# GitHub Advisory malware sweep - 2026-09-30 (late) + 2026-10-01 (pip `beautifytext` import-time RAT; pip `friendly-greeting-tools` Snowflake credential theft to attacker-controlled S3; npm `noverojs` Baileys silent WhatsApp follow family continuation; npm `com.epi.e2e_test` dep-confusion reconnaissance beacon to `meta.brs.cx`; 7 npm Epic Games Store scope dep-confusion probes (`set-egs-backend`, `qa-egs-rollback`, `generator-epic-react`, `player-support-tools-ui`, `mod-manager`, `ssp-config-management-tool`, `store-service-worker`); 6 npm `mms-*` scope dep-confusion probes; 8 npm CWE-506 boilerplate bug-bounty researcher probes)

> GHSA 2026-09-30 (late) + 2026-10-01: 26 new advisories (24 npm + 2 pip). Confirmed payloads: pip `beautifytext` import-time RAT; pip `friendly-greeting-tools` Snowflake credential theft to `s3://pkusinski-external/`; npm `noverojs` Baileys silent-WhatsApp-follow family continuation. Remainder are dep-confusion scope probes (Epic Games Store, `mms-*`) and CWE-506 boilerplate.

- Published: 2026-10-01
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 25 packages, 51 compromised versions
- Tags: infostealer, credential-theft, obfuscation, typosquat, dependency-confusion, dns-exfiltration
- Also known as: 2026-10-01 GHSA npm+pip sweep, beautifytext pip import-time RAT, friendly-greeting-tools pip Snowflake credential theft pkusinski-external S3, noverojs npm Baileys silent WhatsApp follow family continuation, com.epi.e2e_test npm meta.brs.cx dep-confusion recon beacon, Epic Games Store npm scope dep-confusion probe batch (set-egs-backend qa-egs-rollback generator-epic-react player-support-tools-ui mod-manager ssp-config-management-tool store-service-worker), mms-* npm scope dep-confusion probe batch (ref-client ref-dedserver tools thin-client service simulation), pf25262 pf23727 pflag14570 pf25133 pulse-pwn-9f3a2 pflag29424 my-ctf-helper-script-9921 ddok-modal bug-bounty probe
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193/bad-packages
- Incident ID: multi-2026-10-01-ghsa-malware-sweep

## Affected packages (25)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [beautifytext](https://dependencywatch.io/package/pypi/beautifytext) | PyPI | 1.0.3, 1.0.4, 1.0.7 |
| [com.epi.e2e_test](https://dependencywatch.io/package/npm/com.epi.e2e_test) | npm | 1.2.2 |
| [ddok-modal](https://dependencywatch.io/package/npm/ddok-modal) | npm | 1.0.0 |
| [friendly-greeting-tools](https://dependencywatch.io/package/pypi/friendly-greeting-tools) | PyPI | 0.1.0, 0.1.1, 0.2, 0.3, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.3.7 |
| [generator-epic-react](https://dependencywatch.io/package/npm/generator-epic-react) | npm | 0.0.1-security, 1.0.0 |
| [mms-ref-client](https://dependencywatch.io/package/npm/mms-ref-client) | npm | 0.0.1-security, 1.0.0 |
| [mms-ref-dedserver](https://dependencywatch.io/package/npm/mms-ref-dedserver) | npm | 0.0.1-security, 1.0.0 |
| [mms-service](https://dependencywatch.io/package/npm/mms-service) | npm | 0.0.1-security, 1.0.0 |
| [mms-simulation](https://dependencywatch.io/package/npm/mms-simulation) | npm | 0.0.1-security, 1.0.0 |
| [mms-thin-client](https://dependencywatch.io/package/npm/mms-thin-client) | npm | 0.0.1-security, 1.0.0 |
| [mms-tools](https://dependencywatch.io/package/npm/mms-tools) | npm | 0.0.1-security, 1.0.0 |
| [mod-manager](https://dependencywatch.io/package/npm/mod-manager) | npm | 0.0.1-security, 1.0.0 |
| [my-ctf-helper-script-9921](https://dependencywatch.io/package/npm/my-ctf-helper-script-9921) | npm | * |
| [noverojs](https://dependencywatch.io/package/npm/noverojs) | npm | 1.0.1, 1.0.4 |
| [pf23727](https://dependencywatch.io/package/npm/pf23727) | npm | * |
| [pf25133](https://dependencywatch.io/package/npm/pf25133) | npm | * |
| [pf25262](https://dependencywatch.io/package/npm/pf25262) | npm | * |
| [pflag14570](https://dependencywatch.io/package/npm/pflag14570) | npm | * |
| [pflag29424](https://dependencywatch.io/package/npm/pflag29424) | npm | * |
| [player-support-tools-ui](https://dependencywatch.io/package/npm/player-support-tools-ui) | npm | 0.0.1-security, 1.0.0 |
| [pulse-pwn-9f3a2](https://dependencywatch.io/package/npm/pulse-pwn-9f3a2) | npm | * |
| [qa-egs-rollback](https://dependencywatch.io/package/npm/qa-egs-rollback) | npm | 0.0.1-security, 1.0.0 |
| [set-egs-backend](https://dependencywatch.io/package/npm/set-egs-backend) | npm | 0.0.1-security, 1.0.0 |
| [ssp-config-management-tool](https://dependencywatch.io/package/npm/ssp-config-management-tool) | npm | 0.0.1-security, 1.0.0 |
| [store-service-worker](https://dependencywatch.io/package/npm/store-service-worker) | npm | 0.0.1-security, 1.0.0 |

## What happened

Between roughly 2026-09-30 12:00 UTC and 2026-10-01 12:00 UTC, the GitHub Advisory Database (with the OpenSSF malicious-packages bulk export, Amazon Inspector`s IN-MAL feed, and kam193/bad-packages) published 26 new malware advisories: 24 npm and 2 pip. The defensively noteworthy shape of this window is heavier on dep-confusion scope-probe batches than yesterday - two co-published probe clusters (Epic Games Store naming in Cluster E, `mms-*` internal-stack naming in Cluster F) account for 13 of the 24 npm entries - but two confirmed-payload pip samples (`beautifytext` RAT, `friendly-greeting-tools` Snowflake credential-theft chain) raise the sweep severity to `high`.

## Cluster A - pip `beautifytext` import-time RAT

`beautifytext@1.0.3`/`1.0.4`/`1.0.7` (GHSA-j7g2-8pxv-8gv2, OpenSSF campaign `2026-07-beautifytext`, source SHA-256 `cba19cfc0b2bdeec177fafdffa10e730769079a14ece3bb4740bfc0ded9fef3b`).

On `import beautifytext`, "silently spawns a separate process that waits for and executes remote commands" per the GHSA body. Classified as remote-access-trojan by OpenSSF `kam193`. The campaign slug (`2026-07`) is older than the publish date - the sample was identified by `kam193/bad-packages` in July 2026 and only reached GHSA on 2026-09-30. Any pip install from that window carries the RAT.

Classify as `malicious-package`.

## Cluster B - pip `friendly-greeting-tools` Snowflake credential theft to attacker-controlled S3

`friendly-greeting-tools@0.1.0`/`0.1.1`/`0.2`/`0.3`/`0.3.1`-`0.3.7` (GHSA-97c4-9mc7-j7wv, OpenSSF campaign `2026-09-friendly-greeting-tools`, amazon-inspector hash `4d584c571cf5d112735aefd07c78bc19659af32f5950b1331a4970cba97c9707`, kam193 hash `e15a50ec5b7be580dec5d1edefa80860b4c650d552f69a1a9ba3dc9bd8edbc9d`).

Two-phase payload. Both stages are base64+gzip-encoded Python blobs executed via `exec()`:

1. **Phase 1 - credential harvest.** Reads `/snowflake/session/token`, `/root/.snowflake/connections.toml`, `/root/.dbt/profiles.yml`, `/snowflake/secrets/pip.conf`. Fernet-encrypts the collected files, wraps the Fernet key under an attacker-controlled RSA public key, stages the bundle to `/workspace/`.
2. **Phase 2 - Snowflake exfil.** Uses the harvested Snowflake credentials to connect to the victim`s warehouse, creates an external stage pointing at `s3://pkusinski-external/` with IAM role `arn:aws:iam::631484165566:role/pentests_s3_role`, then `COPY INTO` the stage from victim tables.

The S3 bucket name (`pkusinski-external`) and the IAM role name (`pentests_s3_role`) strongly suggest a bug-bounty or pentest operation, but the exfil capability is real: a successful run moves production Snowflake table data under attacker control. Package name is a deliberate decoy ("friendly-greeting-tools" implies a trivial text utility).

Classify as `malicious-package`.

## Cluster C - npm `noverojs` Baileys silent WhatsApp follow family continuation

`noverojs@1.0.1`/`1.0.4` (GHSA-wj4h-927q-m5xv).

Patches a Baileys socket-connect routine. Several seconds after every WhatsApp connection, the patched routine fires a `w:mex` FOLLOW query (query ID `7871414976211147`) that silently subscribes the victim to attacker-controlled newsletter channels - no user consent, no config option, no logging. Target JIDs are obscured via plain string literals, base64, base64+XOR, and runtime char-code reconstruction. Some variants fetch the target JID dynamically from attacker-hosted JSON/JS, so the follow target can rotate without a new npm publish.

GHSA calls out that `noverojs` is part of a "large family (100+ identified)" of near-identical Baileys forks sharing the same injection mechanism. Same class-of-harm as [`jexkcode` from yesterday`s sweep](https://dependencywatch.io/incident/multi-2026-09-30-ghsa-malware-sweep): unauthorized modification of the victim`s WhatsApp account.

Classify as `malicious-package`.

## Cluster D - npm `com.epi.e2e_test` meta.brs.cx dep-confusion reconnaissance beacon

`com.epi.e2e_test@1.2.2` (GHSA-76w7-xhq5-w327, source SHA-256 `5a0c1068af335818f2b9d905f2d39ebe594f84a6c63e470877692554bc95103b`).

Preinstall script collects:

- `$HOME` path
- hostname
- current username
- DNS server list
- cwd
- parent `package.json` contents

POSTs the bundle over HTTPS to `meta.brs.cx`. The `com.epi.*` prefix is atypical for public-npm names (it reads as a reverse-DNS style used in Java and in some corporate internal registries); combined with the beacon-only payload, this is a classic dep-confusion recon probe. First `meta.brs.cx` beacon in corpus.

Classify as `dependency-confusion`.

## Cluster E - npm Epic Games Store scope dep-confusion probe batch (7 packages)

All CWE-506 boilerplate GHSAs; all Amazon-Inspector-detected; all `0.0.1-security` + `1.0.0` sentinel-version co-publications. No published payload analysis - the Amazon-Inspector hashes are below for forensic correlation but the OpenSSF repository does not yet carry per-package IOC details:

- `set-egs-backend` (GHSA-whwx-38wq-2f27, hash `bbceb6929d59ced3a4df01c1d61f7da54d4d0a85e467329fecd5f44e59d43f32`)
- `qa-egs-rollback` (GHSA-p4fw-q7gp-3mq3, hash `f069cbe096962a4415247fec584da742da87006805e2e0a12d2e0a080936479d`)
- `generator-epic-react` (GHSA-g46p-chgx-c83v, hash `b7ce6d820d3b2380b3b4cba48d41e31b26d0fc74dd18635e0e01ad7a94c8ba0f`)
- `player-support-tools-ui` (GHSA-2p95-xv34-387r, hash `43e35bb951aab567fdb15daabc8db34691f937b3fefbf102bc1e19657c88aa72`, MAL-2025-49234)
- `mod-manager` (GHSA-c34f-w6mj-2346, hash `8ec890b586ea0ff47a8ba914ff95c535bdeebbdfaf6788b6357a5afae32c9463`, MAL-2025-49233)
- `ssp-config-management-tool` (GHSA-68gm-434m-pfmj, hash `db3d336f799326b6b1dfcbb9485d62b5d02423f9c6a7e7dbb4c29940c22e0ef5`)
- `store-service-worker` (GHSA-pp63-g67g-4hxq, hash `96644928dc5cfc92d966ad6cbd2a16820b0ad6951971e35c226f31e2e594f687`, MAL-2025-49239)

Naming reads as Epic Games Store or adjacent game-storefront internal scope (`-egs-`, `epic-react`, `player-support-tools`, `store-service-worker`, `generator-*`, `qa-egs-*`, `set-egs-*`, `ssp-*`, `mod-manager`). The sibling Cluster D `com.epi.e2e_test` recon beacon targets the same employer-brand naming space but with a concrete payload (meta.brs.cx beacon); whether Cluster E and Cluster D are the same operator is not disclosed.

Classify as `dependency-confusion`. Severity `medium` within the sweep until payload is analysed.

## Cluster F - npm `mms-*` scope dep-confusion probe batch (6 packages)

All CWE-506 boilerplate GHSAs; all Amazon-Inspector-detected; all `0.0.1-security` + `1.0.0` co-publications:

- `mms-ref-client` (GHSA-p4x2-g83h-x323, hash `2b3d204e0f49cb41d203a04419909bce2a366f33ab7859b4e1977374ec1db93e`)
- `mms-ref-dedserver` (GHSA-v7g9-2fm9-gf3r, hash `93da1778cc346bce6d2f674c1b600f0b6d8ea31cd2ee84b0f5d2f22df220ce3a`)
- `mms-tools` (GHSA-gvwj-w5p8-h682, hash `b68fdee506c83917c4153bbb96b046ba77fac1a06fd42a4450e0da45eaaf0620`)
- `mms-thin-client` (GHSA-557c-973f-xg6r)
- `mms-service` (GHSA-pjxq-g48x-h4jh, hash `5912faf3f600f103f64fe2d342cbd05b7146c3b78d9ee54473b28195a5185e49`, MAL-2025-49229)
- `mms-simulation` (GHSA-v994-mfhw-f42p, hash `b05f92c3ffc5ed97302ac873fd40030318d8d2d89d267c615a2b1309d5fd047b`)

Six-package co-publication; the `ref-client`/`ref-dedserver`/`thin-client`/`tools`/`service`/`simulation` suffix pattern fits a specific internal client+server+simulation stack naming (common in game-studio reference-renderer deployments and in industrial-telemetry orgs). No GHSA-side payload analysis.

Classify as `dependency-confusion`. Severity `medium` within the sweep until payload is analysed.

## Cluster G - 8 npm CWE-506 boilerplate bug-bounty researcher probes

- `my-ctf-helper-script-9921@>=0` (GHSA-7mhc-78r2-fgw8)
- `pf25262@>=0` (GHSA-3pg3-52vp-54fg)
- `pf23727@>=0` (GHSA-p2hc-jmvm-qwc9)
- `pflag14570@>=0` (GHSA-qxgf-vc83-fc34)
- `pf25133@>=0` (GHSA-8f7g-cf69-g5p8)
- `pulse-pwn-9f3a2@>=0` (GHSA-fwr5-cj49-cq4h)
- `pflag29424@>=0` (GHSA-8jr8-g7mm-57m6)
- `ddok-modal@1.0.0` (GHSA-5xvp-j6m9-rwr6)

All quarantined with the standard "any computer that has this package installed should be considered fully compromised" GHSA boilerplate. No source hash, no source code, no OpenSSF record - the GHSA was raised via a direct npm takedown rather than through an Amazon-Inspector or `kam193` route. The naming patterns (`pf`/`pflag` + 5-digit numeric suffix, `pulse-pwn` + 5-char hex suffix, `my-ctf-helper-script` + 4-digit numeric suffix) are the standard bug-bounty-researcher scope-probe fingerprint. `ddok-modal` is less obvious but fits the same CWE-506 boilerplate shape.

Classify as mixed. Severity `medium` within the sweep until payload is analysed.

## Operator continuity check

- **`tailwind-forms-kit` EtherHiding, `web-vitals-polyfill-core-v1` chinazhangsan.ccwu.cc, `bfox-build-utils` pip GH-Actions worm, `dotenv-precheck` Telegram, `fabric-loader-core`/`mfahelper`/`get-power` install-time RCE, `jexkcode` Baileys, `zeal-utils`/`zeal-util-hooks` aveliscare canary, `queeuees` py-comment vandalism**: no new publications today - all of [yesterday`s named operators](https://dependencywatch.io/incident/multi-2026-09-30-ghsa-malware-sweep) are quiet.
- **`donutautosellsrc`/`aseity*` Polygon-C2 pip campaign**: no fresh publications (day 4 silent).
- **Baileys silent-WhatsApp-follow family**: continues with `noverojs` (Cluster C today) following `jexkcode` yesterday. The operator`s publish cadence makes a fresh variant likely every 24-48h.
- **Snowflake credential-theft family**: `friendly-greeting-tools` (Cluster B) is new to this corpus. Watch for other packages exfiltrating to `s3://pkusinski-external/` or impersonating harmless pip utilities with Snowflake-token selectors.
- **Dep-confusion scope probes**: Epic Games Store scope (Cluster E) and the `mms-*` scope (Cluster F) are both new co-publications in this window; the `com.epi.e2e_test` sibling (Cluster D) carries a concrete `meta.brs.cx` beacon.

## Registry state

All 26 packages in this sweep are npm/pip-quarantined at time of writing. Active operator-side infrastructure unique to today`s batch:

- `s3://pkusinski-external/` and AWS account `631484165566` IAM role `pentests_s3_role` (Cluster B)
- `meta.brs.cx` (Cluster D)
- Baileys follow query ID `7871414976211147` with rotatable JID (Cluster C)

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector`, `kam193/bad-packages`. Per-package IOC details drawn from GHSA advisory bodies and OpenSSF malicious-packages MAL records published between 2026-09-30 12:00 UTC and 2026-10-01 12:00 UTC.

## Impact

- **Cluster A - pip `beautifytext` import-time RAT (real payload, malicious-package)**: `beautifytext@1.0.3`/`1.0.4`/`1.0.7` (GHSA-j7g2-8pxv-8gv2, OpenSSF campaign `2026-07-beautifytext`, source SHA-256 `cba19cfc0b2bdeec177fafdffa10e730769079a14ece3bb4740bfc0ded9fef3b`). On `import beautifytext`, "silently spawns a separate process that waits for and executes remote commands" per the GHSA body. Classified as remote-access-trojan by OpenSSF `kam193`. The campaign slug (`2026-07`) is older than the publish date - the sample was identified by `kam193/bad-packages` in July and only reached GHSA on 2026-09-30. Treat as live RAT in the wild for any Python developer who pip-installed it
- **Cluster B - pip `friendly-greeting-tools` Snowflake credential-theft stealer to attacker-controlled S3 (real payload, malicious-package)**: `friendly-greeting-tools@0.1.0`/`0.1.1`/`0.2`/`0.3`/`0.3.1`-`0.3.7` (GHSA-97c4-9mc7-j7wv, OpenSSF campaign `2026-09-friendly-greeting-tools`, source SHA-256 `4d584c571cf5d112735aefd07c78bc19659af32f5950b1331a4970cba97c9707` amazon-inspector + `e15a50ec5b7be580dec5d1edefa80860b4c650d552f69a1a9ba3dc9bd8edbc9d` kam193). Two-phase payload, both stages base64+gzip-encoded Python blobs executed via `exec()`. Phase 1 harvests Snowflake and dbt credentials from `/snowflake/session/token`, `/root/.snowflake/connections.toml`, `/root/.dbt/profiles.yml`, `/snowflake/secrets/pip.conf`; Fernet-encrypts them, wraps the Fernet key under an attacker RSA public key, stages the bundle to `/workspace/`. Phase 2 uses the stolen Snowflake creds to connect to the victim`s warehouse, creates an external stage pointing at `s3://pkusinski-external/` with IAM role `arn:aws:iam::631484165566:role/pentests_s3_role`, then `COPY INTO` the stage from victim tables. The S3 bucket and IAM role names strongly suggest a bug-bounty / pentest operation ("pentests_s3_role") but the exfil capability is real and would move production Snowflake data to attacker control. Package name impersonates a harmless greeting utility
- **Cluster C - npm `noverojs` Baileys silent WhatsApp follow family continuation (unauthorized-account-modification, malicious-package)**: `noverojs@1.0.1`/`1.0.4` (GHSA-wj4h-927q-m5xv). Patches a Baileys socket-connect routine so that several seconds after every WhatsApp connection a `w:mex` FOLLOW query (query ID `7871414976211147`) silently subscribes the victim to attacker-controlled newsletter channels. Target JIDs obscured via plain string, base64, base64+XOR, and runtime char-code reconstruction; some variants fetch the target JID dynamically from attacker-hosted JSON/JS, so the follow target can rotate without re-publishing the package. GHSA notes `noverojs` is part of a "large family (100+ identified)" of near-identical Baileys forks sharing the same injection mechanism - same class-of-harm as [`jexkcode` yesterday](https://dependencywatch.io/incident/multi-2026-09-30-ghsa-malware-sweep)
- **Cluster D - npm `com.epi.e2e_test` meta.brs.cx dep-confusion reconnaissance beacon (recon-beacon, dependency-confusion)**: `com.epi.e2e_test@1.2.2` (GHSA-76w7-xhq5-w327, source SHA-256 `5a0c1068af335818f2b9d905f2d39ebe594f84a6c63e470877692554bc95103b`). Preinstall script collects HOME path, hostname, username, DNS server list, cwd, and the parent `package.json`; POSTs the bundle over HTTPS to `meta.brs.cx`. The `com.epi.*` prefix (atypical for public-npm names, matches the reverse-DNS style used in Epic/EPIC internal registries) and the beacon-only payload read as a dep-confusion probe. First `meta.brs.cx` beacon in corpus
- **Cluster E - npm Epic Games Store (EGS) scope dep-confusion probe batch, 7 packages, Amazon-Inspector-detected CWE-506 boilerplate (dependency-confusion, no analysis)**: `set-egs-backend@0.0.1-security`/`1.0.0` (GHSA-whwx-38wq-2f27, hash `bbceb6929d59ced3a4df01c1d61f7da54d4d0a85e467329fecd5f44e59d43f32`), `qa-egs-rollback@0.0.1-security`/`1.0.0` (GHSA-p4fw-q7gp-3mq3, hash `f069cbe096962a4415247fec584da742da87006805e2e0a12d2e0a080936479d`), `generator-epic-react@0.0.1-security`/`1.0.0` (GHSA-g46p-chgx-c83v, hash `b7ce6d820d3b2380b3b4cba48d41e31b26d0fc74dd18635e0e01ad7a94c8ba0f`), `player-support-tools-ui@0.0.1-security`/`1.0.0` (GHSA-2p95-xv34-387r, hash `43e35bb951aab567fdb15daabc8db34691f937b3fefbf102bc1e19657c88aa72`, MAL-2025-49234), `mod-manager@0.0.1-security`/`1.0.0` (GHSA-c34f-w6mj-2346, hash `8ec890b586ea0ff47a8ba914ff95c535bdeebbdfaf6788b6357a5afae32c9463`, MAL-2025-49233), `ssp-config-management-tool@0.0.1-security`/`1.0.0` (GHSA-68gm-434m-pfmj, hash `db3d336f799326b6b1dfcbb9485d62b5d02423f9c6a7e7dbb4c29940c22e0ef5`), `store-service-worker@0.0.1-security`/`1.0.0` (GHSA-pp63-g67g-4hxq, hash `96644928dc5cfc92d966ad6cbd2a16820b0ad6951971e35c226f31e2e594f687`, MAL-2025-49239). The `-egs-`/`epic-react`/`player-support-tools`/`store-service-worker`/`generator-*`/`qa-egs-*`/`set-egs-*`/`ssp-*`/`mod-manager` naming all reads as Epic Games Store or adjacent game-storefront internal-scope dep-confusion. CWE-506 boilerplate, no payload analysis in GHSAs - treat as `medium` for sweep purposes
- **Cluster F - npm `mms-*` scope dep-confusion probe batch, 6 packages, Amazon-Inspector-detected CWE-506 boilerplate (dependency-confusion, no analysis)**: `mms-ref-client@0.0.1-security`/`1.0.0` (GHSA-p4x2-g83h-x323, hash `2b3d204e0f49cb41d203a04419909bce2a366f33ab7859b4e1977374ec1db93e`), `mms-ref-dedserver@0.0.1-security`/`1.0.0` (GHSA-v7g9-2fm9-gf3r, hash `93da1778cc346bce6d2f674c1b600f0b6d8ea31cd2ee84b0f5d2f22df220ce3a`), `mms-tools@0.0.1-security`/`1.0.0` (GHSA-gvwj-w5p8-h682, hash `b68fdee506c83917c4153bbb96b046ba77fac1a06fd42a4450e0da45eaaf0620`), `mms-thin-client@0.0.1-security`/`1.0.0` (GHSA-557c-973f-xg6r), `mms-service@0.0.1-security`/`1.0.0` (GHSA-pjxq-g48x-h4jh, hash `5912faf3f600f103f64fe2d342cbd05b7146c3b78d9ee54473b28195a5185e49`, MAL-2025-49229), `mms-simulation@0.0.1-security`/`1.0.0` (GHSA-v994-mfhw-f42p, hash `b05f92c3ffc5ed97302ac873fd40030318d8d2d89d267c615a2b1309d5fd047b`). Six-package co-published batch targeting an internal `mms-*` scope (`ref-client`, `ref-dedserver`, `thin-client`, `tools`, `service`, `simulation` fits a client+server+simulation stack naming - probable game-studio or industrial-telemetry internal namespace). No GHSA-side analysis - treat as `medium` for sweep purposes
- **Cluster G - 8 npm CWE-506 boilerplate bug-bounty researcher probe takedowns (mixed kinds, unclassified, no analysis)**: `my-ctf-helper-script-9921@>=0` (GHSA-7mhc-78r2-fgw8), `pf25262@>=0` (GHSA-3pg3-52vp-54fg), `pf23727@>=0` (GHSA-p2hc-jmvm-qwc9), `pflag14570@>=0` (GHSA-qxgf-vc83-fc34), `pf25133@>=0` (GHSA-8f7g-cf69-g5p8), `pulse-pwn-9f3a2@>=0` (GHSA-fwr5-cj49-cq4h), `pflag29424@>=0` (GHSA-8jr8-g7mm-57m6), `ddok-modal@1.0.0` (GHSA-5xvp-j6m9-rwr6). All quarantined with the standard "any computer that has this package installed should be considered fully compromised" GHSA boilerplate; no source code, no source hash, no OpenSSF record. The `pf*`/`pflag*`/`pulse-pwn-*`/`my-ctf-helper-script-*` naming patterns (short numeric or hex suffix after a `pf`/`pflag`/`pwn`/`ctf` stem) are the standard bug-bounty-researcher scope-probe fingerprint. Treat as `medium` for sweep purposes
- **Operator continuity check**: no fresh `tailwind-forms-kit`/`web-vitals-polyfill-core-v1`/`bfox-build-utils`/`dotenv-precheck`/`fabric-loader-core`/`mfahelper`/`get-power`/`jexkcode`/`zeal-utils`/`zeal-util-hooks`/`queeuees` publications today - [yesterday`s named operators](https://dependencywatch.io/incident/multi-2026-09-30-ghsa-malware-sweep) are quiet. Also no new `tailwind-forms-kit` EtherHiding wallet-rotation on `0xa322E5...63e1a`; no fresh `chinazhangsan.ccwu.cc` DoH + PWA_ROUTER service-worker variants; no fresh `donutautosellsrc`/`aseity*` Polygon-C2 pip publications (day 4). The Baileys silent-WhatsApp-follow family continues (`noverojs` Cluster C today, following `jexkcode` yesterday) - the operator`s publish cadence makes a fresh variant likely every 24-48h. The `beautifytext` RAT and `friendly-greeting-tools` Snowflake stealer are both new families to this corpus

## What to do

1. Grep every `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `package.json`, `requirements.txt`, `Pipfile.lock`, `poetry.lock`, and `pyproject.toml` for every package name in Clusters A through G. Uninstall on hit, wipe `node_modules`/`.venv`, delete the lockfile, rebuild against a clean cache. Clusters A, B, and C carry confirmed real payloads (RAT, Snowflake credential theft, unauthorized WhatsApp account modification); a hit on any of those is a compromise, not a warning
2. **For Cluster A (pip `beautifytext` import-time RAT)**: uninstall on hit. Any Python environment that imported this package was briefly turned into a RAT host - rotate every credential that lived on the installer`s machine or runner. Grep for the sha256 `cba19cfc0b2bdeec177fafdffa10e730769079a14ece3bb4740bfc0ded9fef3b` across archived pip caches to confirm the specific tarball if present. OpenSSF kam193 identified this sample in July but it only reached GHSA on 2026-09-30; audit install logs back to that window
3. **For Cluster B (pip `friendly-greeting-tools` Snowflake credential stealer)**: uninstall on hit. If the installer had Snowflake credentials in reach (`/snowflake/session/token`, `connections.toml`, dbt `profiles.yml`): rotate every Snowflake user whose creds those files held, review warehouse query history for unexpected `CREATE STAGE` or `COPY INTO` statements pointing at `s3://pkusinski-external/`, and audit AWS CloudTrail for any `AssumeRole` into `arn:aws:iam::631484165566:role/pentests_s3_role` from the warehouse. Block outbound HTTPS egress from CI and warehouse networks to `s3://pkusinski-external/` and to the AWS account `631484165566`. The `pentests_s3_role` name reads as a pentest/bug-bounty operation, but data that reached that bucket is still exfiltrated
4. **For Cluster C (npm `noverojs` Baileys silent WhatsApp follow)**: uninstall on hit. Any WhatsApp account that connected via a Baileys client bundling `noverojs` between the malicious versions is now silently following the attacker`s newsletter JID - check the account`s subscribed newsletters and unsubscribe. Not a credential-theft class incident but a persistent unauthorized account modification. Add the whole family of lookalike-Baileys-fork names (`jexkcode`, `noverojs`, and the 100+ unnamed siblings the GHSA references) to lockfile-lint and reject any Baileys-named fork from an unknown publisher
5. **For Cluster D (npm `com.epi.e2e_test` meta.brs.cx recon beacon)**: uninstall on hit. If the beacon reached `meta.brs.cx`, the operator now has the installer`s hostname, username, DNS config, cwd, and the local `package.json` - review the parent app for any sensitive strings that would leak in the package.json (deploy webhooks, repo URLs). Review internal registries for any `com.epi.*` namespace in use and verify every public-side name under that prefix is explicitly held or reserved by your team
6. **For Cluster E (npm Epic Games Store scope dep-confusion probe batch)**: uninstall on hit. Even though the GHSA bodies carry only CWE-506 boilerplate, these are classic private-registry sentinel-version (`0.0.1-security` + `1.0.0`) dep-confusion probes - any team with an internal `set-egs-*`, `qa-egs-*`, `generator-epic-*`, `player-support-tools-*`, `mod-manager`, `ssp-*`, or `store-service-worker` name needs to confirm the public-npm name of the same string is held and quarantined. Block outbound HTTPS from CI networks that do not have a legitimate reason to resolve to arbitrary attacker beacons during install - combined with `--ignore-scripts`, that defuses most dep-confusion recon payloads
7. **For Cluster F (npm `mms-*` scope dep-confusion probe batch)**: uninstall on hit. The six-package `mms-ref-client`/`-ref-dedserver`/`-thin-client`/`-tools`/`-service`/`-simulation` co-publication fits a specific internal client+server+simulation stack naming (common in game-studio and industrial-telemetry orgs) - any team with an internal namespace matching that pattern should audit it against the public names in this cluster and reserve the public-npm names. CWE-506 boilerplate GHSAs; treat as `medium` while payload is unknown
8. **For Cluster G (npm CWE-506 boilerplate bug-bounty probe batch)**: uninstall on hit. Without payload analysis assume real infostealer/RCE at time of quarantine - image the host, rotate installer-user credentials, check outbound telemetry from the install window. Add all 8 names to lockfile-lint. The `pf*`/`pflag*`/`pulse-pwn-*`/`my-ctf-helper-*`/`ddok-*` naming is almost certainly researcher bug-bounty-scope; safe to add to blocklist regardless
9. Keep prior egress blocks in place: Ethereum mainnet RPC endpoints (per 2026-09-30 Cluster A `tailwind-forms-kit`), Ethereum Sepolia RPC endpoints (per [`indexed-btree`](https://dependencywatch.io/incident/npm-2026-09-17-indexed-btree-sepolia-etherhiding)), `chinazhangsan.ccwu.cc`, `gist.githubusercontent.com/chinazhangsan999-crypto`, `api.npoint.io`, `api.telegram.org` (from CI), `fabric-npm.gm-service.xyz`, `www.jsonkeeper.com`, `github.com/trktgq0wbre1`, `npm-canary.aveliscare.com`, Polygon RPC endpoints. Add for today: `meta.brs.cx`, `s3://pkusinski-external/` and AWS account `631484165566` (block outbound from Snowflake warehouses and CI), and any Baileys-fork package from an unknown publisher

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-j7g2-8pxv-8gv2 - pip beautifytext (Cluster A - import-time RAT, OpenSSF campaign 2026-07-beautifytext)](https://github.com/advisories/GHSA-j7g2-8pxv-8gv2) - GitHub
- [GHSA-97c4-9mc7-j7wv - pip friendly-greeting-tools (Cluster B - Snowflake credential theft to s3://pkusinski-external/)](https://github.com/advisories/GHSA-97c4-9mc7-j7wv) - GitHub
- [GHSA-wj4h-927q-m5xv - npm noverojs (Cluster C - Baileys silent WhatsApp follow, family continuation)](https://github.com/advisories/GHSA-wj4h-927q-m5xv) - GitHub
- [GHSA-76w7-xhq5-w327 - npm com.epi.e2e_test (Cluster D - meta.brs.cx dep-confusion reconnaissance beacon)](https://github.com/advisories/GHSA-76w7-xhq5-w327) - GitHub
- [GHSA-whwx-38wq-2f27 - npm set-egs-backend (Cluster E - Epic Games Store scope dep-confusion probe)](https://github.com/advisories/GHSA-whwx-38wq-2f27) - GitHub
- [GHSA-p4fw-q7gp-3mq3 - npm qa-egs-rollback (Cluster E - EGS scope dep-confusion probe)](https://github.com/advisories/GHSA-p4fw-q7gp-3mq3) - GitHub
- [GHSA-g46p-chgx-c83v - npm generator-epic-react (Cluster E - EGS scope dep-confusion probe)](https://github.com/advisories/GHSA-g46p-chgx-c83v) - GitHub
- [GHSA-2p95-xv34-387r - npm player-support-tools-ui (Cluster E - EGS scope dep-confusion probe, MAL-2025-49234)](https://github.com/advisories/GHSA-2p95-xv34-387r) - GitHub
- [GHSA-c34f-w6mj-2346 - npm mod-manager (Cluster E - EGS scope dep-confusion probe, MAL-2025-49233)](https://github.com/advisories/GHSA-c34f-w6mj-2346) - GitHub
- [GHSA-68gm-434m-pfmj - npm ssp-config-management-tool (Cluster E - EGS scope dep-confusion probe)](https://github.com/advisories/GHSA-68gm-434m-pfmj) - GitHub
- [GHSA-pp63-g67g-4hxq - npm store-service-worker (Cluster E - EGS scope dep-confusion probe, MAL-2025-49239)](https://github.com/advisories/GHSA-pp63-g67g-4hxq) - GitHub
- [GHSA-p4x2-g83h-x323 - npm mms-ref-client (Cluster F - mms-* scope dep-confusion probe)](https://github.com/advisories/GHSA-p4x2-g83h-x323) - GitHub
- [GHSA-v7g9-2fm9-gf3r - npm mms-ref-dedserver (Cluster F - mms-* scope dep-confusion probe)](https://github.com/advisories/GHSA-v7g9-2fm9-gf3r) - GitHub
- [GHSA-gvwj-w5p8-h682 - npm mms-tools (Cluster F - mms-* scope dep-confusion probe)](https://github.com/advisories/GHSA-gvwj-w5p8-h682) - GitHub
- [GHSA-557c-973f-xg6r - npm mms-thin-client (Cluster F - mms-* scope dep-confusion probe)](https://github.com/advisories/GHSA-557c-973f-xg6r) - GitHub
- [GHSA-pjxq-g48x-h4jh - npm mms-service (Cluster F - mms-* scope dep-confusion probe, MAL-2025-49229)](https://github.com/advisories/GHSA-pjxq-g48x-h4jh) - GitHub
- [GHSA-v994-mfhw-f42p - npm mms-simulation (Cluster F - mms-* scope dep-confusion probe)](https://github.com/advisories/GHSA-v994-mfhw-f42p) - GitHub
- [GHSA-7mhc-78r2-fgw8 - npm my-ctf-helper-script-9921 (Cluster G - bug-bounty researcher probe, CWE-506 boilerplate)](https://github.com/advisories/GHSA-7mhc-78r2-fgw8) - GitHub
- [GHSA-3pg3-52vp-54fg - npm pf25262 (Cluster G - bug-bounty researcher probe, CWE-506 boilerplate)](https://github.com/advisories/GHSA-3pg3-52vp-54fg) - GitHub
- [GHSA-p2hc-jmvm-qwc9 - npm pf23727 (Cluster G - bug-bounty researcher probe, CWE-506 boilerplate)](https://github.com/advisories/GHSA-p2hc-jmvm-qwc9) - GitHub
- [GHSA-qxgf-vc83-fc34 - npm pflag14570 (Cluster G - bug-bounty researcher probe, CWE-506 boilerplate)](https://github.com/advisories/GHSA-qxgf-vc83-fc34) - GitHub
- [GHSA-8f7g-cf69-g5p8 - npm pf25133 (Cluster G - bug-bounty researcher probe, CWE-506 boilerplate)](https://github.com/advisories/GHSA-8f7g-cf69-g5p8) - GitHub
- [GHSA-fwr5-cj49-cq4h - npm pulse-pwn-9f3a2 (Cluster G - bug-bounty researcher probe, CWE-506 boilerplate)](https://github.com/advisories/GHSA-fwr5-cj49-cq4h) - GitHub
- [GHSA-8jr8-g7mm-57m6 - npm pflag29424 (Cluster G - bug-bounty researcher probe, CWE-506 boilerplate)](https://github.com/advisories/GHSA-8jr8-g7mm-57m6) - GitHub
- [GHSA-5xvp-j6m9-rwr6 - npm ddok-modal (Cluster G - CWE-506 boilerplate, no analysis)](https://github.com/advisories/GHSA-5xvp-j6m9-rwr6) - GitHub

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-01-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-01-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).