DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
HighAdvisory sweepPublished 9 Oct 202650 packages · 91 versions

GitHub Advisory malware sweep - 2026-10-09 (xwise8887 wave-2 continuation `wie888r`/`testrrrd`/`xblaxw`/`@wxwxtest/testrrrdd` to `185.158.107.175:8787/_ah/dc`; Wix dep-confusion cluster `wix-reg-poc-bypass` (webhook.site) + `css-overscroll-contain` (dxpoc.gt.tc, K8s SA-token theft + container escape); `pxnpm` nfjbill-operator npm proxy weaponization (same operator as 2026-08 `yakuza0`); 16-package `@bellaxchuu/*` + sibling Baileys-themed lure cluster; 6-package `@dransay/*` oast.site dep-confusion probes; `@bitwardne/*` 2-package Bitwarden typosquat; 5-package `@galicia-toolkit/*`+`@design-system-coopeuch/web` dep-confusion cluster; 9 dev-tooling typosquats; 2 pypi `kafka-roller`/`kafka-helmsman` 99.x dep-confusion probes; plus standalones)

Summary

GHSA 2026-10-09: 50 fresh malware advisories across 10 clusters (48 npm, 2 pypi). Headline items: continuation of the xwise8887 dep-confusion operator (wie888r/testrrrd/xblaxw/@wxwxtest/testrrrdd beaconing to the same 185.158.107.175:8787/_ah/dc endpoint as yesterday); Wix dep-confusion cluster including css-overscroll-contain which carries K8s service-account token theft and container-escape payload; and pxnpm npm proxy weaponization from the same operator (nfjbill.ren) as the 2026-08 yakuza0@2.23.40 malicious release.

typosquatdependency-confusioncredential-theftdns-exfiltrationobfuscation
Incident type
Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis · Amazon Inspector · kam193/bad-packages · npm security
Also known as
2026-10-09 GHSA sweep · xwise8887 operator wave 2 · wie888r testrrrd xblaxw cluster · Wix dep-confusion wave 2 (css-overscroll-contain K8s token theft) · pxnpm nfjbill proxy weaponization · @bellaxchuu Baileys lure 16-package cluster · @dransay oast.site dep-confusion probe · @bitwardne Bitwarden typosquat · @galicia-toolkit dep-confusion · kafka-roller kafka-helmsman pypi dep-confusion
Ecosystems
npmPyPI
Packages tracked
50

What happened

Between roughly 2026-10-08 11:00 UTC (end of yesterdays sweep window) and 2026-10-09 11:00 UTC, the GitHub Advisory Database (via OpenSSF malicious-packages, Amazon Inspectors IN-MAL feed, and kam193/bad-packages) published 50 fresh malware advisories: 48 npm and 2 pypi.

The sweep breaks into 10 clusters by operator profile and payload family, with three confirmed operator continuations: the xwise8887 operator (yesterday → today, same beacon URL), the Wix dep-confusion operator (yesterday → today, now with K8s SA-token-theft payload), and the nfjbill operator (2026-08-07 yakuza0 → todays pxnpm`, same npm-proxy-weaponization primitive).

Cluster A - npm wie888r+testrrrd+xblaxw+@wxwxtest/testrrrdd xwise8887 wave 2

PackageVersionsGHSAOSVBeacon
wie888r0.0.1, 1.0.0, 1.0.1, 1.1.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1GHSA-fhmp-x3hx-6669MAL-2026-17707http://185.158.107.175:8787/_ah/dc
testrrrd0.0.1, 1.0.0, 1.1.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1GHSA-w6fg-gwpf-x5xfMAL-2026-17706same
xblaxw1.0.0, 1.0.1, 1.1.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1GHSA-46q8-4h48-v8wcMAL-2026-17708same
@wxwxtest/testrrrdd0.0.1, 0.1.0, 1.0.0, 1.0.1, 2.0.0, 2.0.1, 3.0.0GHSA-8qcg-7j5r-xhvh-same

All four packages carry the identical operator fingerprint from yesterday's troubleshooting+browser-metrics-plugin.contrib (xwise8887): postinstall runs node beacon.cjs that POSTs { hostname, installPath, cwd, process.version, pkg name } as plain-HTTP JSON to 185.158.107.175:8787/_ah/dc; index.js exports a Proxy of no-op functions AND calls require(./beacon.cjs).fire() on import, so the beacon fires even with --ignore-scripts because importing the module triggers it. The 99.0.1 top version matches yesterdays pattern. Classify dependency-confusion, severity medium`.

Cluster B - Wix dep-confusion cluster, now with K8s SA-token theft on css-overscroll-contain

wix-reg-poc-bypass@1.0.0 (GHSA-v43v-p74g-hrf9, MAL-2026-17711)

Shadows Wix-internal registry module names (thunderboltRegistry, corvidRegistry, editorRegistry, siteAssetsRegistry) via a registry-manifest.min.json that points to a static.parastorage.com/unpkg/wix-reg-poc-bypass@1.0.0/ lure URL. thunderboltRegistry.js runs an IIFE at module load that executes host-identifying commands, combines their output with process.platform + process.arch + PID + process.version, and POSTs to webhook.site/43022177-de67-4d5c-a6df-33083b2b026f. The exported factories return Proxy stubs rather than real registry implementations, so the only effective behaviour is the recon beacon.

css-overscroll-contain@1.0.1/1.0.2/1.0.3 (GHSA-hjq9-gv63-8hh8, MAL-2026-17705)

Same Wix-internal thunderboltRegistry.js/siteAssetsRegistry/editorRegistry/corvidRegistry lures + registry-manifest.min.json pointing to static.parastorage.com/unpkg/css-overscroll-contain@1.0.1/. The payload runs:

  • execSync on uname, hostname, id
  • read /proc/self/mountinfo
  • env variable scrape with secret-like-pattern matching
  • read /var/run/secrets/kubernetes.io/serviceaccount/token - K8s SA-token theft
  • unshare --user --mount + devtmpfs/cgroup/release_agent mount container-escape attempt
  • Perl memfd_create+exec fileless-execution sequence
  • exfil to https://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f

This is a continuation of yesterdays Wix dep-confusion operator cluster (css-jptvix-polyfill + appsecc.com/js) but with a significantly more capable payload. The exfil domain dxpoc.gt.tc is a .gt.tc subdomain (free dynamic DNS) under attacker control. Classify dependency-confusion, severity high on css-overscroll-contain (confirmed K8s SA-token exfil + container-escape attempt), severity medium on wix-reg-poc-bypass` (recon only).

Cluster C - npm pxnpm@7.0.0 proxy weaponization (nfjbill operator continuation)

pxnpm@7.0.0-beta.6/7.0.0-beta.8/7.0.0 (GHSA-h3fw-vmw2-h9xc, OSV MAL-2026-17710, published 2026-10-06 by npm user nfjbill).

The postinstall script bin/install.cjs downloads a 17-21 MB Brotli archive from https://registry-pxnpm.rdc.nfjbill.ren:20021/__static/srv/downloads/pxnpm/, decompresses it to a 52-72 MB executable, marks it executable, and caches it at ~/.cache/pxnpm/native/. The launcher (dist/launcher.cjs:54) runs that binary on every CLI invocation.

The binary clears npm_config_registry/npm_config_proxy/npm_config_https_proxy from the environment and forces them to point at nfjbill.ren:20022 (a gost proxy under attacker control). From the moment pxnpm runs once on a host, every subsequent npm install on that host routes through the attacker`s proxy, which can rewrite tarballs on the wire and serve arbitrary malicious packages under any name.

The second-stage binary could not be analysed because the download later returned an npm JSON document rather than the archive, but the proxy-weaponization primitive is confirmed from the launcher code.

Operator continuity: same operator domain nfjbill.ren as the 2026-08-07 yakuza0@2.23.40 compromise (OSV MAL-2026-13605) - that incident shipped server/proxy/tire.js and server/proxy/csrf.js combining child_process with curl POST/GET to the same operator host and included the registry-pxnpm.rdc.nfjbill.ren IOC in the GHSA write-up. Todays pxnpm@7.0.0` extends that primitive with a full npm registry proxy.

Classify malicious-package, severity high (confirmed proxy weaponization + remote-binary execution + operator continuity across two separate malicious npm packages 2 months apart).

Cluster D - 16-package @bellaxchuu/* + sibling Baileys-themed lure cluster

  • @bellaxchuu/overbugs all versions (GHSA-mhqg-97g5-qg8m)
  • @bellaxchuu/familyxtrx all versions (GHSA-jgwg-m26g-j9c2)
  • @bellaxchuu/crystalred all versions (GHSA-862w-53p5-jcpx)
  • @bellaxchuu/libsignal-node all versions (GHSA-3x55-8979-2xhq)
  • @bellaxchuu/skyblue all versions (GHSA-5x7v-4r7v-353c)
  • @bellaxchuu/xbailey all versions (GHSA-rq65-h2vx-ww39)
  • @bellaxchuu/xtrxbails all versions (GHSA-5f6x-qj83-2895)
  • @bellaxchuu/velvetry all versions (GHSA-9jwq-m497-mcq5)
  • @bellaxchuu/privatebails all versions (GHSA-46rh-wx96-cw47)
  • @bellaxchuu/flowblue all versions (GHSA-4gc8-pmgh-hx47)
  • @bellaxchuu/yarnbails all versions (GHSA-mff5-fqw5-7vhj)
  • @bellaxchuu/xbails all versions (GHSA-mwq7-c4ww-fpfq)
  • @bellaxchuu/bails all versions (GHSA-pxp7-vhfv-j52j)
  • @xayz/libsignal-node all versions (GHSA-f748-f8w7-hf22)
  • my-baileys all versions (GHSA-6v2q-p64f-6cp6)
  • @kxafunc/xbails@0.0.8 (GHSA-5prw-6f85-2mmg, MAL-2026-17701)

All 16 packages published 2026-10-08 and quarantined by npm security the same day. The naming is unambiguous: -bails/-xbails/libsignal-node/my-baileys are all brand-impersonations of the real @WhiskeySockets/Baileys WhatsApp library and the libsignal cryptographic library it depends on. The Baileys ecosystem is a repeat target of malicious npm "lure" campaigns against the WhatsApp automation user base.

@kxafunc/xbails@0.0.8 is the most explicit of the cluster: its package.json aliases the real libsignal npm name to npm:@bellaxchuu/libsignal-node@latest, with no version pin and no integrity check. Any consumer that pulls @kxafunc/xbails into a Baileys project also indirectly pulls @bellaxchuu/libsignal-node, even if their own lockfile does not pin that name.

The GHSA bodies for all 16 packages are CWE-506 "fully compromised" boilerplate with no IOCs, so the actual payload remains undocumented. Classify malicious-package, severity medium (coordinated co-publication confirmed, runtime payload not yet published).

Cluster E - 6-package @dransay/* dep-confusion probe cluster, oast.site OAST exfil

PackageVersionGHSAOSV
dransay99.0.0GHSA-j2mr-7vj7-w5rqMAL-2026-17700
@dransay/db99.0.0GHSA-gf65-f25f-jwqvMAL-2026-17695
@dransay/feature-flags99.0.0GHSA-rhg6-g966-4wxgMAL-2026-17696
@dransay/phone-fix-test99.0.0GHSA-4jfw-qx8x-7gv2MAL-2026-17698
@dransay/logger99.0.0GHSA-7v9w-pmg3-8ww9MAL-2026-17697
@dransay/secrets99.0.0GHSA-3qj5-xv6j-m8j4MAL-2026-17699

All six packages carry a preinstall hook running node beacon.js that performs a DNS lookup + HTTPS GET to the hardcoded OAST canary subdomain db3klhbi6i9hark1kegg174t38h33b6wt.oast.site with the package name embedded in the request path. The payload reads nothing beyond the installer`s source IP, DNS resolver IP, and timestamp. The README on each package calls them a benign bug-bounty proof-of-concept, but the install-time beacon fires regardless.

The 99.0.0 sentinel version is the canonical dep-confusion fingerprint, and the @dransay/* scope implies a bug-bounty engagement against a specific target org. All six quarantined. Classify dependency-confusion, severity medium.

Cluster F - 2-package @bitwardne/* typosquat of @bitwarden

@bitwardne/jslib@1.1.0 (GHSA-x8j2-59mv-fr7h, MAL-2026-17694) and @bitwardne/cli@1.0.1 (GHSA-5mwm-46h7-pv2h, MAL-2026-17693). @bitwardne is a one-character typosquat of the real @bitwarden npm scope.

Both ship a four-line index.js that re-requires unrelated utilities (@bitwardne/cli bundles an unrelated cli option-parser library by Chris O'Hara as cover). The real behaviour is in package.json: preinstall: curl -L <empty_url> | node. The URL is empty in the shipped tarball, so the actual curl fails on install (making the preinstall a non-op today), but the structure is the canonical maintainer-abandoned-dropper pattern - the operator published a shell, intended to fill the staging URL in later, and either lost access or got caught before completing the setup.

Classify typosquat, severity medium (preinstall RCE primitive confirmed, no live payload URL).

Cluster G - @galicia-toolkit/* + @design-system-coopeuch/web dep-confusion

  • @galicia-toolkit/core all versions (GHSA-ff43-rphq-9mgw)
  • @galicia-toolkit/error-master all versions (GHSA-42vv-c8c8-q765)
  • @galicia-toolkit/tag-manager all versions (GHSA-q3gj-mpgg-cqpv)
  • @galicia-toolkit/spa-build-config all versions (GHSA-7hx2-c7qp-ggjp)
  • @design-system-coopeuch/web all versions (GHSA-vhjp-6vjm-vq35)

All five scoped names strongly suggest internal registries - a galicia-toolkit dev-tooling monorepo and the Coopeuch (a Chilean financial cooperative) design-system package. All published and quarantined 2026-10-08. GHSA bodies are "fully compromised" CWE-506 boilerplate with no runtime IOC detail. The operator profile and scoped-name fingerprint are consistent with dep-confusion rather than typosquats. Classify dependency-confusion, severity medium.

Cluster H - 9 npm dev-tooling typosquats and CWE-506 boilerplate takedowns

  • tailwindcss-ui-extensions all versions (GHSA-9ww2-25r2-rppg) - typosquat of the tailwindcss + tailwindcss-animated sets
  • tailwindcss-effects-kit all versions (GHSA-9c94-xcv7-wcf4) - typosquat of the tailwindcss-animatecss + Tailwind effects adaptors
  • node-gyp-runtime all versions (GHSA-v64f-f8pp-4qx2) - typosquat of real node-gyp + node-gyp-build
  • node-env-resolve all versions (GHSA-fw57-xw67-r253) - typosquat of dotenv + dotenv-expand
  • node-fetch-lite all versions (GHSA-cfmp-vp7q-257m) - typosquat of node-fetch
  • dom-utils-lite all versions (GHSA-v6fr-pvhf-6rh5) - typosquat of dom-utils
  • system-driver all versions (GHSA-43w2-g2fc-r4h3) - dev-tooling first-publish lure
  • connector-agent all versions (GHSA-422j-hgjh-g8fg) - dev-tooling first-publish lure
  • centralogger all versions (GHSA-wpw7-2rgx-4cfm) - dev-tooling first-publish lure

All nine are CWE-506 boilerplate takedowns with no IOCs. First six classify typosquat, last three malicious-package; all severity medium.

Cluster I - 3 npm standalone CWE-506 boilerplate takedowns

  • revine@2.4.0 (GHSA-gr77-3hqf-674h, 2026-10-08)
  • brat-generator all versions (GHSA-m45c-2rh6-33g6)
  • clickfix_npm_delivery@1.0.0/1.0.2 (GHSA-37h8-m54m-784j)

Note on clickfix_npm_delivery: "ClickFix" is a well-documented social-engineering malware-delivery pattern - a fake browser error dialog instructs the user to paste a powershell or curl | sh command into their terminal to "fix" a problem, which runs an infostealer. Seeing the name hard-coded in an npm package is unusual: it could be a defensive namespace hold, a researcher demo, or an npm-side arm of a broader ClickFix campaign. The GHSA body is boilerplate and the package is quarantined, so no runtime IOC is published.

Classify all three malicious-package, severity medium.

Cluster J - 2-package pypi dep-confusion

kafka-roller@99.0.0..99.0.6 (GHSA-8798-7m3x-mq4q, OSV MAL-2026-17703) and kafka-helmsman@99.0.1..99.0.6 (GHSA-r3f3-f28g-rc9x, OSV MAL-2026-17702). Both PyPI dep-confusion probes against internal-looking kafka-* operations tooling at a 99.x sentinel version, both flagged by OpenSSF Package Analysis for outbound communication to a malicious-activity-associated domain. The specific domain is not disclosed in the GHSA body. Classify dependency-confusion, severity medium.

Registry state

All 50 packages in this sweep are registry-quarantined at time of writing. Active operator-side infrastructure named today:

  • 185.158.107.175:8787/_ah/dc plain-HTTP beacon - Cluster A (xwise8887 wave 2)
  • webhook.site/43022177-de67-4d5c-a6df-33083b2b026f collector - Cluster B (wix-reg-poc-bypass)
  • https://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f K8s-SA-token exfil - Cluster B (css-overscroll-contain)
  • registry-pxnpm.rdc.nfjbill.ren:20021 download host + nfjbill.ren:20022 gost proxy - Cluster C (pxnpm, nfjbill operator)
  • db3klhbi6i9hark1kegg174t38h33b6wt.oast.site OAST canary - Cluster E (@dransay/*)

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193/bad-packages, npm security. Per-package IOC details drawn from GHSA advisory bodies and npm registry metadata between 2026-10-08 11:00 UTC and 2026-10-09 11:00 UTC.

Affected packages (50)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.jsonCheck requirements.txt

Impact

  • Cluster A - xwise8887 wave-2 continuation: wie888r/testrrrd/xblaxw/@wxwxtest/testrrrdd beaconing to 185.158.107.175:8787/_ah/dc (dependency-confusion/typosquat probes, confirmed install-time + require-time HTTP exfil): four packages published 2026-10-08 / 2026-10-09 reusing the exact same operator fingerprint as yesterdays Cluster B (troubleshooting + browser-metrics-plugin.contrib from xwise8887): plain-HTTP POST to 185.158.107.175:8787/_ah/dc with { hostname, installPath, cwd, process.version, pkg name }, index.js exports a Proxy of no-op functions, postinstall runs node beacon.cjs AND require(./beacon.cjs).fire() triggers on import so the beacon fires with --ignore-scripts too. OSV MAL-2026-17707 (wie888r), MAL-2026-17706 (testrrrd), MAL-2026-17708 (xblaxw), and the @wxwxtest/testrrrdd advisory confirm operator continuity. All four quarantined by npm security. Classified dependency-confusion, severity medium` (confirmed install-time hostname/path exfil, plain-HTTP collector, no second-stage disclosed)
  • Cluster B - Wix dep-confusion cluster: wix-reg-poc-bypass (webhook.site) + css-overscroll-contain (K8s SA-token theft + container escape) (dependency-confusion, confirmed install-time credential theft + container-escape payload on css-overscroll-contain): wix-reg-poc-bypass@1.0.0 (GHSA-v43v-p74g-hrf9) is a Wix-internal thunderboltRegistry/corvidRegistry/editorRegistry/siteAssetsRegistry module-name shadow with an IIFE at module load that collects host-identifying commands + process.platform + arch + PID + Node version and POSTs to webhook.site/43022177-de67-4d5c-a6df-33083b2b026f; registry-manifest.min.json points to a parastorage CDN URL to look like legitimate Wix infrastructure. css-overscroll-contain@1.0.1/1.0.2/1.0.3 (GHSA-hjq9-gv63-8hh8) is a SECOND package from the same Wix dep-confusion operator but with a VERY different payload: it ships the same thunderboltRegistry.js/siteAssetsRegistry/editorRegistry/corvidRegistry set + registry-manifest.min.json lures, but the actual payload runs execSync on uname and hostname/id, reads /proc/self/mountinfo, scrapes env variables matching secret-like patterns, reads /var/run/secrets/kubernetes.io/serviceaccount/token, and attempts unshare --user --mount + devtmpfs/cgroup/release_agent container-escape plus a Perl memfd_create+exec sequence; exfil to https://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f. This is a continuation of yesterdays Wix dep-confusion operator cluster (css-jptvix-polyfill + appsecc.com/js), but css-overscroll-contain is the most capable Wix-targeted probe yet seen. Classified dependency-confusion, severity high` (confirmed K8s SA-token exfil + container-escape attempt)
  • Cluster C - pxnpm npm proxy weaponization (malicious-package, same operator as 2026-08-07 yakuza0@2.23.40 MAL-2026-13605 - registry-pxnpm.rdc.nfjbill.ren → gost proxy → attacker-controlled registry mirror): pxnpm@7.0.0-beta.6/7.0.0-beta.8/7.0.0 (GHSA-h3fw-vmw2-h9xc, OSV MAL-2026-17710, published 2026-10-06 by npm user nfjbill). The postinstall script (bin/install.cjs) downloads a 17-21 MB Brotli archive from https://registry-pxnpm.rdc.nfjbill.ren:20021/__static/srv/downloads/pxnpm/, decompresses it to a 52-72 MB executable, and the launcher runs that binary on every invocation. The binary clears npm_config_registry/npm_config_proxy/npm_config_https_proxy from the environment and forces them to point at nfjbill.ren:20022 (a gost proxy), routing ALL subsequent npm registry traffic through the attacker-controlled proxy. OpenSSF could not analyse the second-stage binary because the download later returned an npm JSON document rather than the archive. Same operator email/domain as the 2026-08-07 yakuza0@2.23.40 compromise. Classified malicious-package, severity high (confirmed proxy weaponization + remote binary execution + operator continuity across two separate malicious npm packages 2 months apart)
  • *Cluster D - 16-package `@bellaxchuu/ + sibling Baileys-themed lure cluster (malicious-package, large coordinated Baileys/libsignal brand-impersonation campaign - CWE-506 boilerplate takedowns, no published payload analysis beyond "fully compromised" boilerplate)**: @bellaxchuu/{overbugs, familyxtrx, crystalred, libsignal-node, skyblue, xbailey, xtrxbails, velvetry, privatebails, flowblue, yarnbails, xbails, bails} (13 packages, GHSAs listed in references), plus the sibling packages @xayz/libsignal-node (GHSA-f748-f8w7-hf22), my-baileys (GHSA-6v2q-p64f-6cp6), and @kxafunc/xbails@0.0.8 (GHSA-5prw-6f85-2mmg - this one is explicit: its package.json aliases the real libsignal npm name to npm:@bellaxchuu/libsignal-node@latest, pinning the Baileys/libsignal consumer to the malicious package at install time). All 16 packages published 2026-10-08 and all quarantined by npm security the same day. The @bellaxchuu scope + -bails/-xbails suffix + libsignal-node co-publication nail this as a coordinated attack on consumers of the @WhiskeySockets/Baileys WhatsApp library ecosystem - the Baileys library is a known repeat target of malicious-npm "lure" campaigns against the WhatsApp automation user base. No IOC body published for the actual payload. Classified malicious-package, severity medium` (CWE-506 boilerplate, co-publication operator fingerprint confirmed, no runtime analysis published yet)
  • *Cluster E - 6-package `@dransay/ dep-confusion probe cluster with OAST exfil to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site (dependency-confusion, confirmed install-time preinstall-script beacon disclosing IP+resolver metadata + package-name-keyed path, 99.0.0 sentinel version fingerprint)**: dransay@99.0.0 (GHSA-j2mr-7vj7-w5rq), @dransay/db@99.0.0 (GHSA-gf65-f25f-jwqv), @dransay/feature-flags@99.0.0 (GHSA-rhg6-g966-4wxg), @dransay/phone-fix-test@99.0.0 (GHSA-4jfw-qx8x-7gv2), @dransay/logger@99.0.0 (GHSA-7v9w-pmg3-8ww9), @dransay/secrets@99.0.0 (GHSA-3qj5-xv6j-m8j4). Every package carries a preinstall hook running node beacon.js that performs a DNS lookup + HTTPS GET to the single hardcoded OAST subdomain db3klhbi6i9hark1kegg174t38h33b6wt.oast.site with the package name embedded in the request path; the README describes the packages as a benign bug-bounty proof-of-concept but the install-time beacon fires regardless. The 99.0.0 sentinel version is the canonical dep-confusion fingerprint, and the @dransay/* scope implies a bug-bounty engagement against a specific target org, but external orgs with a lockfile hit are exposed. OSV MAL-2026-17695..17700. All six packages quarantined. Classified dependency-confusion, severity medium` (confirmed install-time IP+resolver exfil, no destructive payload disclosed)
  • *Cluster F - 2-package `@bitwardne/ Bitwarden-scope typosquat (@bitwardne is a one-character typosquat of the real @bitwarden npm scope) with preinstall: curl -L <url> | node sideload (typosquat, confirmed install-time remote-code-execution via curl | node preinstall - URL left empty in the shipped tarball but the preinstall hook still fires)**: @bitwardne/jslib@1.1.0 (GHSA-x8j2-59mv-fr7h, OSV MAL-2026-17694) and @bitwardne/cli@1.0.1 (GHSA-5mwm-46h7-pv2h, OSV MAL-2026-17693). Both ship a four-line index.js stub that re-requires unrelated utilities (the @bitwardne/cli tarball bundles an unrelated option-parser cli library by Chris OHara as cover) with a preinstall: curl -L <empty_url> | node in package.json. The empty URL means curl fails as shipped (so the preinstall is a non-op today), but the structure is the canonical maintainer-abandoned-dropper pattern - the operator published a shell, intended to fill in the staging URL later, and either lost access or got caught before completing the setup. Both packages quarantined. Classified typosquat, severity medium (confirmed preinstall RCE primitive, no live payload URL)
  • *Cluster G - 5-package `@galicia-toolkit/ + @design-system-coopeuch/web dep-confusion probe cluster (dependency-confusion, CWE-506 boilerplate takedowns from Amazon Inspector / OpenSSF, no runtime IOC published)**: @galicia-toolkit/core (GHSA-ff43-rphq-9mgw), @galicia-toolkit/error-master (GHSA-42vv-c8c8-q765), @galicia-toolkit/tag-manager (GHSA-q3gj-mpgg-cqpv), @galicia-toolkit/spa-build-config (GHSA-7hx2-c7qp-ggjp), plus @design-system-coopeuch/web (GHSA-vhjp-6vjm-vq35). All five scoped names strongly suggest internal registries (a "galicia-toolkit" dev-tooling monorepo and the Coopeuch design-system package) and all were published and quarantined on 2026-10-08. The GHSA bodies are "fully compromised" CWE-506 boilerplate with no IOC detail; the operator profile and scoped-name fingerprint are consistent with dep-confusion rather than typosquats. Classified dependency-confusion, severity medium` (CWE-506 takedown, no IOC body)
  • Cluster H - 9 npm dev-tooling typosquats and CWE-506 boilerplate takedowns (typosquat/malicious-package mixed, no published IOCs): tailwindcss-ui-extensions (GHSA-9ww2-25r2-rppg) and tailwindcss-effects-kit (GHSA-9c94-xcv7-wcf4) are Tailwind-ecosystem typosquats aimed at consumers of the real tailwindcss + tailwindcss-animated + tailwindcss-animatecss sets; node-gyp-runtime (GHSA-v64f-f8pp-4qx2) typosquats the real node-gyp + node-gyp-build; node-env-resolve (GHSA-fw57-xw67-r253) typosquats dotenv + dotenv-expand; node-fetch-lite (GHSA-cfmp-vp7q-257m) typosquats node-fetch; dom-utils-lite (GHSA-v6fr-pvhf-6rh5) typosquats dev-dependency dom-utils; system-driver (GHSA-43w2-g2fc-r4h3), connector-agent (GHSA-422j-hgjh-g8fg), and centralogger (GHSA-wpw7-2rgx-4cfm) are dev-tooling-themed first-publish malicious lures with no obvious legitimate upstream. All nine are CWE-506 boilerplate takedowns with no IOCs. Classified typosquat or malicious-package per the fingerprint; severity medium
  • Cluster I - 3 npm standalone CWE-506 boilerplate takedowns (revine, brat-generator, clickfix_npm_delivery) (malicious-package, no published IOC body): revine@2.4.0 (GHSA-gr77-3hqf-674h, 2026-10-08), brat-generator all versions (GHSA-m45c-2rh6-33g6), and clickfix_npm_delivery@1.0.0/1.0.2 (GHSA-37h8-m54m-784j). The clickfix_npm_delivery name is notable - "ClickFix" is a well-known social-engineering malware-delivery pattern (a fake browser error dialog telling the user to paste a malicious powershell/curl command into their terminal to "fix" a problem) and seeing the name hard-coded in an npm package suggests an npm-side arm of a broader ClickFix campaign or a defensive namespace-hold, but the GHSA body is boilerplate and the npm registry entry has been pulled. Severity medium on all three
  • Cluster J - 2-package pypi kafka-roller+kafka-helmsman dep-confusion probe (dependency-confusion, OpenSSF Package Analysis flagged for communicating with a domain associated with malicious activity, 99.x sentinel version fingerprint): kafka-roller@99.0.0..99.0.6 (GHSA-8798-7m3x-mq4q, OSV MAL-2026-17703) and kafka-helmsman@99.0.1..99.0.6 (GHSA-r3f3-f28g-rc9x, OSV MAL-2026-17702). Both PyPI dep-confusion probes against internal-looking kafka-* operations tooling at a 99.x sentinel version, both flagged by OpenSSF Package Analysis for outbound communication to a malicious-activity-associated domain (the specific domain is not disclosed in the GHSA body). Classified dependency-confusion, severity medium
  • Operator continuity check: today has three confirmed operator continuations - xwise8887 (yesterday's troubleshooting+browser-metrics-plugin.contrib → today's wie888r+testrrrd+xblaxw+@wxwxtest/testrrrdd, same 185.158.107.175:8787/_ah/dc beacon URL to the character), the Wix dep-confusion operator (yesterday's css-jptvix-polyfill+appsecc.com/js → today's wix-reg-poc-bypass+css-overscroll-contain, same thunderboltRegistry/parastorage lures and same anti-Wix target profile), and the nfjbill operator (2026-08-07 yakuza0@2.23.40 MAL-2026-13605 → today's pxnpm@7.0.0, same nfjbill.ren operator host and the same npm-proxy-weaponization primitive). The internallib_v<N> RFC1918 reverse-shell operator (yesterdays Cluster A v788, 2026-10-07 v23/30/86/875, 2026-10-05 v275), the reaperhackbot256f operator (yesterday's personio-pipeline-projen`), the jsonspack/Pinecone operators from 2026-10-07, and all 2026-10-05/06 operator profiles are quiet today. The tensorlake maintainer-account compromise (yesterday's carve-out) has not had a wave-2 republish

What to do

  1. 1For Cluster A (xwise8887 operator wave 2): grep lockfiles for wie888r, testrrrd, xblaxw, and @wxwxtest/testrrrdd at any version. On hit, assume install-time + import-time beacon fired to http://185.158.107.175:8787/_ah/dc under the xwise8887 operator - the beacon fires even with --ignore-scripts because the Proxy stub in index.js triggers require(./beacon.cjs).fire() on import. The egress block for 185.158.107.175:8787 from yesterday`s sweep (Cluster B) remains in force; add the four new package names to the internal denylist entry
  2. 2For Cluster B (Wix dep-confusion cluster, css-overscroll-contain K8s token theft): grep lockfiles for wix-reg-poc-bypass and css-overscroll-contain. On hit, especially for css-overscroll-contain@1.0.1/1.0.2/1.0.3: assume the host read /var/run/secrets/kubernetes.io/serviceaccount/token, scraped env variables matching secret-like patterns, attempted unshare --user --mount + devtmpfs/cgroup/release_agent container escape, and exfiltrated results to https://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f. Rotate the Kubernetes service-account token on any pod/node that resolved the package, rotate every env-exported credential the pod could reach, and audit /proc/self/mountinfo for lingering attacker mounts. Add dxpoc.gt.tc, webhook.site/43022177-de67-4d5c-a6df-33083b2b026f, and the thunderboltRegistry.js/registry-manifest.min.json filenames to detection rules. If your org publishes under Wix-internal *Registry* names, scope-lock the internal registry and hold the public slugs with placeholder packages
  3. 3For Cluster C (pxnpm npm proxy weaponization): grep lockfiles and global npm installs for pxnpm at 7.0.0-beta.6/7.0.0-beta.8/7.0.0. On hit: assume the install downloaded a 17-21 MB Brotli archive from registry-pxnpm.rdc.nfjbill.ren:20021, extracted a 52-72 MB executable into ~/.cache/pxnpm/native/, and rewrote npm_config_registry/npm_config_proxy/npm_config_https_proxy to route ALL subsequent npm traffic through nfjbill.ren:20022 (a gost proxy under attacker control). Treat the installer host as fully compromised and assume every npm package installed since the pxnpm install came from the attacker-controlled proxy, not from the public npm registry - rebuild node_modules from scratch on a clean host from a trusted registry endpoint, with lockfile integrity verification. Delete ~/.cache/pxnpm/native/. Add nfjbill.ren and all subdomains (registry-pxnpm.rdc.nfjbill.ren observed, but assume the operator owns the full apex) to the CI/build-host egress denylist. The 2026-08-07 yakuza0@2.23.40 IOC registry-pxnpm.rdc.nfjbill.ren was already in prior denylists; today's advisory confirms operator continuity
  4. 4*For Cluster D (`@bellaxchuu/ + sibling Baileys lure cluster)**: grep lockfiles for @bellaxchuu/* (any of the 13 package suffixes: overbugs, familyxtrx, crystalred, libsignal-node, skyblue, xbailey, xtrxbails, velvetry, privatebails, flowblue, yarnbails, xbails, bails) plus @xayz/libsignal-node, my-baileys, and @kxafunc/xbails. On hit, treat as a Baileys/WhatsApp-automation lure - uninstall, delete node_modules, delete the lockfile, rebuild from a scope-locked internal registry. @kxafunc/xbails aliases libsignal to npm:@bellaxchuu/libsignal-node@latest in its package.json, so consumers of @kxafunc/xbails indirectly pull @bellaxchuu/libsignal-node even if their own lockfile does not pin the name. No specific network IOC published for the Baileys payload today, but add the @bellaxchuu and @xayz` scopes to the internal denylist
  5. 5*For Cluster E (`@dransay/ dep-confusion probes, oast.site)**: grep lockfiles for dransay and @dransay/ (db, feature-flags, phone-fix-test, logger, secrets) at 99.0.0. On hit, assume install-time beacon fired to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site with the installers source IP, DNS resolver IP, and the package name. Rotate any env-exported credentials. Add `.oast.site apex and the specific canary subdomain to the CI/build-host egress denylist unless legitimately used by in-house red-team (yesterdays denylist already contained *.oast.fun apex from the reaperhackbot256f operator; today adds *.oast.site apex). If your orgs internal registry publishes under @dransay/*` names, scope-lock the internal registry and hold the public slug with a placeholder
  6. 6*For Cluster F (`@bitwardne/ Bitwarden typosquat)**: grep lockfiles for @bitwardne/jslib@1.1.0 and @bitwardne/cli@1.0.1. On hit: although the curl -L <empty_url> | node preinstall URL is empty in the shipped tarball (so the current payload is a non-op), treat the installer host as potentially compromised anyway - the preinstall ran, which proves the typosquat succeeded in bypassing the users intention to install @bitwarden/*. Audit for any legitimate Bitwarden CLI or jslib usage that should have resolved to the real @bitwarden scope, and teach the correct spelling. Add @bitwardne scope (and other one-character variants of @bitwarden) to the internal denylist
  7. 7*For Cluster G (`@galicia-toolkit/ + @design-system-coopeuch/web dep-confusion)**: grep lockfiles for @galicia-toolkit/* (core, error-master, tag-manager, spa-build-config) and @design-system-coopeuch/web. On hit, uninstall. No specific IOCs published (CWE-506 boilerplate) but if the scoped names map to your orgs internal registry, scope-lock and hold the public slugs with placeholders
  8. 8For Cluster H (9 npm dev-tooling typosquats): grep lockfiles for tailwindcss-ui-extensions, tailwindcss-effects-kit, node-gyp-runtime, node-env-resolve, node-fetch-lite, dom-utils-lite, system-driver, connector-agent, centralogger. On hit, uninstall, delete node_modules, delete lockfile, rebuild. Teach the correct spellings: tailwindcss not tailwindcss-ui-extensions; node-gyp + node-gyp-build not node-gyp-runtime; dotenv + dotenv-expand not node-env-resolve; node-fetch not node-fetch-lite; dom-utils not dom-utils-lite. No specific IOCs published
  9. 9For Cluster I (standalones: revine, brat-generator, clickfix_npm_delivery): grep lockfiles for all three. On hit, uninstall. Note on clickfix_npm_delivery: the name maps to the well-known "ClickFix" social-engineering malware-delivery family (fake browser error dialogs that instruct the user to paste a curl/powershell command into their terminal) - treat any host that installed the package as potentially staged for a ClickFix-style second-stage drop even though no payload IOC was published in the GHSA body
  10. 10For Cluster J (pypi kafka-roller+kafka-helmsman dep-confusion): grep requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock for kafka-roller at 99.0.0..99.0.6 and kafka-helmsman at 99.0.1..99.0.6. On hit, uninstall. If your orgs internal Python registry publishes kafka-*` operations tooling under matching names, scope-lock and hold the PyPI slugs with placeholders
  11. 11NEW outbound denylist entries for CI/build-host egress proxies today: webhook.site/43022177-de67-4d5c-a6df-33083b2b026f (Cluster B wix-reg-poc-bypass), dxpoc.gt.tc apex (Cluster B css-overscroll-contain), nfjbill.ren apex and all subdomains (Cluster C pxnpm/yakuza0 operator), *.oast.site apex (Cluster E @dransay). Keep prior egress blocks in place: 185.158.107.175:8787 (yesterdays xwise8887 + todays wave-2), *.oast.fun apex (yesterdays reaperhackbot256f), *.oastify.com, appsecc.com (2026-10-07 Wix cluster), storage.googleapis.com/depenconf/ + ltidi.storage.googleapis.com (2026-10-07), 10.0.19.0/24 + 10.0.49.0/24 (internallib_v<N> operator reverse-shells), api.nm-streetwear.space (2026-10-06), discord.com/api/webhooks + api.telegram.org (unless legitimately used), ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools, Ethereum mainnet / Sepolia / Arbitrum Sepolia RPC, chinazhangsan.ccwu.cc, api.npoint.io, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, Polygon RPC, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com publisher email domain (yesterdays function-color/function-flag 2025-08-04 sleepers), and the 45.138.0.0/16 RubyGems wgkit CIDRs

References

Back to feedSubmit a correction
multi-2026-10-09-ghsa-malware-sweep