GitHub Advisory malware sweep - 2026-10-01 (late) + 2026-10-02 (npm Baileys silent WhatsApp follow mass batch, 15 siblings sharing query ID `7871414976211147`: `@xayz/baileys`, `xvinleys`, `yonzoffic-baileys`, `xzbails`, `xzvexpzcbailey`, `yonzofficial`, `kiyoramarkets`, `kasabaileys`, `my-baileys`, `lilys-baileys`, `noxleyss`, `syncxbails`, `whalibmob`, `ishumdz-bail`, `eliteprotech-baileys`; pip `spo365-graph` NEW campaign - AWS Lambda deploy + AWS Secrets Manager credential theft; pip `friendly-tools` Snowflake credential-theft `friendly-greeting-tools` family continuation; pip `shortneer` Chrome-extension crypto-wallet + Telegram infostealer (`sherpy` campaign continuation); npm `future-scripts` browser DoS `boom()` time-bomb detonating 2026-10-10; npm `online-header@99.0.0` sentinel-version malicious-domain beacon; 5 npm CWE-506 boilerplate takedowns `illusion-datalab`, `homestack-cheer`, `kartykgithub-ph-f`, `kartykgithub-ph-e`, `kartykgithub-ph-b`)

What happened

Between roughly 2026-10-01 12:00 UTC and 2026-10-02 12:00 UTC, the GitHub Advisory Database (with the OpenSSF malicious-packages bulk export, Amazon Inspectors IN-MAL feed, and kam193/bad-packages) published ~26 new malware advisories: 23 npm and 3 pip. The defensively noteworthy shape of todays window is dominated by a single-operator mass push of 15 Baileys silent-WhatsApp-follow siblings (same query ID 7871414976211147 as jexkcode and noverojs); three distinct confirmed-payload pip samples (spo365-graph AWS credential theft NEW campaign, friendly-tools Snowflake credential theft family continuation, shortneer Chrome-wallet + Telegram stealer); one novel browser DoS time-bomb set for 2026-10-10 (future-scripts); and the usual tail of CWE-506 boilerplate takedowns (illusion-datalab, homestack-cheer, three kartykgithub-ph-* red-team artefacts).

Cluster A - npm Baileys silent WhatsApp follow mass batch (15 siblings)

15 packages sharing the hardcoded w:mex FOLLOW query ID 7871414976211147, the same socket-patch mechanism catalogued in jexkcode and noverojs:

The primitive. Each package patches a Baileys socket-connect routine so that seconds after every WhatsApp connection the installer`s own authenticated session issues a FOLLOW query against attacker-controlled newsletter/channel JIDs - no user consent, no config option, no logging. Target JIDs are obscured per-package via plain string literals, base64, base64+XOR, or runtime char-code arrays; some variants fetch the target JID list dynamically from attacker-hosted JSON/JS, so the follow target can rotate without re-publishing the package.

Family size. GHSA calls out that each of these is one of "a large family (100+ identified as of September 2026) of near-identical forks" sharing the same injection mechanism - today`s 15 entries are a visible slice of a bigger backlog arriving in GHSA this week.

Classify as malicious-package for each. Class-of-harm is unauthorized modification of the victim`s WhatsApp account.

Cluster B - pip spo365-graph AWS Lambda + Secrets Manager credential theft

spo365-graph@1.0.0/1.1.0/1.1.1/1.1.2 (GHSA-jf8h-4jc3-c652, OpenSSF campaign 2026-10-spo365-graph, source SHA-256 ea8dd7600717964f4ca8f8b1134f867f4bf69f1538243d5c7da752eefed99fe1).

Malicious payload introduced in 1.1.2. Overrides the install command in setup.py to execute during pip install. The payload:

1. Deploys unauthorized AWS Lambda functions in the installer`s AWS account.
2. Extracts credentials from AWS Secrets Manager - any secret the installers identity can read via secretsmanager:GetSecretValue`.
3. Harvests additional system and environment data.
4. Exfiltrates the stolen bundle to attacker-controlled infrastructure.

Package name impersonates a SharePoint Online 365 Microsoft Graph API helper (plausible utility for any Microsoft 365 automation script). First member of this corpus - fresh OpenSSF campaign slug 2026-10-spo365-graph (distinct from yesterdays friendly-greeting-tools` Snowflake exfil, both in pip but different target cloud).

Classify as malicious-package.

Cluster C - pip friendly-tools Snowflake credential-theft family continuation

friendly-tools@0.1/0.2 (GHSA-8hwj-527f-mmvm, OpenSSF campaign 2026-09-friendly-greeting-tools, source SHA-256 969afb49a1e59fa643e9d90d07745e3957906cc9603c4e5643e5760d5f254381).

Shares the OpenSSF campaign slug with yesterdays [friendly-greeting-tools](/incident/multi-2026-10-01-ghsa-malware-sweep) Cluster B - same operator, dropped-prefix sibling. Obfuscated code exfiltrates data from the environment targeting primarily Snowflake databases and the credentials to them. GHSA note: "some evidence suggests involvement in penetration testing activities" - the pentests_s3_role IAM role in yesterdays stage URL (arn:aws:iam::631484165566:role/pentests_s3_role) supports that read. But the exfil capability is real: a successful run moves production Snowflake table data under attacker control.

Classify as malicious-package.

Cluster D - pip shortneer Chrome-extension crypto-wallet + Telegram stealer

shortneer@0.1.0 (GHSA-2wm2-fc38-63vw, OpenSSF campaign 2026-09-sherpy, source SHA-256 5e166ae1253c886885381cb5087f67a59a869cad6ece6f3ac40aefc6e463c27f).

Same OpenSSF campaign as the pip sherpy Chrome-wallet + Telegram infostealer from 2026-09-26 - same operator six days later. Exfiltrates Chrome extension files (likely targeting cryptocurrency wallet extensions - MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Rabby, Keplr) and Telegram-related files from the compromised host. OpenSSF classification: infostealer, crypto-wallet-drain, credential-theft, native-extension targeting.

Classify as malicious-package.

Cluster E - npm future-scripts browser DoS time-bomb detonating 2026-10-10

future-scripts@0.0.2/0.0.3 (GHSA-c9xw-xmvx-ffm7, MAL-2026-17418, source hash 03666f5e7d007a161251954396c72a1a546a29e7).

Contains a function boom() scheduled to activate on 2026-10-10 that calls localStorage.setItem(key, i) 100,000,000 times in a synchronous loop, freezing any browser tab that reaches it.

• 0.0.1 - clean.
• 0.0.2 - exported getCommonDateInRanges() triggers boom() automatically before validating inputs. Any downstream library that calls that function detonates the DoS at the user with no attacker action.
• 0.0.3 - detonator still bundled but requires explicit invocation; reduced exploitability.

GHSA marks it a "static finding" with no confirmed real-world victim yet, but the time-bomb is live - any site that ships this transitively will freeze on 2026-10-10. Audit npm ls future-scripts / yarn why future-scripts / pnpm why future-scripts across every production bundle NOW, before the detonation date.

Classify as malicious-package. Class-of-harm is denial-of-service against end users.

Cluster F - npm online-header@99.0.0 sentinel-version malicious-domain beacon

online-header@99.0.0 (GHSA-hg4r-6gv8-6hmj, MAL-2026-17420, source SHA-256 161e267d603ad6aae77c0c365e895c8e40538da2c09f746c2183124434509fdc).

OpenSSF Package Analysis flagged for communicating with a domain associated with malicious activity. The 99.0.0 single-version publication is the classic sentinel-version shape of a dep-confusion probe or a quick malicious push against a hypothetical internal online-header name - but the OpenSSF classification is based on a confirmed C2 beacon rather than a plain CWE-506 takedown.

Classify as malicious-package (not dep-confusion - the OpenSSF confirmed beacon raises it above a plain probe).

Cluster G - 5 npm CWE-506 boilerplate takedowns

All five carry only the standard "any computer that has this package installed should be considered fully compromised" GHSA boilerplate; no source hash, no source code, no OpenSSF record. The three kartykgithub-ph-* extend the kartyk* red-team pattern catalogued across 2026-09-16, 2026-09-17, and 2026-09-18 sweeps.

Classify as mixed. Severity medium within the sweep until payload is analysed.

Operator continuity check

• jexkcode/noverojs Baileys silent-WhatsApp-follow family: 15 fresh siblings in a single window today (Cluster A). The "100+ identified" GHSA language implies more will arrive this week.
• friendly-greeting-tools/friendly-tools pip Snowflake credential-theft family (pkusinski-external S3): on day 2 (friendly-tools continues yesterday).
• sherpy/shortneer pip Chrome-wallet + Telegram stealer: active again today, six days after the last catalogued publication.
• *`kartyk red-team engagement**: on day 4+. Three fresh kartykgithub-ph-* siblings in todays sweep.
• tailwind-forms-kit EtherHiding (Ethereum mainnet wallet 0xa322E5...63e1a), chinazhangsan.ccwu.cc DoH + PWA_ROUTER service-worker, bfox-build-utils pip GH-Actions worm, dotenv-precheck Telegram wallet-mnemonic exfil, fabric-loader-core/mfahelper/get-power install-time RCE, zeal-utils/zeal-util-hooks aveliscare canary, queeuees py-comment vandalism: no new publications in today`s window.
• *donutautosellsrc/`aseity` Polygon-C2 pip campaign**: no fresh publications (day 5 silent).
• *`com.epi./meta.brs.cx` dep-confusion recon beacon**: no fresh publications today.
• New to corpus: spo365-graph AWS Lambda + Secrets Manager credential theft campaign (Cluster B, OpenSSF campaign 2026-10-spo365-graph); future-scripts 2026-10-10 browser DoS time-bomb (Cluster E, novel class).

Registry state

All 26 packages in this sweep are npm/pip-quarantined at time of writing. Active operator-side infrastructure unique to today`s batch:

• Baileys follow query ID 7871414976211147 with per-package rotatable JID obfuscation (Cluster A - continuation of jexkcode/noverojs operator primitive)
• spo365-graph payload creates unauthorized AWS Lambda functions + reads from AWS Secrets Manager; specific attacker C2 destination for the exfil bundle not disclosed in the GHSA body (Cluster B)
• s3://pkusinski-external/ S3 bucket and AWS account 631484165566 IAM role pentests_s3_role (Cluster C, continuation of yesterday`s Snowflake exfil)
• boom() detonation date 2026-10-10 - 8 days from this sweep (Cluster E)
• online-header@99.0.0 malicious-domain beacon; specific destination domain not disclosed in GHSA body (Cluster F)

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193/bad-packages. Per-package IOC details drawn from GHSA advisory bodies and OpenSSF malicious-packages MAL records published between 2026-10-01 12:00 UTC and 2026-10-02 12:00 UTC.

Affected packages (25)

Impact

• Cluster A - npm Baileys silent WhatsApp follow mass batch, 15 siblings (unauthorized-account-modification, malicious-package): all share hardcoded w:mex FOLLOW query ID 7871414976211147, same socket-patch mechanism documented in jexkcode and noverojs. GHSA calls out "a large family (100+ identified as of September 2026) of near-identical forks". Each package patches a Baileys socket-connect routine so that seconds after every WhatsApp connection the installers own authenticated session issues a FOLLOW query against attacker-controlled newsletter/channel JIDs, silently subscribing the victim account - no user consent, no config option, no logging. Target JIDs are obscured per-package via plain strings, base64, base64+XOR, or runtime char-code arrays; some variants fetch the target JID list dynamically from remote GitHub/JSON hosts so the follow target can rotate without re-publishing. Packages and GHSAs: @xayz/baileys 3.0.0/4.0.0/5.0.0/6.0.0-6.0.75/6.1.0-6.1.8 (GHSA-75px-x2r4-9f98); xvinleys@1.0.0 (GHSA-vpxr-24w4-56qf); yonzoffic-baileys@8.6.90 (GHSA-j5q9-mf2r-jhf9); xzbails@0.0.3-0.0.5 (GHSA-w8fw-prwf-rpmg); xzvexpzcbailey@1.0.0/2.0.0/2.1.0/2.5.0 (GHSA-fwmc-x797-fpr6); yonzofficial@2.1.0-2.1.3 (GHSA-5jww-9h4j-x7w7); kiyoramarkets@8.0.16 (GHSA-mjx8-f269-h2qf); kasabaileys@0.3.15/1.0.0/1.0.1/1.0.2 (GHSA-vrqh-8vm7-r584); my-baileys@1.0.1-1.0.5 (GHSA-xgfv-rm5m-vffw); lilys-baileys@1.3.2/1.3.3 (GHSA-xcqq-823x-hhv7); noxleyss@1.0.0/1.1.0-1.1.11 (GHSA-wf8j-w269-5xwv); syncxbails@1.0.0/1.0.1 (GHSA-hvc6-5q6j-2867); whalibmob@5.24.0-5.33.5 (GHSA-g2qq-9229-mhjq); ishumdz-bail@1.0.1-1.0.16 excl 1.0.5/1.0.12 (GHSA-hpmr-5fvg-hvqf); eliteprotech-baileys@1.1.0/1.1.1/1.1.2 (GHSA-jjr8-hv8r-m5x7). Not credential theft or RCE - class-of-harm is unauthorized modification of the victims WhatsApp account (silent channel/newsletter subscription for operator reach-boosting)
• Cluster B - pip spo365-graph AWS Lambda + Secrets Manager credential theft (NEW CAMPAIGN, malicious-package): spo365-graph@1.0.0/1.1.0/1.1.1/1.1.2 (GHSA-jf8h-4jc3-c652, OpenSSF campaign 2026-10-spo365-graph, source SHA-256 ea8dd7600717964f4ca8f8b1134f867f4bf69f1538243d5c7da752eefed99fe1). Malicious payload introduced in 1.1.2. Overrides the install command in setup.py to execute during pip install. Deploys unauthorized AWS Lambda functions, extracts credentials from AWS Secrets Manager, harvests additional system and environment data, and exfiltrates the stolen secrets to attacker infrastructure. Package name impersonates a SharePoint Online 365 Microsoft Graph helper (plausible utility for Microsoft 365 automation scripts). First member of this corpus - fresh OpenSSF campaign slug 2026-10-spo365-graph. Distinct infrastructure from yesterdays friendly-greeting-tools` Snowflake exfil
• Cluster C - pip friendly-tools Snowflake credential-theft family continuation (malicious-package): friendly-tools@0.1/0.2 (GHSA-8hwj-527f-mmvm, OpenSSF campaign 2026-09-friendly-greeting-tools, source SHA-256 969afb49a1e59fa643e9d90d07745e3957906cc9603c4e5643e5760d5f254381). Shares the OpenSSF campaign slug with yesterdays [friendly-greeting-tools](/incident/multi-2026-10-01-ghsa-malware-sweep) Cluster B (same operator, dropped-prefix sibling). Obfuscated code exfiltrates data from the environment, targeting primarily Snowflake databases and the credentials to them. Advisory notes some evidence suggests involvement in penetration testing - but the exfil capability is real whichever side it was published for. Add to the egress block already in place for s3://pkusinski-external/ and AWS account 631484165566`
• Cluster D - pip shortneer Chrome-extension crypto-wallet + Telegram stealer (sherpy family continuation, malicious-package): shortneer@0.1.0 (GHSA-2wm2-fc38-63vw, OpenSSF campaign 2026-09-sherpy, source SHA-256 5e166ae1253c886885381cb5087f67a59a869cad6ece6f3ac40aefc6e463c27f). Same OpenSSF campaign as the pip sherpy Chrome-wallet + Telegram infostealer from 2026-09-26. Exfiltrates Chrome extension files (crypto wallets - MetaMask, Phantom, and similar extension IDs) and Telegram-related files from the compromised host. Classified by OpenSSF as infostealer with crypto-wallet-drain + credential-theft + native-extension targeting
• Cluster E - npm future-scripts browser DoS time-bomb detonating 2026-10-10 (malicious-package): future-scripts@0.0.2/0.0.3 (GHSA-c9xw-xmvx-ffm7, MAL-2026-17418, source hash 03666f5e7d007a161251954396c72a1a546a29e7). Contains function boom() scheduled to activate on 2026-10-10 that calls localStorage.setItem(key, i) 100,000,000 times in a synchronous loop, freezing any browser tab that reaches it. In 0.0.2 the exported getCommonDateInRanges() triggers boom() automatically before validating inputs - any downstream library that calls that function detonates the DoS at the user. In 0.0.3 the detonator is still bundled but requires explicit invocation. 0.0.1 is clean. GHSA marks it a "static finding" with no confirmed real-world victim yet, but the time-bomb is live - any site that ships this transitively will freeze on 2026-10-10
• Cluster F - npm online-header@99.0.0 sentinel-version malicious-domain beacon (dependency-confusion-shaped, malicious-package): online-header@99.0.0 (GHSA-hg4r-6gv8-6hmj, MAL-2026-17420, source SHA-256 161e267d603ad6aae77c0c365e895c8e40538da2c09f746c2183124434509fdc). OpenSSF Package Analysis flagged for communicating with a domain associated with malicious activity. The 99.0.0 single-version publication is the classic sentinel-version shape of a dep-confusion probe or a quick malicious push against a hypothetical internal online-header name - but the OpenSSF classification is based on a confirmed C2 beacon rather than a plain CWE-506 takedown, so treat as a confirmed malicious package not a probe
• Cluster G - 5 npm CWE-506 boilerplate takedowns (mixed kinds, no analysis): illusion-datalab@1.1.1-1.1.5 (GHSA-834w-x8gq-8rmx; 5-version co-publication - operator pushed 5 patch versions in sequence, naming suggests a data-analytics -datalab internal); homestack-cheer@1.0.0-1.1.9 (GHSA-x567-p88w-3697; 12-version wide publication, homestack-* scope suggests an IoT-smart-home-stack internal); kartykgithub-ph-f@1.0.0 (GHSA-x2m2-w3gv-m5wg), kartykgithub-ph-e@1.0.0 (GHSA-7hq7-x7ww-7cxr), kartykgithub-ph-b@0.0.1-security/0.0.1-security.0/1.0.0 (GHSA-27m4-jjxc-69wf) - fourth day of the kartyk* red-team engagement, continuing the pattern catalogued across 2026-09-16, 2026-09-17, and 2026-09-18 sweeps. All seven packages carry only the standard "any computer that has this package installed should be considered fully compromised" GHSA boilerplate; no source hash, no source code, no OpenSSF record. Treat as medium within the sweep
• Operator continuity check: todays standout is the jexkcode/noverojs Baileys-follow operator shipping 15 siblings in a single window (the "100+ identified" GHSA language suggests this is a visible slice of a bigger backlog arriving in GHSA this week). The pkusinski-external Snowflake-exfil operator is on day 2 (friendly-tools continues friendly-greeting-tools). The sherpy Chrome-wallet-stealer operator is active again today (shortneer), six days after the last catalogued publication. The kartyk red-team scope engagement is on day 4+. New to corpus: spo365-graph AWS Lambda credential-theft (Cluster B) and the future-scripts 2026-10-10 time-bomb (Cluster E). No fresh tailwind-forms-kit EtherHiding publications; no fresh chinazhangsan.ccwu.cc service-worker variants; no fresh donutautosellsrc/aseity Polygon-C2 pip publications (day 5 silent); no fresh com.epi.* or meta.brs.cx` beacons

What to do

1. 1Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, package.json, requirements.txt, Pipfile.lock, poetry.lock, and pyproject.toml for every package name in Clusters A through G. Uninstall on hit, wipe node_modules/.venv, delete the lockfile, rebuild against a clean cache. Clusters A, B, C, D, E, and F carry confirmed real payloads (Baileys account modification, AWS credential theft, Snowflake credential theft, Chrome-wallet infostealer, browser DoS time-bomb, and C2 beacon); a hit on any of those is a compromise, not a warning
2. 2For Cluster A (npm Baileys silent WhatsApp follow mass batch - 15 siblings): uninstall on hit. Any WhatsApp account that connected via a Baileys client bundling any of these packages between the malicious versions is now silently following the operators newsletter JID - check the accounts subscribed newsletters and unsubscribe. Not a credential-theft class incident but persistent unauthorized account modification. Extend lockfile-lint denylist beyond the specific names: block any *baileys*/*bails*/*bailey* package from an unknown publisher (the operator pattern is clear - rotating thin wrappers around the real @whiskeysockets/baileys). The GHSA family-count ("100+ identified as of September 2026") means more siblings will keep arriving; a prefix/suffix denylist is more defensive than chasing names
3. 3For Cluster B (pip spo365-graph AWS Lambda + Secrets Manager credential theft): uninstall on hit. If the installer had AWS credentials in reach (any ~/.aws/credentials, instance-metadata reachable IAM role, or AWS_* env vars): rotate every AWS access key those credentials unlocked, review CloudTrail for unexpected lambda:CreateFunction/iam:CreateRole/secretsmanager:GetSecretValue calls originating from the install host or from newly-created roles, delete any Lambda function the attacker provisioned and the IAM role attached to it, and audit Secrets Manager access logs for every secret the installers identity could read. The spo365-graph` naming impersonates a Microsoft SharePoint 365 Graph API helper - any team automating Microsoft 365 against AWS should audit install logs for this specific package
4. 4For Cluster C (pip friendly-tools Snowflake credential-theft family continuation): uninstall on hit. Follow the same Snowflake-credential rotation and warehouse-query-history audit as the 2026-10-01 friendly-greeting-tools Cluster B remediation: rotate every Snowflake user whose creds /snowflake/session/token/connections.toml/profiles.yml held, review warehouse query history for unexpected CREATE STAGE or COPY INTO statements, and audit AWS CloudTrail for any AssumeRole into arn:aws:iam::631484165566:role/pentests_s3_role. The sibling-naming pattern (same operator, dropped greeting- prefix) means more pip packages impersonating harmless utilities are likely
5. 5For Cluster D (pip shortneer Chrome-wallet + Telegram stealer): uninstall on hit. If the installer host has Chrome/Chromium browser profiles with crypto-wallet extensions (MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Rabby, Keplr, and similar), assume wallet credentials and seed phrases are stolen - rotate every wallet seed and move funds out of any address those wallets held. If the host has Telegram Desktop installed, assume Telegram session + chat history exfiltrated - revoke all active Telegram sessions and reset the account 2FA. Same remediation shape as the 2026-09-26 sherpy incident
6. 6For Cluster E (npm future-scripts browser DoS time-bomb): uninstall on hit before 2026-10-10. Any production bundle that transitively ships future-scripts@0.0.2 or 0.0.3 will freeze every browser tab the moment the detonation condition triggers on 2026-10-10. If 0.0.2 is present anywhere in a lockfile, any downstream call to getCommonDateInRanges() triggers boom() automatically - no attacker action required. Audit yarn why future-scripts / npm ls future-scripts / pnpm why future-scripts across every repo now, before the detonation date. Not a credential-theft incident; the class-of-harm is denial-of-service against end users
7. 7For Cluster F (npm online-header@99.0.0 C2 beacon): uninstall on hit. The 99.0.0 sentinel version suggests a dep-confusion probe shape, but the OpenSSF Package Analysis classification is based on a confirmed C2 beacon rather than a plain CWE-506 takedown - assume install-time connection to attacker infrastructure. If any installer-user credentials could have been reached, rotate them
8. 8*For Cluster G (npm CWE-506 boilerplate takedowns - illusion-datalab, homestack-cheer, three `kartykgithub-ph-)**: uninstall on hit. Without payload analysis assume real infostealer/RCE at time of quarantine - image the host, rotate installer-user credentials, check outbound telemetry from the install window. The illusion-datalab 5-version burst and homestack-cheer 12-version wide publication both read as internal-registry name squats (-datalab/homestack- fit internal naming); teams running those internal names should confirm the public-npm names are held. The three kartykgithub-ph- packages are the fourth day of a visible red-team engagement - safe to add kartyk` to blocklist
9. 9Keep prior egress blocks in place: Ethereum mainnet RPC endpoints (per 2026-09-30 Cluster A tailwind-forms-kit), Ethereum Sepolia RPC endpoints (per indexed-btree), chinazhangsan.ccwu.cc, gist.githubusercontent.com/chinazhangsan999-crypto, api.npoint.io, api.telegram.org (from CI), fabric-npm.gm-service.xyz, www.jsonkeeper.com, github.com/trktgq0wbre1, npm-canary.aveliscare.com, Polygon RPC endpoints, meta.brs.cx, s3://pkusinski-external/ and AWS account 631484165566. Add for today: any AWS account targeted by spo365-graph CloudTrail (unknown specific infra - watch for unexpected lambda:CreateFunction+secretsmanager:GetSecretValue pairs), and *baileys*/*bails*/*bailey* npm scope lint from unknown publishers

References

• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub
• GHSA-75px-x2r4-9f98 - npm @xayz/baileys (Cluster A - Baileys silent WhatsApp follow, query ID 7871414976211147)

  github.com
  GitHub
• GHSA-vpxr-24w4-56qf - npm xvinleys (Cluster A - Baileys silent WhatsApp follow)

  github.com
  GitHub
• GHSA-j5q9-mf2r-jhf9 - npm yonzoffic-baileys (Cluster A - Baileys silent WhatsApp follow)

  github.com
  GitHub
• GHSA-w8fw-prwf-rpmg - npm xzbails (Cluster A - Baileys silent WhatsApp follow)

  github.com
  GitHub
• GHSA-fwmc-x797-fpr6 - npm xzvexpzcbailey (Cluster A - Baileys silent WhatsApp follow)

  github.com
  GitHub
• GHSA-5jww-9h4j-x7w7 - npm yonzofficial (Cluster A - Baileys silent WhatsApp follow)

  github.com
  GitHub
• GHSA-mjx8-f269-h2qf - npm kiyoramarkets (Cluster A - Baileys silent WhatsApp follow)

  github.com
  GitHub
• GHSA-vrqh-8vm7-r584 - npm kasabaileys (Cluster A - Baileys silent WhatsApp follow)

  github.com
  GitHub
• GHSA-xgfv-rm5m-vffw - npm my-baileys (Cluster A - Baileys silent WhatsApp follow)

  github.com
  GitHub
• GHSA-xcqq-823x-hhv7 - npm lilys-baileys (Cluster A - Baileys silent WhatsApp follow)

  github.com
  GitHub
• GHSA-wf8j-w269-5xwv - npm noxleyss (Cluster A - Baileys silent WhatsApp follow)

  github.com
  GitHub
• GHSA-hvc6-5q6j-2867 - npm syncxbails (Cluster A - Baileys silent WhatsApp follow)

  github.com
  GitHub
• GHSA-g2qq-9229-mhjq - npm whalibmob (Cluster A - Baileys silent WhatsApp follow)

  github.com
  GitHub
• GHSA-hpmr-5fvg-hvqf - npm ishumdz-bail (Cluster A - Baileys silent WhatsApp follow)

  github.com
  GitHub
• GHSA-jjr8-hv8r-m5x7 - npm eliteprotech-baileys (Cluster A - Baileys silent WhatsApp follow)

  github.com
  GitHub
• GHSA-jf8h-4jc3-c652 - pip spo365-graph (Cluster B - AWS Lambda + Secrets Manager credential theft, NEW campaign 2026-10-spo365-graph)

  github.com
  GitHub
• GHSA-8hwj-527f-mmvm - pip friendly-tools (Cluster C - Snowflake credential theft, friendly-greeting-tools family continuation)

  github.com
  GitHub
• GHSA-2wm2-fc38-63vw - pip shortneer (Cluster D - Chrome-wallet + Telegram infostealer, sherpy family continuation)

  github.com
  GitHub
• GHSA-c9xw-xmvx-ffm7 - npm future-scripts (Cluster E - browser DoS boom() time-bomb detonating 2026-10-10, MAL-2026-17418)

  github.com
  GitHub
• GHSA-hg4r-6gv8-6hmj - npm online-header@99.0.0 (Cluster F - malicious-domain beacon, MAL-2026-17420)

  github.com
  GitHub
• GHSA-834w-x8gq-8rmx - npm illusion-datalab (Cluster G - CWE-506 boilerplate takedown, 5 versions)

  github.com
  GitHub
• GHSA-x567-p88w-3697 - npm homestack-cheer (Cluster G - CWE-506 boilerplate takedown, 12 versions)

  github.com
  GitHub
• GHSA-x2m2-w3gv-m5wg - npm kartykgithub-ph-f (Cluster G - kartyk* red-team engagement day 4+, CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-7hq7-x7ww-7cxr - npm kartykgithub-ph-e (Cluster G - kartyk* red-team engagement, CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-27m4-jjxc-69wf - npm kartykgithub-ph-b (Cluster G - kartyk* red-team engagement, CWE-506 boilerplate)

  github.com
  GitHub