GitHub Advisory malware sweep - 2026-10-12 (**s4yhii operator wave 3**: 8 npm packages across `@s4yhiitestpoc/*` + `@coopeuch/*` Coopeuch-brand dep-confusion all beaconing `collector.oob.s4yhii.com/_npm-poc/beacon`; **`185.158.107.175:8787/_ah/dc` operator wave 2**: 6 npm `beacon.cjs`-pattern recon packages (`nitro-cjs-requirer`, `nitro-bundled-dep`, `nested-lib`, `cloudflare_module`, `another-very-long-name`, `some-very-long-package-name`); **`64.181.165.115/dc` native-addon operator**: 4 npm packages with HTTP/1.0 raw-socket beacons (`ksp-app`, `ksp-client-registry`, `pay-methods-kmf`, `deposit-limit-fe`); `liferay-workspace-scripts` bundled-dep from `ltidi.storage.googleapis.com/depenconf/`; `react-dropzone-v4`/`react-paginate-v5`/`kmf-vendor-pack`/`exodus-firestore-synchronize` dep-confusion probes; `hardhat-option@2.0.1` npm `hardhat-promised`-family stealer; `css-nesting-transform@1.0.0` Wix-brand `webhook.site` recon; PyPI `ig-gox` (`goxtools.shop` encrypted-loader) + `py2ops` trojaned-REPL. Big RubyGems wgkit wave-2 crypto cluster split out to its own carve-out.)

What happened

Between 2026-10-10 11:42 UTC (yesterdays sweep cutoff) and 2026-10-12 06:11 UTC (todays ingest-window start), the GitHub Advisory Database and OpenSSF malicious-packages published ~50 fresh malware advisories. The 24 RubyGems wgkit wave-2 crypto gems were split into their own carve-out, and the standalone hridoy-ultimate Facebook credential stealer into its own carve-out. The remaining 24 advisories across npm + PyPI are summarised in six operator clusters above.

Infrastructure signals

• collector.oob.s4yhii.com/_npm-poc/beacon (Cluster A) - operator continuity signal: the s4yhii operator is now in wave 3, having pivoted from the native-addon oob.s4yhii.com:9999/native payload to postinstall JS targeting the @coopeuch scope (Chilean credit cooperative).
• 185.158.107.175:8787/_ah/dc (Cluster B) - operator wave 2 of the already-tracked beacon.cjs dep-confusion operator; 6 new slugs under the same C2.
• 64.181.165.115/dc (Cluster C) - new operator; HTTP/1.0 raw-socket beacon from a prebuilt Linux x64 ELF addon; 4 slugs; pay-methods-kmf additionally beacons oast.me.
• ltidi.storage.googleapis.com/depenconf/ (Cluster D, liferay-workspace-scripts) - standing-denylist reuse; same storage bucket on storage.googleapis.com/depenconf/ as previous dep-confusion campaigns.
• 167.88.172.33:8087/api/log (Cluster E, hardhat-option) - hardhat-promised family continuation; copy of pino with a 4.5 MB lib/config.js carrying BrowserLDB / Discord-token / wallet-storage stealer modules.
• goxtools.shop (Cluster F, ig-gox) - operator continuity of the previously-tracked Instagram-abuse operator.

Classification

sweep. Severity high taken as a whole, driven by hardhat-option (confirmed infostealer with known stealer-module names and a working C2) and the s4yhii wave-3 organisational-targeting signal (Coopeuch brand impersonation). Individual clusters, taken alone, would be medium (install-time recon beacons without second-stage payload analysis).

Discovery

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector (IN-MAL feed), InvisiRisk, Inc. (kmf-vendor-pack 21-second-after-publish flag), npm security.

Affected packages (27)

Impact

• Cluster A - npm s4yhii operator wave 3 (malicious-package, dep-confusion variant; 8 packages across two scopes all beaconing collector.oob.s4yhii.com/_npm-poc/beacon): three @s4yhiitestpoc/* self-labeled test-POC packages - @s4yhiitestpoc/r3-https@1.0.0 (GHSA-m7mp-74j7-2w45, MAL-2026-17765), @s4yhiitestpoc/r2-https@1.0.0 (GHSA-r3vq-5g6w-hwmm, MAL-2026-17764), @s4yhiitestpoc/scan-https-d@1.0.0 (GHSA-845p-jq49-x946, MAL-2026-17766) - and five @coopeuch/* dep-confusion packages impersonating the Chilean credit cooperative Coopeuch: @coopeuch/common@1.999.999 (GHSA-pcjv-x9w3-wc2g, MAL-2026-17760), @coopeuch/button@1.999.999 (GHSA-gwpw-pvv6-cxg3, MAL-2026-17759), @coopeuch/core@1.999.999 (GHSA-pxq4-wc36-p967, MAL-2026-17763), @coopeuch/components@1.999.999 (GHSA-p3q5-2wv6-qx57, MAL-2026-17761), @coopeuch/config@1.999.999 (GHSA-m89q-pg4c-ffx9, MAL-2026-17762). Every record uses the SAME postinstall JS pattern: a postinstall.js sends host, user, network, DNS, container, and CI metadata as JSON to https://collector.oob.s4yhii.com/_npm-poc/beacon, PLUS a secondary DNS-exfil beacon to a labeled subdomain under *.oob.s4yhii.com. This is the same s4yhii operator as the 2026-10-09/10 native-binary waves (prior waves used oob.s4yhii.com:9999/native with a prebuilt metrics.node native addon); wave 3 drops the native addon in favour of plain postinstall JS and spreads across a legitimate-sounding dep-confusion scope (@coopeuch). Severity medium for the cluster taken alone (install-time recon beacon, no second-stage payload disclosed), BUT the Coopeuch scope impersonation is high-value organisational targeting - if your organisation ships internal @coopeuch/* packages, treat this as evidence of an active dep-confusion attempt against Coopeuch`s internal registry
• Cluster B - npm 185.158.107.175:8787/_ah/dc dep-confusion family (malicious-package; 6 packages, same beacon.cjs code pattern): nitro-bundled-dep (99.0.1, 2.0.1, 1.1.0; GHSA-j6mc-gqc2-j75h, MAL-2026-17774), nitro-cjs-requirer (0.0.1, 1.0.0, 1.1.0, 2.0.0, 3.0.0, 99.0.1; GHSA-hp5p-fc9h-wfg5, MAL-2026-17775), nested-lib (1.0.0, 1.0.1, 1.1.0; GHSA-vhwg-xx2q-m28q, MAL-2026-17773), cloudflare_module (1.0.0, 1.0.1, 3.0.0, 99.0.1; GHSA-9p5g-9jf3-6739, MAL-2026-17768 - typosquats Cloudflare branding), another-very-long-name (1.0.1, 1.1.0, 2.0.0, 2.0.1; GHSA-9w99-w8fq-2x8w, MAL-2026-17767), some-very-long-package-name (1.0.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1; GHSA-rf49-p2c5-fh8p, MAL-2026-17778). Every package ships the SAME beacon.cjs code pattern: a fire() function collects hostname + __dirname + process.cwd() + process.version + package name and POSTs JSON to http://185.158.107.175:8787/_ah/dc on postinstall AND on require of the index module (which is a Proxy of no-op functions). 185.158.107.175:8787 was already a known operator IP on the dependencywatch denylist (prior waves) - this is a fresh batch under new slugs. Severity medium (confirmed install-time beacon, no second-stage payload disclosed)
• Cluster C - npm 64.181.165.115/dc HTTP/1.0 native-addon operator (malicious-package; 4 packages, same prebuilt-ELF-addon pattern): ksp-app@100.100.100 (GHSA-2f2f-3rf8-8fgc, MAL-2026-17770), ksp-client-registry (100.100.100, 100.100.101; GHSA-8mf7-79w4-6frj, MAL-2026-17771), pay-methods-kmf (100.100.100, 100.100.101, 100.100.102; GHSA-7644-gqv2-mhcv, MAL-2026-17776), deposit-limit-fe (100.100.101, 100.100.102, 100.100.106; GHSA-pwj2-g23f-p5jg, MAL-2026-17769). Every record ships prebuilds/linux-x64/addon.node (a prebuilt Linux x64 ELF with no C sources, no binding.gyp, and no build tooling in the tarball), loaded on postinstall and on require. The ELF reads HOSTNAME, npm_package_name, npm_config_registry and raw-socket-writes POST /dc HTTP/1.0 ... h=&p=&u=&r=<registry> to 64.181.165.115. pay-methods-kmf additionally beacons an interactsh OAST subdomain (db4jlbku53082dmp0d7g3mffj7s7aordk.oast.me - prefix encodes host + package). The 100.100.1XX version pattern is dep-confusion sentinel-shaped. Severity medium (recon beacon; the ELF has no second-stage decrypt visible, but is prebuilt binary - treat as unknown payload)
• Cluster D - other npm dep-confusion probes and standalone malicious packages: liferay-workspace-scripts@99.9.1 (GHSA-p862-3rvq-8852, MAL-2026-17772) pins its ltidisafe dep to the raw tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz and lets its lifecycle scripts run with no SHA pin - the ltidi.storage.googleapis.com/depenconf/ sink has been reused by multiple earlier campaigns and is already on the standing denylist; react-dropzone-v4@99.0.0 (GHSA-7945-qpg8-rjvv, MAL-2026-17758) flagged by OSSF Package Analysis as "communicates with a domain associated with malicious activity" (specific domain NOT disclosed); react-paginate-v5@99.0.0 (GHSA-fg5r-8pv8-mvc8, MAL-2026-17777) DNS-beacons dep-confusion-poc.<rand>.canarytokens.com on preinstall (canarytokens.com is a legitimate Thinkst service - the author appears to be running a bounty/pentest canary rather than running a real second-stage); kmf-vendor-pack@99.0.0 (merged 2026-10-12) postinstall-hooks node -e to send hostname + username to db4fe7a2e2lvaraia8k0n4amgw4ir83az.oast.pro with path /dc?pkg=kmf-vendor-pack&h=<host>&u=<user> (shares kmf branding with cluster Cs pay-methods-kmf but C2 is a different sink - either same operator spreading across infra or two groups mining the same brand); exodus-firestore-synchronize@0.0.1 (GHSA-m497-v5g4-6c4q, MAL-2026-16533) is a dep-confusion POC that only whoami/hostname/env-dumps to STDOUT (no outbound sink in this version - CI log leakage only). Severity medium` (recon beacons / inert probes)
• Cluster E - standalone malicious npm packages with payloads: hardhat-option@2.0.1 (merged 2026-10-12 via OSSF PR #1607) is a copy of the pino logger with an added 4.5 MB obfuscated lib/config.js that index.js loads on import. In sandbox it exfils host/OS/user to http://167.88.172.33:8087/api/log with ukey=309 and tries to launch three stealer modules (autoUploadScript, ldbScript, socketScript - the Browser Local Database / Discord-token / wallet-storage stealer trio). Published by a fake "Robert King <hello@jsonspack.com>" identity with no repo. Second observed in the "hardhat-promised family" that shares infra and tactics with hardhat-promised (previously tracked). npm removed it ~6 hours after publication. Severity high for this package alone - confirmed infostealer with known stealer-module names. css-nesting-transform@1.0.0 (merged 2026-10-12 via OSSF PR #1602) exfils whoami/id/uname -a to a webhook.site collector (exact URL redacted in the OSV record) and poses as a Wix-internal module (rb_wixui.thunderbolt.manifest.min.json), from the same publisher account as css-flow-render-shim and css-jptvix-polyfill. Severity medium for this alone (recon beacon with command output but no payload second-stage)
• Cluster F - PyPI standalone malicious packages: ig-gox@1.0.0 (merged 2026-10-12 via OSSF PR #1610) __init__.py has an obfuscated loader that performs anti-debug / emulator checks, then AES-decrypts and in-memory-executes code downloaded from goxtools.shop. README cover story is "runtime engine for Termux". Second-stage payload content not disclosed in the public write-up. py2ops@2.2 (merged 2026-10-12 via OSSF PR #1613) installs a python2 console-script shim. The REPL that this fakes is real (so a casual user does not notice), but single-word commands typed into the REPL are forwarded to a remote server as an "unlock" check, and the server can return code that runs in-memory with the REPL as the "whole cover". No specific C2 domain disclosed. Severity medium for each alone (confirmed second-stage execution primitive but payload content unknown; low expected reach - Termux niche and Python-2 niche)
• Operator continuity: today extends several existing operators on this feed. s4yhii: wave 3 pivots from the native-addon oob.s4yhii.com:9999/native payload family to plain postinstall JS to collector.oob.s4yhii.com/_npm-poc/beacon - same operator, different payload shape, now using the @coopeuch scope for brand-adjacent dep-confusion against the Chilean credit-cooperative Coopeuch. 185.158.107.175:8787: another wave of the same beacon.cjs/Proxy-stub operator, same IP:port, 6 new slugs. ltidi.storage.googleapis.com/depenconf/: fresh dep pinned to this known sink - operator is still active. hardhat-promised family: hardhat-option is the second package family member seen. ig-gox / goxtools.shop: Instagram-abuse operator continuing (previously tracked). wgkit RubyGems crypto operator: WAVE 2 of 24 gems split into its own carve-out - same C2 45.138.12.177:8089 as the 2026-10-05 wave 1

What to do

1. 1For Cluster A (s4yhii wave 3 npm): grep every package.json/package-lock.json/yarn.lock/pnpm-lock.yaml for @s4yhiitestpoc/r3-https, @s4yhiitestpoc/r2-https, @s4yhiitestpoc/scan-https-d, @coopeuch/common, @coopeuch/button, @coopeuch/core, @coopeuch/components, @coopeuch/config. On hit, treat the installer host as recon-enumerated (host, user, network, DNS, container, CI metadata leaked) and rotate any credential the Node runtime could reach. If your organisation publishes an internal @coopeuch/* scope (Coopeuchs own CI, or any contractor pipeline that resolves @coopeuch/ from an internal registry), scope-lock the internal registry (npm config set @coopeuch:registry https://internal.registry.coopeuch.cl) and hold the public @coopeuch scope with placeholder packages at a safe version. Add collector.oob.s4yhii.com, .oob.s4yhii.com, and the s4yhii.com apex to the standing CI/build-host egress denylist (the entire s4yhii.com` apex is operator-controlled - block the apex, not individual subdomains)
2. 2For Cluster B (185.158.107.175:8787/_ah/dc operator): grep lockfiles for nitro-bundled-dep, nitro-cjs-requirer, nested-lib, cloudflare_module, another-very-long-name, some-very-long-package-name. On hit, same remediation as Cluster A (install-time recon beacon, no further payload disclosed). Keep 185.158.107.175:8787 on the CI/build-host egress denylist. The beacon.cjs + Proxy no-op index.js pattern is this operators signature across waves - add a CI rule rejecting any npm package whose main entry is a Proxy that returns no-op functions and whose scripts.postinstall is node beacon.cjs`
3. 3For Cluster C (64.181.165.115/dc prebuilt-ELF native-addon operator): grep lockfiles for ksp-app, ksp-client-registry, pay-methods-kmf, deposit-limit-fe. On hit, treat as recon leak PLUS unknown-payload native-addon run (the ELF is prebuilt binary, so a second-stage could be in it even if the primary beacon is h=&u=&p=&r=). Image the installer host. Add 64.181.165.115 to the CI/build-host egress denylist. Flag any npm package that ships prebuilds/<os-arch>/addon.node without a corresponding binding.gyp and C/C++/Rust sources in the tarball - that is the dep-confusion-via-prebuilt-ELF primitive, and it should fail CI by default
4. 4For Cluster D (other dep-confusion probes): grep for liferay-workspace-scripts, react-dropzone-v4, react-paginate-v5, kmf-vendor-pack, exodus-firestore-synchronize, and for the ANTI-PATTERN "ltidisafe" or raw tarball URLs under ltidi.storage.googleapis.com/depenconf/. On any hit, remove, invalidate the Docker layer or build cache that ran npm install, and audit for environment-variable leakage in CI logs (exodus-firestore-synchronize writes TOKEN|SECRET|KEY|AUTH|npm values to STDOUT so they end up in CI archive logs even without an outbound sink). Add ltidi.storage.googleapis.com/depenconf/ (standing), *.oast.pro, *.oast.me, *.canarytokens.com to the CI/build-host egress denylist (canarytokens is legitimate for AUTHORISED canary users, but any npm package phoning its canary during an unauthorised install is still a signal)
5. 5For Cluster E (hardhat-option stealer): grep lockfiles for hardhat-option (any version). On ANY hit, treat the installer host as compromised with a Browser Local Database stealer / Discord-token stealer / wallet-storage stealer trio. Rotate ALL browser-stored credentials, all Discord tokens, revoke all browser-stored session cookies, rotate crypto wallet seeds, image the host. Add 167.88.172.33:8087 to the egress denylist and jsonspack.com to the publisher-email denylist. Also grep for hardhat-promised as a family-member of the same operator
6. 6For Cluster F (PyPI ig-gox, py2ops): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, uv.lock, pdm.lock for ig-gox and py2ops. On hit, assume in-memory second-stage execution. Rotate credentials reachable from the Python runtime. Add goxtools.shop apex to the standing CI/build-host egress denylist. If a developer has installed py2ops and been typing into its REPL, the "unlock" commands they tried are known to the operator; audit for subsequent code execution on the host
7. 7NEW outbound denylist entries for CI/build-host egress proxies today: collector.oob.s4yhii.com (exact subdomain - Cluster A), *.oob.s4yhii.com + s4yhii.com apex (Cluster A plus standing wave 1 and 2 continuity), 64.181.165.115 (Cluster C), 167.88.172.33:8087 + jsonspack.com publisher-email + the stealer-module names autoUploadScript/ldbScript/socketScript as text signatures for CI vet pipelines (Cluster E hardhat-option), goxtools.shop apex (Cluster F ig-gox), minhdong.site apex (todays hridoy-ultimate [carve-out](/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer)) + GitHub user VangBanLaNhat, 45.138.12.177:8089 (todays wgkit wave-2 RubyGems carve-out). Keep prior egress blocks in place: 185.158.107.175:8787 (now wave 2), ltidi.storage.googleapis.com/depenconf/ (continuing), oob.s4yhii.com:9999/native (wave 1 + 2 of s4yhii), *.oast.pro/*.oast.me/*.oast.fun/*.oast.site/*.oastify.com OAST apex set, frjmzbjbhwvtdnsuodmu.supabase.co, api.npoint.io, googleforum.pythonanywhere.com, oob.s4yhii.com, tele.metry.orgin.net, morroncr0w.io, api.telegram.org on untrusted CI/build hosts, appsecc.com, webhook.site/*, dxpoc.gt.tc, nfjbill.ren, storage.googleapis.com/depenconf/, 10.0.19.0/24 + 10.0.49.0/24, api.nm-streetwear.space, Discord webhook URL pattern, ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools, Ethereum + Sepolia + Arbitrum + Polygon RPC endpoints, chinazhangsan.ccwu.cc, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil patterns, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com publisher-email domain, 45.138.0.0/16 RubyGems wgkit CIDRs

References

• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub
• GHSA-m7mp-74j7-2w45 - npm @s4yhiitestpoc/r3-https (Cluster A - s4yhii wave 3, collector.oob.s4yhii.com)

  github.com
  GitHub
• GHSA-r3vq-5g6w-hwmm - npm @s4yhiitestpoc/r2-https (Cluster A)

  github.com
  GitHub
• GHSA-845p-jq49-x946 - npm @s4yhiitestpoc/scan-https-d (Cluster A)

  github.com
  GitHub
• GHSA-pcjv-x9w3-wc2g - npm @coopeuch/common (Cluster A - Coopeuch brand dep-confusion)

  github.com
  GitHub
• GHSA-gwpw-pvv6-cxg3 - npm @coopeuch/button (Cluster A)

  github.com
  GitHub
• GHSA-pxq4-wc36-p967 - npm @coopeuch/core (Cluster A)

  github.com
  GitHub
• GHSA-p3q5-2wv6-qx57 - npm @coopeuch/components (Cluster A)

  github.com
  GitHub
• GHSA-m89q-pg4c-ffx9 - npm @coopeuch/config (Cluster A)

  github.com
  GitHub
• GHSA-j6mc-gqc2-j75h - npm nitro-bundled-dep (Cluster B - 185.158.107.175:8787/_ah/dc)

  github.com
  GitHub
• GHSA-hp5p-fc9h-wfg5 - npm nitro-cjs-requirer (Cluster B)

  github.com
  GitHub
• GHSA-vhwg-xx2q-m28q - npm nested-lib (Cluster B)

  github.com
  GitHub
• GHSA-9p5g-9jf3-6739 - npm cloudflare_module (Cluster B - typosquats Cloudflare)

  github.com
  GitHub
• GHSA-9w99-w8fq-2x8w - npm another-very-long-name (Cluster B)

  github.com
  GitHub
• GHSA-rf49-p2c5-fh8p - npm some-very-long-package-name (Cluster B)

  github.com
  GitHub
• GHSA-2f2f-3rf8-8fgc - npm ksp-app (Cluster C - 64.181.165.115/dc, prebuilt ELF addon)

  github.com
  GitHub
• GHSA-8mf7-79w4-6frj - npm ksp-client-registry (Cluster C)

  github.com
  GitHub
• GHSA-7644-gqv2-mhcv - npm pay-methods-kmf (Cluster C)

  github.com
  GitHub
• GHSA-pwj2-g23f-p5jg - npm deposit-limit-fe (Cluster C)

  github.com
  GitHub
• GHSA-p862-3rvq-8852 - npm liferay-workspace-scripts (Cluster D - ltidi.storage.googleapis.com/depenconf/)

  github.com
  GitHub
• GHSA-7945-qpg8-rjvv - npm react-dropzone-v4 (Cluster D - OSSF Package Analysis flag)

  github.com
  GitHub
• GHSA-fg5r-8pv8-mvc8 - npm react-paginate-v5 (Cluster D - canarytokens.com)

  github.com
  GitHub
• OSSF malicious-packages PR #1615 - kmf-vendor-pack (Cluster D - oast.pro)

  github.com
  OpenSSF
• GHSA-m497-v5g4-6c4q - npm exodus-firestore-synchronize (Cluster D - STDOUT-only dep-confusion POC)

  github.com
  GitHub
• OSSF malicious-packages PR #1607 - hardhat-option (Cluster E - hardhat-promised family, 167.88.172.33 stealer trio)

  github.com
  OpenSSF
• OSSF malicious-packages PR #1602 - css-nesting-transform (Cluster E - Wix impersonation, webhook.site)

  github.com
  OpenSSF
• OSSF malicious-packages PR #1610 - PyPI ig-gox (Cluster F - goxtools.shop encrypted loader)

  github.com
  OpenSSF
• OSSF malicious-packages PR #1613 - PyPI py2ops (Cluster F - trojaned python2 REPL)

  github.com
  OpenSSF
• DependencyWatch: rubygems-2026-10-12-wgkit-wave-2-crypto-defi-cluster (today`s companion carve-out, 24 crypto gems)

  dependencywatch.io
• DependencyWatch: npm-2026-10-12-hridoy-ultimate-fb-credential-stealer (today`s companion carve-out, FB credential sink)

  dependencywatch.io
• DependencyWatch: multi-2026-10-11-ghsa-malware-sweep (prior-day context: webreader+pafer pickle RAT, agentaix cluster)

  dependencywatch.io
• DependencyWatch: multi-2026-10-10-ghsa-malware-sweep (prior-day context: s4yhii native-binary wave 1-2)

  dependencywatch.io
• DependencyWatch: rubygems-2026-10-05-eth-crypto-wgkit-cluster (wgkit RubyGems operator wave 1)

  dependencywatch.io