DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
HighAdvisory sweepPublished 11 Oct 20266 packages · 8 versions

GitHub Advisory malware sweep - 2026-10-11 (new `webreader` + `pafer` PyPI two-package pickle-execution RAT with disclosed `frjmzbjbhwvtdnsuodmu.supabase.co` + `api.npoint.io/40e32d283a9d97e59252/a` C2 and `.pth` persistence, where the main package hides the pickle and the mandatory dependency unpickles it; new `agentaix` PyPI 3-package first-publish RAT cluster (`agentaix`, `agent-vx`, `media-manager5`) with autorun persistence beaconing `googleforum.pythonanywhere.com`; and standalone `@library-wide/library-shell@99.9.1` npm dep-confusion sentinel flagged by OpenSSF Package Analysis for malicious-domain egress)

Summary

GHSA 2026-10-11: 6 fresh malware advisories (1 npm, 5 pypi) in 3 clusters. Headline: new webreader+pafer PyPI pickle-execution RAT - lure ships a pickle "config", its mandatory pafer dep unpickles it (RCE), drops a .pth autoloader, pulls stage 2 from a Supabase bucket via api.npoint.io. Plus a 3-package agentaix RAT cluster beaconing googleforum.pythonanywhere.com.

infostealercredential-theftobfuscationdependency-confusion
Incident type
Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis · kam193/bad-packages · PyPI security · npm security
Also known as
2026-10-11 GHSA sweep · 2026-10-webreader pickle-execution campaign · 2026-10-agentaix PyPI RAT cluster · webreader + pafer PyPI pickle RAT · @library-wide/library-shell npm dep-confusion sentinel
Ecosystems
npmPyPI
Packages tracked
6

What happened

Between 2026-10-10 11:00 UTC (the end of yesterdays sweep window) and 2026-10-10 11:42 UTC (the OSSF malicious-packages final commit of the UTC day), the GitHub Advisory Database and OpenSSF malicious-packages published **6 fresh malware advisories across 3 clusters** - 1 npm and 5 pypi. There are no fresh advisories dated 2026-10-11 at the time of this ingest; the OSSF ingest pipelines last commit of record is 1861f95 at 2026-10-10T11:42:58Z, so todays ingest window covers the half-hour tail of 2026-10-10 that fell outside yesterdays sweep.

Cluster A - PyPI webreader + pafer pickle-execution RAT (two-package campaign)

PackageVersionsGHSAOSV
webreader2.3.8GHSA-82r3-2956-8fx5MAL-2026-17757
pafer0.9.7, 0.9.8GHSA-5hwh-vp87-mgmxMAL-2026-17756

Campaign tag: 2026-10-webreader.

Mechanics (as described in both OSV records verbatim): "In this campaign, the main package (webreader) has an embeded pickle disguised as a config. A related dependency (pafer) contains code to load the pickle. During unpickling, malicious code embeded in the pickle file is automatically executed. It then establishes persistence via a PTH file and downloads the next stage payload. It finally acts like a RAT, allowing remote exfiltration and code execution."

Technical read-out:

  • The lure (webreader) carries a pickle file in its tarball, framed as a configuration artefact so a casual code review doesn`t flag it.
  • The pickle is never deserialised by webreader itself - the lures own setup.py and module code stay clean. Instead webreader declares pafer as a mandatory dependency, and pafer's module code is what calls pickle.load()` on the file.
  • A hostile pickle can run arbitrary code during deserialisation via __reduce__ (or any dunder returning a callable + args tuple). The moment the first import webreader happens, the pafer loader fires and the payload runs with the installer`s Python-process privileges.
  • The payload installs a .pth autoloader into site-packages. .pth files are read on every interpreter start and lines starting with import are executed, so this gives persistence across every subsequent Python process on the host without touching user-level cron/systemd/startup entries.
  • The payload then reaches out to https://api.npoint.io/40e32d283a9d97e59252/a (npoint.io is a legitimate throwaway JSON-document host - attackers use it to serve mutable configuration documents without needing their own infra) and downloads a second-stage from frjmzbjbhwvtdnsuodmu.supabase.co (an attacker-controlled Supabase bucket).
  • End state: remote-access-trojan behaviour with remote command execution and file exfiltration.

IOCs (verbatim from each OSV records database_specific.iocs`):

  • domain: frjmzbjbhwvtdnsuodmu.supabase.co
  • url: https://api.npoint.io/40e32d283a9d97e59252/a

Classify malicious-package, severity high (confirmed RCE-grade pickle execution + .pth persistence + second-stage drop + file exfil + two concrete IOCs; the two-package lure/loader split is the signature).

Cluster B - PyPI 3-package agentaix first-publish RAT cluster

PackageVersionsGHSAOSV
agentaix0.1.0, 0.2.0GHSA-7w8h-6mv7-cwm8MAL-2026-17752
agent-vx0.1.0GHSA-qqmp-mxcj-44p3MAL-2026-17755
media-manager50.1.0GHSA-hq9p-535j-wcf7MAL-2026-17753

Campaign tag: 2026-10-agentaix.

Mechanics (verbatim): "The package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine."

Reasons listed on each record: files-exfiltration, persistence-autorun, "The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine", rat, persistence.

IOC (verbatim, same domain on all three records):

  • domain: googleforum.pythonanywhere.com

The three records share the campaign tag 2026-10-agentaix AND the single C2 domain, which confirms single-operator continuity across the three packages. The naming is thematic (agent* + media-manager5) and does not try to typosquat a specific legitimate upstream, so this is a first-publish lure rather than a typosquat.

Classify malicious-package, severity high (persistent RAT with disclosed autorun persistence and shared C2; a carve-out would stand on its own at high, but is grouped here because the three records are small and have no public vendor write-up beyond the kam193/bad-packages behavioural tags).

Cluster C - npm @library-wide/library-shell@99.9.1 dep-confusion sentinel

@library-wide/library-shell@99.9.1 (GHSA-4vw4-9hf5-5fx8, OSV MAL-2026-17754). Flagged by OpenSSF Package Analysis with the single verdict "The package communicates with a domain associated with malicious activity." No specific beacon domain, hash, or payload is in the public record. The scope-plus-slug naming (@library-wide/library-shell) and the 99.9.1 sentinel version are the dep-confusion-probe fingerprint.

Classify dependency-confusion, severity medium (OpenSSF-verified install-time beacon, no further payload analysis published).

Registry state

All 6 packages are registry-quarantined at time of writing. Active operator-side infrastructure named today:

  • frjmzbjbhwvtdnsuodmu.supabase.co - Cluster A (webreader/pafer second-stage download)
  • api.npoint.io/40e32d283a9d97e59252/a - Cluster A (webreader/pafer config-document relay; api.npoint.io apex is reused by multiple earlier campaigns)
  • googleforum.pythonanywhere.com - Cluster B (agentaix operator C2)

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, kam193/bad-packages, PyPI security, npm security. Per-package IOC details drawn from each OSV MAL records database_specific.iocs` block.

Affected packages (6)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.jsonCheck requirements.txt

Impact

  • Cluster A - PyPI webreader + pafer two-package pickle-execution RAT (malicious-package, confirmed pickle __reduce__ RCE + .pth autoload persistence + second-stage download + file exfil + remote command execution, two IOCs disclosed): webreader@2.3.8 (GHSA-82r3-2956-8fx5, OSV MAL-2026-17757) ships an embedded pickle file disguised as a config artefact. pafer@0.9.7/@0.9.8 (GHSA-5hwh-vp87-mgmx, OSV MAL-2026-17756), declared as a mandatory dependency of webreader, contains the code path that opens and pickle.load()s that file. Deserialisation of a hostile pickle executes arbitrary code via __reduce__ (or any dunder returning a callable+args tuple) with no second-stage request needed, so the moment webreader is import-ed the pafer loader fires and the pickle runs. The payload then: (1) writes a .pth file into site-packages so that it auto-executes on every subsequent Python interpreter start (classic abuse of .pth auto-import, flagged abuses-pth by the campaign tag 2026-10-webreader), (2) retrieves a configuration document from the jsonkeeper-style URL https://api.npoint.io/40e32d283a9d97e59252/a (same api.npoint.io C2 pattern reused by multiple earlier campaigns on this feed), (3) downloads a next-stage payload from frjmzbjbhwvtdnsuodmu.supabase.co (a Supabase-hosted attacker bucket), and (4) ends up acting as a RAT with remote command execution and file exfiltration. OSSF malicious-packages lists both IOCs explicitly in each records database_specific.iocs. The two-package split (lure + dependency doing the dirty work) is the campaigns signature - it makes the lures own setup.py look clean and defers the sketchy pickle.load() into a sibling dependency. Classified malicious-package, severity high` (confirmed RCE-grade pickle execution + persistence + 2nd-stage drop + file exfil, two concrete IOCs)
  • Cluster B - PyPI 3-package agentaix first-publish RAT cluster (agentaix, agent-vx, media-manager5) (malicious-package, confirmed autorun persistence + remote command execution + file exfil + RAT; shared campaign tag 2026-10-agentaix; one C2 domain disclosed): agentaix@0.1.0/@0.2.0 (GHSA-7w8h-6mv7-cwm8, OSV MAL-2026-17752), agent-vx@0.1.0 (GHSA-qqmp-mxcj-44p3, OSV MAL-2026-17755), and media-manager5@0.1.0 (GHSA-hq9p-535j-wcf7, OSV MAL-2026-17753) are three first-publish lures. Each installs a persistent job (persistence-autorun) that gives the attacker file exfiltration and remote command execution on the installer host. The three records share the campaign tag 2026-10-agentaix and the same C2 IOC domain googleforum.pythonanywhere.com (a free pythonanywhere.com subdomain impersonating a Google-support-forum origin) - this confirms the three are one operator. The naming is thematic (agent* + media-manager5) but none of the three impersonates a specific legitimate upstream, so this is first-publish lures rather than typosquats. All three quarantined. Classified malicious-package, severity high (confirmed persistent RAT with disclosed C2 - this would stand on its own at high as a carve-out, but is grouped into today`s sweep because the three records are tiny and have no vendor write-up beyond the kam193/bad-packages behavioural tags)
  • Cluster C - npm @library-wide/library-shell@99.9.1 dep-confusion sentinel (dependency-confusion, OpenSSF Package Analysis flagged "communicates with a domain associated with malicious activity", no specific C2 disclosed): @library-wide/library-shell@99.9.1 (GHSA-4vw4-9hf5-5fx8, OSV MAL-2026-17754) is a classic 99.x dep-confusion sentinel published under a scope (@library-wide) chosen to look like an umbrella internal-registry namespace. OpenSSF Package Analysis flagged it as malicious with the single verdict "communicates with a domain associated with malicious activity" - a network beacon fired at install/sandbox time, exact domain not disclosed in the public record. No second-stage payload has been published. Classified dependency-confusion, severity medium (OpenSSF-verified install-time beacon but no further payload analysis)
  • Operator continuity check: todays material does NOT continue yesterdays big operators - no new s4yhii native-binary dep-confusion packages (oob.s4yhii.com is quiet so far), *no new `@galicia-toolkit-nestjs or @brick-v2 publishes**, **no new @tunstock/remact-dom typosquats**, **no new cloud-baileys/arsya-baileys/asepxyz` Baileys-lure packages, no new `@tvg-mar/ dep-confusion**, **no new tailwind-animatecss-` typosquats, no new sharpnes crates.io infostealer (crows7781-glitch is quiet), and no new ig-gox Instagram-abuse drops. The TensorLake AI maintainer compromise (2026-10-08 carve-out) is still at tensorlake@0.5.145 with no new wave. The xwise8887, Wix dep-confusion, nfjbill/yakuza0, `@dransay/, @bitwardne/, and reaperhackbot256f` operators are quiet. One infrastructure reuse signal*: Cluster As api.npoint.io/40e32d283a9d97e59252/a is a fresh api.npoint.io sink but the apex api.npoint.io has been reused by multiple prior PyPI/npm campaigns on this feed as a configuration-document relay - keep api.npoint.io` on the standing egress denylist

What to do

  1. 1For Cluster A (webreader + pafer PyPI pickle-execution RAT): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, conda env, setup.py, pdm.lock, and uv.lock for webreader (any version - only 2.3.8 is in the GHSA affected list but future republishes should be assumed hostile until a maintainer statement lands) and for pafer at 0.9.7 or 0.9.8. On any hit, assume the pickle has already executed in the projects Python runtime - this is pickle __reduce__ RCE, not an opt-in postinstall script, so a bare pip install + any import webreader has already dropped the .pth` autoloader and run arbitrary attacker-controlled Python. Treat the installer host as fully compromised: (1) grep -r the Python environments site-packages for all .pth files added or modified recently and remove any attacker-authored one (a .pth file that does more than a bare directory addition - any import , exec, or __import__ call - is the autoloader), (2) revoke every credential the Python process could reach from the environment or disk (AWS keys, GitHub tokens, cloud SDK caches, SSH keys, browser-wallet keystores if present), (3) add frjmzbjbhwvtdnsuodmu.supabase.co (exact subdomain) and api.npoint.io/40e32d283a9d97e59252/a (exact URL) to the CI/build-host egress denylist, keep the apex api.npoint.io on the standing denylist (prior waves reuse it), (4) teach the correct spelling: the real packages a user might have meant are webreaders (plural) or web-reader for the "web reader" idea and pafer has no legitimate upstream (it exists only to pretend to be webreader`'s pickle unpacker). If an internal CI host built with these packages, rotate every credential that ever touched that host
  2. 2For Cluster B (agentaix, agent-vx, media-manager5 first-publish RAT): grep every Python manifest for agentaix (0.1.0 or 0.2.0), agent-vx (0.1.0), and media-manager5 (0.1.0). On hit, treat as a confirmed RAT with autorun persistence - the GHSA bodies state file exfiltration, remote command execution, and persistence as the installed behaviour. Add googleforum.pythonanywhere.com to the CI/build-host egress denylist (the pythonanywhere.com apex is a legitimate PaaS - do not blanket-block the apex because real projects use it, but a specific googleforum.*.pythonanywhere.com subdomain can be blocked without collateral). Audit for leftover autorun entries: user-level cron and systemd --user units, ~/.config/autostart/ on Linux, ~/Library/LaunchAgents/ on macOS, HKCU\Software\Microsoft\Windows\CurrentVersion\Run and Scheduled Tasks on Windows, and any .pth autoloader in the Python environment (same .pth hunt as Cluster A). Rotate credentials reachable from the Python runtime
  3. 3For Cluster C (@library-wide/library-shell@99.9.1 npm dep-confusion sentinel): grep lockfiles for @library-wide/library-shell at any version. On hit, OpenSSF Package Analysis has already recorded that the package phoned home at install time; the exact beacon domain is not in the public record, so treat the installer host as recon-enumerated at minimum. If your org publishes an internal registry under @library-wide/*, scope-lock the internal registry and hold the public slug with a placeholder package. The 99.9.1 version string is a classic dep-confusion sentinel - a public package pretending to be at an "always-newest" sentinel to beat your internal pin
  4. 4NEW outbound denylist entries for CI/build-host egress proxies today: frjmzbjbhwvtdnsuodmu.supabase.co (exact subdomain - Cluster A webreader/pafer 2nd-stage download) + api.npoint.io/40e32d283a9d97e59252/a (exact URL - Cluster A config relay), googleforum.pythonanywhere.com (exact subdomain - Cluster B agentaix operator C2). Keep prior egress blocks in place: api.npoint.io apex (long-standing reuse by multiple PyPI/npm campaigns including todays Cluster A), oob.s4yhii.com apex (yesterdays s4yhii native-binary operator) + the HTTP POST /native HTTP/1.0 request-line pattern, tele.metry.orgin.net + morroncr0w.io (yesterdays @tunstock/remact-dom recon beacon), api.telegram.org for untrusted CI/build hosts (yesterdays sharpnes Telegram-Desktop + Chrome-extension exfil), *.oast.pro + *.oast.fun + *.oast.site + *.oastify.com OAST apex set, appsecc.com, webhook.site/43022177-de67-4d5c-a6df-33083b2b026f + dxpoc.gt.tc, nfjbill.ren, 185.158.107.175:8787, storage.googleapis.com/depenconf/ + ltidi.storage.googleapis.com, 10.0.19.0/24 + 10.0.49.0/24 (internallib_v<N> reverse-shells), api.nm-streetwear.space, Discord webhook URL pattern, ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools, Ethereum + Sepolia + Arbitrum + Polygon RPC endpoints, chinazhangsan.ccwu.cc, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil patterns, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com publisher-email domain, 45.138.0.0/16 RubyGems wgkit CIDRs

References

Back to feedSubmit a correction
multi-2026-10-11-ghsa-malware-sweep