# GitHub Advisory malware sweep - 2026-10-01 (late) + 2026-10-02 (npm Baileys silent WhatsApp follow mass batch, 15 siblings sharing query ID `7871414976211147`: `@xayz/baileys`, `xvinleys`, `yonzoffic-baileys`, `xzbails`, `xzvexpzcbailey`, `yonzofficial`, `kiyoramarkets`, `kasabaileys`, `my-baileys`, `lilys-baileys`, `noxleyss`, `syncxbails`, `whalibmob`, `ishumdz-bail`, `eliteprotech-baileys`; pip `spo365-graph` NEW campaign - AWS Lambda deploy + AWS Secrets Manager credential theft; pip `friendly-tools` Snowflake credential-theft `friendly-greeting-tools` family continuation; pip `shortneer` Chrome-extension crypto-wallet + Telegram infostealer (`sherpy` campaign continuation); npm `future-scripts` browser DoS `boom()` time-bomb detonating 2026-10-10; npm `online-header@99.0.0` sentinel-version malicious-domain beacon; 5 npm CWE-506 boilerplate takedowns `illusion-datalab`, `homestack-cheer`, `kartykgithub-ph-f`, `kartykgithub-ph-e`, `kartykgithub-ph-b`)

> GHSA 2026-10-01 (late) + 2026-10-02: 26 new advisories (23 npm + 3 pip). Confirmed payloads: 15 npm Baileys silent-WhatsApp-follow siblings (`jexkcode`/`noverojs` family); pip `spo365-graph` AWS Lambda + Secrets Manager credential theft (new); pip `friendly-tools` Snowflake exfil; pip `shortneer` Chrome-wallet stealer; npm `future-scripts` browser DoS time-bomb set for 2026-10-10.

- Published: 2026-10-02
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 25 packages, 95 compromised versions
- Tags: infostealer, credential-theft, crypto-wallet-drain, account-takeover, obfuscation, dependency-confusion
- Also known as: 2026-10-02 GHSA npm+pip sweep, 15 npm Baileys silent WhatsApp follow siblings jexkcode noverojs family continuation (query ID 7871414976211147), spo365-graph pip AWS Lambda + Secrets Manager credential theft NEW campaign, friendly-tools pip Snowflake credential theft friendly-greeting-tools family continuation, shortneer pip Chrome-wallet + Telegram infostealer sherpy family continuation, future-scripts npm browser DoS boom() time-bomb detonating 2026-10-10, online-header@99.0.0 npm sentinel-version malicious-domain beacon, illusion-datalab homestack-cheer kartykgithub-ph-f/e/b npm CWE-506 boilerplate takedowns
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193/bad-packages
- Incident ID: multi-2026-10-02-ghsa-malware-sweep

## Affected packages (25)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@xayz/baileys](https://dependencywatch.io/package/npm/@xayz/baileys) | npm | 3.0.0, 4.0.0, 5.0.0, >=6.0.0 <=6.0.75, >=6.1.0 <=6.1.8 |
| [eliteprotech-baileys](https://dependencywatch.io/package/npm/eliteprotech-baileys) | npm | 1.1.0, 1.1.1, 1.1.2 |
| [friendly-tools](https://dependencywatch.io/package/pypi/friendly-tools) | PyPI | 0.1, 0.2 |
| [future-scripts](https://dependencywatch.io/package/npm/future-scripts) | npm | 0.0.2, 0.0.3 |
| [homestack-cheer](https://dependencywatch.io/package/npm/homestack-cheer) | npm | 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9 |
| [illusion-datalab](https://dependencywatch.io/package/npm/illusion-datalab) | npm | 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5 |
| [ishumdz-bail](https://dependencywatch.io/package/npm/ishumdz-bail) | npm | 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.13, 1.0.14, 1.0.15, 1.0.16 |
| [kartykgithub-ph-b](https://dependencywatch.io/package/npm/kartykgithub-ph-b) | npm | 0.0.1-security, 0.0.1-security.0, 1.0.0 |
| [kartykgithub-ph-e](https://dependencywatch.io/package/npm/kartykgithub-ph-e) | npm | 1.0.0 |
| [kartykgithub-ph-f](https://dependencywatch.io/package/npm/kartykgithub-ph-f) | npm | 1.0.0 |
| [kasabaileys](https://dependencywatch.io/package/npm/kasabaileys) | npm | 0.3.15, 1.0.0, 1.0.1, 1.0.2 |
| [kiyoramarkets](https://dependencywatch.io/package/npm/kiyoramarkets) | npm | 8.0.16 |
| [lilys-baileys](https://dependencywatch.io/package/npm/lilys-baileys) | npm | 1.3.2, 1.3.3 |
| [my-baileys](https://dependencywatch.io/package/npm/my-baileys) | npm | 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 |
| [noxleyss](https://dependencywatch.io/package/npm/noxleyss) | npm | 1.0.0, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9, 1.1.10, 1.1.11 |
| [online-header](https://dependencywatch.io/package/npm/online-header) | npm | 99.0.0 |
| [shortneer](https://dependencywatch.io/package/pypi/shortneer) | PyPI | 0.1.0 |
| [spo365-graph](https://dependencywatch.io/package/pypi/spo365-graph) | PyPI | 1.0.0, 1.1.0, 1.1.1, 1.1.2 |
| [syncxbails](https://dependencywatch.io/package/npm/syncxbails) | npm | 1.0.0, 1.0.1 |
| [whalibmob](https://dependencywatch.io/package/npm/whalibmob) | npm | >=5.24.0 <=5.33.5 |
| [xvinleys](https://dependencywatch.io/package/npm/xvinleys) | npm | 1.0.0 |
| [xzbails](https://dependencywatch.io/package/npm/xzbails) | npm | 0.0.3, 0.0.4, 0.0.5 |
| [xzvexpzcbailey](https://dependencywatch.io/package/npm/xzvexpzcbailey) | npm | 1.0.0, 2.0.0, 2.1.0, 2.5.0 |
| [yonzoffic-baileys](https://dependencywatch.io/package/npm/yonzoffic-baileys) | npm | 8.6.90 |
| [yonzofficial](https://dependencywatch.io/package/npm/yonzofficial) | npm | 2.1.0, 2.1.1, 2.1.2, 2.1.3 |

## What happened

Between roughly 2026-10-01 12:00 UTC and 2026-10-02 12:00 UTC, the GitHub Advisory Database (with the OpenSSF malicious-packages bulk export, Amazon Inspector`s IN-MAL feed, and `kam193/bad-packages`) published ~26 new malware advisories: 23 npm and 3 pip. The defensively noteworthy shape of today`s window is dominated by a single-operator mass push of 15 Baileys silent-WhatsApp-follow siblings (same query ID `7871414976211147` as [`jexkcode`](https://dependencywatch.io/incident/multi-2026-09-30-ghsa-malware-sweep) and [`noverojs`](https://dependencywatch.io/incident/multi-2026-10-01-ghsa-malware-sweep)); three distinct confirmed-payload pip samples (`spo365-graph` AWS credential theft NEW campaign, `friendly-tools` Snowflake credential theft family continuation, `shortneer` Chrome-wallet + Telegram stealer); one novel browser DoS time-bomb set for 2026-10-10 (`future-scripts`); and the usual tail of CWE-506 boilerplate takedowns (`illusion-datalab`, `homestack-cheer`, three `kartykgithub-ph-*` red-team artefacts).

## Cluster A - npm Baileys silent WhatsApp follow mass batch (15 siblings)

15 packages sharing the hardcoded `w:mex` FOLLOW query ID `7871414976211147`, the same socket-patch mechanism catalogued in [`jexkcode`](https://dependencywatch.io/incident/multi-2026-09-30-ghsa-malware-sweep) and [`noverojs`](https://dependencywatch.io/incident/multi-2026-10-01-ghsa-malware-sweep):

| Package | Versions | GHSA |
|---|---|---|
| `@xayz/baileys` | 3.0.0, 4.0.0, 5.0.0, 6.0.0-6.0.75, 6.1.0-6.1.8 | GHSA-75px-x2r4-9f98 |
| `xvinleys` | 1.0.0 | GHSA-vpxr-24w4-56qf |
| `yonzoffic-baileys` | 8.6.90 | GHSA-j5q9-mf2r-jhf9 |
| `xzbails` | 0.0.3, 0.0.4, 0.0.5 | GHSA-w8fw-prwf-rpmg |
| `xzvexpzcbailey` | 1.0.0, 2.0.0, 2.1.0, 2.5.0 | GHSA-fwmc-x797-fpr6 |
| `yonzofficial` | 2.1.0, 2.1.1, 2.1.2, 2.1.3 | GHSA-5jww-9h4j-x7w7 |
| `kiyoramarkets` | 8.0.16 | GHSA-mjx8-f269-h2qf |
| `kasabaileys` | 0.3.15, 1.0.0, 1.0.1, 1.0.2 | GHSA-vrqh-8vm7-r584 |
| `my-baileys` | 1.0.1-1.0.5 | GHSA-xgfv-rm5m-vffw |
| `lilys-baileys` | 1.3.2, 1.3.3 | GHSA-xcqq-823x-hhv7 |
| `noxleyss` | 1.0.0, 1.1.0-1.1.11 | GHSA-wf8j-w269-5xwv |
| `syncxbails` | 1.0.0, 1.0.1 | GHSA-hvc6-5q6j-2867 |
| `whalibmob` | 5.24.0-5.33.5 | GHSA-g2qq-9229-mhjq |
| `ishumdz-bail` | 1.0.1-1.0.16 (excl 1.0.5, 1.0.12) | GHSA-hpmr-5fvg-hvqf |
| `eliteprotech-baileys` | 1.1.0, 1.1.1, 1.1.2 | GHSA-jjr8-hv8r-m5x7 |

**The primitive.** Each package patches a Baileys socket-connect routine so that seconds after every WhatsApp connection the installer`s own authenticated session issues a FOLLOW query against attacker-controlled newsletter/channel JIDs - no user consent, no config option, no logging. Target JIDs are obscured per-package via plain string literals, base64, base64+XOR, or runtime char-code arrays; some variants fetch the target JID list dynamically from attacker-hosted JSON/JS, so the follow target can rotate without re-publishing the package.

**Family size.** GHSA calls out that each of these is one of "a large family (100+ identified as of September 2026) of near-identical forks" sharing the same injection mechanism - today`s 15 entries are a visible slice of a bigger backlog arriving in GHSA this week.

Classify as `malicious-package` for each. Class-of-harm is unauthorized modification of the victim`s WhatsApp account.

## Cluster B - pip `spo365-graph` AWS Lambda + Secrets Manager credential theft

`spo365-graph@1.0.0`/`1.1.0`/`1.1.1`/`1.1.2` (GHSA-jf8h-4jc3-c652, OpenSSF campaign `2026-10-spo365-graph`, source SHA-256 `ea8dd7600717964f4ca8f8b1134f867f4bf69f1538243d5c7da752eefed99fe1`).

Malicious payload introduced in 1.1.2. Overrides the `install` command in `setup.py` to execute during pip install. The payload:

1. Deploys unauthorized AWS Lambda functions in the installer`s AWS account.
2. Extracts credentials from AWS Secrets Manager - any secret the installer`s identity can read via `secretsmanager:GetSecretValue`.
3. Harvests additional system and environment data.
4. Exfiltrates the stolen bundle to attacker-controlled infrastructure.

Package name impersonates a SharePoint Online 365 Microsoft Graph API helper (plausible utility for any Microsoft 365 automation script). First member of this corpus - fresh OpenSSF campaign slug `2026-10-spo365-graph` (distinct from yesterday`s `friendly-greeting-tools` Snowflake exfil, both in pip but different target cloud).

Classify as `malicious-package`.

## Cluster C - pip `friendly-tools` Snowflake credential-theft family continuation

`friendly-tools@0.1`/`0.2` (GHSA-8hwj-527f-mmvm, OpenSSF campaign `2026-09-friendly-greeting-tools`, source SHA-256 `969afb49a1e59fa643e9d90d07745e3957906cc9603c4e5643e5760d5f254381`).

Shares the OpenSSF campaign slug with yesterday`s [`friendly-greeting-tools`](https://dependencywatch.io/incident/multi-2026-10-01-ghsa-malware-sweep) Cluster B - same operator, dropped-prefix sibling. Obfuscated code exfiltrates data from the environment targeting primarily Snowflake databases and the credentials to them. GHSA note: "some evidence suggests involvement in penetration testing activities" - the `pentests_s3_role` IAM role in yesterday`s stage URL (`arn:aws:iam::631484165566:role/pentests_s3_role`) supports that read. But the exfil capability is real: a successful run moves production Snowflake table data under attacker control.

Classify as `malicious-package`.

## Cluster D - pip `shortneer` Chrome-extension crypto-wallet + Telegram stealer

`shortneer@0.1.0` (GHSA-2wm2-fc38-63vw, OpenSSF campaign `2026-09-sherpy`, source SHA-256 `5e166ae1253c886885381cb5087f67a59a869cad6ece6f3ac40aefc6e463c27f`).

Same OpenSSF campaign as the pip [`sherpy`](https://dependencywatch.io/incident/multi-2026-09-26-ghsa-malware-sweep) Chrome-wallet + Telegram infostealer from 2026-09-26 - same operator six days later. Exfiltrates Chrome extension files (likely targeting cryptocurrency wallet extensions - MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Rabby, Keplr) and Telegram-related files from the compromised host. OpenSSF classification: infostealer, crypto-wallet-drain, credential-theft, native-extension targeting.

Classify as `malicious-package`.

## Cluster E - npm `future-scripts` browser DoS time-bomb detonating 2026-10-10

`future-scripts@0.0.2`/`0.0.3` (GHSA-c9xw-xmvx-ffm7, MAL-2026-17418, source hash `03666f5e7d007a161251954396c72a1a546a29e7`).

Contains a function `boom()` scheduled to activate on **2026-10-10** that calls `localStorage.setItem(key, i)` 100,000,000 times in a synchronous loop, freezing any browser tab that reaches it.

- `0.0.1` - clean.
- `0.0.2` - exported `getCommonDateInRanges()` triggers `boom()` automatically before validating inputs. Any downstream library that calls that function detonates the DoS at the user with no attacker action.
- `0.0.3` - detonator still bundled but requires explicit invocation; reduced exploitability.

GHSA marks it a "static finding" with no confirmed real-world victim yet, but the time-bomb is live - any site that ships this transitively will freeze on 2026-10-10. Audit `npm ls future-scripts` / `yarn why future-scripts` / `pnpm why future-scripts` across every production bundle NOW, before the detonation date.

Classify as `malicious-package`. Class-of-harm is denial-of-service against end users.

## Cluster F - npm `online-header@99.0.0` sentinel-version malicious-domain beacon

`online-header@99.0.0` (GHSA-hg4r-6gv8-6hmj, MAL-2026-17420, source SHA-256 `161e267d603ad6aae77c0c365e895c8e40538da2c09f746c2183124434509fdc`).

OpenSSF Package Analysis flagged for communicating with a domain associated with malicious activity. The `99.0.0` single-version publication is the classic sentinel-version shape of a dep-confusion probe or a quick malicious push against a hypothetical internal `online-header` name - but the OpenSSF classification is based on a confirmed C2 beacon rather than a plain CWE-506 takedown.

Classify as `malicious-package` (not dep-confusion - the OpenSSF confirmed beacon raises it above a plain probe).

## Cluster G - 5 npm CWE-506 boilerplate takedowns

| Package | Versions | GHSA | Notes |
|---|---|---|---|
| `illusion-datalab` | 1.1.1-1.1.5 | GHSA-834w-x8gq-8rmx | 5-version co-publication; `-datalab` suggests data-analytics internal |
| `homestack-cheer` | 1.0.0-1.1.9 (12 versions) | GHSA-x567-p88w-3697 | Wide-publication; `homestack-*` suggests IoT-smart-home internal |
| `kartykgithub-ph-f` | 1.0.0 | GHSA-x2m2-w3gv-m5wg | Day 4+ of `kartyk*` red-team engagement |
| `kartykgithub-ph-e` | 1.0.0 | GHSA-7hq7-x7ww-7cxr | Same engagement |
| `kartykgithub-ph-b` | 0.0.1-security, 0.0.1-security.0, 1.0.0 | GHSA-27m4-jjxc-69wf | Same engagement |

All five carry only the standard "any computer that has this package installed should be considered fully compromised" GHSA boilerplate; no source hash, no source code, no OpenSSF record. The three `kartykgithub-ph-*` extend the `kartyk*` red-team pattern [catalogued across 2026-09-16, 2026-09-17, and 2026-09-18 sweeps](https://dependencywatch.io/incident/multi-2026-09-18-ghsa-malware-sweep).

Classify as mixed. Severity `medium` within the sweep until payload is analysed.

## Operator continuity check

- **`jexkcode`/`noverojs` Baileys silent-WhatsApp-follow family**: 15 fresh siblings in a single window today (Cluster A). The "100+ identified" GHSA language implies more will arrive this week.
- **`friendly-greeting-tools`/`friendly-tools` pip Snowflake credential-theft family (`pkusinski-external` S3)**: on day 2 (`friendly-tools` continues yesterday).
- **`sherpy`/`shortneer` pip Chrome-wallet + Telegram stealer**: active again today, six days after the last catalogued publication.
- **`kartyk*` red-team engagement**: on day 4+. Three fresh `kartykgithub-ph-*` siblings in today`s sweep.
- **`tailwind-forms-kit` EtherHiding (Ethereum mainnet wallet `0xa322E5...63e1a`), `chinazhangsan.ccwu.cc` DoH + PWA_ROUTER service-worker, `bfox-build-utils` pip GH-Actions worm, `dotenv-precheck` Telegram wallet-mnemonic exfil, `fabric-loader-core`/`mfahelper`/`get-power` install-time RCE, `zeal-utils`/`zeal-util-hooks` aveliscare canary, `queeuees` py-comment vandalism**: no new publications in today`s window.
- **`donutautosellsrc`/`aseity*` Polygon-C2 pip campaign**: no fresh publications (day 5 silent).
- **`com.epi.*`/`meta.brs.cx` dep-confusion recon beacon**: no fresh publications today.
- **New to corpus**: `spo365-graph` AWS Lambda + Secrets Manager credential theft campaign (Cluster B, OpenSSF campaign `2026-10-spo365-graph`); `future-scripts` 2026-10-10 browser DoS time-bomb (Cluster E, novel class).

## Registry state

All 26 packages in this sweep are npm/pip-quarantined at time of writing. Active operator-side infrastructure unique to today`s batch:

- Baileys follow query ID `7871414976211147` with per-package rotatable JID obfuscation (Cluster A - continuation of `jexkcode`/`noverojs` operator primitive)
- `spo365-graph` payload creates unauthorized AWS Lambda functions + reads from AWS Secrets Manager; specific attacker C2 destination for the exfil bundle not disclosed in the GHSA body (Cluster B)
- `s3://pkusinski-external/` S3 bucket and AWS account `631484165566` IAM role `pentests_s3_role` (Cluster C, continuation of yesterday`s Snowflake exfil)
- `boom()` detonation date 2026-10-10 - 8 days from this sweep (Cluster E)
- `online-header@99.0.0` malicious-domain beacon; specific destination domain not disclosed in GHSA body (Cluster F)

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector`, `kam193/bad-packages`. Per-package IOC details drawn from GHSA advisory bodies and OpenSSF malicious-packages MAL records published between 2026-10-01 12:00 UTC and 2026-10-02 12:00 UTC.

## Impact

- **Cluster A - npm Baileys silent WhatsApp follow mass batch, 15 siblings (unauthorized-account-modification, malicious-package)**: all share hardcoded `w:mex` FOLLOW query ID `7871414976211147`, same socket-patch mechanism documented in [`jexkcode`](https://dependencywatch.io/incident/multi-2026-09-30-ghsa-malware-sweep) and [`noverojs`](https://dependencywatch.io/incident/multi-2026-10-01-ghsa-malware-sweep). GHSA calls out "a large family (100+ identified as of September 2026) of near-identical forks". Each package patches a Baileys socket-connect routine so that seconds after every WhatsApp connection the installer`s own authenticated session issues a FOLLOW query against attacker-controlled newsletter/channel JIDs, silently subscribing the victim account - no user consent, no config option, no logging. Target JIDs are obscured per-package via plain strings, base64, base64+XOR, or runtime char-code arrays; some variants fetch the target JID list dynamically from remote GitHub/JSON hosts so the follow target can rotate without re-publishing. Packages and GHSAs: `@xayz/baileys` 3.0.0/4.0.0/5.0.0/6.0.0-6.0.75/6.1.0-6.1.8 (GHSA-75px-x2r4-9f98); `xvinleys@1.0.0` (GHSA-vpxr-24w4-56qf); `yonzoffic-baileys@8.6.90` (GHSA-j5q9-mf2r-jhf9); `xzbails@0.0.3-0.0.5` (GHSA-w8fw-prwf-rpmg); `xzvexpzcbailey@1.0.0/2.0.0/2.1.0/2.5.0` (GHSA-fwmc-x797-fpr6); `yonzofficial@2.1.0-2.1.3` (GHSA-5jww-9h4j-x7w7); `kiyoramarkets@8.0.16` (GHSA-mjx8-f269-h2qf); `kasabaileys@0.3.15/1.0.0/1.0.1/1.0.2` (GHSA-vrqh-8vm7-r584); `my-baileys@1.0.1-1.0.5` (GHSA-xgfv-rm5m-vffw); `lilys-baileys@1.3.2/1.3.3` (GHSA-xcqq-823x-hhv7); `noxleyss@1.0.0/1.1.0-1.1.11` (GHSA-wf8j-w269-5xwv); `syncxbails@1.0.0/1.0.1` (GHSA-hvc6-5q6j-2867); `whalibmob@5.24.0-5.33.5` (GHSA-g2qq-9229-mhjq); `ishumdz-bail@1.0.1-1.0.16 excl 1.0.5/1.0.12` (GHSA-hpmr-5fvg-hvqf); `eliteprotech-baileys@1.1.0/1.1.1/1.1.2` (GHSA-jjr8-hv8r-m5x7). Not credential theft or RCE - class-of-harm is unauthorized modification of the victim`s WhatsApp account (silent channel/newsletter subscription for operator reach-boosting)
- **Cluster B - pip `spo365-graph` AWS Lambda + Secrets Manager credential theft (NEW CAMPAIGN, malicious-package)**: `spo365-graph@1.0.0/1.1.0/1.1.1/1.1.2` (GHSA-jf8h-4jc3-c652, OpenSSF campaign `2026-10-spo365-graph`, source SHA-256 `ea8dd7600717964f4ca8f8b1134f867f4bf69f1538243d5c7da752eefed99fe1`). Malicious payload introduced in 1.1.2. Overrides the `install` command in `setup.py` to execute during pip install. Deploys unauthorized AWS Lambda functions, extracts credentials from AWS Secrets Manager, harvests additional system and environment data, and exfiltrates the stolen secrets to attacker infrastructure. Package name impersonates a SharePoint Online 365 Microsoft Graph helper (plausible utility for Microsoft 365 automation scripts). First member of this corpus - fresh OpenSSF campaign slug `2026-10-spo365-graph`. Distinct infrastructure from yesterday`s `friendly-greeting-tools` Snowflake exfil
- **Cluster C - pip `friendly-tools` Snowflake credential-theft family continuation (malicious-package)**: `friendly-tools@0.1/0.2` (GHSA-8hwj-527f-mmvm, OpenSSF campaign `2026-09-friendly-greeting-tools`, source SHA-256 `969afb49a1e59fa643e9d90d07745e3957906cc9603c4e5643e5760d5f254381`). Shares the OpenSSF campaign slug with yesterday`s [`friendly-greeting-tools`](https://dependencywatch.io/incident/multi-2026-10-01-ghsa-malware-sweep) Cluster B (same operator, dropped-prefix sibling). Obfuscated code exfiltrates data from the environment, targeting primarily Snowflake databases and the credentials to them. Advisory notes some evidence suggests involvement in penetration testing - but the exfil capability is real whichever side it was published for. Add to the egress block already in place for `s3://pkusinski-external/` and AWS account `631484165566`
- **Cluster D - pip `shortneer` Chrome-extension crypto-wallet + Telegram stealer (sherpy family continuation, malicious-package)**: `shortneer@0.1.0` (GHSA-2wm2-fc38-63vw, OpenSSF campaign `2026-09-sherpy`, source SHA-256 `5e166ae1253c886885381cb5087f67a59a869cad6ece6f3ac40aefc6e463c27f`). Same OpenSSF campaign as the pip [`sherpy`](https://dependencywatch.io/incident/multi-2026-09-26-ghsa-malware-sweep) Chrome-wallet + Telegram infostealer from 2026-09-26. Exfiltrates Chrome extension files (crypto wallets - MetaMask, Phantom, and similar extension IDs) and Telegram-related files from the compromised host. Classified by OpenSSF as infostealer with crypto-wallet-drain + credential-theft + native-extension targeting
- **Cluster E - npm `future-scripts` browser DoS time-bomb detonating 2026-10-10 (malicious-package)**: `future-scripts@0.0.2/0.0.3` (GHSA-c9xw-xmvx-ffm7, MAL-2026-17418, source hash `03666f5e7d007a161251954396c72a1a546a29e7`). Contains function `boom()` scheduled to activate on **2026-10-10** that calls `localStorage.setItem(key, i)` 100,000,000 times in a synchronous loop, freezing any browser tab that reaches it. In `0.0.2` the exported `getCommonDateInRanges()` triggers `boom()` automatically before validating inputs - any downstream library that calls that function detonates the DoS at the user. In `0.0.3` the detonator is still bundled but requires explicit invocation. `0.0.1` is clean. GHSA marks it a "static finding" with no confirmed real-world victim yet, but the time-bomb is live - any site that ships this transitively will freeze on 2026-10-10
- **Cluster F - npm `online-header@99.0.0` sentinel-version malicious-domain beacon (dependency-confusion-shaped, malicious-package)**: `online-header@99.0.0` (GHSA-hg4r-6gv8-6hmj, MAL-2026-17420, source SHA-256 `161e267d603ad6aae77c0c365e895c8e40538da2c09f746c2183124434509fdc`). OpenSSF Package Analysis flagged for communicating with a domain associated with malicious activity. The `99.0.0` single-version publication is the classic sentinel-version shape of a dep-confusion probe or a quick malicious push against a hypothetical internal `online-header` name - but the OpenSSF classification is based on a confirmed C2 beacon rather than a plain CWE-506 takedown, so treat as a confirmed malicious package not a probe
- **Cluster G - 5 npm CWE-506 boilerplate takedowns (mixed kinds, no analysis)**: `illusion-datalab@1.1.1-1.1.5` (GHSA-834w-x8gq-8rmx; 5-version co-publication - operator pushed 5 patch versions in sequence, naming suggests a data-analytics `-datalab` internal); `homestack-cheer@1.0.0-1.1.9` (GHSA-x567-p88w-3697; 12-version wide publication, `homestack-*` scope suggests an IoT-smart-home-stack internal); `kartykgithub-ph-f@1.0.0` (GHSA-x2m2-w3gv-m5wg), `kartykgithub-ph-e@1.0.0` (GHSA-7hq7-x7ww-7cxr), `kartykgithub-ph-b@0.0.1-security/0.0.1-security.0/1.0.0` (GHSA-27m4-jjxc-69wf) - fourth day of the `kartyk*` red-team engagement, continuing [the pattern catalogued across 2026-09-16, 2026-09-17, and 2026-09-18 sweeps](https://dependencywatch.io/incident/multi-2026-09-18-ghsa-malware-sweep). All seven packages carry only the standard "any computer that has this package installed should be considered fully compromised" GHSA boilerplate; no source hash, no source code, no OpenSSF record. Treat as `medium` within the sweep
- **Operator continuity check**: today`s standout is the `jexkcode`/`noverojs` Baileys-follow operator shipping 15 siblings in a single window (the "100+ identified" GHSA language suggests this is a visible slice of a bigger backlog arriving in GHSA this week). The `pkusinski-external` Snowflake-exfil operator is on day 2 (`friendly-tools` continues `friendly-greeting-tools`). The `sherpy` Chrome-wallet-stealer operator is active again today (`shortneer`), six days after the last catalogued publication. The `kartyk*` red-team scope engagement is on day 4+. New to corpus: `spo365-graph` AWS Lambda credential-theft (Cluster B) and the `future-scripts` 2026-10-10 time-bomb (Cluster E). No fresh `tailwind-forms-kit` EtherHiding publications; no fresh `chinazhangsan.ccwu.cc` service-worker variants; no fresh `donutautosellsrc`/`aseity*` Polygon-C2 pip publications (day 5 silent); no fresh `com.epi.*` or `meta.brs.cx` beacons

## What to do

1. Grep every `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `package.json`, `requirements.txt`, `Pipfile.lock`, `poetry.lock`, and `pyproject.toml` for every package name in Clusters A through G. Uninstall on hit, wipe `node_modules`/`.venv`, delete the lockfile, rebuild against a clean cache. Clusters A, B, C, D, E, and F carry confirmed real payloads (Baileys account modification, AWS credential theft, Snowflake credential theft, Chrome-wallet infostealer, browser DoS time-bomb, and C2 beacon); a hit on any of those is a compromise, not a warning
2. **For Cluster A (npm Baileys silent WhatsApp follow mass batch - 15 siblings)**: uninstall on hit. Any WhatsApp account that connected via a Baileys client bundling any of these packages between the malicious versions is now silently following the operator`s newsletter JID - check the account`s subscribed newsletters and unsubscribe. Not a credential-theft class incident but persistent unauthorized account modification. Extend lockfile-lint denylist beyond the specific names: block any `*baileys*`/`*bails*`/`*bailey*` package from an unknown publisher (the operator pattern is clear - rotating thin wrappers around the real `@whiskeysockets/baileys`). The GHSA family-count ("100+ identified as of September 2026") means more siblings will keep arriving; a prefix/suffix denylist is more defensive than chasing names
3. **For Cluster B (pip `spo365-graph` AWS Lambda + Secrets Manager credential theft)**: uninstall on hit. If the installer had AWS credentials in reach (any `~/.aws/credentials`, instance-metadata reachable IAM role, or AWS_* env vars): rotate every AWS access key those credentials unlocked, review CloudTrail for unexpected `lambda:CreateFunction`/`iam:CreateRole`/`secretsmanager:GetSecretValue` calls originating from the install host or from newly-created roles, delete any Lambda function the attacker provisioned and the IAM role attached to it, and audit Secrets Manager access logs for every secret the installer`s identity could read. The `spo365-graph` naming impersonates a Microsoft SharePoint 365 Graph API helper - any team automating Microsoft 365 against AWS should audit install logs for this specific package
4. **For Cluster C (pip `friendly-tools` Snowflake credential-theft family continuation)**: uninstall on hit. Follow the same Snowflake-credential rotation and warehouse-query-history audit as [the 2026-10-01 `friendly-greeting-tools` Cluster B remediation](https://dependencywatch.io/incident/multi-2026-10-01-ghsa-malware-sweep): rotate every Snowflake user whose creds `/snowflake/session/token`/`connections.toml`/`profiles.yml` held, review warehouse query history for unexpected `CREATE STAGE` or `COPY INTO` statements, and audit AWS CloudTrail for any `AssumeRole` into `arn:aws:iam::631484165566:role/pentests_s3_role`. The sibling-naming pattern (same operator, dropped `greeting-` prefix) means more pip packages impersonating harmless utilities are likely
5. **For Cluster D (pip `shortneer` Chrome-wallet + Telegram stealer)**: uninstall on hit. If the installer host has Chrome/Chromium browser profiles with crypto-wallet extensions (MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Rabby, Keplr, and similar), assume wallet credentials and seed phrases are stolen - rotate every wallet seed and move funds out of any address those wallets held. If the host has Telegram Desktop installed, assume Telegram session + chat history exfiltrated - revoke all active Telegram sessions and reset the account 2FA. Same remediation shape as [the 2026-09-26 `sherpy` incident](https://dependencywatch.io/incident/multi-2026-09-26-ghsa-malware-sweep)
6. **For Cluster E (npm `future-scripts` browser DoS time-bomb)**: uninstall on hit **before 2026-10-10**. Any production bundle that transitively ships `future-scripts@0.0.2` or `0.0.3` will freeze every browser tab the moment the detonation condition triggers on 2026-10-10. If `0.0.2` is present anywhere in a lockfile, any downstream call to `getCommonDateInRanges()` triggers `boom()` automatically - no attacker action required. Audit `yarn why future-scripts` / `npm ls future-scripts` / `pnpm why future-scripts` across every repo now, before the detonation date. Not a credential-theft incident; the class-of-harm is denial-of-service against end users
7. **For Cluster F (npm `online-header@99.0.0` C2 beacon)**: uninstall on hit. The `99.0.0` sentinel version suggests a dep-confusion probe shape, but the OpenSSF Package Analysis classification is based on a confirmed C2 beacon rather than a plain CWE-506 takedown - assume install-time connection to attacker infrastructure. If any installer-user credentials could have been reached, rotate them
8. **For Cluster G (npm CWE-506 boilerplate takedowns - `illusion-datalab`, `homestack-cheer`, three `kartykgithub-ph-*`)**: uninstall on hit. Without payload analysis assume real infostealer/RCE at time of quarantine - image the host, rotate installer-user credentials, check outbound telemetry from the install window. The `illusion-datalab` 5-version burst and `homestack-cheer` 12-version wide publication both read as internal-registry name squats (`-datalab`/`homestack-` fit internal naming); teams running those internal names should confirm the public-npm names are held. The three `kartykgithub-ph-*` packages are the fourth day of a visible red-team engagement - safe to add `kartyk*` to blocklist
9. Keep prior egress blocks in place: Ethereum mainnet RPC endpoints (per 2026-09-30 Cluster A `tailwind-forms-kit`), Ethereum Sepolia RPC endpoints (per [`indexed-btree`](https://dependencywatch.io/incident/npm-2026-09-17-indexed-btree-sepolia-etherhiding)), `chinazhangsan.ccwu.cc`, `gist.githubusercontent.com/chinazhangsan999-crypto`, `api.npoint.io`, `api.telegram.org` (from CI), `fabric-npm.gm-service.xyz`, `www.jsonkeeper.com`, `github.com/trktgq0wbre1`, `npm-canary.aveliscare.com`, Polygon RPC endpoints, `meta.brs.cx`, `s3://pkusinski-external/` and AWS account `631484165566`. Add for today: any AWS account targeted by `spo365-graph` CloudTrail (unknown specific infra - watch for unexpected `lambda:CreateFunction`+`secretsmanager:GetSecretValue` pairs), and `*baileys*`/`*bails*`/`*bailey*` npm scope lint from unknown publishers

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-75px-x2r4-9f98 - npm @xayz/baileys (Cluster A - Baileys silent WhatsApp follow, query ID 7871414976211147)](https://github.com/advisories/GHSA-75px-x2r4-9f98) - GitHub
- [GHSA-vpxr-24w4-56qf - npm xvinleys (Cluster A - Baileys silent WhatsApp follow)](https://github.com/advisories/GHSA-vpxr-24w4-56qf) - GitHub
- [GHSA-j5q9-mf2r-jhf9 - npm yonzoffic-baileys (Cluster A - Baileys silent WhatsApp follow)](https://github.com/advisories/GHSA-j5q9-mf2r-jhf9) - GitHub
- [GHSA-w8fw-prwf-rpmg - npm xzbails (Cluster A - Baileys silent WhatsApp follow)](https://github.com/advisories/GHSA-w8fw-prwf-rpmg) - GitHub
- [GHSA-fwmc-x797-fpr6 - npm xzvexpzcbailey (Cluster A - Baileys silent WhatsApp follow)](https://github.com/advisories/GHSA-fwmc-x797-fpr6) - GitHub
- [GHSA-5jww-9h4j-x7w7 - npm yonzofficial (Cluster A - Baileys silent WhatsApp follow)](https://github.com/advisories/GHSA-5jww-9h4j-x7w7) - GitHub
- [GHSA-mjx8-f269-h2qf - npm kiyoramarkets (Cluster A - Baileys silent WhatsApp follow)](https://github.com/advisories/GHSA-mjx8-f269-h2qf) - GitHub
- [GHSA-vrqh-8vm7-r584 - npm kasabaileys (Cluster A - Baileys silent WhatsApp follow)](https://github.com/advisories/GHSA-vrqh-8vm7-r584) - GitHub
- [GHSA-xgfv-rm5m-vffw - npm my-baileys (Cluster A - Baileys silent WhatsApp follow)](https://github.com/advisories/GHSA-xgfv-rm5m-vffw) - GitHub
- [GHSA-xcqq-823x-hhv7 - npm lilys-baileys (Cluster A - Baileys silent WhatsApp follow)](https://github.com/advisories/GHSA-xcqq-823x-hhv7) - GitHub
- [GHSA-wf8j-w269-5xwv - npm noxleyss (Cluster A - Baileys silent WhatsApp follow)](https://github.com/advisories/GHSA-wf8j-w269-5xwv) - GitHub
- [GHSA-hvc6-5q6j-2867 - npm syncxbails (Cluster A - Baileys silent WhatsApp follow)](https://github.com/advisories/GHSA-hvc6-5q6j-2867) - GitHub
- [GHSA-g2qq-9229-mhjq - npm whalibmob (Cluster A - Baileys silent WhatsApp follow)](https://github.com/advisories/GHSA-g2qq-9229-mhjq) - GitHub
- [GHSA-hpmr-5fvg-hvqf - npm ishumdz-bail (Cluster A - Baileys silent WhatsApp follow)](https://github.com/advisories/GHSA-hpmr-5fvg-hvqf) - GitHub
- [GHSA-jjr8-hv8r-m5x7 - npm eliteprotech-baileys (Cluster A - Baileys silent WhatsApp follow)](https://github.com/advisories/GHSA-jjr8-hv8r-m5x7) - GitHub
- [GHSA-jf8h-4jc3-c652 - pip spo365-graph (Cluster B - AWS Lambda + Secrets Manager credential theft, NEW campaign 2026-10-spo365-graph)](https://github.com/advisories/GHSA-jf8h-4jc3-c652) - GitHub
- [GHSA-8hwj-527f-mmvm - pip friendly-tools (Cluster C - Snowflake credential theft, friendly-greeting-tools family continuation)](https://github.com/advisories/GHSA-8hwj-527f-mmvm) - GitHub
- [GHSA-2wm2-fc38-63vw - pip shortneer (Cluster D - Chrome-wallet + Telegram infostealer, sherpy family continuation)](https://github.com/advisories/GHSA-2wm2-fc38-63vw) - GitHub
- [GHSA-c9xw-xmvx-ffm7 - npm future-scripts (Cluster E - browser DoS boom() time-bomb detonating 2026-10-10, MAL-2026-17418)](https://github.com/advisories/GHSA-c9xw-xmvx-ffm7) - GitHub
- [GHSA-hg4r-6gv8-6hmj - npm online-header@99.0.0 (Cluster F - malicious-domain beacon, MAL-2026-17420)](https://github.com/advisories/GHSA-hg4r-6gv8-6hmj) - GitHub
- [GHSA-834w-x8gq-8rmx - npm illusion-datalab (Cluster G - CWE-506 boilerplate takedown, 5 versions)](https://github.com/advisories/GHSA-834w-x8gq-8rmx) - GitHub
- [GHSA-x567-p88w-3697 - npm homestack-cheer (Cluster G - CWE-506 boilerplate takedown, 12 versions)](https://github.com/advisories/GHSA-x567-p88w-3697) - GitHub
- [GHSA-x2m2-w3gv-m5wg - npm kartykgithub-ph-f (Cluster G - kartyk* red-team engagement day 4+, CWE-506 boilerplate)](https://github.com/advisories/GHSA-x2m2-w3gv-m5wg) - GitHub
- [GHSA-7hq7-x7ww-7cxr - npm kartykgithub-ph-e (Cluster G - kartyk* red-team engagement, CWE-506 boilerplate)](https://github.com/advisories/GHSA-7hq7-x7ww-7cxr) - GitHub
- [GHSA-27m4-jjxc-69wf - npm kartykgithub-ph-b (Cluster G - kartyk* red-team engagement, CWE-506 boilerplate)](https://github.com/advisories/GHSA-27m4-jjxc-69wf) - GitHub

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-02-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-02-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).