GitHub Advisory malware sweep - 2026-10-02 (late) + 2026-10-03 (npm `amel10` AWS API Gateway dep-confusion mass push targeting Amazon/Alexa internal names - 6 confirmed packages sharing C2 `s85r5k14qk.execute-api.us-east-1.amazonaws.com`: `alexa-cybertron-team-code-review-agent`, `okra-cloud-cdk`, `ai-workshop-radio-app`, `ai-workshop-maa15-radio`, `ai-workshop-radio-lambda`, `niksinnkatalapp`; 5 npm PhantomSub Baileys silent WhatsApp follow siblings `mikuhostt-baileys`, `luoxy-baileys`, `@zanta/baileys`, `wailib`, `prastzy`; pip `dedh-devops-automation` AWS Lambda + Secrets Manager credential theft `spo365-graph` family continuation; pip `voxeval` cryptominer NEW campaign `2026-10-voxeval`; 2 Go module `Graphalgo` campaign expansion `gogets.dev/btreex`, `gocommunity.io/orderedbtree`; npm `@bluewin/utils` Burp-Collaborator Swisscom-scope dep-confusion probe by `securityresearch1`; npm `@smwebserver/static@99.9.1` sentinel-version malicious-domain beacon; 9 npm CWE-506 boilerplate takedowns `turbo-ws`, `hardhat-zet`, `ui-base-colors`, `translate-base-font`, `ui.dist.min.js`, `@woodpecker-web-shared/components`, `bnppf-flag-icons`)

What happened

Between roughly 2026-10-02 12:00 UTC and 2026-10-03 12:00 UTC, the GitHub Advisory Database (with the OpenSSF malicious-packages bulk export, Amazon Inspectors IN-MAL feed, and kam193/bad-packages) published ~26 new malware advisories. The defensively notable shape of todays window: a focused 6-package amel10 npm dep-confusion mass push against Amazon/Alexa internal names sharing a single AWS API Gateway C2; five more PhantomSub Baileys silent-WhatsApp-follow siblings; a second member of the spo365-graph AWS Lambda credential-theft pip campaign; a new-to-corpus pip cryptominer campaign (voxeval); the first two Go module samples in the Graphalgo cluster (Arbitrum Sepolia EtherHiding + Slack bot token C2); a Burp Collaborator bug-bounty probe against a Swisscom-shaped scope; and the usual tail of CWE-506 boilerplate takedowns.

Cluster A - npm amel10 AWS API Gateway dep-confusion mass push targeting Amazon/Alexa internal names

Six npm packages co-published by the amel10 account in a two-minute window on 2026-09-30 UTC, batched into GHSA on 2026-10-02:

The primitive. Each package uses the inflated version 100.0.0 to outrank private-registry resolutions, declares node setup.js || true as a preinstall hook, and the setup script HTTPS-POSTs hostname, username, cwd, OS, architecture, Node.js version, configured npm registry, and a per-package tracking token to:

https://s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook

That endpoint is an AWS API Gateway in us-east-1 under an attacker-controlled AWS account - standard dep-confusion collector shape. The per-package tracking token lets the operator correlate which specific internal name triggered the resolution, so they know which name to push a follow-on payload against.

Payload class. Reconnaissance-only; no credential theft, no persistence. The signal is the hit, not the exfil.

Operator continuity. Fresh amel10 operator for this corpus. The naming shape - specifically alexa-cybertron-team-code-review-agent, which is far too specific to be a lucky guess - strongly suggests prior OSINT on Amazon`s internal namespace. Expect siblings against the same product spaces (Alexa, AWS CDK, AI workshop pipelines) over the next week.

Classify as dependency-confusion for each.

Cluster B - 5 npm PhantomSub Baileys silent WhatsApp follow siblings

Five more Baileys forks shipping the same w:mex FOLLOW query ID 7871414976211147 mechanism catalogued in the prior sweeps:

Formal attribution. This cluster is OX Securitys September 2026 **PhantomSub** campaign. SafeDep first flagged Baileys forks engaging in silent channel-follow + ad-injection in August 2026; Xygeni named @dappaoffc/baileys-mod` in September 2026; OX Security consolidated the family and named it in late September. The Hacker News reported "101 malicious npm packages collectively downloaded 490,000 times, 116,000 in the last 30 days" for this cluster.

Known IOC additions today.

• wailib@1.0.0 tarball SHA-256: e762bd70253081e1f523e929509e8bd5ff005feaaec6580f8f8b95ee84085920
• prastzy tarball SHA-256: 937b12c263711d14b2ef5a30fd6ce3a1583110b199ad2ce8143be9f4ba1e6242
• @zanta/baileys target JID: 120363406265537739@newsletter
• mikuhostt-baileys target JID: 120363400911374213@newsletter

Novel sub-primitives seen today.

• wailib: README explicitly claims "no channel auto-follow" while the shipped code does exactly that - the first catalogued instance in this family of README/code contradiction misdirection.
• wailib: auto-mutes notifications after subscribing so the victim never sees the subscription in-app.
• luoxy-baileys: fetches the target JID list dynamically at runtime from attacker-hosted JSON - target can rotate without re-publishing the package.

Classify as malicious-package for each.

Cluster C - pip dedh-devops-automation AWS Lambda + Secrets Manager credential theft (spo365-graph family continuation)

dedh-devops-automation@0.0.1/5.0.0/5.6.0/5.6.1/5.6.999/5.8.0/5.8.1/5.9.0 (GHSA-mc5h-r7fw-gr4j, OpenSSF campaign 2026-10-spo365-graph).

Second member of the spo365-graph corpus - same operator as yesterdays pip spo365-graph` Cluster B. Overrides the install command in setup.py; on pip install the payload:

1. Deploys unauthorized AWS Lambda functions in the installer`s AWS account.
2. Extracts credentials from AWS Secrets Manager - any secret the installers identity can read via secretsmanager:GetSecretValue`.
3. Harvests additional system and environment data.
4. Exfiltrates the stolen bundle to attacker-controlled infrastructure.

The eight-version publication (0.0.1 through 5.9.0, including the 5.6.999 sentinel) shows this operator is comfortable mixing dep-confusion-style high versions with mainline numbers to maximise resolution against both public and private-registry setups.

Classify as malicious-package.

Cluster D - 2 Go module Graphalgo campaign expansion

Both are attributed by GHSA to the Graphalgo campaign and cite Aikido Security`s coverage of the Terraform + Go module threats in that cluster. See the existing Lazarus Graphalgo (npm + PyPI) campaign file, which has been extended to carry these two Go module packages.

The btree/orderedbtree/btreex theme and Arbitrum Sepolia EtherHiding infrastructure overlap with the Checkmarx-disclosed indexed-btree Sepolia EtherHiding campaign (npm) is suggestive but not confirmed by a vendor as the same operator - the shared btree naming and shared EtherHiding+Slack TTP class are not alone conclusive.

Classify as malicious-package for each.

Cluster E - pip voxeval cryptominer (NEW campaign 2026-10-voxeval)

voxeval@0.4.2/0.4.3/0.4.4/0.4.5 (GHSA-xmhj-hj4f-c924, source SHA-256 4ffc5162b3b77de40988aa702c4493260a4f0b4f09d5f4719feabcd69f33908a, OpenSSF campaign 2026-10-voxeval).

Advisory text: "imitates real activity and instead deploys a coin miner." The payload mines cryptocurrency on the installers host; no credential theft indicator in the GHSA body. The campaign slug is fresh - this is the first member of the voxeval` corpus. The package name reads as a voice-synthesis / LLM evaluation harness, fitting an audio-ML or LLM-eval workflow.

Classify as malicious-package.

Cluster F - npm @bluewin/utils Burp Collaborator Swisscom-scope dep-confusion probe

@bluewin/utils@>=1.0.0 (GHSA-9ggj-2v34-hwv8), published by npm account securityresearch1.

Package metadata explicitly describes itself as "a PoC package for dependency confusion testing" attempting to claim the @bluewin scope. The @bluewin scope aligns with Swisscoms Bluewin.ch email/portal brand. Postinstall executes node postinstall.js` which beacons to a Burp Collaborator OAST subdomain:

https://5w2cezr3af2i0rvm72x74empvg18pzdo.oastify.com/bluewin/utils

Only the installing hosts IP is exfiltrated - the installer confirmation is the whole payload. oastify.com is PortSwiggers Burp Collaborator service; the subdomain is per-researcher-generated.

Classify as dependency-confusion and severity medium within the sweep - no payload beyond the beacon.

Cluster G - npm @smwebserver/static@99.9.1 sentinel-version malicious-domain beacon

@smwebserver/static@99.9.1 (GHSA-xh7x-r46x-g84q). OpenSSF Package Analysis flagged for communicating with a domain associated with malicious activity. The 99.9.1 single-version publication is the classic sentinel-version shape of a dep-confusion probe against a hypothetical internal @smwebserver/static name - but the OpenSSF classification is based on a confirmed C2 beacon rather than a plain CWE-506 takedown.

Same shape as yesterdays [online-header@99.0.0](/incident/multi-2026-10-02-ghsa-malware-sweep). Classify as malicious-package` (OpenSSF-confirmed beacon raises it above a plain probe).

Cluster H - 9 npm CWE-506 boilerplate takedowns + 1 duplicate

Seven fresh CWE-506 takedowns with no payload analysis beyond the GHSA boilerplate; one duplicate re-publication for a previously-catalogued package. Classify as mixed. Severity medium within the sweep until payload is analysed.

Operator continuity check

• amel10 AWS API Gateway dep-confusion operator: NEW to corpus today (Cluster A). Six confirmed packages, shared C2 s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook. Target shape: Amazon/Alexa internal names.
• jexkcode/noverojs/xayz PhantomSub Baileys operator: on day 4 of visible publications in this corpus (Cluster B). Cumulative catalogued names in this sweep + 2026-09-30/10-01/10-02 now exceeds 25 packages; OX Security`s "101 malicious npm packages / 490,000 downloads" means more are coming.
• spo365-graph AWS Lambda + Secrets Manager pip operator: on day 2 (dedh-devops-automation continues yesterdays spo365-graph`).
• Graphalgo campaign: first two Go module samples in this corpus (Cluster D). Extends the existing Lazarus Graphalgo file.
• voxeval cryptominer: NEW to corpus (Cluster E).
• friendly-greeting-tools/friendly-tools Snowflake credential-theft family (pkusinski-external S3): quiet today (no new publications).
• sherpy/shortneer pip Chrome-wallet + Telegram stealer: quiet today.
• *`kartyk` red-team engagement**: quiet today.
• tailwind-forms-kit EtherHiding mainnet (wallet 0xa322E5...63e1a): quiet today.
• chinazhangsan.ccwu.cc DoH + PWA_ROUTER service-worker hijack: quiet today.
• bfox-build-utils pip GH-Actions worm: quiet today.
• dotenv-precheck Telegram wallet-mnemonic exfil: quiet today.
• fabric-loader-core/mfahelper/get-power install-time RCE: quiet (todays mfahelper@1.0.0` GHSA-9f55-6cf9-3pgw is a DUPLICATE of GHSA-vxqj-q8pf-p87h, not a new version or publication).
• zeal-utils/zeal-util-hooks aveliscare canary: quiet today.
• *donutautosellsrc/`aseity` Polygon-C2 pip campaign**: no fresh publications (day 6 silent).

Registry state

All packages in this sweep are npm/pip/pkg.go.dev-quarantined at time of writing. Active operator-side infrastructure unique to today`s batch:

• s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook (Cluster A - amel10 AWS API Gateway, us-east-1, path /prod/hook)
• Baileys follow query ID 7871414976211147 with per-package rotatable JID obfuscation (Cluster B - PhantomSub continuation)
• luoxy-baileys dynamic JID list fetched from attacker-hosted JSON at runtime (Cluster B)
• wailib@1.0.0 tarball SHA-256 e762bd70253081e1f523e929509e8bd5ff005feaaec6580f8f8b95ee84085920 (Cluster B)
• prastzy tarball SHA-256 937b12c263711d14b2ef5a30fd6ce3a1583110b199ad2ce8143be9f4ba1e6242 (Cluster B)
• dedh-devops-automation AWS Lambda + Secrets Manager payload (Cluster C - continuation of yesterdays spo365-graph`)
• gogets.dev/btreex + gocommunity.io/orderedbtree Arbitrum Sepolia EtherHiding + Slack bot token C2 (Cluster D)
• voxeval source SHA-256 4ffc5162b3b77de40988aa702c4493260a4f0b4f09d5f4719feabcd69f33908a (Cluster E)
• 5w2cezr3af2i0rvm72x74empvg18pzdo.oastify.com/bluewin/utils - Burp Collaborator OAST, researcher securityresearch1 (Cluster F - not attacker-owned C2)

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193/bad-packages, OX Security (PhantomSub campaign formal naming), SafeDep (first Baileys-fork disclosure, August 2026), Xygeni Security Research Team (@dappaoffc/baileys-mod disclosure, September 2026), Aikido Security (Graphalgo Terraform + Go module coverage). Per-package IOC details drawn from GHSA advisory bodies and OpenSSF malicious-packages MAL records published between 2026-10-02 12:00 UTC and 2026-10-03 12:00 UTC.

Affected packages (24)

Impact

• Cluster A - npm amel10 AWS API Gateway dep-confusion mass push targeting Amazon/Alexa internal names (6 confirmed packages, dependency-confusion + malicious-package): all share the exact same payload - inflated version 100.0.0 to outrank private-registry resolutions, node setup.js || true preinstall hook, HTTPS POST of hostname/username/cwd/OS/arch/Node version/configured npm registry + a per-package tracking token to https://s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook (AWS API Gateway, us-east-1, path /prod/hook). Published by the npm account amel10 in a two-minute burst on 2026-09-30; GHSA batched them on 2026-10-02. Packages and GHSAs: alexa-cybertron-team-code-review-agent (GHSA-g7c3-m79h-9cqq - clearly impersonates an Amazon Alexa Cybertron team internal code-review helper), okra-cloud-cdk (GHSA-7rq8-hfxr-pxhw - okra-cloud likely a product scope, -cdk suggests AWS CDK construct), ai-workshop-radio-app (GHSA-rxfj-38w3-hw2x), ai-workshop-maa15-radio (GHSA-5m79-v4p8-r597), ai-workshop-radio-lambda (GHSA-427x-rv7c-m3f9 - ai-workshop-* cluster suggests an Amazon AI/ML workshop internal namespace with AWS Lambda target), niksinnkatalapp (GHSA-g37r-cvvp-rj75). Reconnaissance-only payload: no credential theft, no persistence, but every successful install returns the resolved hostname+username+registry URL to the operator so they can map which internal names landed inside which org - that signal alone validates the probe for a follow-on push with a real payload
• Cluster B - 5 npm PhantomSub Baileys silent WhatsApp follow siblings (malicious-package): mikuhostt-baileys@1.0.0/1.0.1/1.0.2 (GHSA-p4xf-x6j2-mq3f - target JID 120363400911374213@newsletter, 90-second post-connect delay, up to three retries), luoxy-baileys@7.1.1/7.1.2/7.1.3 (GHSA-rhcf-fwmc-3cm3 - fetches target JID list dynamically from attacker-hosted JSON, autoFollowNewsletterOnConnect: true default), @zanta/baileys@1.0.0/1.0.1 (GHSA-44wf-ggpw-qq53 - target JID 120363406265537739@newsletter, 3-second delay in package/lib/Socket/socket.js), wailib@<=1.0.0 (GHSA-w72m-vjx4-9m36 - obfuscated char-code decoding in package/lib/Socket/messages-recv.js, 30-second delay, auto-mutes notifications so the victim never sees the subscription; tarball v1.0.0 SHA-256 e762bd70253081e1f523e929509e8bd5ff005feaaec6580f8f8b95ee84085920; README explicitly claims "no channel auto-follow" while the shipped code does exactly that), prastzy@<=1.0.0 (GHSA-phvc-2p87-8jf3 - six hardcoded newsletter JIDs base64-encoded in package/lib/Socket/newsletter.js, 90-second intervals; tarball SHA-256 937b12c263711d14b2ef5a30fd6ce3a1583110b199ad2ce8143be9f4ba1e6242). All share the WhatsApp w:mex FOLLOW query ID 7871414976211147 and the same mechanism catalogued in the earlier jexkcode, noverojs, and 15-sibling 2026-10-02 batch. Formally the OX Security September 2026 PhantomSub campaign (SafeDep first flagged Baileys forks in August 2026, Xygeni named @dappaoffc/baileys-mod in September 2026); The Hacker News reported "101 malicious npm packages / 490,000 downloads / 116,000 in last 30 days" for this cluster. Class-of-harm is unauthorized modification of the victim`s WhatsApp account (silent channel/newsletter subscription for operator reach-boosting), not credential theft or RCE
• Cluster C - pip dedh-devops-automation AWS Lambda + Secrets Manager credential theft (spo365-graph family continuation, malicious-package): dedh-devops-automation@0.0.1/5.0.0/5.6.0/5.6.1/5.6.999/5.8.0/5.8.1/5.9.0 (GHSA-mc5h-r7fw-gr4j, OpenSSF campaign 2026-10-spo365-graph). SECOND MEMBER of the spo365-graph corpus - same operator as yesterdays pip spo365-graph`. Overrides the install command in setup.py; on pip install the payload deploys unauthorized AWS Lambda functions, extracts credentials from AWS Secrets Manager (any secret the installers identity can read via secretsmanager:GetSecretValue), harvests system/environment data, and exfiltrates to attacker infrastructure. The 5.6.999 sentinel-version shape sits inside this one - this operator is comfortable mixing dep-confusion-style high versions with mainline numbers. Package name impersonates a DevOps-automation utility. Likely the same pentests_s3_role IAM role (arn:aws:iam::631484165566:role/pentests_s3_role) remains in play per the friendly-greeting-tools/friendly-tools` lineage from 2026-10-01/02
• Cluster D - 2 Go module Graphalgo campaign expansion (malicious-package, EtherHiding Arbitrum Sepolia + Slack bot token C2): gogets.dev/btreex (GHSA-652v-q229-xvr4; payload concealed in a ZIP file masquerading as btreex.sql, triggered by a specific price integer value; dual-channel RAT via Ethereum smart contract dead drops and Slack bot tokens) and gocommunity.io/orderedbtree (GHSA-p3x3-hqg5-8pwf; second-stage RAT in plaintext that runs automatically; system reconnaissance, executes encrypted payloads, beacons to two C2 points every 3-10 seconds via an Ethereum smart contract on Arbitrum Sepolia network and a Slack bot token; initial distribution ~2026-08-11). First Go module samples in this Graphalgo cluster - GHSA explicitly names the shared campaign; both reference Aikido Securitys coverage of Terraform + Go module threats. See the existing [Lazarus Graphalgo (npm + PyPI) campaign file](/incident/multi-2026-02-11-lazarus-graphalgo) now extended with these two Go packages. The btree/orderedbtree/btreex theme and Arbitrum Sepolia EtherHiding infrastructure overlap with the Checkmarx-disclosed [indexed-btree` Sepolia campaign (npm)](/incident/npm-2026-09-17-indexed-btree-sepolia-etherhiding) is suggestive but not confirmed by a vendor as the same operator
• Cluster E - pip voxeval cryptominer (NEW campaign 2026-10-voxeval, malicious-package): voxeval@0.4.2/0.4.3/0.4.4/0.4.5 (GHSA-xmhj-hj4f-c924, source SHA-256 4ffc5162b3b77de40988aa702c4493260a4f0b4f09d5f4719feabcd69f33908a, OpenSSF campaign 2026-10-voxeval). Advisory text: "imitates real activity and instead deploys a coin miner." First member of this corpus - fresh OpenSSF campaign slug. voxeval reads as a voice/eval evaluation harness name (fits speech-synthesis / LLM-eval workflows). Payload mines cryptocurrency on the installer`s host; no credential theft indicator in the GHSA body
• Cluster F - npm @bluewin/utils Burp-Collaborator Swisscom-scope dep-confusion probe (dependency-confusion): @bluewin/utils@>=1.0.0 (GHSA-9ggj-2v34-hwv8), published by npm account securityresearch1 and explicitly self-described in the package metadata as "a PoC package for dependency confusion testing" that attempts to claim the @bluewin scope on public npm. The @bluewin scope aligns with Swisscoms Bluewin.ch email/portal brand - a plausible internal-scope target. Postinstall executes node postinstall.js which beacons to a Burp Collaborator OAST subdomain https://5w2cezr3af2i0rvm72x74empvg18pzdo.oastify.com/bluewin/utils, confirming install and exfiltrating only the installing hosts IP. Classic bug-bounty researcher recon-only probe shape. oastify.com is PortSwiggers Burp Collaborator service - not attacker-owned C2; the destination string is per-researcher-generated. Severity medium` within the sweep - no payload beyond the beacon
• Cluster G - npm @smwebserver/static@99.9.1 sentinel-version malicious-domain beacon (malicious-package, OpenSSF-confirmed C2): @smwebserver/static@99.9.1 (GHSA-xh7x-r46x-g84q). OpenSSF Package Analysis flagged for communicating with a domain associated with malicious activity. The 99.9.1 single-version publication is the classic sentinel-version shape of a dep-confusion probe against an internal @smwebserver/static name - but the OpenSSF classification is based on a confirmed beacon destination rather than a plain CWE-506 takedown, so classified as a confirmed malicious package rather than a probe. Same shape as yesterdays [online-header@99.0.0`](/incident/multi-2026-10-02-ghsa-malware-sweep)
• Cluster H - 9 npm CWE-506 boilerplate takedowns + 1 duplicate (mixed kinds, no published analysis): turbo-ws@>=1.0.0 (GHSA-3933-m2c5-xfm8), hardhat-zet (GHSA-mw8r-6m3f-qmg8 - hardhat-* scope targets the Ethereum Hardhat developer-tooling ecosystem), ui-base-colors (GHSA-qgqx-3mhx-jwx3), translate-base-font (GHSA-grv5-7wp6-vw6h), ui.dist.min.js (GHSA-325f-rjxf-3gm9 - the .min.js suffix on a package name is unusual, likely trying to trick a copy-paste install), @woodpecker-web-shared/components (GHSA-44hm-95r4-wcrf - impersonates a Woodpecker CI internal web-shared scope), bnppf-flag-icons (GHSA-34p9-xxp2-hv3g - bnppf is BNP Paribas Fortis, the Belgian bank; likely a dep-confusion probe against a specific orgs internal name). All seven carry only the standard "any computer that has this package installed should be considered fully compromised" GHSA boilerplate; no source hash, no source code, no OpenSSF record. ALSO batched today: mfahelper@1.0.0 (GHSA-9f55-6cf9-3pgw) which is a DUPLICATE/second GHSA on the same version already catalogued as [mfahelper Cluster F in the 2026-09-30 sweep](/incident/multi-2026-09-30-ghsa-malware-sweep) via GHSA-vxqj-q8pf-p87h (unpinned-GitHub-tarball RCE via node-net-pool) - treat as a duplicate advisory, remediation unchanged. Treat Cluster H as medium` within the sweep
• Operator continuity check: Todays standout is the amel10 AWS API Gateway dep-confusion operator - a focused probe against Amazon/Alexa internal names (6 confirmed packages co-published in two minutes). The jexkcode/noverojs/xayz PhantomSub Baileys operator continues (5 more siblings, OX Securitys "100+ identified as of September 2026" language still unfolding; cumulative visible count across catalogued sweeps now exceeds 25 names). The spo365-graph AWS Lambda + Secrets Manager pip operator is on day 2 (dedh-devops-automation continues yesterdays spo365-graph). The Graphalgo cluster expands to Go modules for the first time this corpus has seen. The pkusinski-external/631484165566 Snowflake-exfil operator is quiet today (no new publications). The kartyk* red-team engagement is quiet today. The sherpy/shortneer Chrome-wallet operator is quiet today. New to corpus: voxeval` cryptominer campaign (Cluster E)

What to do

1. 1Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, package.json, go.sum, go.mod, requirements.txt, Pipfile.lock, poetry.lock, and pyproject.toml for every package name in Clusters A through H. Uninstall on hit, wipe node_modules/.venv, delete the lockfile, rebuild against a clean cache. Clusters A, B, C, D, E, F, and G carry confirmed payloads; a hit on any of those is a compromise, not a warning
2. 2For Cluster A (amel10 AWS API Gateway dep-confusion against Amazon/Alexa internal names): uninstall on hit immediately. The payload itself is reconnaissance-only (no credential theft, no persistence), but a successful resolution of any of these names on your build host confirms you have an internal namespace exposure the operator can target with a follow-on push. If any of these names resolved to the public npm registry during a build at your org (npm ls alexa-cybertron-team-code-review-agent, yarn why okra-cloud-cdk, etc.), audit .npmrc scope-registry mappings urgently; publish placeholder packages at the public-npm names you expected to be internal; block *.execute-api.us-east-1.amazonaws.com/prod/hook with path matching at egress. If you are inside Amazon/AWS specifically: the alexa-cybertron-team-code-review-agent/ai-workshop-*/okra-cloud-cdk naming shows the operator mapped specific internal product spaces, so expect follow-on names in those scopes
3. 3For Cluster B (5 npm PhantomSub Baileys silent WhatsApp follow siblings): uninstall on hit. Any WhatsApp account that connected via a Baileys client bundling any of these packages between the malicious versions is now silently following the operators newsletter JID - check the accounts subscribed newsletters/channels and unsubscribe. Not a credential-theft class incident but persistent unauthorized account modification. Extend lockfile-lint denylist beyond specific names: block any *baileys*/*bails*/*bailey*/wailib/prastzy package from an unknown publisher - the OX Security "101 malicious npm packages / 490,000 downloads / 116,000 in last 30 days" telemetry means more siblings will keep arriving in GHSA this week
4. 4For Cluster C (pip dedh-devops-automation AWS Lambda + Secrets Manager credential theft): uninstall on hit. If the installer had AWS credentials in reach (any ~/.aws/credentials, instance-metadata reachable IAM role, or AWS_* env vars): rotate every AWS access key those credentials unlocked, review CloudTrail for unexpected lambda:CreateFunction + iam:CreateRole + secretsmanager:GetSecretValue call chains originating from the install host or from newly-created roles, delete any Lambda function the attacker provisioned and the IAM role attached to it, and audit Secrets Manager access logs for every secret the installers identity could read. Same remediation shape as [yesterdays spo365-graph Cluster B](/incident/multi-2026-10-02-ghsa-malware-sweep)
5. 5For Cluster D (Go modules gogets.dev/btreex + gocommunity.io/orderedbtree - Graphalgo campaign Arbitrum Sepolia EtherHiding + Slack bot C2): uninstall on hit, go clean -modcache, re-build against a clean module cache. If the host had a Slack bot token in reach, assume it is now in attacker control - rotate every Slack bot token issued at your org, review Slack audit logs for unexpected bot-token API calls, and revoke OAuth tokens for any Slack app with repository access. If the host runs Ethereum/Arbitrum tooling with mainnet or Sepolia RPC egress permitted, add Arbitrum Sepolia (sepolia-rollup.arbitrum.io, arb-sepolia.g.alchemy.com, and public Arbitrum Sepolia nodes) to the CI/build egress denylist alongside the Ethereum mainnet/Sepolia blocks already in place from indexed-btree and tailwind-forms-kit. The Go-module naming shape (vanity-domain hosts like gogets.dev, gocommunity.io) also suggests fresh vanity-import hostnames; audit go.mod for module hosts that do not resolve to a well-known Git forge
6. 6For Cluster E (pip voxeval cryptominer): uninstall on hit. Audit host CPU/GPU utilisation and process trees for mining pool connections (common pool ports and known Monero/XMR/CryptoNight pool domains); image the host if you cannot rule out running processes. The campaign slug is fresh (2026-10-voxeval) so expect sibling publications - voxeval is a credible speech-synthesis / LLM-eval name, so related utility-sounding names may follow
7. 7For Cluster F (npm @bluewin/utils dep-confusion probe): if any installer or build host at Swisscom or any org that uses an internal @bluewin npm scope resolved this package, treat it as evidence that your private-scope resolution is leaking to public npm. The payload itself is a Burp Collaborator OAST beacon by a self-identified security researcher (securityresearch1) - no attacker-owned C2 and no secondary payload - but the vulnerability is real: fix the scope-registry mapping. If @bluewin is NOT an internal scope at your org, no action needed
8. 8For Cluster G (npm @smwebserver/static@99.9.1 C2 beacon): uninstall on hit. The 99.9.1 sentinel version suggests a dep-confusion probe shape, but the OpenSSF Package Analysis classification is based on a confirmed C2 beacon rather than a plain CWE-506 takedown - assume install-time connection to attacker infrastructure. If any installer-user credentials could have been reached, rotate them. If @smwebserver is a legitimate internal scope at your org, hold the public-npm name
9. 9For Cluster H (9 npm CWE-506 boilerplate takedowns + 1 duplicate): uninstall on hit. Without payload analysis assume real infostealer/RCE at time of quarantine - image the host, rotate installer-user credentials, check outbound telemetry from the install window. bnppf-flag-icons reads unambiguously as a dep-confusion probe against BNP Paribas Fortiss internal naming; @woodpecker-web-shared/components reads as a Woodpecker CI internal scope squat; hardhat-zet fits the pattern of fake Ethereum Hardhat plugins (watch Hardhat-related ingest for siblings). The mfahelper@1.0.0 GHSA-9f55-6cf9-3pgw is a duplicate of GHSA-vxqj-q8pf-p87h already catalogued; remediation is the unchanged "block outbound to github.com/trktgq0wbre1/*`" from the 2026-09-30 sweep Cluster F
10. 10Keep prior egress blocks in place: Ethereum mainnet RPC endpoints (per 2026-09-30 Cluster A tailwind-forms-kit), Ethereum Sepolia RPC endpoints (per indexed-btree), Arbitrum Sepolia RPC endpoints (NEW today - Cluster D gogets.dev/btreex + gocommunity.io/orderedbtree), chinazhangsan.ccwu.cc, gist.githubusercontent.com/chinazhangsan999-crypto, api.npoint.io, api.telegram.org (from CI), fabric-npm.gm-service.xyz, www.jsonkeeper.com, github.com/trktgq0wbre1, npm-canary.aveliscare.com, Polygon RPC endpoints, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil at the egress proxy, and NEW today s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook (Cluster A amel10 AWS API Gateway)

References

• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub
• GHSA-g7c3-m79h-9cqq - npm alexa-cybertron-team-code-review-agent (Cluster A - amel10 AWS API Gateway dep-confusion, Amazon Alexa Cybertron team internal name squat)

  github.com
  GitHub
• GHSA-7rq8-hfxr-pxhw - npm okra-cloud-cdk (Cluster A - amel10 AWS API Gateway dep-confusion)

  github.com
  GitHub
• GHSA-rxfj-38w3-hw2x - npm ai-workshop-radio-app (Cluster A - amel10 AWS API Gateway dep-confusion)

  github.com
  GitHub
• GHSA-5m79-v4p8-r597 - npm ai-workshop-maa15-radio (Cluster A - amel10 AWS API Gateway dep-confusion)

  github.com
  GitHub
• GHSA-427x-rv7c-m3f9 - npm ai-workshop-radio-lambda (Cluster A - amel10 AWS API Gateway dep-confusion)

  github.com
  GitHub
• GHSA-g37r-cvvp-rj75 - npm niksinnkatalapp (Cluster A - amel10 AWS API Gateway dep-confusion)

  github.com
  GitHub
• GHSA-p4xf-x6j2-mq3f - npm mikuhostt-baileys (Cluster B - PhantomSub Baileys silent WhatsApp follow)

  github.com
  GitHub
• GHSA-rhcf-fwmc-3cm3 - npm luoxy-baileys (Cluster B - PhantomSub Baileys silent WhatsApp follow, dynamic JID list)

  github.com
  GitHub
• GHSA-44wf-ggpw-qq53 - npm @zanta/baileys (Cluster B - PhantomSub Baileys silent WhatsApp follow)

  github.com
  GitHub
• GHSA-w72m-vjx4-9m36 - npm wailib (Cluster B - PhantomSub Baileys silent WhatsApp follow, auto-mutes notifications)

  github.com
  GitHub
• GHSA-phvc-2p87-8jf3 - npm prastzy (Cluster B - PhantomSub Baileys silent WhatsApp follow, 6 base64 JIDs)

  github.com
  GitHub
• The Hacker News - 101 malicious npm packages PhantomSub Baileys WhatsApp subscriber campaign (OX Security, SafeDep, Xygeni, September 2026)

  thehackernews.com
  The Hacker News
• GHSA-mc5h-r7fw-gr4j - pip dedh-devops-automation (Cluster C - AWS Lambda + Secrets Manager credential theft, spo365-graph family continuation)

  github.com
  GitHub
• GHSA-652v-q229-xvr4 - Go module gogets.dev/btreex (Cluster D - Graphalgo campaign expansion, Ethereum smart contract + Slack bot token RAT)

  github.com
  GitHub
• GHSA-p3x3-hqg5-8pwf - Go module gocommunity.io/orderedbtree (Cluster D - Graphalgo campaign expansion, Arbitrum Sepolia EtherHiding + Slack bot token)

  github.com
  GitHub
• GHSA-xmhj-hj4f-c924 - pip voxeval (Cluster E - cryptominer NEW campaign 2026-10-voxeval)

  github.com
  GitHub
• GHSA-9ggj-2v34-hwv8 - npm @bluewin/utils (Cluster F - Burp Collaborator Swisscom-scope dep-confusion probe by securityresearch1)

  github.com
  GitHub
• GHSA-xh7x-r46x-g84q - npm @smwebserver/static@99.9.1 (Cluster G - sentinel-version malicious-domain beacon, OpenSSF Package Analysis confirmed)

  github.com
  GitHub
• GHSA-3933-m2c5-xfm8 - npm turbo-ws (Cluster H - CWE-506 boilerplate takedown)

  github.com
  GitHub
• GHSA-mw8r-6m3f-qmg8 - npm hardhat-zet (Cluster H - CWE-506 boilerplate takedown, hardhat-* scope)

  github.com
  GitHub
• GHSA-qgqx-3mhx-jwx3 - npm ui-base-colors (Cluster H - CWE-506 boilerplate takedown)

  github.com
  GitHub
• GHSA-grv5-7wp6-vw6h - npm translate-base-font (Cluster H - CWE-506 boilerplate takedown)

  github.com
  GitHub
• GHSA-325f-rjxf-3gm9 - npm ui.dist.min.js (Cluster H - CWE-506 boilerplate takedown, .min.js suffix in package name)

  github.com
  GitHub
• GHSA-44hm-95r4-wcrf - npm @woodpecker-web-shared/components (Cluster H - CWE-506 boilerplate takedown, Woodpecker CI internal scope squat)

  github.com
  GitHub
• GHSA-34p9-xxp2-hv3g - npm bnppf-flag-icons (Cluster H - CWE-506 boilerplate takedown, BNP Paribas Fortis internal probe)

  github.com
  GitHub
• GHSA-9f55-6cf9-3pgw - npm mfahelper (Cluster H - DUPLICATE of GHSA-vxqj-q8pf-p87h, catalogued in 2026-09-30 sweep)

  github.com
  GitHub