DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
HighAdvisory sweepPublished 10 Oct 202647 packages · 120 versions

GitHub Advisory malware sweep - 2026-10-10 (new `s4yhii` native-binary credential-stealer dep-confusion operator - 16 npm packages across `@galicia-toolkit-nestjs/*`, `@galicia-toolkit-nestjs-20/*`, `@galicia-toolkit-nestjs-20-lite/*`, `@galicia-toolkit-cheques-nc/*`, `@brick-v2/*` loading prebuilds/-/metrics.node ELF+PE that forks+setsid and exfils AWS/GitHub/npm/Azure DevOps/Actions tokens to oob.s4yhii.com/native; `@tunstock/remact-dom@19.2.0` react-dom typosquat with confirmed `tele.metry.orgin.net/api/v1/events` beacon; Baileys/libsignal lure continuation `@fer2809fl/baileys`+`cloud-baileys`+`arsya-baileys`+10-package `asepxyz*` cluster; crates.io `sharpnes` Telegram-Desktop + Chrome-extension/wallet infostealer (first cargo malware advisory this week); 3-package `kmf-*` + 2-package internal-frontend dep-confusion with oast.pro OAST; 5-package `@tvg-mar/*` dep-confusion probes; 2 Tailwind typosquats; plus pypi `ig-gox` Instagram abuse)

Summary

GHSA 2026-10-10: ~48 fresh malware advisories across 10 clusters (46 npm, 1 pypi, 1 crates). Headline items: new s4yhii operator native-binary credential-stealer dep-confusion cluster (16 packages across @galicia-toolkit-nestjs* and @brick-v2 scopes, prebuilds/metrics.node ELF+PE forks+setsid and exfils cloud/CI tokens to oob.s4yhii.com/native); first-seen crates.io infostealer sharpnes targeting Telegram Desktop sessions + Chrome extension/wallet data via Telegram Bot API; and @tunstock/remact-dom@19.2.0 react-dom typosquat with confirmed install-time beacon to tele.metry.orgin.net.

typosquatdependency-confusioncredential-theftcrypto-wallet-draininfostealerobfuscation
Incident type
Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis · Amazon Inspector · kam193/bad-packages · npm security · crates.io security
Also known as
2026-10-10 GHSA sweep · s4yhii native-binary credential-stealer operator · @galicia-toolkit-nestjs native ELF addon · @brick-v2 native ELF addon · @tunstock/remact-dom react-dom typosquat · cloud-baileys arsya-baileys asepxyz Baileys lure wave 2 · sharpnes crates.io Telegram Chrome infostealer · kmf-* oast.pro dep-confusion
Ecosystems
crates.ionpmPyPI
Packages tracked
47

What happened

Between roughly 2026-10-09 11:00 UTC (end of yesterdays sweep window) and 2026-10-10 11:00 UTC, the GitHub Advisory Database (via OpenSSF malicious-packages, Amazon Inspectors IN-MAL feed, OpenSSF Package Analysis, and kam193/bad-packages) published ~48 fresh malware advisories: 46 npm, 1 pypi, 1 crates.

The sweep breaks into 9 clusters by operator profile and payload family, plus a cross-cluster operator-continuity analysis. The most important new material is a new native-binary credential-stealer dep-confusion operator (nicknamed s4yhii after its exfil host oob.s4yhii.com) and the first crates.io malware advisory of substance this week (sharpnes, a cross-platform Rust infostealer).

Cluster A - npm s4yhii native-binary credential-stealer dep-confusion (16 packages)

PackageVersionsGHSAOSV
@galicia-toolkit-nestjs/archetype999.0.1, 999.0.5, 999.0.6GHSA-76rm-2c8x-h676MAL-2026-17721
@galicia-toolkit-nestjs/paas999.0.3, 999.0.4, 999.0.5, 999.0.6GHSA-xmvx-x823-fvm2MAL-2026-17723
@galicia-toolkit-nestjs/swagger999.0.1, 999.0.2, 999.0.3GHSA-7hxg-fr5p-9hp5-
@galicia-toolkit-nestjs/commons999.0.1, 999.0.6, 999.0.7, 999.0.8, 3.0.1GHSA-j7v5-rrxc-7jrh-
@galicia-toolkit-nestjs-20/paas3.0.3, 3.0.5, 3.0.6, 3.0.7, 999.0.1GHSA-mgg2-4cpg-5cfj-
@galicia-toolkit-nestjs-20/commons999.0.1, 999.0.2, 999.0.3GHSA-hwv3-5v66-4cvw-
@galicia-toolkit-nestjs-20/archetype999.0.1, 999.0.2GHSA-43v2-p79h-pjp9-
@galicia-toolkit-nestjs-20-lite/paas1.0.20, 1.0.21, 1.0.22, 1.0.24GHSA-p5pm-8q88-fj6v-
@galicia-toolkit-nestjs-20-lite/commons999.0.1, 999.0.2, 999.0.3GHSA-pw25-gp8h-4cr2MAL-2026-17729
@galicia-toolkit-cheques-nc/front999.0.1, 999.0.2, 999.0.3GHSA-xj56-89c6-596gMAL-2026-17720
@brick-v2/table999.0.1, 999.0.2, 999.0.3GHSA-rmgm-9vm2-v688MAL-2026-17718
@brick-v2/icons999.0.1, 999.0.2, 999.0.3GHSA-gm38-f7q8-qc9p-
@brick-v2/core999.0.1, 999.0.2GHSA-49xp-7x68-8hf4MAL-2026-17715
@brick-v2/form999.0.1, 999.0.3GHSA-cxh8-f5qg-3jmp-
@brick-v2/tour999.0.1, 999.0.2, 999.0.3GHSA-4w7c-9xc7-gwv7-
@brick-v2/brand999.0.1, 999.0.2, 999.0.3GHSA-62v9-prv8-q646-

Payload: each packages preinstall hook runs node index.js || true (or in some variants a module-load require() triggers it); index.js loads prebuilds/<platform>-<arch>/metrics.node, a prebuilt native addon with no shipped C/C++ source and no binding.gyp. The ELF (Linux) and PE (Windows) binaries - built as metrics with the entry symbol do_report, the decoy env var _METRICS_PKG, and a src:native JSON field - read AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, SYSTEM_ACCESSTOKEN (Azure DevOps), ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN, GITHUB_REPOSITORY, plus host identifiers (hostname, uid/pwuid, cwd, uname). The data is POSTed as JSON over a raw socket (manual POST /native HTTP/1.0 request line) to oob.s4yhii.com. The binary then calls fork() + setsid()` from libc and daemonises so the exfiltration process outlives the Node parent.

Operator continuity: the @galicia-toolkit* scope was first seen in yesterdays Cluster G (plain @galicia-toolkit/ 4-package set, CWE-506 boilerplate, no runtime detail). Todays expansion into `@galicia-toolkit-nestjs/ + the s4yhii payload confirms the operator (or a close copy-cat) iterated and shipped a real credential stealer. The @brick-v2` scope is new today.

Classification: dependency-confusion (999.x sentinel versions on scoped names that look like internal corporate NestJS/design-system monorepos). Severity high because the payload is a confirmed cloud+CI credential-stealing native binary with daemonized persistence, not just a beacon.

Cluster B - @tunstock/remact-dom@19.2.0 react-dom typosquat

@tunstock/remact-dom@19.2.0 (GHSA-gjvr-3qjw-56fx, OSV MAL-2026-17745) is a one-character typosquat of react-dom, pinned to the real react-dom@19.2.0 latest for maximum consumer-side confusion. The tarballs package.json falsely identifies itself as react-dom@19.2.0, uses lookalike author/repository metadata (github.com/m00r0ncr33w/act.git + morroncr0w.io), and runs scripts/setup.js as postinstall. The script opens an https.request to tele.metry.orgin.net/api/v1/events carrying the hostname, OS platform+arch, Node version, public IP, cwd, and consuming projects name+version. No second-stage payload is in the tarball; the GHSA assesses this as reconnaissance to support a follow-on supply-chain compromise.

Classify typosquat, severity medium.

Cluster C - Baileys/libsignal lure continuation (13 packages)

  • @fer2809fl/baileys 1.4.5, 1.4.6, 1.4.7, 1.4.9, 7.0.0-rc13, 7.0.0, 7.0.1, 7.0.2, 7.0.4, 7.0.5, 7.0.6, 7.0.7 (GHSA-wv7g-r3r9-ww8v)
  • cloud-baileys 1.0.0-1.0.5, 1.1.0-1.1.3, 1.1.33-1.1.42 (GHSA-745p-g872-6x8c)
  • arsya-baileys 9.2.0-9.2.4 (GHSA-pv3g-8jvf-qc7x)
  • asepxyz-baileys, asepxyz-signal, razamodsxasepxyz, asepxyz, asepxyz12, asepxyzz, asepxyznew, asepxyz-eslint-config, asepxyzxrazamodsnew-baileys, @aseppxyzz12/baileys - all versions, 10 GHSAs (xv7g, 38rx, f3vq, qvwh, 3rxj, hmqh, m23r, rhjp, v95p, 4pw9)

All 13 packages continue yesterdays @bellaxchuu/* Baileys/libsignal brand-impersonation campaign against the @WhiskeySockets/Baileys` WhatsApp-automation library consumer base. The GHSA bodies are CWE-506 "fully compromised" boilerplate with no runtime IOC published.

Classify malicious-package, severity medium.

Cluster D - crates.io sharpnes Telegram + Chrome infostealer

sharpnes@0.1.0/0.1.1 (GHSA-qq2r-xp7w-5r55, OSV MAL-2026-17713, publisher crows7781-glitch).

The crate exports an async function shortname() which, on invocation, runs two parallel exfil chains:

  • src/teleg.rs (Windows only): collects the Telegram Desktop session directory tdata, zips it as tdata_backup.zip, and uploads via the Telegram Bot API sendDocument endpoint using a hardcoded bot token.
  • src/data.rs (Windows + Linux + macOS): reads the Chrome Default profile Local Extension Settings directory - where browser-wallet extensions (MetaMask, Phantom, Keplr, Rabby, etc.) keep their vaults, and where other extensions keep OAuth tokens and API keys - XOR-obfuscates path strings with key 0xAA, zips in memory, and uploads via teloxide using a second hardcoded bot token.

In 0.1.0 the Chrome stealer code is present but unused; in 0.1.1 it is wired into shortname(). Upstream metadata on crates.io points to the GitHub repository crows7781-glitch/shortneer.

Classify malicious-package, severity high (confirmed cross-platform Telegram Desktop session theft + crypto-wallet-related Chrome extension data theft).

Cluster E - kmf-* + internal-frontend dep-confusion with oast.pro OAST exfil (5 packages)

  • kmf-bootstrap@100.100.102/100.100.103 (GHSA-97h4-9p9c-qhp2, MAL-2026-17746) - OpenSSF Package Analysis flagged
  • kmf-i18n@100.100.102 (GHSA-c93g-xqm8-mjcg, MAL-2026-17747)
  • kmf-vendor-pack@99.0.0 (GHSA-575h-jpqc-p8h4, MAL-2026-17744) - disclosed IOC: postinstall runs node -e to GET db4fe7a2e2lvaraia8k0n4amgw4ir83az.oast.pro with hostname + username as query string
  • test-account-portal-fe@100.100.102 (GHSA-rh76-qjhp-v9m8)
  • @myorder-frontend-commons/analytics@3.0.0/10.0.0/99.0.0 (GHSA-rjqp-7c89-4x98, MAL-2026-17749)

The 100.100.102 sentinel version used by kmf-* + test-account-portal-fe is a new fingerprint, not the usual 99.x/999.x seen elsewhere today. All five quarantined.

Classify dependency-confusion, severity medium.

Cluster F - @tvg-mar/* dep-confusion probes (5 packages)

  • @tvg-mar/storyblok-bridge (GHSA-3wxx-x983-53mg)
  • @tvg-mar/tvg-promos-atomic-ui (GHSA-gj3c-r86r-hr43)
  • @tvg-mar/utils (GHSA-p6w4-mmhj-wc4v)
  • @tvg-mar/promos-context (GHSA-f42w-v662-25cr)
  • @tvg-mar/promos-gtm (GHSA-8g69-976g-h44g)

All five all-versions, CWE-506 boilerplate takedowns, no IOC body published. Scoped names imply an internal registry at a marketing/promotions org (tvg-mar + Storyblok CMS + GTM + "promos" naming). Classify dependency-confusion, severity medium.

Cluster G - Tailwind typosquats (2 packages)

  • tailwind-animatecss-uniform all versions (GHSA-hxvr-77vv-6r85)
  • tailwind-animatecss-form all versions (GHSA-pp69-57rc-3v49)

Typo of tailwindcss-animatecss/tailwindcss-animated. Continuation of yesterdays tailwindcss-ui-extensions+tailwindcss-effects-kit Tailwind-typosquat operator. Classify typosquat, severity medium`.

Cluster H - npm standalones (3 packages)

  • pino-testkit all versions (GHSA-9q39-547h-rfpc) - impersonates the pino logger ecosystem
  • hanncap all versions (GHSA-jw9f-6xx8-mj3f)
  • pahinuy all versions (GHSA-hcwg-cqc9-469q)

CWE-506 boilerplate takedowns, no runtime IOC. Classify malicious-package, severity medium.

Cluster I - pypi ig-gox Instagram-abuse dropper

ig-gox@1.0.0 (GHSA-rhpj-mr3r-r4gg, OSV MAL-2026-17712, campaign 2026-10-ig-gox): the package hides obfuscated code aimed at analysis evasion, performs sandbox detection, and downloads a second-stage script that abuses Instagrams API for mass fake-account registration. Flagged by kam193/bad-packages`.

Classify malicious-package, severity medium (confirmed drop-and-exec, Instagram is the harm target, installer host still ran attacker-controlled Python).

Registry state

All 48 packages in this sweep are registry-quarantined at time of writing. Active operator-side infrastructure named today:

  • oob.s4yhii.com/native - Cluster A (s4yhii native-binary cloud+CI credential stealer, 16 packages, raw-socket POST /native HTTP/1.0)
  • tele.metry.orgin.net/api/v1/events - Cluster B (@tunstock/remact-dom recon beacon)
  • api.telegram.org with two hardcoded bot tokens - Cluster D (sharpnes Telegram + Chrome exfil)
  • db4fe7a2e2lvaraia8k0n4amgw4ir83az.oast.pro - Cluster E (kmf-vendor-pack OAST canary)

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193/bad-packages, npm security, crates.io security. Per-package IOC details drawn from GHSA advisory bodies, OSV MAL records, and npm/crates.io registry metadata between 2026-10-09 11:00 UTC and 2026-10-10 11:00 UTC.

Affected packages (47)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.jsonCheck requirements.txt

Impact

  • *Cluster A - s4yhii native-binary credential-stealer dep-confusion operator: 16-package `@galicia-toolkit-nestjs/ + @galicia-toolkit-nestjs-20/ + @galicia-toolkit-nestjs-20-lite/ + @galicia-toolkit-cheques-nc/ + @brick-v2/ cluster (dependency-confusion, confirmed credential exfil via prebuilt native ELF+PE addon, cross-platform fork+setsid daemonization, severity-elevating payload)**: a new operator published 16 npm packages on 2026-10-08 / 2026-10-09, all under scoped names that look like internal corporate monorepo registries (Chilean financial-cooperative Banco Galicia "galicia-toolkit-nestjs" dev-tooling monorepo + "brick-v2" design-system) with implausibly high sentinel versions (999.0.1-999.0.8 on most, plus 3.0.1-3.0.7 on NestJS commons/paas, and 1.0.20-1.0.24 on nestjs-20-lite/paas). Each package ships a preinstall: node index.js || true hook (and in some variants a module-load trigger via require()) that loads prebuilds/<platform>-<arch>/metrics.node - a prebuilt native addon with no shipped C/C++ source or binding.gyp. The ELF (Linux) and PE (Windows) binaries read AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, SYSTEM_ACCESSTOKEN (Azure DevOps), ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN, GITHUB_REPOSITORY, plus host identifiers (hostname, uid/pwuid, cwd, uname) and POST the JSON body via raw socket (request line POST /native HTTP/1.0) to oob.s4yhii.com. The binary calls fork() + setsid() from libc and daemonises so the exfiltration process outlives the Node parent. Function symbol in the binary is do_report, decoy env var _METRICS_PKG, JSON field src:native. OSV MAL-2026-17713..17729 range covers the cluster. All 16 packages quarantined. Classified dependency-confusion, severity high` (confirmed cloud+CI credential exfil + daemonized persistence, not just a beacon)
  • Cluster B - @tunstock/remact-dom@19.2.0 react-dom typosquat with install-time recon beacon (typosquat, confirmed postinstall HTTPS beacon to attacker-controlled lookalike domain): @tunstock/remact-dom@19.2.0 (GHSA-gjvr-3qjw-56fx, OSV MAL-2026-17745) - a one-character typosquat of the real react-dom npm package, pinned to the real react-dom latest 19.2.0 for maximum consumer-side confusion. The tarballs package.json falsely identifies itself as react-dom@19.2.0, uses lookalike author/repository metadata (github.com/m00r0ncr33w/act.git and morroncr0w.io), and runs a postinstall script scripts/setup.js that opens an https.request to tele.metry.orgin.net/api/v1/events carrying the hostname, OS platform+arch, Node version, public IP, cwd, and the consuming projects name+version. The GHSA assesses this as reconnaissance intended to support a follow-on supply-chain compromise rather than an endpoint infostealer. Classified typosquat, severity medium (recon-only beacon disclosed, no second-stage drop in the shipped tarball)
  • *Cluster C - Baileys/libsignal lure continuation (@fer2809fl/baileys, cloud-baileys, arsya-baileys, 10-package `asepxyz cluster, @aseppxyzz12/baileys) (malicious-package, continuation of yesterday's @bellaxchuu/ + @xayz/libsignal-node + my-baileys + @kxafunc/xbails` 16-package cluster - CWE-506 boilerplate takedowns, no runtime payload analysis in GHSA bodies): today adds @fer2809fl/baileys (12 versions: 1.4.5, 1.4.6, 1.4.7, 1.4.9, 7.0.0-rc13, 7.0.0, 7.0.1, 7.0.2, 7.0.4, 7.0.5, 7.0.6, 7.0.7 - GHSA-wv7g-r3r9-ww8v), cloud-baileys (14 versions across 1.0.x and 1.1.x - GHSA-745p-g872-6x8c), arsya-baileys (9.2.0-9.2.4 - GHSA-pv3g-8jvf-qc7x), and a 10-package `asepxyz/razamods-themed cluster: asepxyz-baileys (GHSA-xv7g-p6pq-vg9q), asepxyz-signal (GHSA-38rx-c4rh-xc4p), razamodsxasepxyz (GHSA-f3vq-wx4x-jv6w), asepxyz (GHSA-qvwh-x99q-h49x), asepxyz12 (GHSA-3rxj-r3x6-3992), asepxyzz (GHSA-hmqh-m5mj-f7mm), asepxyznew (GHSA-m23r-8cxr-4gw3), asepxyz-eslint-config (GHSA-rhjp-rpj7-8x4q), asepxyzxrazamodsnew-baileys (GHSA-v95p-rhxh-mm8g), @aseppxyzz12/baileys (GHSA-4pw9-3c22-g559). The -baileys/-signal suffix on multiple names + the razamods/asepxyz scope reuse continues the Baileys ecosystem lure campaign started by yesterdays @bellaxchuu/* cluster against the @WhiskeySockets/Baileys WhatsApp-automation library consumer base. All GHSAs are CWE-506 boilerplate ("fully compromised" wording) with no IOC detail. All 13 packages quarantined. Classified malicious-package, severity medium (operator continuity confirmed via scope-reuse fingerprint, runtime payload not yet published)
  • Cluster D - crates.io sharpnes Telegram-Desktop + Chrome-extension/wallet infostealer (malicious-package, first crates.io malware advisory in this week's window, confirmed cross-platform infostealer payload - severity-elevating in a cargo ecosystem that normally sees ~0 malicious-package takedowns per week): sharpnes@0.1.0/0.1.1 (GHSA-qq2r-xp7w-5r55, OSV MAL-2026-17713, crates.io publisher crows7781-glitch). The crate exports an async function shortname() which, on invocation, runs: (1) on Windows, src/teleg.rs collects the Telegram Desktop session directory (tdata), zips it as tdata_backup.zip, and uploads via the Telegram Bot API sendDocument endpoint using a hardcoded bot token; and (2) on Windows+Linux+macOS, src/data.rs reads the Chrome Default profile Local Extension Settings directory (which stores extension data including crypto-wallet vaults for MetaMask, Phantom, Keplr, etc.), uses XOR-obfuscated strings (key 0xAA) to hide path strings, zips in memory, and uploads via teloxide using a second hardcoded bot token. In 0.1.0 the Chrome stealer is present but unused; in 0.1.1 it is wired into the exported shortname(). Upstream metadata points to crows7781-glitch/shortneer on GitHub. Classified malicious-package, severity high (confirmed cross-platform Telegram Desktop session theft + crypto-wallet-related Chrome extension data theft, two separate hardcoded Telegram Bot tokens as collectors)
  • *Cluster E - 3-package `kmf- + 2-package internal-frontend dep-confusion probes with oast.pro OAST exfil (dependency-confusion, confirmed postinstall beacon to OpenSSF-flagged canary domain + OpenSSF Package Analysis flagged "communicates with malicious-activity domain")**: kmf-bootstrap@100.100.102/100.100.103 (GHSA-97h4-9p9c-qhp2, OSV MAL-2026-17746), kmf-i18n@100.100.102 (GHSA-c93g-xqm8-mjcg, OSV MAL-2026-17747), kmf-vendor-pack@99.0.0 (GHSA-575h-jpqc-p8h4, OSV MAL-2026-17744 - **the one with disclosed IOC**: postinstall runs node -e to GET db4fe7a2e2lvaraia8k0n4amgw4ir83az.oast.pro with hostname + username as query string, fires automatically on npm install), test-account-portal-fe@100.100.102 (GHSA-rh76-qjhp-v9m8), and @myorder-frontend-commons/analytics at 3.0.0/10.0.0/99.0.0 (GHSA-rjqp-7c89-4x98, OSV MAL-2026-17749). The 100.100.102-era sentinel version used by kmf-* + test-account-portal-fe is a new fingerprint (not the usual 99.x or 999.x seen elsewhere today). All five quarantined. Classified dependency-confusion, severity medium`
  • *Cluster F - 5-package `@tvg-mar/ dep-confusion probe cluster (dependency-confusion, CWE-506 "fully compromised" boilerplate takedowns, no IOC body published)**: @tvg-mar/storyblok-bridge all versions (GHSA-3wxx-x983-53mg), @tvg-mar/tvg-promos-atomic-ui all versions (GHSA-gj3c-r86r-hr43), @tvg-mar/utils all versions (GHSA-p6w4-mmhj-wc4v), @tvg-mar/promos-context all versions (GHSA-f42w-v662-25cr), @tvg-mar/promos-gtm all versions (GHSA-8g69-976g-h44g). The scoped name + the Storyblok CMS "promos" and GTM naming imply an internal registry at a marketing/promotions org publishing under @tvg-mar/*. All five quarantined 2026-10-09. Classified dependency-confusion, severity medium`
  • Cluster G - 2-package Tailwind-ecosystem typosquats (tailwind-animatecss-uniform, tailwind-animatecss-form) (typosquat, CWE-506 "fully compromised" boilerplate, no payload IOC): tailwind-animatecss-uniform all versions (GHSA-hxvr-77vv-6r85) and tailwind-animatecss-form all versions (GHSA-pp69-57rc-3v49) - both typosquats of the real tailwindcss-animatecss + tailwindcss-animated Tailwind-ecosystem adaptor packages. Continuation of yesterdays tailwindcss-ui-extensions/tailwindcss-effects-kit Cluster H entries - same operator profile targeting Tailwind consumers. Classified typosquat, severity medium`
  • Cluster H - 3 npm standalone CWE-506 boilerplate takedowns (pino-testkit, hanncap, pahinuy) (malicious-package, no published IOC): pino-testkit all versions (GHSA-9q39-547h-rfpc) - dev-tooling-themed first-publish lure impersonating the pino logger ecosystem; hanncap all versions (GHSA-jw9f-6xx8-mj3f) and pahinuy all versions (GHSA-hcwg-cqc9-469q) - standalone CWE-506 takedowns with no obvious legitimate upstream and no runtime IOC in the GHSA bodies. All three quarantined. Classified malicious-package, severity medium
  • Cluster I - pypi ig-gox@1.0.0 Instagram-abuse second-stage dropper (malicious-package, confirmed obfuscated code + sandbox detection + remote-stage download for Instagram mass-fake-account-registration abuse): ig-gox@1.0.0 (GHSA-rhpj-mr3r-r4gg, OSV MAL-2026-17712, campaign tag 2026-10-ig-gox). The package hides obfuscated code aimed at analysis evasion, performs sandbox detection, and downloads + executes a second-stage script that abuses the Instagram API for mass fake-account registration. Not a credential stealer in the traditional sense - the payload is a RAT-grade dropper for a social-media-abuse operation, flagged by kam193/bad-packages. Classified malicious-package, severity medium (confirmed drop-and-exec, but target of abuse is Instagram, not the installer host)
  • Operator continuity check: today has three confirmed operator continuations - Baileys/libsignal lure operator family (yesterdays @bellaxchuu/ + @xayz + my-baileys + @kxafunc/xbails 16-package cluster → todays @fer2809fl/baileys+cloud-baileys+arsya-baileys+10-package `asepxyz cluster, same Baileys/libsignal-node brand-impersonation naming), **Tailwind typosquat operator** (yesterdays tailwindcss-ui-extensions+tailwindcss-effects-kit → todays tailwind-animatecss-uniform+tailwind-animatecss-form), and **galicia-toolkit dep-confusion operator** (yesterdays plain @galicia-toolkit/* 4-package Cluster G scope → todays @galicia-toolkit-nestjs/ + @galicia-toolkit-nestjs-20/ + @galicia-toolkit-nestjs-20-lite/ + @galicia-toolkit-cheques-nc/ 11-package expansion - BUT with a crucial payload change: yesterday was CWE-506 boilerplate with no runtime detail, today the s4yhii operator ships a native ELF+PE credential-stealing addon with daemonized persistence). The xwise8887 operator (yesterdays wave-2 wie888r+testrrrd+xblaxw+@wxwxtest/testrrrdd → 185.158.107.175:8787/_ah/dc), the Wix dep-confusion operator (yesterdays wix-reg-poc-bypass+css-overscroll-contain with K8s SA-token theft), the nfjbill operator (yesterdays pxnpm@7.0.0 npm proxy weaponization), and the @dransay/* + @bitwardne/* operators are quiet today. The TensorLake AI maintainer compromise (2026-10-08 carve-out) has not had a wave-2 republish on tensorlake@0.5.145+

What to do

  1. 1For Cluster A (s4yhii native-binary credential-stealer, 16 npm packages): grep lockfiles for the 16 package names (@galicia-toolkit-nestjs/{archetype,paas,swagger,commons}, @galicia-toolkit-nestjs-20/{paas,commons,archetype}, @galicia-toolkit-nestjs-20-lite/{paas,commons}, @galicia-toolkit-cheques-nc/front, @brick-v2/{table,icons,core,form,tour,brand}) at any version. On hit, assume the host executed a prebuilt ELF (Linux) or PE (Windows) credential-stealing addon that forked+setsid-daemonised and exfiltrated AWS, GitHub, npm, Azure DevOps, and GitHub Actions tokens to oob.s4yhii.com/native. Treat the installer host as fully compromised: rotate every token the binary could have read from the environment (AWS access/secret/session, GitHub PAT + fine-grained tokens + Actions tokens, npm auth tokens, Azure DevOps SYSTEM_ACCESSTOKEN); check ps/systemd/launch agents for a daemonized metrics/anonymous process still running after the shell exits; audit for the hostname/uid/cwd leak-time disclosure in network logs. Add oob.s4yhii.com apex and all subdomains + the HTTP POST /native request-line pattern to CI/build-host egress denylists. If your org publishes @galicia-toolkit*, @brick-v2, or similar internal scopes, scope-lock the internal registry and hold the public slugs with placeholder packages
  2. 2For Cluster B (@tunstock/remact-dom@19.2.0 react-dom typosquat): grep lockfiles for @tunstock/remact-dom at 19.2.0 or any version. On hit, the postinstall script scripts/setup.js already fired an HTTPS GET to tele.metry.orgin.net/api/v1/events leaking hostname, OS platform+arch, Node version, public IP, cwd, and the consuming projects name+version - treat the installer host as positively enumerated by the operator. Rotate build-environment credentials, add tele.metry.orgin.net and the lookalike morroncr0w.io to the CI/build-host egress denylist, and audit for any legitimate consumer who intended to install react-dom but typo-ed into @tunstock/remact-dom (the packages own metadata lies and claims to be react-dom@19.2.0, which can hide the typosquat on cursory npm ls). Teach the correct spelling: the real package is unscoped react-dom, not @tunstock/remact-dom
  3. 3For Cluster C (Baileys/libsignal lure continuation): grep lockfiles for @fer2809fl/baileys, cloud-baileys, arsya-baileys, asepxyz-baileys, asepxyz-signal, razamodsxasepxyz, asepxyz, asepxyz12, asepxyzz, asepxyznew, asepxyz-eslint-config, asepxyzxrazamodsnew-baileys, @aseppxyzz12/baileys. On hit, treat as a Baileys/WhatsApp-automation lure and apply the same remediation as yesterdays @bellaxchuu/ cluster: uninstall, delete node_modules, delete the lockfile, rebuild from a scope-locked internal registry. The GHSA bodies are CWE-506 boilerplate so no specific IOC has been published for this cluster yet, but the operator profile continues yesterdays @bellaxchuu/@kxafunc fingerprint - add the @fer2809fl, arsya, `asepxyz, and razamods*` namespaces to the internal denylist
  4. 4For Cluster D (crates.io sharpnes Telegram+Chrome infostealer): grep Cargo.lock and Cargo.toml for sharpnes at 0.1.0 or 0.1.1. On hit: assume Telegram Desktop session theft on Windows (tdata_backup.zip upload via Telegram Bot API sendDocument) and Chrome extension-data theft on all platforms (reading Chrome/Default/Local Extension Settings - this is where MetaMask, Phantom, Keplr, Rabby, and other browser wallet extensions keep their vaults, so crypto-wallet keystore theft is in scope). Treat affected hosts as fully compromised: sign out of Telegram Desktop on every device under the account to invalidate the stolen session, migrate every browser-wallet seed phrase to a new wallet on a clean host before the attacker can drain, rotate any browser-extension-stored API keys, and block outbound traffic to api.telegram.org from untrusted CI/build hosts. The crates.io publisher crows7781-glitch and the GitHub upstream crows7781-glitch/shortneer should be added to internal denylists
  5. 5*For Cluster E (`kmf-, test-account-portal-fe, @myorder-frontend-commons/analytics dep-confusion)**: grep lockfiles for kmf-bootstrap, kmf-i18n, kmf-vendor-pack, test-account-portal-fe, and @myorder-frontend-commons/analytics at any version. On kmf-vendor-pack@99.0.0 hit specifically, the postinstall already fired an HTTPS GET to db4fe7a2e2lvaraia8k0n4amgw4ir83az.oast.pro with hostname + username in the query string - rotate those credentials. Add .oast.pro apex to the CI/build-host egress denylist (prior denylists cover .oast.fun + .oast.site; today adds the third of the OAST canary apex trio). For the OpenSSF-flagged kmf- siblings and the test-account-portal-fe + @myorder-frontend-commons/analytics` entries, no specific IOC was published - but the OpenSSF Package Analysis "communicates with malicious-activity domain" verdict means a network beacon fired at install time, so treat the installer host as recon-enumerated at minimum
  6. 6*For Cluster F (`@tvg-mar/ dep-confusion)**: grep lockfiles for @tvg-mar/storyblok-bridge, @tvg-mar/tvg-promos-atomic-ui, @tvg-mar/utils, @tvg-mar/promos-context, @tvg-mar/promos-gtm. On hit, uninstall. No specific IOC published (CWE-506 boilerplate). If your org publishes a marketing/promotions dev-tooling monorepo under @tvg-mar/*`, scope-lock the internal registry and hold the public slugs with placeholders
  7. 7For Cluster G (2 Tailwind typosquats): grep lockfiles for tailwind-animatecss-uniform and tailwind-animatecss-form. On hit, uninstall. Teach the correct spelling: the real packages are tailwindcss-animatecss and tailwindcss-animated (unscoped, with tailwindcss- prefix not tailwind- prefix). No specific IOC in the GHSA body
  8. 8For Cluster H (standalones: pino-testkit, hanncap, pahinuy): grep lockfiles for all three. On hit, uninstall. For pino-testkit, teach that the real pino logger ecosystem does not publish a pino-testkit package (closest legitimate names are pino-std-serializers, pino-pretty, pino-abstract-transport). No specific IOC published
  9. 9For Cluster I (pypi ig-gox@1.0.0): grep requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, conda env, setup.py for ig-gox at 1.0.0. On hit: assume the obfuscated loader fired on import, performed sandbox detection, and attempted to download a second-stage script for Instagram-API abuse. The target of harm is Instagrams service rather than the installer host, but the installer still ran arbitrary attacker-controlled Python code and should be treated as compromised. No specific second-stage IOC published in the GHSA body - monitor outbound traffic from the installer host to Instagrams API endpoints and to any unexpected code-hosting providers (gist, pastebin, raw-GitHub)
  10. 10NEW outbound denylist entries for CI/build-host egress proxies today: oob.s4yhii.com apex and all subdomains (Cluster A s4yhii native-binary operator) + the HTTP POST /native HTTP/1.0 request-line pattern, tele.metry.orgin.net + morroncr0w.io (Cluster B @tunstock/remact-dom recon beacon), api.telegram.org for untrusted CI/build hosts (Cluster D sharpnes Telegram Bot API exfil), *.oast.pro apex (Cluster E kmf-vendor-pack OAST). Keep prior egress blocks in place: 185.158.107.175:8787 (xwise8887), *.oast.fun + *.oast.site apex (reaperhackbot256f + @dransay), *.oastify.com, appsecc.com, webhook.site/43022177-de67-4d5c-a6df-33083b2b026f + dxpoc.gt.tc apex (Wix dep-confusion wave 2), nfjbill.ren apex (pxnpm/yakuza0), storage.googleapis.com/depenconf/ + ltidi.storage.googleapis.com, 10.0.19.0/24 + 10.0.49.0/24 (internallib_v<N> reverse-shells), api.nm-streetwear.space, discord.com/api/webhooks + Discord webhook URL pattern, ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools, Ethereum mainnet + Sepolia + Arbitrum Sepolia RPC endpoints, chinazhangsan.ccwu.cc, api.npoint.io, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, Polygon RPC, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil patterns, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com publisher email domain, and the 45.138.0.0/16 RubyGems wgkit CIDRs

References

Back to feedSubmit a correction
multi-2026-10-10-ghsa-malware-sweep