# GitHub Advisory malware sweep - 2026-10-02 (late) + 2026-10-03 (npm `amel10` AWS API Gateway dep-confusion mass push targeting Amazon/Alexa internal names - 6 confirmed packages sharing C2 `s85r5k14qk.execute-api.us-east-1.amazonaws.com`: `alexa-cybertron-team-code-review-agent`, `okra-cloud-cdk`, `ai-workshop-radio-app`, `ai-workshop-maa15-radio`, `ai-workshop-radio-lambda`, `niksinnkatalapp`; 5 npm PhantomSub Baileys silent WhatsApp follow siblings `mikuhostt-baileys`, `luoxy-baileys`, `@zanta/baileys`, `wailib`, `prastzy`; pip `dedh-devops-automation` AWS Lambda + Secrets Manager credential theft `spo365-graph` family continuation; pip `voxeval` cryptominer NEW campaign `2026-10-voxeval`; 2 Go module `Graphalgo` campaign expansion `gogets.dev/btreex`, `gocommunity.io/orderedbtree`; npm `@bluewin/utils` Burp-Collaborator Swisscom-scope dep-confusion probe by `securityresearch1`; npm `@smwebserver/static@99.9.1` sentinel-version malicious-domain beacon; 9 npm CWE-506 boilerplate takedowns `turbo-ws`, `hardhat-zet`, `ui-base-colors`, `translate-base-font`, `ui.dist.min.js`, `@woodpecker-web-shared/components`, `bnppf-flag-icons`)

> GHSA 2026-10-02 (late) + 2026-10-03: ~26 new advisories. Confirmed payloads: 6-package `amel10` npm dep-confusion mass push against Amazon/Alexa internal names (shared C2 `s85r5k14qk.execute-api.us-east-1.amazonaws.com`); 5 PhantomSub Baileys siblings (query ID `7871414976211147`); pip `dedh-devops-automation` AWS Lambda credential theft (`spo365-graph` family day 2); pip `voxeval` cryptominer; 2 Go modules in the `Graphalgo` campaign.

- Published: 2026-10-03
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: Go, npm, PyPI
- Scope: 24 packages, 37 compromised versions
- Tags: dependency-confusion, infostealer, credential-theft, crypto-wallet-drain, account-takeover, obfuscation, ci-cd-compromise, dns-exfiltration
- Also known as: 2026-10-03 GHSA npm+pip+go sweep, amel10 npm AWS API Gateway dep-confusion mass push 6 packages targeting Amazon Alexa internal names, 5 npm PhantomSub Baileys silent WhatsApp follow siblings jexkcode noverojs xayz family continuation (query ID 7871414976211147), dedh-devops-automation pip AWS Lambda + Secrets Manager credential theft spo365-graph family continuation, gogets.dev/btreex + gocommunity.io/orderedbtree Go module Graphalgo campaign expansion Arbitrum Sepolia EtherHiding, voxeval pip cryptominer NEW campaign 2026-10-voxeval, @bluewin/utils npm Swisscom scope Burp Collaborator dep-confusion probe securityresearch1, @smwebserver/static@99.9.1 npm sentinel-version malicious-domain beacon, turbo-ws hardhat-zet ui-base-colors translate-base-font ui.dist.min.js @woodpecker-web-shared/components bnppf-flag-icons npm CWE-506 boilerplate takedowns, PhantomSub campaign
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193/bad-packages, OX Security, SafeDep, Xygeni Security, Aikido Security
- Incident ID: multi-2026-10-03-ghsa-malware-sweep

## Affected packages (24)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@bluewin/utils](https://dependencywatch.io/package/npm/@bluewin/utils) | npm | 1.0.0 |
| [@smwebserver/static](https://dependencywatch.io/package/npm/@smwebserver/static) | npm | 99.9.1 |
| [@woodpecker-web-shared/components](https://dependencywatch.io/package/npm/@woodpecker-web-shared/components) | npm | 1.0.0 |
| [@zanta/baileys](https://dependencywatch.io/package/npm/@zanta/baileys) | npm | 1.0.0, 1.0.1 |
| [ai-workshop-maa15-radio](https://dependencywatch.io/package/npm/ai-workshop-maa15-radio) | npm | 100.0.0 |
| [ai-workshop-radio-app](https://dependencywatch.io/package/npm/ai-workshop-radio-app) | npm | 100.0.0 |
| [ai-workshop-radio-lambda](https://dependencywatch.io/package/npm/ai-workshop-radio-lambda) | npm | 100.0.0 |
| [alexa-cybertron-team-code-review-agent](https://dependencywatch.io/package/npm/alexa-cybertron-team-code-review-agent) | npm | 100.0.0 |
| [bnppf-flag-icons](https://dependencywatch.io/package/npm/bnppf-flag-icons) | npm | 1.0.0 |
| [dedh-devops-automation](https://dependencywatch.io/package/pypi/dedh-devops-automation) | PyPI | 0.0.1, 5.0.0, 5.6.0, 5.6.1, 5.6.999, 5.8.0, 5.8.1, 5.9.0 |
| [gocommunity.io/orderedbtree](https://dependencywatch.io/package/go/gocommunity.io/orderedbtree) | Go |  |
| [gogets.dev/btreex](https://dependencywatch.io/package/go/gogets.dev/btreex) | Go |  |
| [hardhat-zet](https://dependencywatch.io/package/npm/hardhat-zet) | npm | 1.0.0 |
| [luoxy-baileys](https://dependencywatch.io/package/npm/luoxy-baileys) | npm | 7.1.1, 7.1.2, 7.1.3 |
| [mikuhostt-baileys](https://dependencywatch.io/package/npm/mikuhostt-baileys) | npm | 1.0.0, 1.0.1, 1.0.2 |
| [niksinnkatalapp](https://dependencywatch.io/package/npm/niksinnkatalapp) | npm | 100.0.0 |
| [okra-cloud-cdk](https://dependencywatch.io/package/npm/okra-cloud-cdk) | npm | 100.0.0 |
| [prastzy](https://dependencywatch.io/package/npm/prastzy) | npm | 1.0.0 |
| [translate-base-font](https://dependencywatch.io/package/npm/translate-base-font) | npm | 1.0.0 |
| [turbo-ws](https://dependencywatch.io/package/npm/turbo-ws) | npm | 1.0.0 |
| [ui-base-colors](https://dependencywatch.io/package/npm/ui-base-colors) | npm | 1.0.0 |
| [ui.dist.min.js](https://dependencywatch.io/package/npm/ui.dist.min.js) | npm | 1.0.0 |
| [voxeval](https://dependencywatch.io/package/pypi/voxeval) | PyPI | 0.4.2, 0.4.3, 0.4.4, 0.4.5 |
| [wailib](https://dependencywatch.io/package/npm/wailib) | npm | 1.0.0 |

## What happened

Between roughly 2026-10-02 12:00 UTC and 2026-10-03 12:00 UTC, the GitHub Advisory Database (with the OpenSSF malicious-packages bulk export, Amazon Inspector`s IN-MAL feed, and `kam193/bad-packages`) published ~26 new malware advisories. The defensively notable shape of today`s window: a focused 6-package `amel10` npm dep-confusion mass push against Amazon/Alexa internal names sharing a single AWS API Gateway C2; five more PhantomSub Baileys silent-WhatsApp-follow siblings; a second member of the `spo365-graph` AWS Lambda credential-theft pip campaign; a new-to-corpus pip cryptominer campaign (`voxeval`); the first two Go module samples in the `Graphalgo` cluster (Arbitrum Sepolia EtherHiding + Slack bot token C2); a Burp Collaborator bug-bounty probe against a Swisscom-shaped scope; and the usual tail of CWE-506 boilerplate takedowns.

## Cluster A - npm `amel10` AWS API Gateway dep-confusion mass push targeting Amazon/Alexa internal names

Six npm packages co-published by the `amel10` account in a two-minute window on 2026-09-30 UTC, batched into GHSA on 2026-10-02:

| Package | GHSA | Likely target namespace |
|---|---|---|
| `alexa-cybertron-team-code-review-agent` | GHSA-g7c3-m79h-9cqq | Amazon Alexa Cybertron team |
| `okra-cloud-cdk` | GHSA-7rq8-hfxr-pxhw | Amazon / okra-cloud scope with AWS CDK |
| `ai-workshop-radio-app` | GHSA-rxfj-38w3-hw2x | Amazon AI/ML workshop |
| `ai-workshop-maa15-radio` | GHSA-5m79-v4p8-r597 | Amazon AI/ML workshop |
| `ai-workshop-radio-lambda` | GHSA-427x-rv7c-m3f9 | Amazon AI/ML workshop + AWS Lambda |
| `niksinnkatalapp` | GHSA-g37r-cvvp-rj75 | Unclear scope |

**The primitive.** Each package uses the inflated version `100.0.0` to outrank private-registry resolutions, declares `node setup.js || true` as a preinstall hook, and the setup script HTTPS-POSTs hostname, username, cwd, OS, architecture, Node.js version, configured npm registry, and a per-package tracking token to:

```
https://s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook
```

That endpoint is an AWS API Gateway in us-east-1 under an attacker-controlled AWS account - standard dep-confusion collector shape. The per-package tracking token lets the operator correlate which specific internal name triggered the resolution, so they know which name to push a follow-on payload against.

**Payload class.** Reconnaissance-only; no credential theft, no persistence. The signal is the hit, not the exfil.

**Operator continuity.** Fresh `amel10` operator for this corpus. The naming shape - specifically `alexa-cybertron-team-code-review-agent`, which is far too specific to be a lucky guess - strongly suggests prior OSINT on Amazon`s internal namespace. Expect siblings against the same product spaces (Alexa, AWS CDK, AI workshop pipelines) over the next week.

Classify as `dependency-confusion` for each.

## Cluster B - 5 npm PhantomSub Baileys silent WhatsApp follow siblings

Five more Baileys forks shipping the same `w:mex` FOLLOW query ID `7871414976211147` mechanism catalogued in the prior sweeps:

| Package | Versions | GHSA | Target JID / delay |
|---|---|---|---|
| `mikuhostt-baileys` | 1.0.0, 1.0.1, 1.0.2 | GHSA-p4xf-x6j2-mq3f | `120363400911374213@newsletter`, 90s delay, 3 retries |
| `luoxy-baileys` | 7.1.1, 7.1.2, 7.1.3 | GHSA-rhcf-fwmc-3cm3 | Dynamic JID list fetched from attacker-hosted JSON |
| `@zanta/baileys` | 1.0.0, 1.0.1 | GHSA-44wf-ggpw-qq53 | `120363406265537739@newsletter`, 3s delay |
| `wailib` | <=1.0.0 | GHSA-w72m-vjx4-9m36 | 2 hidden newsletter JIDs, 30s delay, auto-mutes |
| `prastzy` | <=1.0.0 | GHSA-phvc-2p87-8jf3 | 6 base64-encoded JIDs, 90s intervals |

**Formal attribution.** This cluster is OX Security`s September 2026 **PhantomSub** campaign. SafeDep first flagged Baileys forks engaging in silent channel-follow + ad-injection in August 2026; Xygeni named `@dappaoffc/baileys-mod` in September 2026; OX Security consolidated the family and named it in late September. The Hacker News reported "101 malicious npm packages collectively downloaded 490,000 times, 116,000 in the last 30 days" for this cluster.

**Known IOC additions today.**
- `wailib@1.0.0` tarball SHA-256: `e762bd70253081e1f523e929509e8bd5ff005feaaec6580f8f8b95ee84085920`
- `prastzy` tarball SHA-256: `937b12c263711d14b2ef5a30fd6ce3a1583110b199ad2ce8143be9f4ba1e6242`
- `@zanta/baileys` target JID: `120363406265537739@newsletter`
- `mikuhostt-baileys` target JID: `120363400911374213@newsletter`

**Novel sub-primitives seen today.**
- `wailib`: README explicitly claims "no channel auto-follow" while the shipped code does exactly that - the first catalogued instance in this family of README/code contradiction misdirection.
- `wailib`: auto-mutes notifications after subscribing so the victim never sees the subscription in-app.
- `luoxy-baileys`: fetches the target JID list dynamically at runtime from attacker-hosted JSON - target can rotate without re-publishing the package.

Classify as `malicious-package` for each.

## Cluster C - pip `dedh-devops-automation` AWS Lambda + Secrets Manager credential theft (`spo365-graph` family continuation)

`dedh-devops-automation@0.0.1`/`5.0.0`/`5.6.0`/`5.6.1`/`5.6.999`/`5.8.0`/`5.8.1`/`5.9.0` (GHSA-mc5h-r7fw-gr4j, OpenSSF campaign `2026-10-spo365-graph`).

Second member of the `spo365-graph` corpus - same operator as [yesterday`s pip `spo365-graph`](https://dependencywatch.io/incident/multi-2026-10-02-ghsa-malware-sweep) Cluster B. Overrides the `install` command in `setup.py`; on `pip install` the payload:

1. Deploys unauthorized AWS Lambda functions in the installer`s AWS account.
2. Extracts credentials from AWS Secrets Manager - any secret the installer`s identity can read via `secretsmanager:GetSecretValue`.
3. Harvests additional system and environment data.
4. Exfiltrates the stolen bundle to attacker-controlled infrastructure.

The eight-version publication (`0.0.1` through `5.9.0`, including the `5.6.999` sentinel) shows this operator is comfortable mixing dep-confusion-style high versions with mainline numbers to maximise resolution against both public and private-registry setups.

Classify as `malicious-package`.

## Cluster D - 2 Go module `Graphalgo` campaign expansion

| Module | GHSA | Mechanism |
|---|---|---|
| `gogets.dev/btreex` | GHSA-652v-q229-xvr4 | Payload in ZIP masquerading as `btreex.sql`; triggered by specific price integer value; dual-channel RAT via Ethereum smart contract + Slack bot tokens |
| `gocommunity.io/orderedbtree` | GHSA-p3x3-hqg5-8pwf | Second-stage RAT in plaintext; auto-runs; system reconnaissance + encrypted payloads; C2 every 3-10 seconds via Ethereum smart contract on **Arbitrum Sepolia** network + Slack bot token |

Both are attributed by GHSA to the `Graphalgo` campaign and cite Aikido Security`s coverage of the Terraform + Go module threats in that cluster. See the existing [Lazarus Graphalgo (npm + PyPI) campaign file](https://dependencywatch.io/incident/multi-2026-02-11-lazarus-graphalgo), which has been extended to carry these two Go module packages.

The `btree`/`orderedbtree`/`btreex` theme and Arbitrum Sepolia EtherHiding infrastructure overlap with the Checkmarx-disclosed [`indexed-btree` Sepolia EtherHiding campaign (npm)](https://dependencywatch.io/incident/npm-2026-09-17-indexed-btree-sepolia-etherhiding) is suggestive but not confirmed by a vendor as the same operator - the shared `btree` naming and shared EtherHiding+Slack TTP class are not alone conclusive.

Classify as `malicious-package` for each.

## Cluster E - pip `voxeval` cryptominer (NEW campaign `2026-10-voxeval`)

`voxeval@0.4.2`/`0.4.3`/`0.4.4`/`0.4.5` (GHSA-xmhj-hj4f-c924, source SHA-256 `4ffc5162b3b77de40988aa702c4493260a4f0b4f09d5f4719feabcd69f33908a`, OpenSSF campaign `2026-10-voxeval`).

Advisory text: "imitates real activity and instead deploys a coin miner." The payload mines cryptocurrency on the installer`s host; no credential theft indicator in the GHSA body. The campaign slug is fresh - this is the first member of the `voxeval` corpus. The package name reads as a voice-synthesis / LLM evaluation harness, fitting an audio-ML or LLM-eval workflow.

Classify as `malicious-package`.

## Cluster F - npm `@bluewin/utils` Burp Collaborator Swisscom-scope dep-confusion probe

`@bluewin/utils@>=1.0.0` (GHSA-9ggj-2v34-hwv8), published by npm account `securityresearch1`.

Package metadata explicitly describes itself as "a PoC package for dependency confusion testing" attempting to claim the `@bluewin` scope. The `@bluewin` scope aligns with Swisscom`s Bluewin.ch email/portal brand. Postinstall executes `node postinstall.js` which beacons to a Burp Collaborator OAST subdomain:

```
https://5w2cezr3af2i0rvm72x74empvg18pzdo.oastify.com/bluewin/utils
```

Only the installing host`s IP is exfiltrated - the installer confirmation is the whole payload. `oastify.com` is PortSwigger`s Burp Collaborator service; the subdomain is per-researcher-generated.

Classify as `dependency-confusion` and severity `medium` within the sweep - no payload beyond the beacon.

## Cluster G - npm `@smwebserver/static@99.9.1` sentinel-version malicious-domain beacon

`@smwebserver/static@99.9.1` (GHSA-xh7x-r46x-g84q). OpenSSF Package Analysis flagged for communicating with a domain associated with malicious activity. The `99.9.1` single-version publication is the classic sentinel-version shape of a dep-confusion probe against a hypothetical internal `@smwebserver/static` name - but the OpenSSF classification is based on a confirmed C2 beacon rather than a plain CWE-506 takedown.

Same shape as yesterday`s [`online-header@99.0.0`](https://dependencywatch.io/incident/multi-2026-10-02-ghsa-malware-sweep). Classify as `malicious-package` (OpenSSF-confirmed beacon raises it above a plain probe).

## Cluster H - 9 npm CWE-506 boilerplate takedowns + 1 duplicate

| Package | GHSA | Notes |
|---|---|---|
| `turbo-ws` | GHSA-3933-m2c5-xfm8 | Generic |
| `hardhat-zet` | GHSA-mw8r-6m3f-qmg8 | `hardhat-*` scope targets Ethereum Hardhat tooling |
| `ui-base-colors` | GHSA-qgqx-3mhx-jwx3 | Generic |
| `translate-base-font` | GHSA-grv5-7wp6-vw6h | Generic |
| `ui.dist.min.js` | GHSA-325f-rjxf-3gm9 | `.min.js` suffix on a package name is unusual |
| `@woodpecker-web-shared/components` | GHSA-44hm-95r4-wcrf | Impersonates Woodpecker CI internal scope |
| `bnppf-flag-icons` | GHSA-34p9-xxp2-hv3g | `bnppf` = BNP Paribas Fortis (Belgian bank) internal probe |
| `mfahelper` (DUPLICATE) | GHSA-9f55-6cf9-3pgw | Duplicate of GHSA-vxqj-q8pf-p87h ([2026-09-30 Cluster F](https://dependencywatch.io/incident/multi-2026-09-30-ghsa-malware-sweep)) |

Seven fresh CWE-506 takedowns with no payload analysis beyond the GHSA boilerplate; one duplicate re-publication for a previously-catalogued package. Classify as mixed. Severity `medium` within the sweep until payload is analysed.

## Operator continuity check

- **`amel10` AWS API Gateway dep-confusion operator**: NEW to corpus today (Cluster A). Six confirmed packages, shared C2 `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`. Target shape: Amazon/Alexa internal names.
- **`jexkcode`/`noverojs`/`xayz` PhantomSub Baileys operator**: on day 4 of visible publications in this corpus (Cluster B). Cumulative catalogued names in this sweep + 2026-09-30/10-01/10-02 now exceeds 25 packages; OX Security`s "101 malicious npm packages / 490,000 downloads" means more are coming.
- **`spo365-graph` AWS Lambda + Secrets Manager pip operator**: on day 2 (`dedh-devops-automation` continues yesterday`s `spo365-graph`).
- **`Graphalgo` campaign**: first two Go module samples in this corpus (Cluster D). Extends the existing [Lazarus Graphalgo](https://dependencywatch.io/incident/multi-2026-02-11-lazarus-graphalgo) file.
- **`voxeval` cryptominer**: NEW to corpus (Cluster E).
- **`friendly-greeting-tools`/`friendly-tools` Snowflake credential-theft family (`pkusinski-external` S3)**: quiet today (no new publications).
- **`sherpy`/`shortneer` pip Chrome-wallet + Telegram stealer**: quiet today.
- **`kartyk*` red-team engagement**: quiet today.
- **`tailwind-forms-kit` EtherHiding mainnet (wallet `0xa322E5...63e1a`)**: quiet today.
- **`chinazhangsan.ccwu.cc` DoH + PWA_ROUTER service-worker hijack**: quiet today.
- **`bfox-build-utils` pip GH-Actions worm**: quiet today.
- **`dotenv-precheck` Telegram wallet-mnemonic exfil**: quiet today.
- **`fabric-loader-core`/`mfahelper`/`get-power` install-time RCE**: quiet (today`s `mfahelper@1.0.0` GHSA-9f55-6cf9-3pgw is a DUPLICATE of GHSA-vxqj-q8pf-p87h, not a new version or publication).
- **`zeal-utils`/`zeal-util-hooks` aveliscare canary**: quiet today.
- **`donutautosellsrc`/`aseity*` Polygon-C2 pip campaign**: no fresh publications (day 6 silent).

## Registry state

All packages in this sweep are npm/pip/pkg.go.dev-quarantined at time of writing. Active operator-side infrastructure unique to today`s batch:

- `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook` (Cluster A - `amel10` AWS API Gateway, us-east-1, path `/prod/hook`)
- Baileys follow query ID `7871414976211147` with per-package rotatable JID obfuscation (Cluster B - PhantomSub continuation)
- `luoxy-baileys` dynamic JID list fetched from attacker-hosted JSON at runtime (Cluster B)
- `wailib@1.0.0` tarball SHA-256 `e762bd70253081e1f523e929509e8bd5ff005feaaec6580f8f8b95ee84085920` (Cluster B)
- `prastzy` tarball SHA-256 `937b12c263711d14b2ef5a30fd6ce3a1583110b199ad2ce8143be9f4ba1e6242` (Cluster B)
- `dedh-devops-automation` AWS Lambda + Secrets Manager payload (Cluster C - continuation of yesterday`s `spo365-graph`)
- `gogets.dev/btreex` + `gocommunity.io/orderedbtree` Arbitrum Sepolia EtherHiding + Slack bot token C2 (Cluster D)
- `voxeval` source SHA-256 `4ffc5162b3b77de40988aa702c4493260a4f0b4f09d5f4719feabcd69f33908a` (Cluster E)
- `5w2cezr3af2i0rvm72x74empvg18pzdo.oastify.com/bluewin/utils` - Burp Collaborator OAST, researcher `securityresearch1` (Cluster F - not attacker-owned C2)

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector`, `kam193/bad-packages`, `OX Security` (PhantomSub campaign formal naming), `SafeDep` (first Baileys-fork disclosure, August 2026), `Xygeni Security Research Team` (`@dappaoffc/baileys-mod` disclosure, September 2026), `Aikido Security` (`Graphalgo` Terraform + Go module coverage). Per-package IOC details drawn from GHSA advisory bodies and OpenSSF malicious-packages MAL records published between 2026-10-02 12:00 UTC and 2026-10-03 12:00 UTC.

## Impact

- **Cluster A - npm `amel10` AWS API Gateway dep-confusion mass push targeting Amazon/Alexa internal names (6 confirmed packages, dependency-confusion + malicious-package)**: all share the exact same payload - inflated version `100.0.0` to outrank private-registry resolutions, `node setup.js || true` preinstall hook, HTTPS POST of hostname/username/cwd/OS/arch/Node version/configured npm registry + a per-package tracking token to `https://s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook` (AWS API Gateway, us-east-1, path `/prod/hook`). Published by the npm account `amel10` in a two-minute burst on 2026-09-30; GHSA batched them on 2026-10-02. Packages and GHSAs: `alexa-cybertron-team-code-review-agent` (GHSA-g7c3-m79h-9cqq - clearly impersonates an Amazon Alexa Cybertron team internal code-review helper), `okra-cloud-cdk` (GHSA-7rq8-hfxr-pxhw - `okra-cloud` likely a product scope, `-cdk` suggests AWS CDK construct), `ai-workshop-radio-app` (GHSA-rxfj-38w3-hw2x), `ai-workshop-maa15-radio` (GHSA-5m79-v4p8-r597), `ai-workshop-radio-lambda` (GHSA-427x-rv7c-m3f9 - `ai-workshop-*` cluster suggests an Amazon AI/ML workshop internal namespace with AWS Lambda target), `niksinnkatalapp` (GHSA-g37r-cvvp-rj75). Reconnaissance-only payload: no credential theft, no persistence, but every successful install returns the resolved hostname+username+registry URL to the operator so they can map which internal names landed inside which org - that signal alone validates the probe for a follow-on push with a real payload
- **Cluster B - 5 npm PhantomSub Baileys silent WhatsApp follow siblings (malicious-package)**: `mikuhostt-baileys@1.0.0/1.0.1/1.0.2` (GHSA-p4xf-x6j2-mq3f - target JID `120363400911374213@newsletter`, 90-second post-connect delay, up to three retries), `luoxy-baileys@7.1.1/7.1.2/7.1.3` (GHSA-rhcf-fwmc-3cm3 - fetches target JID list dynamically from attacker-hosted JSON, `autoFollowNewsletterOnConnect: true` default), `@zanta/baileys@1.0.0/1.0.1` (GHSA-44wf-ggpw-qq53 - target JID `120363406265537739@newsletter`, 3-second delay in `package/lib/Socket/socket.js`), `wailib@<=1.0.0` (GHSA-w72m-vjx4-9m36 - obfuscated char-code decoding in `package/lib/Socket/messages-recv.js`, 30-second delay, auto-mutes notifications so the victim never sees the subscription; tarball v1.0.0 SHA-256 `e762bd70253081e1f523e929509e8bd5ff005feaaec6580f8f8b95ee84085920`; README explicitly claims "no channel auto-follow" while the shipped code does exactly that), `prastzy@<=1.0.0` (GHSA-phvc-2p87-8jf3 - six hardcoded newsletter JIDs base64-encoded in `package/lib/Socket/newsletter.js`, 90-second intervals; tarball SHA-256 `937b12c263711d14b2ef5a30fd6ce3a1583110b199ad2ce8143be9f4ba1e6242`). All share the WhatsApp `w:mex` FOLLOW query ID `7871414976211147` and the same mechanism catalogued in the earlier [`jexkcode`](https://dependencywatch.io/incident/multi-2026-09-30-ghsa-malware-sweep), [`noverojs`](https://dependencywatch.io/incident/multi-2026-10-01-ghsa-malware-sweep), and [15-sibling 2026-10-02 batch](https://dependencywatch.io/incident/multi-2026-10-02-ghsa-malware-sweep). Formally the OX Security September 2026 **PhantomSub** campaign (SafeDep first flagged Baileys forks in August 2026, Xygeni named `@dappaoffc/baileys-mod` in September 2026); The Hacker News reported "101 malicious npm packages / 490,000 downloads / 116,000 in last 30 days" for this cluster. Class-of-harm is unauthorized modification of the victim`s WhatsApp account (silent channel/newsletter subscription for operator reach-boosting), not credential theft or RCE
- **Cluster C - pip `dedh-devops-automation` AWS Lambda + Secrets Manager credential theft (`spo365-graph` family continuation, malicious-package)**: `dedh-devops-automation@0.0.1/5.0.0/5.6.0/5.6.1/5.6.999/5.8.0/5.8.1/5.9.0` (GHSA-mc5h-r7fw-gr4j, OpenSSF campaign `2026-10-spo365-graph`). SECOND MEMBER of the `spo365-graph` corpus - same operator as [yesterday`s pip `spo365-graph`](https://dependencywatch.io/incident/multi-2026-10-02-ghsa-malware-sweep). Overrides the `install` command in `setup.py`; on `pip install` the payload deploys unauthorized AWS Lambda functions, extracts credentials from AWS Secrets Manager (any secret the installer`s identity can read via `secretsmanager:GetSecretValue`), harvests system/environment data, and exfiltrates to attacker infrastructure. The `5.6.999` sentinel-version shape sits inside this one - this operator is comfortable mixing dep-confusion-style high versions with mainline numbers. Package name impersonates a DevOps-automation utility. Likely the same `pentests_s3_role` IAM role (`arn:aws:iam::631484165566:role/pentests_s3_role`) remains in play per the `friendly-greeting-tools`/`friendly-tools` lineage from 2026-10-01/02
- **Cluster D - 2 Go module `Graphalgo` campaign expansion (malicious-package, EtherHiding Arbitrum Sepolia + Slack bot token C2)**: `gogets.dev/btreex` (GHSA-652v-q229-xvr4; payload concealed in a ZIP file masquerading as `btreex.sql`, triggered by a specific price integer value; dual-channel RAT via Ethereum smart contract dead drops and Slack bot tokens) and `gocommunity.io/orderedbtree` (GHSA-p3x3-hqg5-8pwf; second-stage RAT in plaintext that runs automatically; system reconnaissance, executes encrypted payloads, beacons to two C2 points every 3-10 seconds via an Ethereum smart contract on Arbitrum Sepolia network and a Slack bot token; initial distribution ~2026-08-11). First Go module samples in this `Graphalgo` cluster - GHSA explicitly names the shared campaign; both reference Aikido Security`s coverage of Terraform + Go module threats. See the existing [Lazarus Graphalgo (npm + PyPI) campaign file](https://dependencywatch.io/incident/multi-2026-02-11-lazarus-graphalgo) now extended with these two Go packages. The `btree`/`orderedbtree`/`btreex` theme and Arbitrum Sepolia EtherHiding infrastructure overlap with the Checkmarx-disclosed [`indexed-btree` Sepolia campaign (npm)](https://dependencywatch.io/incident/npm-2026-09-17-indexed-btree-sepolia-etherhiding) is suggestive but not confirmed by a vendor as the same operator
- **Cluster E - pip `voxeval` cryptominer (NEW campaign `2026-10-voxeval`, malicious-package)**: `voxeval@0.4.2/0.4.3/0.4.4/0.4.5` (GHSA-xmhj-hj4f-c924, source SHA-256 `4ffc5162b3b77de40988aa702c4493260a4f0b4f09d5f4719feabcd69f33908a`, OpenSSF campaign `2026-10-voxeval`). Advisory text: "imitates real activity and instead deploys a coin miner." First member of this corpus - fresh OpenSSF campaign slug. `voxeval` reads as a voice/eval evaluation harness name (fits speech-synthesis / LLM-eval workflows). Payload mines cryptocurrency on the installer`s host; no credential theft indicator in the GHSA body
- **Cluster F - npm `@bluewin/utils` Burp-Collaborator Swisscom-scope dep-confusion probe (dependency-confusion)**: `@bluewin/utils@>=1.0.0` (GHSA-9ggj-2v34-hwv8), published by npm account `securityresearch1` and explicitly self-described in the package metadata as "a PoC package for dependency confusion testing" that attempts to claim the `@bluewin` scope on public npm. The `@bluewin` scope aligns with Swisscom`s Bluewin.ch email/portal brand - a plausible internal-scope target. Postinstall executes `node postinstall.js` which beacons to a Burp Collaborator OAST subdomain `https://5w2cezr3af2i0rvm72x74empvg18pzdo.oastify.com/bluewin/utils`, confirming install and exfiltrating only the installing host`s IP. Classic bug-bounty researcher recon-only probe shape. `oastify.com` is PortSwigger`s Burp Collaborator service - not attacker-owned C2; the destination string is per-researcher-generated. Severity `medium` within the sweep - no payload beyond the beacon
- **Cluster G - npm `@smwebserver/static@99.9.1` sentinel-version malicious-domain beacon (malicious-package, OpenSSF-confirmed C2)**: `@smwebserver/static@99.9.1` (GHSA-xh7x-r46x-g84q). OpenSSF Package Analysis flagged for communicating with a domain associated with malicious activity. The `99.9.1` single-version publication is the classic sentinel-version shape of a dep-confusion probe against an internal `@smwebserver/static` name - but the OpenSSF classification is based on a confirmed beacon destination rather than a plain CWE-506 takedown, so classified as a confirmed malicious package rather than a probe. Same shape as yesterday`s [`online-header@99.0.0`](https://dependencywatch.io/incident/multi-2026-10-02-ghsa-malware-sweep)
- **Cluster H - 9 npm CWE-506 boilerplate takedowns + 1 duplicate (mixed kinds, no published analysis)**: `turbo-ws@>=1.0.0` (GHSA-3933-m2c5-xfm8), `hardhat-zet` (GHSA-mw8r-6m3f-qmg8 - `hardhat-*` scope targets the Ethereum Hardhat developer-tooling ecosystem), `ui-base-colors` (GHSA-qgqx-3mhx-jwx3), `translate-base-font` (GHSA-grv5-7wp6-vw6h), `ui.dist.min.js` (GHSA-325f-rjxf-3gm9 - the `.min.js` suffix on a package name is unusual, likely trying to trick a copy-paste install), `@woodpecker-web-shared/components` (GHSA-44hm-95r4-wcrf - impersonates a Woodpecker CI internal web-shared scope), `bnppf-flag-icons` (GHSA-34p9-xxp2-hv3g - `bnppf` is BNP Paribas Fortis, the Belgian bank; likely a dep-confusion probe against a specific org`s internal name). All seven carry only the standard "any computer that has this package installed should be considered fully compromised" GHSA boilerplate; no source hash, no source code, no OpenSSF record. ALSO batched today: `mfahelper@1.0.0` (GHSA-9f55-6cf9-3pgw) which is a DUPLICATE/second GHSA on the same version already catalogued as [`mfahelper` Cluster F in the 2026-09-30 sweep](https://dependencywatch.io/incident/multi-2026-09-30-ghsa-malware-sweep) via GHSA-vxqj-q8pf-p87h (unpinned-GitHub-tarball RCE via `node-net-pool`) - treat as a duplicate advisory, remediation unchanged. Treat Cluster H as `medium` within the sweep
- **Operator continuity check**: Today`s standout is the `amel10` AWS API Gateway dep-confusion operator - a focused probe against Amazon/Alexa internal names (6 confirmed packages co-published in two minutes). The `jexkcode`/`noverojs`/`xayz` PhantomSub Baileys operator continues (5 more siblings, OX Security`s "100+ identified as of September 2026" language still unfolding; cumulative visible count across catalogued sweeps now exceeds 25 names). The `spo365-graph` AWS Lambda + Secrets Manager pip operator is on day 2 (`dedh-devops-automation` continues yesterday`s `spo365-graph`). The `Graphalgo` cluster expands to Go modules for the first time this corpus has seen. The `pkusinski-external`/`631484165566` Snowflake-exfil operator is quiet today (no new publications). The `kartyk*` red-team engagement is quiet today. The `sherpy`/`shortneer` Chrome-wallet operator is quiet today. New to corpus: `voxeval` cryptominer campaign (Cluster E)

## What to do

1. Grep every `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `package.json`, `go.sum`, `go.mod`, `requirements.txt`, `Pipfile.lock`, `poetry.lock`, and `pyproject.toml` for every package name in Clusters A through H. Uninstall on hit, wipe `node_modules`/`.venv`, delete the lockfile, rebuild against a clean cache. Clusters A, B, C, D, E, F, and G carry confirmed payloads; a hit on any of those is a compromise, not a warning
2. **For Cluster A (`amel10` AWS API Gateway dep-confusion against Amazon/Alexa internal names)**: uninstall on hit immediately. The payload itself is reconnaissance-only (no credential theft, no persistence), but a successful resolution of any of these names on your build host confirms you have an internal namespace exposure the operator can target with a follow-on push. If any of these names resolved to the public npm registry during a build at your org (`npm ls alexa-cybertron-team-code-review-agent`, `yarn why okra-cloud-cdk`, etc.), audit `.npmrc` scope-registry mappings urgently; publish placeholder packages at the public-npm names you expected to be internal; block `*.execute-api.us-east-1.amazonaws.com/prod/hook` with path matching at egress. If you are inside Amazon/AWS specifically: the `alexa-cybertron-team-code-review-agent`/`ai-workshop-*`/`okra-cloud-cdk` naming shows the operator mapped specific internal product spaces, so expect follow-on names in those scopes
3. **For Cluster B (5 npm PhantomSub Baileys silent WhatsApp follow siblings)**: uninstall on hit. Any WhatsApp account that connected via a Baileys client bundling any of these packages between the malicious versions is now silently following the operator`s newsletter JID - check the account`s subscribed newsletters/channels and unsubscribe. Not a credential-theft class incident but persistent unauthorized account modification. Extend lockfile-lint denylist beyond specific names: block any `*baileys*`/`*bails*`/`*bailey*`/`wailib`/`prastzy` package from an unknown publisher - the OX Security "101 malicious npm packages / 490,000 downloads / 116,000 in last 30 days" telemetry means more siblings will keep arriving in GHSA this week
4. **For Cluster C (pip `dedh-devops-automation` AWS Lambda + Secrets Manager credential theft)**: uninstall on hit. If the installer had AWS credentials in reach (any `~/.aws/credentials`, instance-metadata reachable IAM role, or `AWS_*` env vars): rotate every AWS access key those credentials unlocked, review CloudTrail for unexpected `lambda:CreateFunction` + `iam:CreateRole` + `secretsmanager:GetSecretValue` call chains originating from the install host or from newly-created roles, delete any Lambda function the attacker provisioned and the IAM role attached to it, and audit Secrets Manager access logs for every secret the installer`s identity could read. Same remediation shape as [yesterday`s `spo365-graph` Cluster B](https://dependencywatch.io/incident/multi-2026-10-02-ghsa-malware-sweep)
5. **For Cluster D (Go modules `gogets.dev/btreex` + `gocommunity.io/orderedbtree` - `Graphalgo` campaign Arbitrum Sepolia EtherHiding + Slack bot C2)**: uninstall on hit, `go clean -modcache`, re-build against a clean module cache. If the host had a Slack bot token in reach, assume it is now in attacker control - rotate every Slack bot token issued at your org, review Slack audit logs for unexpected bot-token API calls, and revoke OAuth tokens for any Slack app with repository access. If the host runs Ethereum/Arbitrum tooling with mainnet or Sepolia RPC egress permitted, add Arbitrum Sepolia (`sepolia-rollup.arbitrum.io`, `arb-sepolia.g.alchemy.com`, and public Arbitrum Sepolia nodes) to the CI/build egress denylist alongside the Ethereum mainnet/Sepolia blocks already in place from [`indexed-btree`](https://dependencywatch.io/incident/npm-2026-09-17-indexed-btree-sepolia-etherhiding) and [`tailwind-forms-kit`](https://dependencywatch.io/incident/multi-2026-09-30-ghsa-malware-sweep). The Go-module naming shape (vanity-domain hosts like `gogets.dev`, `gocommunity.io`) also suggests fresh vanity-import hostnames; audit `go.mod` for module hosts that do not resolve to a well-known Git forge
6. **For Cluster E (pip `voxeval` cryptominer)**: uninstall on hit. Audit host CPU/GPU utilisation and process trees for mining pool connections (common pool ports and known Monero/XMR/CryptoNight pool domains); image the host if you cannot rule out running processes. The campaign slug is fresh (`2026-10-voxeval`) so expect sibling publications - `voxeval` is a credible speech-synthesis / LLM-eval name, so related utility-sounding names may follow
7. **For Cluster F (npm `@bluewin/utils` dep-confusion probe)**: if any installer or build host at Swisscom or any org that uses an internal `@bluewin` npm scope resolved this package, treat it as evidence that your private-scope resolution is leaking to public npm. The payload itself is a Burp Collaborator OAST beacon by a self-identified security researcher (`securityresearch1`) - no attacker-owned C2 and no secondary payload - but the vulnerability is real: fix the scope-registry mapping. If `@bluewin` is NOT an internal scope at your org, no action needed
8. **For Cluster G (npm `@smwebserver/static@99.9.1` C2 beacon)**: uninstall on hit. The `99.9.1` sentinel version suggests a dep-confusion probe shape, but the OpenSSF Package Analysis classification is based on a confirmed C2 beacon rather than a plain CWE-506 takedown - assume install-time connection to attacker infrastructure. If any installer-user credentials could have been reached, rotate them. If `@smwebserver` is a legitimate internal scope at your org, hold the public-npm name
9. **For Cluster H (9 npm CWE-506 boilerplate takedowns + 1 duplicate)**: uninstall on hit. Without payload analysis assume real infostealer/RCE at time of quarantine - image the host, rotate installer-user credentials, check outbound telemetry from the install window. `bnppf-flag-icons` reads unambiguously as a dep-confusion probe against BNP Paribas Fortis`s internal naming; `@woodpecker-web-shared/components` reads as a Woodpecker CI internal scope squat; `hardhat-zet` fits the pattern of fake Ethereum Hardhat plugins (watch Hardhat-related ingest for siblings). The `mfahelper@1.0.0` GHSA-9f55-6cf9-3pgw is a duplicate of GHSA-vxqj-q8pf-p87h already catalogued; remediation is the unchanged "block outbound to `github.com/trktgq0wbre1/*`" from [the 2026-09-30 sweep Cluster F](https://dependencywatch.io/incident/multi-2026-09-30-ghsa-malware-sweep)
10. Keep prior egress blocks in place: Ethereum mainnet RPC endpoints (per 2026-09-30 Cluster A `tailwind-forms-kit`), Ethereum Sepolia RPC endpoints (per [`indexed-btree`](https://dependencywatch.io/incident/npm-2026-09-17-indexed-btree-sepolia-etherhiding)), Arbitrum Sepolia RPC endpoints (NEW today - Cluster D `gogets.dev/btreex` + `gocommunity.io/orderedbtree`), `chinazhangsan.ccwu.cc`, `gist.githubusercontent.com/chinazhangsan999-crypto`, `api.npoint.io`, `api.telegram.org` (from CI), `fabric-npm.gm-service.xyz`, `www.jsonkeeper.com`, `github.com/trktgq0wbre1`, `npm-canary.aveliscare.com`, Polygon RPC endpoints, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil at the egress proxy, and NEW today `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook` (Cluster A `amel10` AWS API Gateway)

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-g7c3-m79h-9cqq - npm alexa-cybertron-team-code-review-agent (Cluster A - amel10 AWS API Gateway dep-confusion, Amazon Alexa Cybertron team internal name squat)](https://github.com/advisories/GHSA-g7c3-m79h-9cqq) - GitHub
- [GHSA-7rq8-hfxr-pxhw - npm okra-cloud-cdk (Cluster A - amel10 AWS API Gateway dep-confusion)](https://github.com/advisories/GHSA-7rq8-hfxr-pxhw) - GitHub
- [GHSA-rxfj-38w3-hw2x - npm ai-workshop-radio-app (Cluster A - amel10 AWS API Gateway dep-confusion)](https://github.com/advisories/GHSA-rxfj-38w3-hw2x) - GitHub
- [GHSA-5m79-v4p8-r597 - npm ai-workshop-maa15-radio (Cluster A - amel10 AWS API Gateway dep-confusion)](https://github.com/advisories/GHSA-5m79-v4p8-r597) - GitHub
- [GHSA-427x-rv7c-m3f9 - npm ai-workshop-radio-lambda (Cluster A - amel10 AWS API Gateway dep-confusion)](https://github.com/advisories/GHSA-427x-rv7c-m3f9) - GitHub
- [GHSA-g37r-cvvp-rj75 - npm niksinnkatalapp (Cluster A - amel10 AWS API Gateway dep-confusion)](https://github.com/advisories/GHSA-g37r-cvvp-rj75) - GitHub
- [GHSA-p4xf-x6j2-mq3f - npm mikuhostt-baileys (Cluster B - PhantomSub Baileys silent WhatsApp follow)](https://github.com/advisories/GHSA-p4xf-x6j2-mq3f) - GitHub
- [GHSA-rhcf-fwmc-3cm3 - npm luoxy-baileys (Cluster B - PhantomSub Baileys silent WhatsApp follow, dynamic JID list)](https://github.com/advisories/GHSA-rhcf-fwmc-3cm3) - GitHub
- [GHSA-44wf-ggpw-qq53 - npm @zanta/baileys (Cluster B - PhantomSub Baileys silent WhatsApp follow)](https://github.com/advisories/GHSA-44wf-ggpw-qq53) - GitHub
- [GHSA-w72m-vjx4-9m36 - npm wailib (Cluster B - PhantomSub Baileys silent WhatsApp follow, auto-mutes notifications)](https://github.com/advisories/GHSA-w72m-vjx4-9m36) - GitHub
- [GHSA-phvc-2p87-8jf3 - npm prastzy (Cluster B - PhantomSub Baileys silent WhatsApp follow, 6 base64 JIDs)](https://github.com/advisories/GHSA-phvc-2p87-8jf3) - GitHub
- [The Hacker News - 101 malicious npm packages PhantomSub Baileys WhatsApp subscriber campaign (OX Security, SafeDep, Xygeni, September 2026)](https://thehackernews.com/2026/09/101-malicious-npm-packages-add.html) - The Hacker News
- [GHSA-mc5h-r7fw-gr4j - pip dedh-devops-automation (Cluster C - AWS Lambda + Secrets Manager credential theft, spo365-graph family continuation)](https://github.com/advisories/GHSA-mc5h-r7fw-gr4j) - GitHub
- [GHSA-652v-q229-xvr4 - Go module gogets.dev/btreex (Cluster D - Graphalgo campaign expansion, Ethereum smart contract + Slack bot token RAT)](https://github.com/advisories/GHSA-652v-q229-xvr4) - GitHub
- [GHSA-p3x3-hqg5-8pwf - Go module gocommunity.io/orderedbtree (Cluster D - Graphalgo campaign expansion, Arbitrum Sepolia EtherHiding + Slack bot token)](https://github.com/advisories/GHSA-p3x3-hqg5-8pwf) - GitHub
- [GHSA-xmhj-hj4f-c924 - pip voxeval (Cluster E - cryptominer NEW campaign 2026-10-voxeval)](https://github.com/advisories/GHSA-xmhj-hj4f-c924) - GitHub
- [GHSA-9ggj-2v34-hwv8 - npm @bluewin/utils (Cluster F - Burp Collaborator Swisscom-scope dep-confusion probe by securityresearch1)](https://github.com/advisories/GHSA-9ggj-2v34-hwv8) - GitHub
- [GHSA-xh7x-r46x-g84q - npm @smwebserver/static@99.9.1 (Cluster G - sentinel-version malicious-domain beacon, OpenSSF Package Analysis confirmed)](https://github.com/advisories/GHSA-xh7x-r46x-g84q) - GitHub
- [GHSA-3933-m2c5-xfm8 - npm turbo-ws (Cluster H - CWE-506 boilerplate takedown)](https://github.com/advisories/GHSA-3933-m2c5-xfm8) - GitHub
- [GHSA-mw8r-6m3f-qmg8 - npm hardhat-zet (Cluster H - CWE-506 boilerplate takedown, hardhat-* scope)](https://github.com/advisories/GHSA-mw8r-6m3f-qmg8) - GitHub
- [GHSA-qgqx-3mhx-jwx3 - npm ui-base-colors (Cluster H - CWE-506 boilerplate takedown)](https://github.com/advisories/GHSA-qgqx-3mhx-jwx3) - GitHub
- [GHSA-grv5-7wp6-vw6h - npm translate-base-font (Cluster H - CWE-506 boilerplate takedown)](https://github.com/advisories/GHSA-grv5-7wp6-vw6h) - GitHub
- [GHSA-325f-rjxf-3gm9 - npm ui.dist.min.js (Cluster H - CWE-506 boilerplate takedown, .min.js suffix in package name)](https://github.com/advisories/GHSA-325f-rjxf-3gm9) - GitHub
- [GHSA-44hm-95r4-wcrf - npm @woodpecker-web-shared/components (Cluster H - CWE-506 boilerplate takedown, Woodpecker CI internal scope squat)](https://github.com/advisories/GHSA-44hm-95r4-wcrf) - GitHub
- [GHSA-34p9-xxp2-hv3g - npm bnppf-flag-icons (Cluster H - CWE-506 boilerplate takedown, BNP Paribas Fortis internal probe)](https://github.com/advisories/GHSA-34p9-xxp2-hv3g) - GitHub
- [GHSA-9f55-6cf9-3pgw - npm mfahelper (Cluster H - DUPLICATE of GHSA-vxqj-q8pf-p87h, catalogued in 2026-09-30 sweep)](https://github.com/advisories/GHSA-9f55-6cf9-3pgw) - GitHub

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-03-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-03-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).