# GitHub Advisory malware sweep - 2026-10-10 (new `s4yhii` native-binary credential-stealer dep-confusion operator - 16 npm packages across `@galicia-toolkit-nestjs/*`, `@galicia-toolkit-nestjs-20/*`, `@galicia-toolkit-nestjs-20-lite/*`, `@galicia-toolkit-cheques-nc/*`, `@brick-v2/*` loading prebuilds/-/metrics.node ELF+PE that forks+setsid and exfils AWS/GitHub/npm/Azure DevOps/Actions tokens to oob.s4yhii.com/native; `@tunstock/remact-dom@19.2.0` react-dom typosquat with confirmed `tele.metry.orgin.net/api/v1/events` beacon; Baileys/libsignal lure continuation `@fer2809fl/baileys`+`cloud-baileys`+`arsya-baileys`+10-package `asepxyz*` cluster; crates.io `sharpnes` Telegram-Desktop + Chrome-extension/wallet infostealer (first cargo malware advisory this week); 3-package `kmf-*` + 2-package internal-frontend dep-confusion with oast.pro OAST; 5-package `@tvg-mar/*` dep-confusion probes; 2 Tailwind typosquats; plus pypi `ig-gox` Instagram abuse)

> GHSA 2026-10-10: ~48 fresh malware advisories across 10 clusters (46 npm, 1 pypi, 1 crates). Headline items: **new `s4yhii` operator native-binary credential-stealer dep-confusion cluster** (16 packages across `@galicia-toolkit-nestjs*` and `@brick-v2` scopes, prebuilds/metrics.node ELF+PE forks+setsid and exfils cloud/CI tokens to `oob.s4yhii.com/native`); first-seen **crates.io infostealer `sharpnes`** targeting Telegram Desktop sessions + Chrome extension/wallet data via Telegram Bot API; and **`@tunstock/remact-dom@19.2.0` react-dom typosquat** with confirmed install-time beacon to `tele.metry.orgin.net`.

- Published: 2026-10-10
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: crates.io, npm, PyPI
- Scope: 47 packages, 120 compromised versions
- Tags: typosquat, dependency-confusion, credential-theft, crypto-wallet-drain, infostealer, obfuscation
- Also known as: 2026-10-10 GHSA sweep, s4yhii native-binary credential-stealer operator, @galicia-toolkit-nestjs native ELF addon, @brick-v2 native ELF addon, @tunstock/remact-dom react-dom typosquat, cloud-baileys arsya-baileys asepxyz Baileys lure wave 2, sharpnes crates.io Telegram Chrome infostealer, kmf-* oast.pro dep-confusion
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193/bad-packages, npm security, crates.io security
- Incident ID: multi-2026-10-10-ghsa-malware-sweep

## Affected packages (47)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@aseppxyzz12/baileys](https://dependencywatch.io/package/npm/@aseppxyzz12/baileys) | npm | * |
| [@brick-v2/brand](https://dependencywatch.io/package/npm/@brick-v2/brand) | npm | 999.0.1, 999.0.2, 999.0.3 |
| [@brick-v2/core](https://dependencywatch.io/package/npm/@brick-v2/core) | npm | 999.0.1, 999.0.2 |
| [@brick-v2/form](https://dependencywatch.io/package/npm/@brick-v2/form) | npm | 999.0.1, 999.0.3 |
| [@brick-v2/icons](https://dependencywatch.io/package/npm/@brick-v2/icons) | npm | 999.0.1, 999.0.2, 999.0.3 |
| [@brick-v2/table](https://dependencywatch.io/package/npm/@brick-v2/table) | npm | 999.0.1, 999.0.2, 999.0.3 |
| [@brick-v2/tour](https://dependencywatch.io/package/npm/@brick-v2/tour) | npm | 999.0.1, 999.0.2, 999.0.3 |
| [@fer2809fl/baileys](https://dependencywatch.io/package/npm/@fer2809fl/baileys) | npm | 1.4.5, 1.4.6, 1.4.7, 1.4.9, 7.0.0-rc13, 7.0.0, 7.0.1, 7.0.2, 7.0.4, 7.0.5, 7.0.6, 7.0.7 |
| [@galicia-toolkit-cheques-nc/front](https://dependencywatch.io/package/npm/@galicia-toolkit-cheques-nc/front) | npm | 999.0.1, 999.0.2, 999.0.3 |
| [@galicia-toolkit-nestjs-20-lite/commons](https://dependencywatch.io/package/npm/@galicia-toolkit-nestjs-20-lite/commons) | npm | 999.0.1, 999.0.2, 999.0.3 |
| [@galicia-toolkit-nestjs-20-lite/paas](https://dependencywatch.io/package/npm/@galicia-toolkit-nestjs-20-lite/paas) | npm | 1.0.20, 1.0.21, 1.0.22, 1.0.24 |
| [@galicia-toolkit-nestjs-20/archetype](https://dependencywatch.io/package/npm/@galicia-toolkit-nestjs-20/archetype) | npm | 999.0.1, 999.0.2 |
| [@galicia-toolkit-nestjs-20/commons](https://dependencywatch.io/package/npm/@galicia-toolkit-nestjs-20/commons) | npm | 999.0.1, 999.0.2, 999.0.3 |
| [@galicia-toolkit-nestjs-20/paas](https://dependencywatch.io/package/npm/@galicia-toolkit-nestjs-20/paas) | npm | 3.0.3, 3.0.5, 3.0.6, 3.0.7, 999.0.1 |
| [@galicia-toolkit-nestjs/archetype](https://dependencywatch.io/package/npm/@galicia-toolkit-nestjs/archetype) | npm | 999.0.1, 999.0.5, 999.0.6 |
| [@galicia-toolkit-nestjs/commons](https://dependencywatch.io/package/npm/@galicia-toolkit-nestjs/commons) | npm | 999.0.1, 999.0.6, 999.0.7, 999.0.8, 3.0.1 |
| [@galicia-toolkit-nestjs/paas](https://dependencywatch.io/package/npm/@galicia-toolkit-nestjs/paas) | npm | 999.0.3, 999.0.4, 999.0.5, 999.0.6 |
| [@galicia-toolkit-nestjs/swagger](https://dependencywatch.io/package/npm/@galicia-toolkit-nestjs/swagger) | npm | 999.0.1, 999.0.2, 999.0.3 |
| [@myorder-frontend-commons/analytics](https://dependencywatch.io/package/npm/@myorder-frontend-commons/analytics) | npm | 3.0.0, 10.0.0, 99.0.0 |
| [@tunstock/remact-dom](https://dependencywatch.io/package/npm/@tunstock/remact-dom) | npm | 19.2.0 |
| [@tvg-mar/promos-context](https://dependencywatch.io/package/npm/@tvg-mar/promos-context) | npm | * |
| [@tvg-mar/promos-gtm](https://dependencywatch.io/package/npm/@tvg-mar/promos-gtm) | npm | * |
| [@tvg-mar/storyblok-bridge](https://dependencywatch.io/package/npm/@tvg-mar/storyblok-bridge) | npm | * |
| [@tvg-mar/tvg-promos-atomic-ui](https://dependencywatch.io/package/npm/@tvg-mar/tvg-promos-atomic-ui) | npm | * |
| [@tvg-mar/utils](https://dependencywatch.io/package/npm/@tvg-mar/utils) | npm | * |
| [arsya-baileys](https://dependencywatch.io/package/npm/arsya-baileys) | npm | 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4 |
| [asepxyz](https://dependencywatch.io/package/npm/asepxyz) | npm | * |
| [asepxyz-baileys](https://dependencywatch.io/package/npm/asepxyz-baileys) | npm | * |
| [asepxyz-eslint-config](https://dependencywatch.io/package/npm/asepxyz-eslint-config) | npm | * |
| [asepxyz-signal](https://dependencywatch.io/package/npm/asepxyz-signal) | npm | * |
| [asepxyz12](https://dependencywatch.io/package/npm/asepxyz12) | npm | * |
| [asepxyznew](https://dependencywatch.io/package/npm/asepxyznew) | npm | * |
| [asepxyzxrazamodsnew-baileys](https://dependencywatch.io/package/npm/asepxyzxrazamodsnew-baileys) | npm | * |
| [asepxyzz](https://dependencywatch.io/package/npm/asepxyzz) | npm | * |
| [cloud-baileys](https://dependencywatch.io/package/npm/cloud-baileys) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.33, 1.1.34, 1.1.35, 1.1.36, 1.1.37, 1.1.38, 1.1.39, 1.1.40, 1.1.41, 1.1.42 |
| [hanncap](https://dependencywatch.io/package/npm/hanncap) | npm | * |
| [ig-gox](https://dependencywatch.io/package/pypi/ig-gox) | PyPI | 1.0.0 |
| [kmf-bootstrap](https://dependencywatch.io/package/npm/kmf-bootstrap) | npm | 100.100.102, 100.100.103 |
| [kmf-i18n](https://dependencywatch.io/package/npm/kmf-i18n) | npm | 100.100.102 |
| [kmf-vendor-pack](https://dependencywatch.io/package/npm/kmf-vendor-pack) | npm | 99.0.0 |
| [pahinuy](https://dependencywatch.io/package/npm/pahinuy) | npm | * |
| [pino-testkit](https://dependencywatch.io/package/npm/pino-testkit) | npm | * |
| [razamodsxasepxyz](https://dependencywatch.io/package/npm/razamodsxasepxyz) | npm | * |
| [sharpnes](https://dependencywatch.io/package/crates/sharpnes) | crates.io | 0.1.0, 0.1.1 |
| [tailwind-animatecss-form](https://dependencywatch.io/package/npm/tailwind-animatecss-form) | npm | * |
| [tailwind-animatecss-uniform](https://dependencywatch.io/package/npm/tailwind-animatecss-uniform) | npm | * |
| [test-account-portal-fe](https://dependencywatch.io/package/npm/test-account-portal-fe) | npm | 100.100.102 |

## What happened

Between roughly 2026-10-09 11:00 UTC (end of yesterday`s sweep window) and 2026-10-10 11:00 UTC, the GitHub Advisory Database (via OpenSSF `malicious-packages`, Amazon Inspector`s IN-MAL feed, OpenSSF Package Analysis, and `kam193/bad-packages`) published ~48 fresh malware advisories: 46 npm, 1 pypi, 1 crates.

The sweep breaks into **9 clusters by operator profile and payload family**, plus a cross-cluster operator-continuity analysis. The most important new material is a **new native-binary credential-stealer dep-confusion operator** (nicknamed `s4yhii` after its exfil host `oob.s4yhii.com`) and the **first crates.io malware advisory of substance this week** (`sharpnes`, a cross-platform Rust infostealer).

## Cluster A - npm s4yhii native-binary credential-stealer dep-confusion (16 packages)

| Package | Versions | GHSA | OSV |
|---|---|---|---|
| `@galicia-toolkit-nestjs/archetype` | 999.0.1, 999.0.5, 999.0.6 | GHSA-76rm-2c8x-h676 | MAL-2026-17721 |
| `@galicia-toolkit-nestjs/paas` | 999.0.3, 999.0.4, 999.0.5, 999.0.6 | GHSA-xmvx-x823-fvm2 | MAL-2026-17723 |
| `@galicia-toolkit-nestjs/swagger` | 999.0.1, 999.0.2, 999.0.3 | GHSA-7hxg-fr5p-9hp5 | - |
| `@galicia-toolkit-nestjs/commons` | 999.0.1, 999.0.6, 999.0.7, 999.0.8, 3.0.1 | GHSA-j7v5-rrxc-7jrh | - |
| `@galicia-toolkit-nestjs-20/paas` | 3.0.3, 3.0.5, 3.0.6, 3.0.7, 999.0.1 | GHSA-mgg2-4cpg-5cfj | - |
| `@galicia-toolkit-nestjs-20/commons` | 999.0.1, 999.0.2, 999.0.3 | GHSA-hwv3-5v66-4cvw | - |
| `@galicia-toolkit-nestjs-20/archetype` | 999.0.1, 999.0.2 | GHSA-43v2-p79h-pjp9 | - |
| `@galicia-toolkit-nestjs-20-lite/paas` | 1.0.20, 1.0.21, 1.0.22, 1.0.24 | GHSA-p5pm-8q88-fj6v | - |
| `@galicia-toolkit-nestjs-20-lite/commons` | 999.0.1, 999.0.2, 999.0.3 | GHSA-pw25-gp8h-4cr2 | MAL-2026-17729 |
| `@galicia-toolkit-cheques-nc/front` | 999.0.1, 999.0.2, 999.0.3 | GHSA-xj56-89c6-596g | MAL-2026-17720 |
| `@brick-v2/table` | 999.0.1, 999.0.2, 999.0.3 | GHSA-rmgm-9vm2-v688 | MAL-2026-17718 |
| `@brick-v2/icons` | 999.0.1, 999.0.2, 999.0.3 | GHSA-gm38-f7q8-qc9p | - |
| `@brick-v2/core` | 999.0.1, 999.0.2 | GHSA-49xp-7x68-8hf4 | MAL-2026-17715 |
| `@brick-v2/form` | 999.0.1, 999.0.3 | GHSA-cxh8-f5qg-3jmp | - |
| `@brick-v2/tour` | 999.0.1, 999.0.2, 999.0.3 | GHSA-4w7c-9xc7-gwv7 | - |
| `@brick-v2/brand` | 999.0.1, 999.0.2, 999.0.3 | GHSA-62v9-prv8-q646 | - |

**Payload**: each package`s `preinstall` hook runs `node index.js || true` (or in some variants a module-load `require()` triggers it); `index.js` loads `prebuilds/<platform>-<arch>/metrics.node`, a prebuilt native addon with no shipped C/C++ source and no `binding.gyp`. The ELF (Linux) and PE (Windows) binaries - built as `metrics` with the entry symbol `do_report`, the decoy env var `_METRICS_PKG`, and a `src:native` JSON field - read AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, SYSTEM_ACCESSTOKEN (Azure DevOps), ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN, GITHUB_REPOSITORY, plus host identifiers (hostname, uid/pwuid, cwd, uname). The data is POSTed as JSON over a raw socket (manual `POST /native HTTP/1.0` request line) to `oob.s4yhii.com`. The binary then calls `fork()` + `setsid()` from libc and daemonises so the exfiltration process outlives the Node parent.

**Operator continuity**: the `@galicia-toolkit*` scope was first seen in yesterday`s Cluster G (plain `@galicia-toolkit/*` 4-package set, CWE-506 boilerplate, no runtime detail). Today`s expansion into `@galicia-toolkit-nestjs/*` + the `s4yhii` payload confirms the operator (or a close copy-cat) iterated and shipped a real credential stealer. The `@brick-v2` scope is new today.

**Classification**: `dependency-confusion` (999.x sentinel versions on scoped names that look like internal corporate NestJS/design-system monorepos). **Severity `high`** because the payload is a confirmed cloud+CI credential-stealing native binary with daemonized persistence, not just a beacon.

## Cluster B - `@tunstock/remact-dom@19.2.0` react-dom typosquat

`@tunstock/remact-dom@19.2.0` (GHSA-gjvr-3qjw-56fx, OSV MAL-2026-17745) is a one-character typosquat of `react-dom`, pinned to the real `react-dom@19.2.0` latest for maximum consumer-side confusion. The tarball`s `package.json` falsely identifies itself as `react-dom@19.2.0`, uses lookalike author/repository metadata (`github.com/m00r0ncr33w/act.git` + `morroncr0w.io`), and runs `scripts/setup.js` as `postinstall`. The script opens an `https.request` to `tele.metry.orgin.net/api/v1/events` carrying the hostname, OS platform+arch, Node version, public IP, cwd, and consuming project`s name+version. No second-stage payload is in the tarball; the GHSA assesses this as reconnaissance to support a follow-on supply-chain compromise.

Classify `typosquat`, severity `medium`.

## Cluster C - Baileys/libsignal lure continuation (13 packages)

- `@fer2809fl/baileys` 1.4.5, 1.4.6, 1.4.7, 1.4.9, 7.0.0-rc13, 7.0.0, 7.0.1, 7.0.2, 7.0.4, 7.0.5, 7.0.6, 7.0.7 (GHSA-wv7g-r3r9-ww8v)
- `cloud-baileys` 1.0.0-1.0.5, 1.1.0-1.1.3, 1.1.33-1.1.42 (GHSA-745p-g872-6x8c)
- `arsya-baileys` 9.2.0-9.2.4 (GHSA-pv3g-8jvf-qc7x)
- `asepxyz-baileys`, `asepxyz-signal`, `razamodsxasepxyz`, `asepxyz`, `asepxyz12`, `asepxyzz`, `asepxyznew`, `asepxyz-eslint-config`, `asepxyzxrazamodsnew-baileys`, `@aseppxyzz12/baileys` - all versions, 10 GHSAs (xv7g, 38rx, f3vq, qvwh, 3rxj, hmqh, m23r, rhjp, v95p, 4pw9)

All 13 packages continue yesterday`s `@bellaxchuu/*` Baileys/libsignal brand-impersonation campaign against the `@WhiskeySockets/Baileys` WhatsApp-automation library consumer base. The GHSA bodies are CWE-506 "fully compromised" boilerplate with no runtime IOC published.

Classify `malicious-package`, severity `medium`.

## Cluster D - crates.io `sharpnes` Telegram + Chrome infostealer

`sharpnes@0.1.0`/`0.1.1` (GHSA-qq2r-xp7w-5r55, OSV MAL-2026-17713, publisher `crows7781-glitch`).

The crate exports an async function `shortname()` which, on invocation, runs two parallel exfil chains:

- **`src/teleg.rs` (Windows only)**: collects the Telegram Desktop session directory `tdata`, zips it as `tdata_backup.zip`, and uploads via the Telegram Bot API `sendDocument` endpoint using a hardcoded bot token.
- **`src/data.rs` (Windows + Linux + macOS)**: reads the Chrome Default profile `Local Extension Settings` directory - where browser-wallet extensions (MetaMask, Phantom, Keplr, Rabby, etc.) keep their vaults, and where other extensions keep OAuth tokens and API keys - XOR-obfuscates path strings with key `0xAA`, zips in memory, and uploads via `teloxide` using a second hardcoded bot token.

In `0.1.0` the Chrome stealer code is present but unused; in `0.1.1` it is wired into `shortname()`. Upstream metadata on crates.io points to the GitHub repository `crows7781-glitch/shortneer`.

Classify `malicious-package`, severity `high` (confirmed cross-platform Telegram Desktop session theft + crypto-wallet-related Chrome extension data theft).

## Cluster E - `kmf-*` + internal-frontend dep-confusion with oast.pro OAST exfil (5 packages)

- `kmf-bootstrap@100.100.102`/`100.100.103` (GHSA-97h4-9p9c-qhp2, MAL-2026-17746) - OpenSSF Package Analysis flagged
- `kmf-i18n@100.100.102` (GHSA-c93g-xqm8-mjcg, MAL-2026-17747)
- `kmf-vendor-pack@99.0.0` (GHSA-575h-jpqc-p8h4, MAL-2026-17744) - **disclosed IOC**: `postinstall` runs `node -e` to GET `db4fe7a2e2lvaraia8k0n4amgw4ir83az.oast.pro` with hostname + username as query string
- `test-account-portal-fe@100.100.102` (GHSA-rh76-qjhp-v9m8)
- `@myorder-frontend-commons/analytics@3.0.0`/`10.0.0`/`99.0.0` (GHSA-rjqp-7c89-4x98, MAL-2026-17749)

The `100.100.102` sentinel version used by `kmf-*` + `test-account-portal-fe` is a new fingerprint, not the usual `99.x`/`999.x` seen elsewhere today. All five quarantined.

Classify `dependency-confusion`, severity `medium`.

## Cluster F - `@tvg-mar/*` dep-confusion probes (5 packages)

- `@tvg-mar/storyblok-bridge` (GHSA-3wxx-x983-53mg)
- `@tvg-mar/tvg-promos-atomic-ui` (GHSA-gj3c-r86r-hr43)
- `@tvg-mar/utils` (GHSA-p6w4-mmhj-wc4v)
- `@tvg-mar/promos-context` (GHSA-f42w-v662-25cr)
- `@tvg-mar/promos-gtm` (GHSA-8g69-976g-h44g)

All five all-versions, CWE-506 boilerplate takedowns, no IOC body published. Scoped names imply an internal registry at a marketing/promotions org (`tvg-mar` + Storyblok CMS + GTM + "promos" naming). Classify `dependency-confusion`, severity `medium`.

## Cluster G - Tailwind typosquats (2 packages)

- `tailwind-animatecss-uniform` all versions (GHSA-hxvr-77vv-6r85)
- `tailwind-animatecss-form` all versions (GHSA-pp69-57rc-3v49)

Typo of `tailwindcss-animatecss`/`tailwindcss-animated`. Continuation of yesterday`s `tailwindcss-ui-extensions`+`tailwindcss-effects-kit` Tailwind-typosquat operator. Classify `typosquat`, severity `medium`.

## Cluster H - npm standalones (3 packages)

- `pino-testkit` all versions (GHSA-9q39-547h-rfpc) - impersonates the `pino` logger ecosystem
- `hanncap` all versions (GHSA-jw9f-6xx8-mj3f)
- `pahinuy` all versions (GHSA-hcwg-cqc9-469q)

CWE-506 boilerplate takedowns, no runtime IOC. Classify `malicious-package`, severity `medium`.

## Cluster I - pypi `ig-gox` Instagram-abuse dropper

`ig-gox@1.0.0` (GHSA-rhpj-mr3r-r4gg, OSV MAL-2026-17712, campaign `2026-10-ig-gox`): the package hides obfuscated code aimed at analysis evasion, performs sandbox detection, and downloads a second-stage script that abuses Instagram`s API for mass fake-account registration. Flagged by `kam193/bad-packages`.

Classify `malicious-package`, severity `medium` (confirmed drop-and-exec, Instagram is the harm target, installer host still ran attacker-controlled Python).

## Registry state

All 48 packages in this sweep are registry-quarantined at time of writing. Active operator-side infrastructure named today:

- `oob.s4yhii.com/native` - Cluster A (s4yhii native-binary cloud+CI credential stealer, 16 packages, raw-socket `POST /native HTTP/1.0`)
- `tele.metry.orgin.net/api/v1/events` - Cluster B (`@tunstock/remact-dom` recon beacon)
- `api.telegram.org` with two hardcoded bot tokens - Cluster D (`sharpnes` Telegram + Chrome exfil)
- `db4fe7a2e2lvaraia8k0n4amgw4ir83az.oast.pro` - Cluster E (`kmf-vendor-pack` OAST canary)

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector`, `kam193/bad-packages`, `npm security`, `crates.io security`. Per-package IOC details drawn from GHSA advisory bodies, OSV MAL records, and npm/crates.io registry metadata between 2026-10-09 11:00 UTC and 2026-10-10 11:00 UTC.

## Impact

- **Cluster A - `s4yhii` native-binary credential-stealer dep-confusion operator: 16-package `@galicia-toolkit-nestjs/*` + `@galicia-toolkit-nestjs-20/*` + `@galicia-toolkit-nestjs-20-lite/*` + `@galicia-toolkit-cheques-nc/*` + `@brick-v2/*` cluster (dependency-confusion, confirmed credential exfil via prebuilt native ELF+PE addon, cross-platform fork+setsid daemonization, severity-elevating payload)**: a new operator published 16 npm packages on 2026-10-08 / 2026-10-09, all under scoped names that look like internal corporate monorepo registries (Chilean financial-cooperative Banco Galicia "galicia-toolkit-nestjs" dev-tooling monorepo + "brick-v2" design-system) with implausibly high sentinel versions (999.0.1-999.0.8 on most, plus `3.0.1`-`3.0.7` on NestJS commons/paas, and `1.0.20-1.0.24` on nestjs-20-lite/paas). Each package ships a `preinstall: node index.js || true` hook (and in some variants a module-load trigger via `require()`) that loads `prebuilds/<platform>-<arch>/metrics.node` - a prebuilt native addon with no shipped C/C++ source or `binding.gyp`. The ELF (Linux) and PE (Windows) binaries read AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, SYSTEM_ACCESSTOKEN (Azure DevOps), ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN, GITHUB_REPOSITORY, plus host identifiers (hostname, uid/pwuid, cwd, uname) and POST the JSON body via raw socket (request line `POST /native HTTP/1.0`) to `oob.s4yhii.com`. The binary calls `fork()` + `setsid()` from libc and daemonises so the exfiltration process outlives the Node parent. Function symbol in the binary is `do_report`, decoy env var `_METRICS_PKG`, JSON field `src:native`. OSV MAL-2026-17713..17729 range covers the cluster. All 16 packages quarantined. Classified `dependency-confusion`, severity `high` (confirmed cloud+CI credential exfil + daemonized persistence, not just a beacon)
- **Cluster B - `@tunstock/remact-dom@19.2.0` react-dom typosquat with install-time recon beacon (typosquat, confirmed `postinstall` HTTPS beacon to attacker-controlled lookalike domain)**: `@tunstock/remact-dom@19.2.0` (GHSA-gjvr-3qjw-56fx, OSV MAL-2026-17745) - a one-character typosquat of the real `react-dom` npm package, pinned to the real `react-dom` latest `19.2.0` for maximum consumer-side confusion. The tarball`s `package.json` falsely identifies itself as `react-dom@19.2.0`, uses lookalike author/repository metadata (`github.com/m00r0ncr33w/act.git` and `morroncr0w.io`), and runs a `postinstall` script `scripts/setup.js` that opens an `https.request` to `tele.metry.orgin.net/api/v1/events` carrying the hostname, OS platform+arch, Node version, public IP, cwd, and the consuming project`s name+version. The GHSA assesses this as reconnaissance intended to support a follow-on supply-chain compromise rather than an endpoint infostealer. Classified `typosquat`, severity `medium` (recon-only beacon disclosed, no second-stage drop in the shipped tarball)
- **Cluster C - Baileys/libsignal lure continuation (`@fer2809fl/baileys`, `cloud-baileys`, `arsya-baileys`, 10-package `asepxyz*` cluster, `@aseppxyzz12/baileys`) (malicious-package, continuation of yesterday's `@bellaxchuu/*` + `@xayz/libsignal-node` + `my-baileys` + `@kxafunc/xbails` 16-package cluster - CWE-506 boilerplate takedowns, no runtime payload analysis in GHSA bodies)**: today adds `@fer2809fl/baileys` (12 versions: 1.4.5, 1.4.6, 1.4.7, 1.4.9, 7.0.0-rc13, 7.0.0, 7.0.1, 7.0.2, 7.0.4, 7.0.5, 7.0.6, 7.0.7 - GHSA-wv7g-r3r9-ww8v), `cloud-baileys` (14 versions across 1.0.x and 1.1.x - GHSA-745p-g872-6x8c), `arsya-baileys` (9.2.0-9.2.4 - GHSA-pv3g-8jvf-qc7x), and a 10-package `asepxyz*`/`razamods`-themed cluster: `asepxyz-baileys` (GHSA-xv7g-p6pq-vg9q), `asepxyz-signal` (GHSA-38rx-c4rh-xc4p), `razamodsxasepxyz` (GHSA-f3vq-wx4x-jv6w), `asepxyz` (GHSA-qvwh-x99q-h49x), `asepxyz12` (GHSA-3rxj-r3x6-3992), `asepxyzz` (GHSA-hmqh-m5mj-f7mm), `asepxyznew` (GHSA-m23r-8cxr-4gw3), `asepxyz-eslint-config` (GHSA-rhjp-rpj7-8x4q), `asepxyzxrazamodsnew-baileys` (GHSA-v95p-rhxh-mm8g), `@aseppxyzz12/baileys` (GHSA-4pw9-3c22-g559). The `-baileys`/`-signal` suffix on multiple names + the `razamods`/`asepxyz` scope reuse continues the Baileys ecosystem lure campaign started by yesterday`s `@bellaxchuu/*` cluster against the `@WhiskeySockets/Baileys` WhatsApp-automation library consumer base. All GHSAs are CWE-506 boilerplate ("fully compromised" wording) with no IOC detail. All 13 packages quarantined. Classified `malicious-package`, severity `medium` (operator continuity confirmed via scope-reuse fingerprint, runtime payload not yet published)
- **Cluster D - crates.io `sharpnes` Telegram-Desktop + Chrome-extension/wallet infostealer (malicious-package, first crates.io malware advisory in this week's window, confirmed cross-platform infostealer payload - severity-elevating in a cargo ecosystem that normally sees ~0 malicious-package takedowns per week)**: `sharpnes@0.1.0`/`0.1.1` (GHSA-qq2r-xp7w-5r55, OSV MAL-2026-17713, crates.io publisher `crows7781-glitch`). The crate exports an async function `shortname()` which, on invocation, runs: (1) on Windows, `src/teleg.rs` collects the Telegram Desktop session directory (`tdata`), zips it as `tdata_backup.zip`, and uploads via the Telegram Bot API `sendDocument` endpoint using a hardcoded bot token; and (2) on Windows+Linux+macOS, `src/data.rs` reads the Chrome Default profile `Local Extension Settings` directory (which stores extension data including crypto-wallet vaults for MetaMask, Phantom, Keplr, etc.), uses XOR-obfuscated strings (key `0xAA`) to hide path strings, zips in memory, and uploads via `teloxide` using a second hardcoded bot token. In `0.1.0` the Chrome stealer is present but unused; in `0.1.1` it is wired into the exported `shortname()`. Upstream metadata points to `crows7781-glitch/shortneer` on GitHub. Classified `malicious-package`, severity `high` (confirmed cross-platform Telegram Desktop session theft + crypto-wallet-related Chrome extension data theft, two separate hardcoded Telegram Bot tokens as collectors)
- **Cluster E - 3-package `kmf-*` + 2-package internal-frontend dep-confusion probes with oast.pro OAST exfil (dependency-confusion, confirmed `postinstall` beacon to OpenSSF-flagged canary domain + OpenSSF Package Analysis flagged "communicates with malicious-activity domain")**: `kmf-bootstrap@100.100.102`/`100.100.103` (GHSA-97h4-9p9c-qhp2, OSV MAL-2026-17746), `kmf-i18n@100.100.102` (GHSA-c93g-xqm8-mjcg, OSV MAL-2026-17747), `kmf-vendor-pack@99.0.0` (GHSA-575h-jpqc-p8h4, OSV MAL-2026-17744 - **the one with disclosed IOC**: `postinstall` runs `node -e` to GET `db4fe7a2e2lvaraia8k0n4amgw4ir83az.oast.pro` with hostname + username as query string, fires automatically on `npm install`), `test-account-portal-fe@100.100.102` (GHSA-rh76-qjhp-v9m8), and `@myorder-frontend-commons/analytics` at `3.0.0`/`10.0.0`/`99.0.0` (GHSA-rjqp-7c89-4x98, OSV MAL-2026-17749). The `100.100.102`-era sentinel version used by `kmf-*` + `test-account-portal-fe` is a new fingerprint (not the usual `99.x` or `999.x` seen elsewhere today). All five quarantined. Classified `dependency-confusion`, severity `medium`
- **Cluster F - 5-package `@tvg-mar/*` dep-confusion probe cluster (dependency-confusion, CWE-506 "fully compromised" boilerplate takedowns, no IOC body published)**: `@tvg-mar/storyblok-bridge` all versions (GHSA-3wxx-x983-53mg), `@tvg-mar/tvg-promos-atomic-ui` all versions (GHSA-gj3c-r86r-hr43), `@tvg-mar/utils` all versions (GHSA-p6w4-mmhj-wc4v), `@tvg-mar/promos-context` all versions (GHSA-f42w-v662-25cr), `@tvg-mar/promos-gtm` all versions (GHSA-8g69-976g-h44g). The scoped name + the Storyblok CMS "promos" and GTM naming imply an internal registry at a marketing/promotions org publishing under `@tvg-mar/*`. All five quarantined 2026-10-09. Classified `dependency-confusion`, severity `medium`
- **Cluster G - 2-package Tailwind-ecosystem typosquats (`tailwind-animatecss-uniform`, `tailwind-animatecss-form`) (typosquat, CWE-506 "fully compromised" boilerplate, no payload IOC)**: `tailwind-animatecss-uniform` all versions (GHSA-hxvr-77vv-6r85) and `tailwind-animatecss-form` all versions (GHSA-pp69-57rc-3v49) - both typosquats of the real `tailwindcss-animatecss` + `tailwindcss-animated` Tailwind-ecosystem adaptor packages. Continuation of yesterday`s `tailwindcss-ui-extensions`/`tailwindcss-effects-kit` Cluster H entries - same operator profile targeting Tailwind consumers. Classified `typosquat`, severity `medium`
- **Cluster H - 3 npm standalone CWE-506 boilerplate takedowns (`pino-testkit`, `hanncap`, `pahinuy`) (malicious-package, no published IOC)**: `pino-testkit` all versions (GHSA-9q39-547h-rfpc) - dev-tooling-themed first-publish lure impersonating the `pino` logger ecosystem; `hanncap` all versions (GHSA-jw9f-6xx8-mj3f) and `pahinuy` all versions (GHSA-hcwg-cqc9-469q) - standalone CWE-506 takedowns with no obvious legitimate upstream and no runtime IOC in the GHSA bodies. All three quarantined. Classified `malicious-package`, severity `medium`
- **Cluster I - pypi `ig-gox@1.0.0` Instagram-abuse second-stage dropper (malicious-package, confirmed obfuscated code + sandbox detection + remote-stage download for Instagram mass-fake-account-registration abuse)**: `ig-gox@1.0.0` (GHSA-rhpj-mr3r-r4gg, OSV MAL-2026-17712, campaign tag `2026-10-ig-gox`). The package hides obfuscated code aimed at analysis evasion, performs sandbox detection, and downloads + executes a second-stage script that abuses the Instagram API for mass fake-account registration. Not a credential stealer in the traditional sense - the payload is a RAT-grade dropper for a social-media-abuse operation, flagged by `kam193/bad-packages`. Classified `malicious-package`, severity `medium` (confirmed drop-and-exec, but target of abuse is Instagram, not the installer host)
- **Operator continuity check**: today has three confirmed operator continuations - **Baileys/libsignal lure operator family** (yesterday`s `@bellaxchuu/*` + `@xayz` + `my-baileys` + `@kxafunc/xbails` 16-package cluster → today`s `@fer2809fl/baileys`+`cloud-baileys`+`arsya-baileys`+10-package `asepxyz*` cluster, same Baileys/libsignal-node brand-impersonation naming), **Tailwind typosquat operator** (yesterday`s `tailwindcss-ui-extensions`+`tailwindcss-effects-kit` → today`s `tailwind-animatecss-uniform`+`tailwind-animatecss-form`), and **galicia-toolkit dep-confusion operator** (yesterday`s plain `@galicia-toolkit/*` 4-package Cluster G scope → today`s `@galicia-toolkit-nestjs/*` + `@galicia-toolkit-nestjs-20/*` + `@galicia-toolkit-nestjs-20-lite/*` + `@galicia-toolkit-cheques-nc/*` 11-package expansion - BUT with a crucial payload change: yesterday was CWE-506 boilerplate with no runtime detail, today the s4yhii operator ships a native ELF+PE credential-stealing addon with daemonized persistence). The `xwise8887` operator (yesterday`s wave-2 `wie888r`+`testrrrd`+`xblaxw`+`@wxwxtest/testrrrdd` → `185.158.107.175:8787/_ah/dc`), the Wix dep-confusion operator (yesterday`s `wix-reg-poc-bypass`+`css-overscroll-contain` with K8s SA-token theft), the `nfjbill` operator (yesterday`s `pxnpm@7.0.0` npm proxy weaponization), and the `@dransay/*` + `@bitwardne/*` operators are quiet today. The TensorLake AI maintainer compromise (2026-10-08 [carve-out](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise)) has not had a wave-2 republish on `tensorlake@0.5.145`+

## What to do

1. **For Cluster A (s4yhii native-binary credential-stealer, 16 npm packages)**: grep lockfiles for the 16 package names (`@galicia-toolkit-nestjs/{archetype,paas,swagger,commons}`, `@galicia-toolkit-nestjs-20/{paas,commons,archetype}`, `@galicia-toolkit-nestjs-20-lite/{paas,commons}`, `@galicia-toolkit-cheques-nc/front`, `@brick-v2/{table,icons,core,form,tour,brand}`) at any version. **On hit, assume the host executed a prebuilt ELF (Linux) or PE (Windows) credential-stealing addon that forked+setsid-daemonised and exfiltrated AWS, GitHub, npm, Azure DevOps, and GitHub Actions tokens to `oob.s4yhii.com/native`.** Treat the installer host as fully compromised: rotate every token the binary could have read from the environment (AWS access/secret/session, GitHub PAT + fine-grained tokens + Actions tokens, npm auth tokens, Azure DevOps SYSTEM_ACCESSTOKEN); check `ps`/`systemd`/launch agents for a daemonized `metrics`/anonymous process still running after the shell exits; audit for the hostname/uid/cwd leak-time disclosure in network logs. Add `oob.s4yhii.com` apex and all subdomains + the HTTP `POST /native` request-line pattern to CI/build-host egress denylists. If your org publishes `@galicia-toolkit*`, `@brick-v2`, or similar internal scopes, scope-lock the internal registry and hold the public slugs with placeholder packages
2. **For Cluster B (`@tunstock/remact-dom@19.2.0` react-dom typosquat)**: grep lockfiles for `@tunstock/remact-dom` at `19.2.0` or any version. On hit, the `postinstall` script `scripts/setup.js` already fired an HTTPS GET to `tele.metry.orgin.net/api/v1/events` leaking hostname, OS platform+arch, Node version, public IP, cwd, and the consuming project`s name+version - treat the installer host as positively enumerated by the operator. Rotate build-environment credentials, add `tele.metry.orgin.net` and the lookalike `morroncr0w.io` to the CI/build-host egress denylist, and audit for any legitimate consumer who intended to install `react-dom` but typo-ed into `@tunstock/remact-dom` (the package`s own metadata lies and claims to be `react-dom@19.2.0`, which can hide the typosquat on cursory `npm ls`). Teach the correct spelling: the real package is unscoped `react-dom`, not `@tunstock/remact-dom`
3. **For Cluster C (Baileys/libsignal lure continuation)**: grep lockfiles for `@fer2809fl/baileys`, `cloud-baileys`, `arsya-baileys`, `asepxyz-baileys`, `asepxyz-signal`, `razamodsxasepxyz`, `asepxyz`, `asepxyz12`, `asepxyzz`, `asepxyznew`, `asepxyz-eslint-config`, `asepxyzxrazamodsnew-baileys`, `@aseppxyzz12/baileys`. On hit, treat as a Baileys/WhatsApp-automation lure and apply the same remediation as yesterday`s `@bellaxchuu/*` cluster: uninstall, delete `node_modules`, delete the lockfile, rebuild from a scope-locked internal registry. The GHSA bodies are CWE-506 boilerplate so no specific IOC has been published for this cluster yet, but the operator profile continues yesterday`s `@bellaxchuu`/`@kxafunc` fingerprint - add the `@fer2809fl`, `arsya`, `asepxyz*`, and `razamods*` namespaces to the internal denylist
4. **For Cluster D (crates.io `sharpnes` Telegram+Chrome infostealer)**: grep `Cargo.lock` and `Cargo.toml` for `sharpnes` at `0.1.0` or `0.1.1`. On hit: **assume Telegram Desktop session theft on Windows** (`tdata_backup.zip` upload via Telegram Bot API `sendDocument`) and **Chrome extension-data theft on all platforms** (reading `Chrome/Default/Local Extension Settings` - this is where MetaMask, Phantom, Keplr, Rabby, and other browser wallet extensions keep their vaults, so **crypto-wallet keystore theft is in scope**). Treat affected hosts as fully compromised: sign out of Telegram Desktop on every device under the account to invalidate the stolen session, migrate every browser-wallet seed phrase to a new wallet on a clean host before the attacker can drain, rotate any browser-extension-stored API keys, and block outbound traffic to `api.telegram.org` from untrusted CI/build hosts. The crates.io publisher `crows7781-glitch` and the GitHub upstream `crows7781-glitch/shortneer` should be added to internal denylists
5. **For Cluster E (`kmf-*`, `test-account-portal-fe`, `@myorder-frontend-commons/analytics` dep-confusion)**: grep lockfiles for `kmf-bootstrap`, `kmf-i18n`, `kmf-vendor-pack`, `test-account-portal-fe`, and `@myorder-frontend-commons/analytics` at any version. On `kmf-vendor-pack@99.0.0` hit specifically, the `postinstall` already fired an HTTPS GET to `db4fe7a2e2lvaraia8k0n4amgw4ir83az.oast.pro` with hostname + username in the query string - rotate those credentials. Add `*.oast.pro` apex to the CI/build-host egress denylist (prior denylists cover `*.oast.fun` + `*.oast.site`; today adds the third of the OAST canary apex trio). For the OpenSSF-flagged `kmf-*` siblings and the `test-account-portal-fe` + `@myorder-frontend-commons/analytics` entries, no specific IOC was published - but the OpenSSF Package Analysis "communicates with malicious-activity domain" verdict means a network beacon fired at install time, so treat the installer host as recon-enumerated at minimum
6. **For Cluster F (`@tvg-mar/*` dep-confusion)**: grep lockfiles for `@tvg-mar/storyblok-bridge`, `@tvg-mar/tvg-promos-atomic-ui`, `@tvg-mar/utils`, `@tvg-mar/promos-context`, `@tvg-mar/promos-gtm`. On hit, uninstall. No specific IOC published (CWE-506 boilerplate). If your org publishes a marketing/promotions dev-tooling monorepo under `@tvg-mar/*`, scope-lock the internal registry and hold the public slugs with placeholders
7. **For Cluster G (2 Tailwind typosquats)**: grep lockfiles for `tailwind-animatecss-uniform` and `tailwind-animatecss-form`. On hit, uninstall. Teach the correct spelling: the real packages are `tailwindcss-animatecss` and `tailwindcss-animated` (unscoped, with `tailwindcss-` prefix not `tailwind-` prefix). No specific IOC in the GHSA body
8. **For Cluster H (standalones: `pino-testkit`, `hanncap`, `pahinuy`)**: grep lockfiles for all three. On hit, uninstall. For `pino-testkit`, teach that the real pino logger ecosystem does not publish a `pino-testkit` package (closest legitimate names are `pino-std-serializers`, `pino-pretty`, `pino-abstract-transport`). No specific IOC published
9. **For Cluster I (pypi `ig-gox@1.0.0`)**: grep `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`, `conda env`, `setup.py` for `ig-gox` at `1.0.0`. On hit: assume the obfuscated loader fired on import, performed sandbox detection, and attempted to download a second-stage script for Instagram-API abuse. The target of harm is Instagram`s service rather than the installer host, but the installer still ran arbitrary attacker-controlled Python code and should be treated as compromised. No specific second-stage IOC published in the GHSA body - monitor outbound traffic from the installer host to Instagram`s API endpoints and to any unexpected code-hosting providers (gist, pastebin, raw-GitHub)
10. **NEW outbound denylist entries for CI/build-host egress proxies today**: `oob.s4yhii.com` apex and all subdomains (Cluster A s4yhii native-binary operator) + the HTTP `POST /native HTTP/1.0` request-line pattern, `tele.metry.orgin.net` + `morroncr0w.io` (Cluster B `@tunstock/remact-dom` recon beacon), `api.telegram.org` for untrusted CI/build hosts (Cluster D `sharpnes` Telegram Bot API exfil), `*.oast.pro` apex (Cluster E `kmf-vendor-pack` OAST). Keep prior egress blocks in place: `185.158.107.175:8787` (xwise8887), `*.oast.fun` + `*.oast.site` apex (reaperhackbot256f + @dransay), `*.oastify.com`, `appsecc.com`, `webhook.site/43022177-de67-4d5c-a6df-33083b2b026f` + `dxpoc.gt.tc` apex (Wix dep-confusion wave 2), `nfjbill.ren` apex (pxnpm/yakuza0), `storage.googleapis.com/depenconf/` + `ltidi.storage.googleapis.com`, `10.0.19.0/24` + `10.0.49.0/24` (internallib_v<N> reverse-shells), `api.nm-streetwear.space`, `discord.com/api/webhooks` + Discord webhook URL pattern, `ipify.org` + `ifconfig.me`, `gitflic.ru`, `api.wagmiwallet.org`, `backend-cybersecuritydashboard.onrender.com`, Monero mining pools, Ethereum mainnet + Sepolia + Arbitrum Sepolia RPC endpoints, `chinazhangsan.ccwu.cc`, `api.npoint.io`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `npm-canary.aveliscare.com`, Polygon RPC, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil patterns, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, `tuamaeaquelaursa.com` publisher email domain, and the `45.138.0.0/16` RubyGems wgkit CIDRs

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-76rm-2c8x-h676 - npm @galicia-toolkit-nestjs/archetype (Cluster A - s4yhii native-binary credential stealer, oob.s4yhii.com)](https://github.com/advisories/GHSA-76rm-2c8x-h676) - GitHub
- [GHSA-xmvx-x823-fvm2 - npm @galicia-toolkit-nestjs/paas (Cluster A)](https://github.com/advisories/GHSA-xmvx-x823-fvm2) - GitHub
- [GHSA-7hxg-fr5p-9hp5 - npm @galicia-toolkit-nestjs/swagger (Cluster A)](https://github.com/advisories/GHSA-7hxg-fr5p-9hp5) - GitHub
- [GHSA-j7v5-rrxc-7jrh - npm @galicia-toolkit-nestjs/commons (Cluster A)](https://github.com/advisories/GHSA-j7v5-rrxc-7jrh) - GitHub
- [GHSA-mgg2-4cpg-5cfj - npm @galicia-toolkit-nestjs-20/paas (Cluster A)](https://github.com/advisories/GHSA-mgg2-4cpg-5cfj) - GitHub
- [GHSA-hwv3-5v66-4cvw - npm @galicia-toolkit-nestjs-20/commons (Cluster A)](https://github.com/advisories/GHSA-hwv3-5v66-4cvw) - GitHub
- [GHSA-43v2-p79h-pjp9 - npm @galicia-toolkit-nestjs-20/archetype (Cluster A)](https://github.com/advisories/GHSA-43v2-p79h-pjp9) - GitHub
- [GHSA-p5pm-8q88-fj6v - npm @galicia-toolkit-nestjs-20-lite/paas (Cluster A)](https://github.com/advisories/GHSA-p5pm-8q88-fj6v) - GitHub
- [GHSA-pw25-gp8h-4cr2 - npm @galicia-toolkit-nestjs-20-lite/commons (Cluster A - metrics.node ELF payload full IOC body)](https://github.com/advisories/GHSA-pw25-gp8h-4cr2) - GitHub
- [GHSA-xj56-89c6-596g - npm @galicia-toolkit-cheques-nc/front (Cluster A - preinstall + metrics.node + oob.s4yhii.com/native)](https://github.com/advisories/GHSA-xj56-89c6-596g) - GitHub
- [GHSA-rmgm-9vm2-v688 - npm @brick-v2/table (Cluster A - metrics.node ELF + raw socket POST /native HTTP/1.0)](https://github.com/advisories/GHSA-rmgm-9vm2-v688) - GitHub
- [GHSA-gm38-f7q8-qc9p - npm @brick-v2/icons (Cluster A)](https://github.com/advisories/GHSA-gm38-f7q8-qc9p) - GitHub
- [GHSA-49xp-7x68-8hf4 - npm @brick-v2/core (Cluster A - metrics.node fork+setsid daemon payload)](https://github.com/advisories/GHSA-49xp-7x68-8hf4) - GitHub
- [GHSA-cxh8-f5qg-3jmp - npm @brick-v2/form (Cluster A)](https://github.com/advisories/GHSA-cxh8-f5qg-3jmp) - GitHub
- [GHSA-4w7c-9xc7-gwv7 - npm @brick-v2/tour (Cluster A)](https://github.com/advisories/GHSA-4w7c-9xc7-gwv7) - GitHub
- [GHSA-62v9-prv8-q646 - npm @brick-v2/brand (Cluster A)](https://github.com/advisories/GHSA-62v9-prv8-q646) - GitHub
- [GHSA-gjvr-3qjw-56fx - npm @tunstock/remact-dom (Cluster B - react-dom typosquat, tele.metry.orgin.net recon beacon)](https://github.com/advisories/GHSA-gjvr-3qjw-56fx) - GitHub
- [GHSA-wv7g-r3r9-ww8v - npm @fer2809fl/baileys (Cluster C - Baileys lure continuation)](https://github.com/advisories/GHSA-wv7g-r3r9-ww8v) - GitHub
- [GHSA-745p-g872-6x8c - npm cloud-baileys (Cluster C)](https://github.com/advisories/GHSA-745p-g872-6x8c) - GitHub
- [GHSA-pv3g-8jvf-qc7x - npm arsya-baileys (Cluster C)](https://github.com/advisories/GHSA-pv3g-8jvf-qc7x) - GitHub
- [GHSA-xv7g-p6pq-vg9q - npm asepxyz-baileys (Cluster C - asepxyz cluster)](https://github.com/advisories/GHSA-xv7g-p6pq-vg9q) - GitHub
- [GHSA-38rx-c4rh-xc4p - npm asepxyz-signal (Cluster C)](https://github.com/advisories/GHSA-38rx-c4rh-xc4p) - GitHub
- [GHSA-qvwh-x99q-h49x - npm asepxyz (Cluster C)](https://github.com/advisories/GHSA-qvwh-x99q-h49x) - GitHub
- [GHSA-f3vq-wx4x-jv6w - npm razamodsxasepxyz (Cluster C)](https://github.com/advisories/GHSA-f3vq-wx4x-jv6w) - GitHub
- [GHSA-3rxj-r3x6-3992 - npm asepxyz12 (Cluster C)](https://github.com/advisories/GHSA-3rxj-r3x6-3992) - GitHub
- [GHSA-hmqh-m5mj-f7mm - npm asepxyzz (Cluster C)](https://github.com/advisories/GHSA-hmqh-m5mj-f7mm) - GitHub
- [GHSA-m23r-8cxr-4gw3 - npm asepxyznew (Cluster C)](https://github.com/advisories/GHSA-m23r-8cxr-4gw3) - GitHub
- [GHSA-rhjp-rpj7-8x4q - npm asepxyz-eslint-config (Cluster C)](https://github.com/advisories/GHSA-rhjp-rpj7-8x4q) - GitHub
- [GHSA-v95p-rhxh-mm8g - npm asepxyzxrazamodsnew-baileys (Cluster C)](https://github.com/advisories/GHSA-v95p-rhxh-mm8g) - GitHub
- [GHSA-4pw9-3c22-g559 - npm @aseppxyzz12/baileys (Cluster C)](https://github.com/advisories/GHSA-4pw9-3c22-g559) - GitHub
- [GHSA-qq2r-xp7w-5r55 - crates.io sharpnes (Cluster D - Rust Telegram+Chrome extension infostealer, MAL-2026-17713)](https://github.com/advisories/GHSA-qq2r-xp7w-5r55) - GitHub
- [GHSA-97h4-9p9c-qhp2 - npm kmf-bootstrap (Cluster E - OpenSSF-flagged, MAL-2026-17746)](https://github.com/advisories/GHSA-97h4-9p9c-qhp2) - GitHub
- [GHSA-c93g-xqm8-mjcg - npm kmf-i18n (Cluster E)](https://github.com/advisories/GHSA-c93g-xqm8-mjcg) - GitHub
- [GHSA-575h-jpqc-p8h4 - npm kmf-vendor-pack (Cluster E - disclosed IOC db4fe7a2e2lvaraia8k0n4amgw4ir83az.oast.pro)](https://github.com/advisories/GHSA-575h-jpqc-p8h4) - GitHub
- [GHSA-rh76-qjhp-v9m8 - npm test-account-portal-fe (Cluster E)](https://github.com/advisories/GHSA-rh76-qjhp-v9m8) - GitHub
- [GHSA-rjqp-7c89-4x98 - npm @myorder-frontend-commons/analytics (Cluster E)](https://github.com/advisories/GHSA-rjqp-7c89-4x98) - GitHub
- [GHSA-3wxx-x983-53mg - npm @tvg-mar/storyblok-bridge (Cluster F - dep-confusion probe cluster)](https://github.com/advisories/GHSA-3wxx-x983-53mg) - GitHub
- [GHSA-gj3c-r86r-hr43 - npm @tvg-mar/tvg-promos-atomic-ui (Cluster F)](https://github.com/advisories/GHSA-gj3c-r86r-hr43) - GitHub
- [GHSA-p6w4-mmhj-wc4v - npm @tvg-mar/utils (Cluster F)](https://github.com/advisories/GHSA-p6w4-mmhj-wc4v) - GitHub
- [GHSA-f42w-v662-25cr - npm @tvg-mar/promos-context (Cluster F)](https://github.com/advisories/GHSA-f42w-v662-25cr) - GitHub
- [GHSA-8g69-976g-h44g - npm @tvg-mar/promos-gtm (Cluster F)](https://github.com/advisories/GHSA-8g69-976g-h44g) - GitHub
- [GHSA-hxvr-77vv-6r85 - npm tailwind-animatecss-uniform (Cluster G - Tailwind typosquat continuation)](https://github.com/advisories/GHSA-hxvr-77vv-6r85) - GitHub
- [GHSA-pp69-57rc-3v49 - npm tailwind-animatecss-form (Cluster G)](https://github.com/advisories/GHSA-pp69-57rc-3v49) - GitHub
- [GHSA-9q39-547h-rfpc - npm pino-testkit (Cluster H)](https://github.com/advisories/GHSA-9q39-547h-rfpc) - GitHub
- [GHSA-jw9f-6xx8-mj3f - npm hanncap (Cluster H)](https://github.com/advisories/GHSA-jw9f-6xx8-mj3f) - GitHub
- [GHSA-hcwg-cqc9-469q - npm pahinuy (Cluster H)](https://github.com/advisories/GHSA-hcwg-cqc9-469q) - GitHub
- [GHSA-rhpj-mr3r-r4gg - pypi ig-gox (Cluster I - Instagram-abuse dropper, MAL-2026-17712, kam193/bad-packages)](https://github.com/advisories/GHSA-rhpj-mr3r-r4gg) - GitHub
- [DependencyWatch: multi-2026-10-09-ghsa-malware-sweep (prior-day context: xwise8887 wave 2, Wix dep-confusion wave 2, pxnpm, @bellaxchuu Baileys lure, @galicia-toolkit boilerplate)](https://dependencywatch.io/incident/multi-2026-10-09-ghsa-malware-sweep)
- [DependencyWatch: npm-2026-10-08-tensorlake-maintainer-compromise (recent carve-out maintainer compromise)](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-10-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-10-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).