# GitHub Advisory malware sweep - 2026-10-11 (new `webreader` + `pafer` PyPI two-package pickle-execution RAT with disclosed `frjmzbjbhwvtdnsuodmu.supabase.co` + `api.npoint.io/40e32d283a9d97e59252/a` C2 and `.pth` persistence, where the main package hides the pickle and the mandatory dependency unpickles it; new `agentaix` PyPI 3-package first-publish RAT cluster (`agentaix`, `agent-vx`, `media-manager5`) with autorun persistence beaconing `googleforum.pythonanywhere.com`; and standalone `@library-wide/library-shell@99.9.1` npm dep-confusion sentinel flagged by OpenSSF Package Analysis for malicious-domain egress)

> GHSA 2026-10-11: 6 fresh malware advisories (1 npm, 5 pypi) in 3 clusters. Headline: **new `webreader`+`pafer` PyPI pickle-execution RAT** - lure ships a pickle "config", its mandatory `pafer` dep unpickles it (RCE), drops a `.pth` autoloader, pulls stage 2 from a Supabase bucket via `api.npoint.io`. Plus a 3-package `agentaix` RAT cluster beaconing `googleforum.pythonanywhere.com`.

- Published: 2026-10-11
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 6 packages, 8 compromised versions
- Tags: infostealer, credential-theft, obfuscation, dependency-confusion
- Also known as: 2026-10-11 GHSA sweep, 2026-10-webreader pickle-execution campaign, 2026-10-agentaix PyPI RAT cluster, webreader + pafer PyPI pickle RAT, @library-wide/library-shell npm dep-confusion sentinel
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, kam193/bad-packages, PyPI security, npm security
- Incident ID: multi-2026-10-11-ghsa-malware-sweep

## Affected packages (6)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@library-wide/library-shell](https://dependencywatch.io/package/npm/@library-wide/library-shell) | npm | 99.9.1 |
| [agent-vx](https://dependencywatch.io/package/pypi/agent-vx) | PyPI | 0.1.0 |
| [agentaix](https://dependencywatch.io/package/pypi/agentaix) | PyPI | 0.1.0, 0.2.0 |
| [media-manager5](https://dependencywatch.io/package/pypi/media-manager5) | PyPI | 0.1.0 |
| [pafer](https://dependencywatch.io/package/pypi/pafer) | PyPI | 0.9.7, 0.9.8 |
| [webreader](https://dependencywatch.io/package/pypi/webreader) | PyPI | 2.3.8 |

## What happened

Between 2026-10-10 11:00 UTC (the end of yesterday`s sweep window) and 2026-10-10 11:42 UTC (the OSSF `malicious-packages` final commit of the UTC day), the GitHub Advisory Database and OpenSSF `malicious-packages` published **6 fresh malware advisories across 3 clusters** - 1 npm and 5 pypi. There are no fresh advisories dated 2026-10-11 at the time of this ingest; the OSSF ingest pipeline`s last commit of record is `1861f95` at `2026-10-10T11:42:58Z`, so today`s ingest window covers the half-hour tail of 2026-10-10 that fell outside yesterday`s sweep.

## Cluster A - PyPI `webreader` + `pafer` pickle-execution RAT (two-package campaign)

| Package | Versions | GHSA | OSV |
|---|---|---|---|
| `webreader` | 2.3.8 | GHSA-82r3-2956-8fx5 | MAL-2026-17757 |
| `pafer` | 0.9.7, 0.9.8 | GHSA-5hwh-vp87-mgmx | MAL-2026-17756 |

**Campaign tag**: `2026-10-webreader`.

**Mechanics (as described in both OSV records verbatim)**: *"In this campaign, the main package (webreader) has an embeded pickle disguised as a config. A related dependency (pafer) contains code to load the pickle. During unpickling, malicious code embeded in the pickle file is automatically executed. It then establishes persistence via a PTH file and downloads the next stage payload. It finally acts like a RAT, allowing remote exfiltration and code execution."*

**Technical read-out**:
- The lure (`webreader`) carries a pickle file in its tarball, framed as a configuration artefact so a casual code review doesn`t flag it.
- The pickle is never deserialised by `webreader` itself - the lure`s own setup.py and module code stay clean. Instead `webreader` declares `pafer` as a mandatory dependency, and `pafer`'s module code is what calls `pickle.load()` on the file.
- A hostile pickle can run arbitrary code during deserialisation via `__reduce__` (or any dunder returning a callable + args tuple). The moment the first `import webreader` happens, the `pafer` loader fires and the payload runs with the installer`s Python-process privileges.
- The payload installs a `.pth` autoloader into `site-packages`. `.pth` files are read on every interpreter start and lines starting with `import` are executed, so this gives persistence across every subsequent Python process on the host without touching user-level cron/systemd/startup entries.
- The payload then reaches out to `https://api.npoint.io/40e32d283a9d97e59252/a` (`npoint.io` is a legitimate throwaway JSON-document host - attackers use it to serve mutable configuration documents without needing their own infra) and downloads a second-stage from `frjmzbjbhwvtdnsuodmu.supabase.co` (an attacker-controlled Supabase bucket).
- End state: remote-access-trojan behaviour with remote command execution and file exfiltration.

**IOCs (verbatim from each OSV record`s `database_specific.iocs`)**:
- domain: `frjmzbjbhwvtdnsuodmu.supabase.co`
- url: `https://api.npoint.io/40e32d283a9d97e59252/a`

Classify `malicious-package`, severity `high` (confirmed RCE-grade pickle execution + .pth persistence + second-stage drop + file exfil + two concrete IOCs; the two-package lure/loader split is the signature).

## Cluster B - PyPI 3-package `agentaix` first-publish RAT cluster

| Package | Versions | GHSA | OSV |
|---|---|---|---|
| `agentaix` | 0.1.0, 0.2.0 | GHSA-7w8h-6mv7-cwm8 | MAL-2026-17752 |
| `agent-vx` | 0.1.0 | GHSA-qqmp-mxcj-44p3 | MAL-2026-17755 |
| `media-manager5` | 0.1.0 | GHSA-hq9p-535j-wcf7 | MAL-2026-17753 |

**Campaign tag**: `2026-10-agentaix`.

**Mechanics (verbatim)**: *"The package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine."*

**Reasons listed on each record**: `files-exfiltration`, `persistence-autorun`, "The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine", `rat`, `persistence`.

**IOC (verbatim, same domain on all three records)**:
- domain: `googleforum.pythonanywhere.com`

The three records share the campaign tag `2026-10-agentaix` AND the single C2 domain, which confirms single-operator continuity across the three packages. The naming is thematic (`agent*` + `media-manager5`) and does not try to typosquat a specific legitimate upstream, so this is a first-publish lure rather than a typosquat.

Classify `malicious-package`, severity `high` (persistent RAT with disclosed autorun persistence and shared C2; a carve-out would stand on its own at `high`, but is grouped here because the three records are small and have no public vendor write-up beyond the kam193/bad-packages behavioural tags).

## Cluster C - npm `@library-wide/library-shell@99.9.1` dep-confusion sentinel

`@library-wide/library-shell@99.9.1` (GHSA-4vw4-9hf5-5fx8, OSV MAL-2026-17754). Flagged by **OpenSSF Package Analysis** with the single verdict *"The package communicates with a domain associated with malicious activity."* No specific beacon domain, hash, or payload is in the public record. The scope-plus-slug naming (`@library-wide/library-shell`) and the `99.9.1` sentinel version are the dep-confusion-probe fingerprint.

Classify `dependency-confusion`, severity `medium` (OpenSSF-verified install-time beacon, no further payload analysis published).

## Registry state

All 6 packages are registry-quarantined at time of writing. Active operator-side infrastructure named today:

- `frjmzbjbhwvtdnsuodmu.supabase.co` - Cluster A (webreader/pafer second-stage download)
- `api.npoint.io/40e32d283a9d97e59252/a` - Cluster A (webreader/pafer config-document relay; `api.npoint.io` apex is reused by multiple earlier campaigns)
- `googleforum.pythonanywhere.com` - Cluster B (agentaix operator C2)

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `kam193/bad-packages`, `PyPI security`, `npm security`. Per-package IOC details drawn from each OSV MAL record`s `database_specific.iocs` block.

## Impact

- **Cluster A - PyPI `webreader` + `pafer` two-package pickle-execution RAT (malicious-package, confirmed pickle `__reduce__` RCE + `.pth` autoload persistence + second-stage download + file exfil + remote command execution, two IOCs disclosed)**: `webreader@2.3.8` (GHSA-82r3-2956-8fx5, OSV MAL-2026-17757) ships an embedded pickle file disguised as a `config` artefact. `pafer@0.9.7`/`@0.9.8` (GHSA-5hwh-vp87-mgmx, OSV MAL-2026-17756), declared as a mandatory dependency of `webreader`, contains the code path that opens and `pickle.load()`s that file. Deserialisation of a hostile pickle executes arbitrary code via `__reduce__` (or any dunder returning a callable+args tuple) with no second-stage request needed, so the moment `webreader` is `import`-ed the `pafer` loader fires and the pickle runs. The payload then: (1) writes a `.pth` file into `site-packages` so that it auto-executes on **every** subsequent Python interpreter start (classic abuse of `.pth` auto-import, flagged `abuses-pth` by the campaign tag `2026-10-webreader`), (2) retrieves a configuration document from the `jsonkeeper`-style URL `https://api.npoint.io/40e32d283a9d97e59252/a` (same `api.npoint.io` C2 pattern reused by multiple earlier campaigns on this feed), (3) downloads a next-stage payload from `frjmzbjbhwvtdnsuodmu.supabase.co` (a Supabase-hosted attacker bucket), and (4) ends up acting as a RAT with remote command execution and file exfiltration. OSSF `malicious-packages` lists both IOCs explicitly in each record`s `database_specific.iocs`. The two-package split (lure + dependency doing the dirty work) is the campaign`s signature - it makes the lure`s own setup.py look clean and defers the sketchy `pickle.load()` into a sibling dependency. Classified `malicious-package`, severity `high` (confirmed RCE-grade pickle execution + persistence + 2nd-stage drop + file exfil, two concrete IOCs)
- **Cluster B - PyPI 3-package `agentaix` first-publish RAT cluster (`agentaix`, `agent-vx`, `media-manager5`) (malicious-package, confirmed autorun persistence + remote command execution + file exfil + RAT; shared campaign tag `2026-10-agentaix`; one C2 domain disclosed)**: `agentaix@0.1.0`/`@0.2.0` (GHSA-7w8h-6mv7-cwm8, OSV MAL-2026-17752), `agent-vx@0.1.0` (GHSA-qqmp-mxcj-44p3, OSV MAL-2026-17755), and `media-manager5@0.1.0` (GHSA-hq9p-535j-wcf7, OSV MAL-2026-17753) are three first-publish lures. Each installs a persistent job (`persistence-autorun`) that gives the attacker file exfiltration and remote command execution on the installer host. The three records share the campaign tag `2026-10-agentaix` and the same C2 IOC domain `googleforum.pythonanywhere.com` (a free `pythonanywhere.com` subdomain impersonating a Google-support-forum origin) - this confirms the three are one operator. The naming is thematic (`agent*` + `media-manager5`) but none of the three impersonates a specific legitimate upstream, so this is first-publish lures rather than typosquats. All three quarantined. Classified `malicious-package`, severity `high` (confirmed persistent RAT with disclosed C2 - this would stand on its own at `high` as a carve-out, but is grouped into today`s sweep because the three records are tiny and have no vendor write-up beyond the kam193/bad-packages behavioural tags)
- **Cluster C - npm `@library-wide/library-shell@99.9.1` dep-confusion sentinel (dependency-confusion, OpenSSF Package Analysis flagged "communicates with a domain associated with malicious activity", no specific C2 disclosed)**: `@library-wide/library-shell@99.9.1` (GHSA-4vw4-9hf5-5fx8, OSV MAL-2026-17754) is a classic `99.x` dep-confusion sentinel published under a scope (`@library-wide`) chosen to look like an umbrella internal-registry namespace. OpenSSF Package Analysis flagged it as malicious with the single verdict "communicates with a domain associated with malicious activity" - a network beacon fired at install/sandbox time, exact domain not disclosed in the public record. No second-stage payload has been published. Classified `dependency-confusion`, severity `medium` (OpenSSF-verified install-time beacon but no further payload analysis)
- **Operator continuity check**: today`s material does NOT continue yesterday`s big operators - **no new `s4yhii` native-binary dep-confusion packages** (`oob.s4yhii.com` is quiet so far), **no new `@galicia-toolkit-nestjs*` or `@brick-v2` publishes**, **no new `@tunstock/remact-dom` typosquats**, **no new `cloud-baileys`/`arsya-baileys`/`asepxyz*` Baileys-lure packages**, **no new `@tvg-mar/*` dep-confusion**, **no new `tailwind-animatecss-*` typosquats**, **no new `sharpnes` crates.io infostealer** (`crows7781-glitch` is quiet), and **no new `ig-gox` Instagram-abuse drops**. The TensorLake AI maintainer compromise (2026-10-08 [carve-out](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise)) is still at `tensorlake@0.5.145` with no new wave. The `xwise8887`, Wix dep-confusion, `nfjbill`/`yakuza0`, `@dransay/*`, `@bitwardne/*`, and `reaperhackbot256f` operators are quiet. **One infrastructure reuse signal**: Cluster A`s `api.npoint.io/40e32d283a9d97e59252/a` is a fresh `api.npoint.io` sink but the apex `api.npoint.io` has been reused by multiple prior PyPI/npm campaigns on this feed as a configuration-document relay - keep `api.npoint.io` on the standing egress denylist

## What to do

1. **For Cluster A (webreader + pafer PyPI pickle-execution RAT)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`, `conda env`, `setup.py`, `pdm.lock`, and `uv.lock` for `webreader` (any version - only `2.3.8` is in the GHSA affected list but future republishes should be assumed hostile until a maintainer statement lands) and for `pafer` at `0.9.7` or `0.9.8`. **On any hit, assume the pickle has already executed in the project`s Python runtime - this is pickle `__reduce__` RCE, not an opt-in `postinstall` script, so a bare `pip install` + any `import webreader` has already dropped the `.pth` autoloader and run arbitrary attacker-controlled Python.** Treat the installer host as fully compromised: (1) `grep -r` the Python environment`s `site-packages` for all `.pth` files added or modified recently and remove any attacker-authored one (a `.pth` file that does more than a bare directory addition - any `import `, `exec`, or `__import__` call - is the autoloader), (2) revoke every credential the Python process could reach from the environment or disk (AWS keys, GitHub tokens, cloud SDK caches, SSH keys, browser-wallet keystores if present), (3) add `frjmzbjbhwvtdnsuodmu.supabase.co` (exact subdomain) and `api.npoint.io/40e32d283a9d97e59252/a` (exact URL) to the CI/build-host egress denylist, keep the apex `api.npoint.io` on the standing denylist (prior waves reuse it), (4) teach the correct spelling: the real packages a user might have meant are `webreaders` (plural) or `web-reader` for the "web reader" idea and `pafer` has no legitimate upstream (it exists only to pretend to be `webreader`'s pickle unpacker). If an internal CI host built with these packages, rotate every credential that ever touched that host
2. **For Cluster B (agentaix, agent-vx, media-manager5 first-publish RAT)**: grep every Python manifest for `agentaix` (`0.1.0` or `0.2.0`), `agent-vx` (`0.1.0`), and `media-manager5` (`0.1.0`). On hit, treat as a confirmed RAT with autorun persistence - the GHSA bodies state file exfiltration, remote command execution, and persistence as the installed behaviour. Add `googleforum.pythonanywhere.com` to the CI/build-host egress denylist (the `pythonanywhere.com` apex is a legitimate PaaS - do not blanket-block the apex because real projects use it, but a specific `googleforum.*.pythonanywhere.com` subdomain can be blocked without collateral). Audit for leftover autorun entries: user-level `cron` and `systemd --user` units, `~/.config/autostart/` on Linux, `~/Library/LaunchAgents/` on macOS, `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and Scheduled Tasks on Windows, and any `.pth` autoloader in the Python environment (same `.pth` hunt as Cluster A). Rotate credentials reachable from the Python runtime
3. **For Cluster C (`@library-wide/library-shell@99.9.1` npm dep-confusion sentinel)**: grep lockfiles for `@library-wide/library-shell` at any version. On hit, OpenSSF Package Analysis has already recorded that the package phoned home at install time; the exact beacon domain is not in the public record, so treat the installer host as recon-enumerated at minimum. If your org publishes an internal registry under `@library-wide/*`, scope-lock the internal registry and hold the public slug with a placeholder package. The `99.9.1` version string is a classic dep-confusion sentinel - a public package pretending to be at an "always-newest" sentinel to beat your internal pin
4. **NEW outbound denylist entries for CI/build-host egress proxies today**: `frjmzbjbhwvtdnsuodmu.supabase.co` (exact subdomain - Cluster A `webreader`/`pafer` 2nd-stage download) + `api.npoint.io/40e32d283a9d97e59252/a` (exact URL - Cluster A config relay), `googleforum.pythonanywhere.com` (exact subdomain - Cluster B `agentaix` operator C2). Keep prior egress blocks in place: `api.npoint.io` apex (long-standing reuse by multiple PyPI/npm campaigns including today`s Cluster A), `oob.s4yhii.com` apex (yesterday`s s4yhii native-binary operator) + the HTTP `POST /native HTTP/1.0` request-line pattern, `tele.metry.orgin.net` + `morroncr0w.io` (yesterday`s `@tunstock/remact-dom` recon beacon), `api.telegram.org` for untrusted CI/build hosts (yesterday`s `sharpnes` Telegram-Desktop + Chrome-extension exfil), `*.oast.pro` + `*.oast.fun` + `*.oast.site` + `*.oastify.com` OAST apex set, `appsecc.com`, `webhook.site/43022177-de67-4d5c-a6df-33083b2b026f` + `dxpoc.gt.tc`, `nfjbill.ren`, `185.158.107.175:8787`, `storage.googleapis.com/depenconf/` + `ltidi.storage.googleapis.com`, `10.0.19.0/24` + `10.0.49.0/24` (internallib_v<N> reverse-shells), `api.nm-streetwear.space`, Discord webhook URL pattern, `ipify.org` + `ifconfig.me`, `gitflic.ru`, `api.wagmiwallet.org`, `backend-cybersecuritydashboard.onrender.com`, Monero mining pools, Ethereum + Sepolia + Arbitrum + Polygon RPC endpoints, `chinazhangsan.ccwu.cc`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `npm-canary.aveliscare.com`, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil patterns, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, `tuamaeaquelaursa.com` publisher-email domain, `45.138.0.0/16` RubyGems wgkit CIDRs

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-82r3-2956-8fx5 - pypi webreader (Cluster A - pickle disguised as config, pafer loader, .pth persistence, frjmzbjbhwvtdnsuodmu.supabase.co + api.npoint.io C2, MAL-2026-17757)](https://github.com/advisories/GHSA-82r3-2956-8fx5) - GitHub
- [GHSA-5hwh-vp87-mgmx - pypi pafer (Cluster A - mandatory dependency of webreader that calls pickle.load, MAL-2026-17756)](https://github.com/advisories/GHSA-5hwh-vp87-mgmx) - GitHub
- [OSSF malicious-packages MAL-2026-17757 raw record (webreader IOCs: frjmzbjbhwvtdnsuodmu.supabase.co + api.npoint.io/40e32d283a9d97e59252/a)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/webreader/MAL-2026-17757.json) - OpenSSF
- [OSSF malicious-packages MAL-2026-17756 raw record (pafer IOCs)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pafer/MAL-2026-17756.json) - OpenSSF
- [bad-packages.kam193.eu / pypi / webreader (upstream kam193 record)](https://bad-packages.kam193.eu/pypi/package/webreader) - kam193/bad-packages
- [bad-packages.kam193.eu / pypi / pafer (upstream kam193 record)](https://bad-packages.kam193.eu/pypi/package/pafer) - kam193/bad-packages
- [GHSA-7w8h-6mv7-cwm8 - pypi agentaix (Cluster B - persistent-job RAT, campaign 2026-10-agentaix, googleforum.pythonanywhere.com, MAL-2026-17752)](https://github.com/advisories/GHSA-7w8h-6mv7-cwm8) - GitHub
- [GHSA-qqmp-mxcj-44p3 - pypi agent-vx (Cluster B - same operator, same C2, MAL-2026-17755)](https://github.com/advisories/GHSA-qqmp-mxcj-44p3) - GitHub
- [GHSA-hq9p-535j-wcf7 - pypi media-manager5 (Cluster B - same operator, same C2, MAL-2026-17753)](https://github.com/advisories/GHSA-hq9p-535j-wcf7) - GitHub
- [OSSF malicious-packages MAL-2026-17752 raw record (agentaix IOC: googleforum.pythonanywhere.com)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/agentaix/MAL-2026-17752.json) - OpenSSF
- [OSSF malicious-packages MAL-2026-17755 raw record (agent-vx IOC)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/agent-vx/MAL-2026-17755.json) - OpenSSF
- [OSSF malicious-packages MAL-2026-17753 raw record (media-manager5 IOC)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/media-manager5/MAL-2026-17753.json) - OpenSSF
- [GHSA-4vw4-9hf5-5fx8 - npm @library-wide/library-shell (Cluster C - OpenSSF Package Analysis "communicates with malicious-activity domain", MAL-2026-17754)](https://github.com/advisories/GHSA-4vw4-9hf5-5fx8) - GitHub
- [OSSF malicious-packages MAL-2026-17754 raw record (@library-wide/library-shell flagged by OSSF Package Analysis)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/%40library-wide%2Flibrary-shell/MAL-2026-17754.json) - OpenSSF
- [DependencyWatch: multi-2026-10-10-ghsa-malware-sweep (prior-day context: s4yhii native-binary dep-confusion + sharpnes crates.io + remact-dom typosquat + Baileys lure wave 2)](https://dependencywatch.io/incident/multi-2026-10-10-ghsa-malware-sweep)
- [DependencyWatch: multi-2026-10-09-ghsa-malware-sweep (prior-day context: xwise8887 wave 2, @bellaxchuu Baileys lure, @galicia-toolkit boilerplate)](https://dependencywatch.io/incident/multi-2026-10-09-ghsa-malware-sweep)
- [DependencyWatch: npm-2026-10-08-tensorlake-maintainer-compromise (recent carve-out maintainer compromise)](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-11-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-11-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).