GitHub Advisory malware sweep - 2026-10-06 (3 fresh advisories: pypi `zencleaner` Discord-webhook infostealer + Windows event-log wipe, npm `virgil-cli` runtime conversation/shell-output exfil to api.nm-streetwear.space, npm `dotenv-async` CWE-506 boilerplate takedown; plus 2026-10-05 backfill: 2 npm `@inpeek/odata*` dep-confusion probes at 99.99.99-102 sentinel versions, pypi `erc7730-hackathon@99.0.0` OpenSSF-flagged PROBABLY_PENTEST probe; 25-gem RubyGems Ethereum/crypto wgkit cluster from 2026-10-05 SPLIT OUT)

What happened

Between roughly 2026-10-05 06:17 UTC (end of yesterdays sweep window) and 2026-10-06 11:00 UTC, the GitHub Advisory Database (via OpenSSF malicious-packages, Amazon Inspectors IN-MAL feed, and kam193/bad-packages) published 3 fresh malware advisories for 2026-10-06 and left 3 same-week 2026-10-05 advisories uncovered by yesterdays sweep (which only enumerated npm GHSAs with full-source disclosures). The 25-gem RubyGems Ethereum/crypto wgkit.tar.gz cluster from 2026-10-05 - also missed yesterday - is **SPLIT OUT** as its own named incident at [rubygems-2026-10-05-eth-crypto-wgkit-cluster`](/incident/rubygems-2026-10-05-eth-crypto-wgkit-cluster) because the cluster shares one operator-coherent payload family and warrants dedicated IOC detail.

The remaining 2026-10-06 + 2026-10-05-backfill set breaks into 5 clusters:

Cluster A - pypi zencleaner Discord-webhook infostealer + Windows event-log wipe

zencleaner versions 1.0.0, 1.0.3, 1.0.3.1 (GHSA-4493-p4qp-qw6p, published 2026-10-06). The package advertises itself as a Windows cleaner that "makes no network communication"; webhook_logger.py POSTs to a hardcoded Discord webhook the users license keys, Windows username, hostname and client IP on every run, and 1.0.3/1.0.3.1 additionally enrich with ipify.org and ifconfig.me public-IP lookups. cleaner_system.py runs wevtutil cl across every Windows event log (Security included) with the authors own comment reading "so forensic scanners report 0 entries" - an explicit forensic-sabotage primitive. Payload runs at use-time, not install-time, so install-only sandbox scanners pass it clean.

Classify as malicious-package, severity high (confirmed runtime infostealer + forensic sabotage on any Windows host).

Cluster B - npm virgil-cli runtime conversation/shell-output exfil to api.nm-streetwear.space

virgil-cli versions <=0.1.4 (GHSA-6j8f-g5mj-4wcj, published 2026-10-06). The package is marketed as a "free and private" local CLI. In practice dist/api.js exports reportLearning() which POSTs the entire conversation history, every executed shell command, and every file-tool output - with a hardcoded bearer token and per-install device id - to https://api.nm-streetwear.space/vx/learn. No opt-out, no README disclosure, no runtime flag to disable. The brand name "virgil" and the "learn" path are chosen to look like benign telemetry; it is a wholesale extraction of whatever the CLI touched.

Any developer who ran virgil-cli while piping real credentials, API tokens, SSH keys, kubeconfigs, .env contents, or an interactive conversation with another AI assistant through it should rotate everything that could have reached the CLI`s stdin/stdout and treat the package as unsafe at every version.

Classify as malicious-package, severity high (confirmed runtime exfil of credential-grade material).

Cluster C - npm dotenv-async dotenv typosquat (CWE-506 boilerplate)

dotenv-async all versions (GHSA-gp83-4g76-4qg5, published 2026-10-06). GHSA ships only the CWE-506 boilerplate ("Any computer that has this package installed or running should be considered fully compromised") with no payload hash, no network IOC, and no source code preserved. The name typosquats the real dotenv and the dotenv-webpack/dotenv-cli family.

Classify as typosquat, severity medium (CWE-506 takedown with no published analysis).

Cluster D - 2 npm @inpeek/odata* dep-confusion probes (BACKFILL 2026-10-05)

Classic dep-confusion fingerprint: public @inpeek/* scope spraying four sequential sentinel versions on top of what is almost certainly an internal @inpeek registry. CWE-506 boilerplate takedown - no published payload, no C2, no hash.

Classify as dependency-confusion, severity medium (sentinel-version dep-confusion probe without disclosed second-stage).

Cluster E - pypi erc7730-hackathon PROBABLY_PENTEST probe (BACKFILL 2026-10-05)

erc7730-hackathon versions >=99.0.0 (GHSA-vcg2-mffq-hjmg, published 2026-10-05, SHA-256 9020d8cb4fe701c7e0981ae140af20039845d5d0e0a638c68f3ca3e29adeb221). OpenSSF classifies the package under its GENERIC-standard-pypi-install-pentest campaign - a probe that overrides setup.py install to exfiltrate IP addresses and username on install, no destructive payload. erc7730 is the Ethereum ERC-7730 metadata-standard working group, so the "hackathon" tag plus sentinel 99.0.0 version strongly suggests a hackathon-targeted dep-confusion test rather than criminal infrastructure.

Classify as dependency-confusion, severity medium (PROBABLY_PENTEST labelled by OpenSSF, no second-stage disclosed).

RubyGems - split-out operator-coherent cluster from 2026-10-05

rubygems-2026-10-05-eth-crypto-wgkit-cluster - 25 RubyGems packages, all v1.0.0, all delivering the wgkit.tar.gz dropper from the 45.138.0.0/16 superblock. Operator-coherent typosquat / brand-lure wave in the Ethereum, Bitcoin, Lightning, Web3 and TRON verticals. See that incident for the full IOC detail and 25-gem inventory. Was missed by yesterday`s 2026-10-05 sweep.

Registry state

All 5 packages in this sweep window are registry-quarantined at time of writing. Active operator-side infrastructure named in today`s batch:

• Discord webhook channel (specific URL redacted in GHSA body) - Cluster A
• ipify.org, ifconfig.me IP-enrichment - Cluster A
• api.nm-streetwear.space/vx/learn - Cluster B
• nm-streetwear.space apex - Cluster B
• OpenSSFs GENERIC-standard-pypi-install-pentest` campaign tag - Cluster E (identifies this as the n-th probe in a long-running pentest-pipeline family)
• Source SHA-256 for erc7730-hackathon: 9020d8cb4fe701c7e0981ae140af20039845d5d0e0a638c68f3ca3e29adeb221

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193/bad-packages. Per-package IOC details drawn from GHSA advisory bodies published between 2026-10-05 06:17 UTC and 2026-10-06 11:00 UTC.

Affected packages (6)

Impact

• Cluster A - pypi zencleaner Discord-webhook infostealer + Windows event-log wipe (malicious-package, confirmed runtime data exfil and forensic sabotage): zencleaner versions 1.0.0, 1.0.3, 1.0.3.1 (GHSA-4493-p4qp-qw6p). The package advertises itself as a Windows cleaner, promises no network communication in its README, and does the exact opposite. webhook_logger.py POSTs to a hard-coded Discord webhook the users license keys, computer name, Windows username and client IP on every run; 1.0.3 and 1.0.3.1 additionally fetch the public IP via ipify.org and ifconfig.me. cleaner_system.py runs wevtutil cl to clear every Windows event log, Security included, with a comment reading "so forensic scanners report 0 entries" - i.e. an explicit forensic-sabotage primitive, not a side effect. The payload runs at use-time, not install-time, so install-only sandbox scanners miss it. Classified malicious-package, severity high` (confirmed runtime infostealer + forensic sabotage on any Windows host that runs it)
• Cluster B - npm virgil-cli runtime conversation/shell-output exfil (malicious-package, confirmed runtime credential-grade data exfil in a locally-marketed CLI): virgil-cli versions <=0.1.4 (GHSA-6j8f-g5mj-4wcj). The package markets itself as a "free and private" local CLI. In reality, dist/api.js exports reportLearning() which POSTs the entire conversation history, every shell command executed, and every file-tool output - with a hard-coded bearer token and per-install device id - to https://api.nm-streetwear.space/vx/learn. No opt-out, no README disclosure, no setting to disable. If a developer ran virgil-cli against a repo while piping real credentials, API tokens, SSH keys, kubeconfigs, .env files, or chat with any assistant into it, the operator has them. The brand "virgil" and the "learn" endpoint path are chosen to look telemetry-like; this is not telemetry, it is a wholesale extraction of whatever the CLI touched. Classified malicious-package, severity high (confirmed runtime exfil of credential-grade material from any session that ran it)
• Cluster C - npm dotenv-async dotenv typosquat (typosquat, CWE-506 boilerplate takedown - no payload analysis): dotenv-async all versions (GHSA-gp83-4g76-4qg5). CWE-506 boilerplate from the GHSA auto-ingest pipeline: "Any computer that has this package installed or running should be considered fully compromised" with no payload hash, no network IOC, and no source left to inspect (listed as "No known source code"). The name typosquats the real dotenv and the dotenv-webpack/dotenv-cli family. Treat as a confirmed takedown and remove, but severity within sweep is medium because no analysis published and the package is already registry-pulled
• *Cluster D - 2 npm `@inpeek/odata dep-confusion probes (dependency-confusion, boilerplate takedown with no payload analysis - BACKFILL 2026-10-05)**: @inpeek/odata and @inpeek/odata-angular, both at sentinel versions 99.99.99, 99.99.100, 99.99.101, 99.99.102 (GHSA-cmm5-vwvx-cv5f, GHSA-7p27-jmq6-46ph). Classic dep-confusion fingerprint: public @inpeek/* scope spraying four sequential sentinel versions on top of what is almost certainly an internal @inpeek registry at a software vendor named InPeek. GHSA ships only the CWE-506 boilerplate - no published payload, no C2, no hash - so severity within sweep is medium` (dep-confusion probe without disclosed second-stage). Backfill from 2026-10-05, missed in the 2026-10-05 sweep because it only enumerated npm GHSAs with full-source payload disclosures
• Cluster E - pypi erc7730-hackathon PROBABLY_PENTEST probe (dependency-confusion/pentest artefact, confirmed host-recon beacon - BACKFILL 2026-10-05): erc7730-hackathon versions >=99.0.0 (GHSA-vcg2-mffq-hjmg, SHA-256 9020d8cb4fe701c7e0981ae140af20039845d5d0e0a638c68f3ca3e29adeb221). OpenSSF classifies it under its GENERIC-standard-pypi-install-pentest campaign - i.e. a probe that overrides setup.py install to exfiltrate IPs and username on install; no destructive payload. erc7730 is the Ethereum ERC-7730 metadata-standard working group, so the "hackathon" tag plus the sentinel 99.0.0 version strongly suggest a hackathon-targeted dep-confusion test rather than criminal infrastructure. Severity medium within sweep (recon-only, PROBABLY_PENTEST labelled by OpenSSF). Backfill from 2026-10-05
• Operator continuity check: todays window is dominated by three distinct, operator-uncoordinated advisories (not a single-operator burst). The zencleaner operator and the virgil-cli operator are both NEW to the corpus; neither reuses prior infrastructure we have catalogued. The nm-streetwear.space domain (Cluster B) is a shell-brand lure, no prior corpus mention; the discord.com/api/webhooks/ channel in Cluster A is throwaway. The 25-gem RubyGems Ethereum/crypto wgkit cluster from 2026-10-05 was MISSED in yesterdays sweep (which only enumerated npm GHSAs) and is now split out as its own named incident with full IOC detail. Yesterdays broader operator profiles - hellscripter/gitflic.ru (2026-10-05 Cluster A), the Wix dep-confusion operator (2026-10-05 Cluster B), the jsonspack.com pino-impersonator (2026-10-05 Cluster C), the 4444.vbs ChaCha20 loader operator (2026-10-05 Cluster D), the Oleh-Modal wallet-phishing operator (2026-10-05 Cluster I), and the 2026-10-voxeval cryptominer campaign - are all QUIET today. The amel10, jexkcode/noverojs, spo365-graph, Graphalgo, donutautosellsrc/aseity, kartyk*, tailwind-forms-kit, chinazhangsan.ccwu.cc, bfox-build-utils, fabric-loader-core/mfahelper, and zeal-utils/aveliscare` operators are also QUIET today

What to do

1. 1For Cluster A (zencleaner pypi): on any Windows host that installed zencleaner since 2026-10-06, assume the users license keys, Windows username, hostname and public IP are in the operators Discord channel AND the Windows event logs for the exposure window are gone - do not try to recover attacker evidence from them. Rotate anything that was ever stored as a "license key" or captured by that user; replay recent user activity from EDR/XDR telemetry instead of event logs. Block outbound to discord.com/api/webhooks from any host that should not legitimately post to Discord. Block the ipify.org and ifconfig.me HTTP egress from production hosts
2. 2For Cluster B (virgil-cli npm): grep every package.json, package-lock.json, pnpm-lock.yaml, yarn.lock, every ~/.npm and ~/.pnpm cache, every shell history and every Docker-image layer for virgil-cli at <=0.1.4. On any hit: assume the operator has every conversation, every executed shell command, every file-tool output since the CLI ran. Rotate all credentials, API tokens, SSH keys and AI-assistant/API keys that could have been typed into or displayed by that CLIs stdout/stderr. Block outbound to api.nm-streetwear.space and the nm-streetwear.space apex at every egress point. Treat virgil-cli` as unsafe at any version; there is no clean release
3. 3For Cluster C (dotenv-async npm): grep lockfiles for dotenv-async. On hit uninstall, delete node_modules, delete the lockfile, rebuild from a scope-locked registry. Developers who meant the real dotenv (or @dotenvx/dotenvx, dotenv-cli, dotenv-webpack) autocompleted the wrong name - fix the autocomplete and teach dotenv as the only safe spelling. No specific IOC published, so no egress blocklist entry
4. 4*For Cluster D (`@inpeek/odata npm dep-confusion)**: if your org publishes @inpeek/* on an internal registry, scope-lock it (@inpeek:registry=https://your-internal-npm/) and hold the public @inpeek/odata and @inpeek/odata-angular` names with placeholder packages at a plausibly-high version to deny the slug permanently. On hit uninstall + rebuild. No specific IOC published by GHSA
5. 5For Cluster E (erc7730-hackathon pypi): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock for erc7730-hackathon across the Ethereum / ERC-7730 metadata working groups infrastructure. On hit uninstall. If this was in fact your teams own pentest, de-register the OpenSSF probe by replacing the sentinel 99.0.0 with a legitimate placeholder release under your real internal namespace
6. 6For the SPLIT OUT rubygems-2026-10-05-eth-crypto-wgkit-cluster: see that incident. If your developers run gem install on a crypto / Web3 / Ethereum / Bitcoin / Lightning / TRON workstation, the egress blocks for 45.138.12.177, 45.138.17.70, 45.138.17.177, 45.138.122.177, 45.138.127.77, 45.138.172.177 (or the whole 45.138.0.0/16) belong on the proxy today, and /tmp/.w1/ is a hunt point on any host that could have run those gems
7. 7NEW outbound denylist entries for CI/build-host egress proxies today: api.nm-streetwear.space and the nm-streetwear.space apex (Cluster B), the discord.com/api/webhooks path (Cluster A - unless your org legitimately uses Discord webhooks, in which case allow-list only the specific webhook IDs), ipify.org, ifconfig.me (Cluster A IP-enrichment). Keep prior egress blocks in place: gitflic.ru and web.archive.org/web/https://gitflic.ru/* (per 2026-10-05 Cluster A), api.wagmiwallet.org (per 2026-10-05 Cluster I), backend-cybersecuritydashboard.onrender.com (per 2026-10-05 Cluster G), 10.0.49.106:443 and all RFC1918 from CI (per 2026-10-05 Cluster F), Monero mining pools (per 2026-10-04 Cluster A voxeval cryptominer), Ethereum mainnet / Sepolia / Arbitrum Sepolia RPC, chinazhangsan.ccwu.cc, api.npoint.io, api.telegram.org, fabric-npm.gm-service.xyz, jsonkeeper.com, trktgq0wbre1, npm-canary.aveliscare.com, Polygon RPC, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, and the newly-added 45.138.0.0/16 RubyGems wgkit CIDRs per the split-out ruby incident

References

• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub
• GHSA-4493-p4qp-qw6p - pypi zencleaner (Cluster A - Discord-webhook infostealer + Windows event-log wipe)

  github.com
  GitHub
• GHSA-6j8f-g5mj-4wcj - npm virgil-cli (Cluster B - runtime conversation/shell-output exfil to api.nm-streetwear.space)

  github.com
  GitHub
• GHSA-gp83-4g76-4qg5 - npm dotenv-async (Cluster C - dotenv typosquat, CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-cmm5-vwvx-cv5f - npm @inpeek/odata (Cluster D - BACKFILL 2026-10-05 dep-confusion sentinel versions)

  github.com
  GitHub
• GHSA-7p27-jmq6-46ph - npm @inpeek/odata-angular (Cluster D - BACKFILL 2026-10-05 dep-confusion sentinel versions)

  github.com
  GitHub
• GHSA-vcg2-mffq-hjmg - pypi erc7730-hackathon (Cluster E - BACKFILL 2026-10-05 OpenSSF PROBABLY_PENTEST probe)

  github.com
  GitHub
• DependencyWatch: rubygems-2026-10-05-eth-crypto-wgkit-cluster (SPLIT OUT - 25-gem wgkit.tar.gz operator from 2026-10-05)

  dependencywatch.io