms-* scope dep-confusion probe batch (6 packages)

All CWE-506 boilerplate GHSAs; all Amazon-Inspector-detected; all 0.0.1-security + 1.0.0 co-publications:

• mms-ref-client (GHSA-p4x2-g83h-x323, hash 2b3d204e0f49cb41d203a04419909bce2a366f33ab7859b4e1977374ec1db93e)
• mms-ref-dedserver (GHSA-v7g9-2fm9-gf3r, hash 93da1778cc346bce6d2f674c1b600f0b6d8ea31cd2ee84b0f5d2f22df220ce3a)
• mms-tools (GHSA-gvwj-w5p8-h682, hash b68fdee506c83917c4153bbb96b046ba77fac1a06fd42a4450e0da45eaaf0620)
• mms-thin-client (GHSA-557c-973f-xg6r)
• mms-service (GHSA-pjxq-g48x-h4jh, hash 5912faf3f600f103f64fe2d342cbd05b7146c3b78d9ee54473b28195a5185e49, MAL-2025-49229)
• mms-simulation (GHSA-v994-mfhw-f42p, hash b05f92c3ffc5ed97302ac873fd40030318d8d2d89d267c615a2b1309d5fd047b)

Six-package co-publication; the ref-client/ref-dedserver/thin-client/tools/service/simulation suffix pattern fits a specific internal client+server+simulation stack naming (common in game-studio reference-renderer deployments and in industrial-telemetry orgs). No GHSA-side payload analysis.

Classify as dependency-confusion. Severity medium within the sweep until payload is analysed.

Cluster G - 8 npm CWE-506 boilerplate bug-bounty researcher probes

• my-ctf-helper-script-9921@>=0 (GHSA-7mhc-78r2-fgw8)
• pf25262@>=0 (GHSA-3pg3-52vp-54fg)
• pf23727@>=0 (GHSA-p2hc-jmvm-qwc9)
• pflag14570@>=0 (GHSA-qxgf-vc83-fc34)
• pf25133@>=0 (GHSA-8f7g-cf69-g5p8)
• pulse-pwn-9f3a2@>=0 (GHSA-fwr5-cj49-cq4h)
• pflag29424@>=0 (GHSA-8jr8-g7mm-57m6)
• ddok-modal@1.0.0 (GHSA-5xvp-j6m9-rwr6)

All quarantined with the standard "any computer that has this package installed should be considered fully compromised" GHSA boilerplate. No source hash, no source code, no OpenSSF record - the GHSA was raised via a direct npm takedown rather than through an Amazon-Inspector or kam193 route. The naming patterns (pf/pflag + 5-digit numeric suffix, pulse-pwn + 5-char hex suffix, my-ctf-helper-script + 4-digit numeric suffix) are the standard bug-bounty-researcher scope-probe fingerprint. ddok-modal is less obvious but fits the same CWE-506 boilerplate shape.

Classify as mixed. Severity medium within the sweep until payload is analysed.

Operator continuity check

• tailwind-forms-kit EtherHiding, web-vitals-polyfill-core-v1 chinazhangsan.ccwu.cc, bfox-build-utils pip GH-Actions worm, dotenv-precheck Telegram, fabric-loader-core/mfahelper/get-power install-time RCE, jexkcode Baileys, zeal-utils/zeal-util-hooks aveliscare canary, queeuees py-comment vandalism: no new publications today - all of yesterday`s named operators are quiet.
• *donutautosellsrc/`aseity` Polygon-C2 pip campaign**: no fresh publications (day 4 silent).
• Baileys silent-WhatsApp-follow family: continues with noverojs (Cluster C today) following jexkcode yesterday. The operator`s publish cadence makes a fresh variant likely every 24-48h.
• Snowflake credential-theft family: friendly-greeting-tools (Cluster B) is new to this corpus. Watch for other packages exfiltrating to s3://pkusinski-external/ or impersonating harmless pip utilities with Snowflake-token selectors.
• Dep-confusion scope probes: Epic Games Store scope (Cluster E) and the mms-* scope (Cluster F) are both new co-publications in this window; the com.epi.e2e_test sibling (Cluster D) carries a concrete meta.brs.cx beacon.

Registry state

All 26 packages in this sweep are npm/pip-quarantined at time of writing. Active operator-side infrastructure unique to today`s batch:

• s3://pkusinski-external/ and AWS account 631484165566 IAM role pentests_s3_role (Cluster B)
• meta.brs.cx (Cluster D)
• Baileys follow query ID 7871414976211147 with rotatable JID (Cluster C)

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193/bad-packages. Per-package IOC details drawn from GHSA advisory bodies and OpenSSF malicious-packages MAL records published between 2026-09-30 12:00 UTC and 2026-10-01 12:00 UTC.

Affected packages (25)

Impact

• Cluster A - pip beautifytext import-time RAT (real payload, malicious-package): beautifytext@1.0.3/1.0.4/1.0.7 (GHSA-j7g2-8pxv-8gv2, OpenSSF campaign 2026-07-beautifytext, source SHA-256 cba19cfc0b2bdeec177fafdffa10e730769079a14ece3bb4740bfc0ded9fef3b). On import beautifytext, "silently spawns a separate process that waits for and executes remote commands" per the GHSA body. Classified as remote-access-trojan by OpenSSF kam193. The campaign slug (2026-07) is older than the publish date - the sample was identified by kam193/bad-packages in July and only reached GHSA on 2026-09-30. Treat as live RAT in the wild for any Python developer who pip-installed it
• Cluster B - pip friendly-greeting-tools Snowflake credential-theft stealer to attacker-controlled S3 (real payload, malicious-package): friendly-greeting-tools@0.1.0/0.1.1/0.2/0.3/0.3.1-0.3.7 (GHSA-97c4-9mc7-j7wv, OpenSSF campaign 2026-09-friendly-greeting-tools, source SHA-256 4d584c571cf5d112735aefd07c78bc19659af32f5950b1331a4970cba97c9707 amazon-inspector + e15a50ec5b7be580dec5d1edefa80860b4c650d552f69a1a9ba3dc9bd8edbc9d kam193). Two-phase payload, both stages base64+gzip-encoded Python blobs executed via exec(). Phase 1 harvests Snowflake and dbt credentials from /snowflake/session/token, /root/.snowflake/connections.toml, /root/.dbt/profiles.yml, /snowflake/secrets/pip.conf; Fernet-encrypts them, wraps the Fernet key under an attacker RSA public key, stages the bundle to /workspace/. Phase 2 uses the stolen Snowflake creds to connect to the victims warehouse, creates an external stage pointing at s3://pkusinski-external/ with IAM role arn:aws:iam::631484165566:role/pentests_s3_role, then COPY INTO` the stage from victim tables. The S3 bucket and IAM role names strongly suggest a bug-bounty / pentest operation ("pentests_s3_role") but the exfil capability is real and would move production Snowflake data to attacker control. Package name impersonates a harmless greeting utility
• Cluster C - npm noverojs Baileys silent WhatsApp follow family continuation (unauthorized-account-modification, malicious-package): noverojs@1.0.1/1.0.4 (GHSA-wj4h-927q-m5xv). Patches a Baileys socket-connect routine so that several seconds after every WhatsApp connection a w:mex FOLLOW query (query ID 7871414976211147) silently subscribes the victim to attacker-controlled newsletter channels. Target JIDs obscured via plain string, base64, base64+XOR, and runtime char-code reconstruction; some variants fetch the target JID dynamically from attacker-hosted JSON/JS, so the follow target can rotate without re-publishing the package. GHSA notes noverojs is part of a "large family (100+ identified)" of near-identical Baileys forks sharing the same injection mechanism - same class-of-harm as jexkcode yesterday
• Cluster D - npm com.epi.e2e_test meta.brs.cx dep-confusion reconnaissance beacon (recon-beacon, dependency-confusion): com.epi.e2e_test@1.2.2 (GHSA-76w7-xhq5-w327, source SHA-256 5a0c1068af335818f2b9d905f2d39ebe594f84a6c63e470877692554bc95103b). Preinstall script collects HOME path, hostname, username, DNS server list, cwd, and the parent package.json; POSTs the bundle over HTTPS to meta.brs.cx. The com.epi.* prefix (atypical for public-npm names, matches the reverse-DNS style used in Epic/EPIC internal registries) and the beacon-only payload read as a dep-confusion probe. First meta.brs.cx beacon in corpus
• Cluster E - npm Epic Games Store (EGS) scope dep-confusion probe batch, 7 packages, Amazon-Inspector-detected CWE-506 boilerplate (dependency-confusion, no analysis): set-egs-backend@0.0.1-security/1.0.0 (GHSA-whwx-38wq-2f27, hash bbceb6929d59ced3a4df01c1d61f7da54d4d0a85e467329fecd5f44e59d43f32), qa-egs-rollback@0.0.1-security/1.0.0 (GHSA-p4fw-q7gp-3mq3, hash f069cbe096962a4415247fec584da742da87006805e2e0a12d2e0a080936479d), generator-epic-react@0.0.1-security/1.0.0 (GHSA-g46p-chgx-c83v, hash b7ce6d820d3b2380b3b4cba48d41e31b26d0fc74dd18635e0e01ad7a94c8ba0f), player-support-tools-ui@0.0.1-security/1.0.0 (GHSA-2p95-xv34-387r, hash 43e35bb951aab567fdb15daabc8db34691f937b3fefbf102bc1e19657c88aa72, MAL-2025-49234), mod-manager@0.0.1-security/1.0.0 (GHSA-c34f-w6mj-2346, hash 8ec890b586ea0ff47a8ba914ff95c535bdeebbdfaf6788b6357a5afae32c9463, MAL-2025-49233), ssp-config-management-tool@0.0.1-security/1.0.0 (GHSA-68gm-434m-pfmj, hash db3d336f799326b6b1dfcbb9485d62b5d02423f9c6a7e7dbb4c29940c22e0ef5), store-service-worker@0.0.1-security/1.0.0 (GHSA-pp63-g67g-4hxq, hash 96644928dc5cfc92d966ad6cbd2a16820b0ad6951971e35c226f31e2e594f687, MAL-2025-49239). The -egs-/epic-react/player-support-tools/store-service-worker/generator-*/qa-egs-*/set-egs-*/ssp-*/mod-manager naming all reads as Epic Games Store or adjacent game-storefront internal-scope dep-confusion. CWE-506 boilerplate, no payload analysis in GHSAs - treat as medium for sweep purposes
• *Cluster F - npm `mms- scope dep-confusion probe batch, 6 packages, Amazon-Inspector-detected CWE-506 boilerplate (dependency-confusion, no analysis)**: mms-ref-client@0.0.1-security/1.0.0 (GHSA-p4x2-g83h-x323, hash 2b3d204e0f49cb41d203a04419909bce2a366f33ab7859b4e1977374ec1db93e), mms-ref-dedserver@0.0.1-security/1.0.0 (GHSA-v7g9-2fm9-gf3r, hash 93da1778cc346bce6d2f674c1b600f0b6d8ea31cd2ee84b0f5d2f22df220ce3a), mms-tools@0.0.1-security/1.0.0 (GHSA-gvwj-w5p8-h682, hash b68fdee506c83917c4153bbb96b046ba77fac1a06fd42a4450e0da45eaaf0620), mms-thin-client@0.0.1-security/1.0.0 (GHSA-557c-973f-xg6r), mms-service@0.0.1-security/1.0.0 (GHSA-pjxq-g48x-h4jh, hash 5912faf3f600f103f64fe2d342cbd05b7146c3b78d9ee54473b28195a5185e49, MAL-2025-49229), mms-simulation@0.0.1-security/1.0.0 (GHSA-v994-mfhw-f42p, hash b05f92c3ffc5ed97302ac873fd40030318d8d2d89d267c615a2b1309d5fd047b). Six-package co-published batch targeting an internal mms-* scope (ref-client, ref-dedserver, thin-client, tools, service, simulation fits a client+server+simulation stack naming - probable game-studio or industrial-telemetry internal namespace). No GHSA-side analysis - treat as medium` for sweep purposes
• Cluster G - 8 npm CWE-506 boilerplate bug-bounty researcher probe takedowns (mixed kinds, unclassified, no analysis): my-ctf-helper-script-9921@>=0 (GHSA-7mhc-78r2-fgw8), pf25262@>=0 (GHSA-3pg3-52vp-54fg), pf23727@>=0 (GHSA-p2hc-jmvm-qwc9), pflag14570@>=0 (GHSA-qxgf-vc83-fc34), pf25133@>=0 (GHSA-8f7g-cf69-g5p8), pulse-pwn-9f3a2@>=0 (GHSA-fwr5-cj49-cq4h), pflag29424@>=0 (GHSA-8jr8-g7mm-57m6), ddok-modal@1.0.0 (GHSA-5xvp-j6m9-rwr6). All quarantined with the standard "any computer that has this package installed should be considered fully compromised" GHSA boilerplate; no source code, no source hash, no OpenSSF record. The pf*/pflag*/pulse-pwn-*/my-ctf-helper-script-* naming patterns (short numeric or hex suffix after a pf/pflag/pwn/ctf stem) are the standard bug-bounty-researcher scope-probe fingerprint. Treat as medium for sweep purposes
• Operator continuity check: no fresh tailwind-forms-kit/web-vitals-polyfill-core-v1/bfox-build-utils/dotenv-precheck/fabric-loader-core/mfahelper/get-power/jexkcode/zeal-utils/zeal-util-hooks/queeuees publications today - yesterday`s named operators are quiet. Also no new tailwind-forms-kit EtherHiding wallet-rotation on 0xa322E5...63e1a; no fresh chinazhangsan.ccwu.cc DoH + PWA_ROUTER service-worker variants; no fresh donutautosellsrc/aseity* Polygon-C2 pip publications (day 4). The Baileys silent-WhatsApp-follow family continues (noverojs Cluster C today, following jexkcode yesterday) - the operators publish cadence makes a fresh variant likely every 24-48h. The beautifytext RAT and friendly-greeting-tools` Snowflake stealer are both new families to this corpus

What to do

1. 1Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, package.json, requirements.txt, Pipfile.lock, poetry.lock, and pyproject.toml for every package name in Clusters A through G. Uninstall on hit, wipe node_modules/.venv, delete the lockfile, rebuild against a clean cache. Clusters A, B, and C carry confirmed real payloads (RAT, Snowflake credential theft, unauthorized WhatsApp account modification); a hit on any of those is a compromise, not a warning
2. 2For Cluster A (pip beautifytext import-time RAT): uninstall on hit. Any Python environment that imported this package was briefly turned into a RAT host - rotate every credential that lived on the installers machine or runner. Grep for the sha256 cba19cfc0b2bdeec177fafdffa10e730769079a14ece3bb4740bfc0ded9fef3b` across archived pip caches to confirm the specific tarball if present. OpenSSF kam193 identified this sample in July but it only reached GHSA on 2026-09-30; audit install logs back to that window
3. 3For Cluster B (pip friendly-greeting-tools Snowflake credential stealer): uninstall on hit. If the installer had Snowflake credentials in reach (/snowflake/session/token, connections.toml, dbt profiles.yml): rotate every Snowflake user whose creds those files held, review warehouse query history for unexpected CREATE STAGE or COPY INTO statements pointing at s3://pkusinski-external/, and audit AWS CloudTrail for any AssumeRole into arn:aws:iam::631484165566:role/pentests_s3_role from the warehouse. Block outbound HTTPS egress from CI and warehouse networks to s3://pkusinski-external/ and to the AWS account 631484165566. The pentests_s3_role name reads as a pentest/bug-bounty operation, but data that reached that bucket is still exfiltrated
4. 4For Cluster C (npm noverojs Baileys silent WhatsApp follow): uninstall on hit. Any WhatsApp account that connected via a Baileys client bundling noverojs between the malicious versions is now silently following the attackers newsletter JID - check the accounts subscribed newsletters and unsubscribe. Not a credential-theft class incident but a persistent unauthorized account modification. Add the whole family of lookalike-Baileys-fork names (jexkcode, noverojs, and the 100+ unnamed siblings the GHSA references) to lockfile-lint and reject any Baileys-named fork from an unknown publisher
5. 5For Cluster D (npm com.epi.e2e_test meta.brs.cx recon beacon): uninstall on hit. If the beacon reached meta.brs.cx, the operator now has the installers hostname, username, DNS config, cwd, and the local package.json - review the parent app for any sensitive strings that would leak in the package.json (deploy webhooks, repo URLs). Review internal registries for any com.epi.*` namespace in use and verify every public-side name under that prefix is explicitly held or reserved by your team
6. 6For Cluster E (npm Epic Games Store scope dep-confusion probe batch): uninstall on hit. Even though the GHSA bodies carry only CWE-506 boilerplate, these are classic private-registry sentinel-version (0.0.1-security + 1.0.0) dep-confusion probes - any team with an internal set-egs-*, qa-egs-*, generator-epic-*, player-support-tools-*, mod-manager, ssp-*, or store-service-worker name needs to confirm the public-npm name of the same string is held and quarantined. Block outbound HTTPS from CI networks that do not have a legitimate reason to resolve to arbitrary attacker beacons during install - combined with --ignore-scripts, that defuses most dep-confusion recon payloads
7. 7*For Cluster F (npm `mms- scope dep-confusion probe batch)**: uninstall on hit. The six-package mms-ref-client/-ref-dedserver/-thin-client/-tools/-service/-simulation co-publication fits a specific internal client+server+simulation stack naming (common in game-studio and industrial-telemetry orgs) - any team with an internal namespace matching that pattern should audit it against the public names in this cluster and reserve the public-npm names. CWE-506 boilerplate GHSAs; treat as medium` while payload is unknown
8. 8For Cluster G (npm CWE-506 boilerplate bug-bounty probe batch): uninstall on hit. Without payload analysis assume real infostealer/RCE at time of quarantine - image the host, rotate installer-user credentials, check outbound telemetry from the install window. Add all 8 names to lockfile-lint. The pf*/pflag*/pulse-pwn-*/my-ctf-helper-*/ddok-* naming is almost certainly researcher bug-bounty-scope; safe to add to blocklist regardless
9. 9Keep prior egress blocks in place: Ethereum mainnet RPC endpoints (per 2026-09-30 Cluster A tailwind-forms-kit), Ethereum Sepolia RPC endpoints (per indexed-btree), chinazhangsan.ccwu.cc, gist.githubusercontent.com/chinazhangsan999-crypto, api.npoint.io, api.telegram.org (from CI), fabric-npm.gm-service.xyz, www.jsonkeeper.com, github.com/trktgq0wbre1, npm-canary.aveliscare.com, Polygon RPC endpoints. Add for today: meta.brs.cx, s3://pkusinski-external/ and AWS account 631484165566 (block outbound from Snowflake warehouses and CI), and any Baileys-fork package from an unknown publisher

References

• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub
• GHSA-j7g2-8pxv-8gv2 - pip beautifytext (Cluster A - import-time RAT, OpenSSF campaign 2026-07-beautifytext)

  github.com
  GitHub
• GHSA-97c4-9mc7-j7wv - pip friendly-greeting-tools (Cluster B - Snowflake credential theft to s3://pkusinski-external/)

  github.com
  GitHub
• GHSA-wj4h-927q-m5xv - npm noverojs (Cluster C - Baileys silent WhatsApp follow, family continuation)

  github.com
  GitHub
• GHSA-76w7-xhq5-w327 - npm com.epi.e2e_test (Cluster D - meta.brs.cx dep-confusion reconnaissance beacon)

  github.com
  GitHub
• GHSA-whwx-38wq-2f27 - npm set-egs-backend (Cluster E - Epic Games Store scope dep-confusion probe)

  github.com
  GitHub
• GHSA-p4fw-q7gp-3mq3 - npm qa-egs-rollback (Cluster E - EGS scope dep-confusion probe)

  github.com
  GitHub
• GHSA-g46p-chgx-c83v - npm generator-epic-react (Cluster E - EGS scope dep-confusion probe)

  github.com
  GitHub
• GHSA-2p95-xv34-387r - npm player-support-tools-ui (Cluster E - EGS scope dep-confusion probe, MAL-2025-49234)

  github.com
  GitHub
• GHSA-c34f-w6mj-2346 - npm mod-manager (Cluster E - EGS scope dep-confusion probe, MAL-2025-49233)

  github.com
  GitHub
• GHSA-68gm-434m-pfmj - npm ssp-config-management-tool (Cluster E - EGS scope dep-confusion probe)

  github.com
  GitHub
• GHSA-pp63-g67g-4hxq - npm store-service-worker (Cluster E - EGS scope dep-confusion probe, MAL-2025-49239)

  github.com
  GitHub
• GHSA-p4x2-g83h-x323 - npm mms-ref-client (Cluster F - mms-* scope dep-confusion probe)

  github.com
  GitHub
• GHSA-v7g9-2fm9-gf3r - npm mms-ref-dedserver (Cluster F - mms-* scope dep-confusion probe)

  github.com
  GitHub
• GHSA-gvwj-w5p8-h682 - npm mms-tools (Cluster F - mms-* scope dep-confusion probe)

  github.com
  GitHub
• GHSA-557c-973f-xg6r - npm mms-thin-client (Cluster F - mms-* scope dep-confusion probe)

  github.com
  GitHub
• GHSA-pjxq-g48x-h4jh - npm mms-service (Cluster F - mms-* scope dep-confusion probe, MAL-2025-49229)

  github.com
  GitHub
• GHSA-v994-mfhw-f42p - npm mms-simulation (Cluster F - mms-* scope dep-confusion probe)

  github.com
  GitHub
• GHSA-7mhc-78r2-fgw8 - npm my-ctf-helper-script-9921 (Cluster G - bug-bounty researcher probe, CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-3pg3-52vp-54fg - npm pf25262 (Cluster G - bug-bounty researcher probe, CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-p2hc-jmvm-qwc9 - npm pf23727 (Cluster G - bug-bounty researcher probe, CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-qxgf-vc83-fc34 - npm pflag14570 (Cluster G - bug-bounty researcher probe, CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-8f7g-cf69-g5p8 - npm pf25133 (Cluster G - bug-bounty researcher probe, CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-fwr5-cj49-cq4h - npm pulse-pwn-9f3a2 (Cluster G - bug-bounty researcher probe, CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-8jr8-g7mm-57m6 - npm pflag29424 (Cluster G - bug-bounty researcher probe, CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-5xvp-j6m9-rwr6 - npm ddok-modal (Cluster G - CWE-506 boilerplate, no analysis)

  github.com
  GitHub