# GitHub Advisory malware sweep - 2026-10-12 (**s4yhii operator wave 3**: 8 npm packages across `@s4yhiitestpoc/*` + `@coopeuch/*` Coopeuch-brand dep-confusion all beaconing `collector.oob.s4yhii.com/_npm-poc/beacon`; **`185.158.107.175:8787/_ah/dc` operator wave 2**: 6 npm `beacon.cjs`-pattern recon packages (`nitro-cjs-requirer`, `nitro-bundled-dep`, `nested-lib`, `cloudflare_module`, `another-very-long-name`, `some-very-long-package-name`); **`64.181.165.115/dc` native-addon operator**: 4 npm packages with HTTP/1.0 raw-socket beacons (`ksp-app`, `ksp-client-registry`, `pay-methods-kmf`, `deposit-limit-fe`); `liferay-workspace-scripts` bundled-dep from `ltidi.storage.googleapis.com/depenconf/`; `react-dropzone-v4`/`react-paginate-v5`/`kmf-vendor-pack`/`exodus-firestore-synchronize` dep-confusion probes; `hardhat-option@2.0.1` npm `hardhat-promised`-family stealer; `css-nesting-transform@1.0.0` Wix-brand `webhook.site` recon; PyPI `ig-gox` (`goxtools.shop` encrypted-loader) + `py2ops` trojaned-REPL. Big RubyGems wgkit wave-2 crypto cluster split out to its own carve-out.) > GHSA 2026-10-11 batch (ingested 2026-10-12): 25+ fresh malware advisories across npm + PyPI, dominated by **s4yhii operator wave 3** (`collector.oob.s4yhii.com/_npm-poc/beacon` across `@s4yhiitestpoc/*` + `@coopeuch/*`) and a second `185.158.107.175:8787/_ah/dc` dep-confusion family. Also `hardhat-option@2.0.1` npm `hardhat-promised`-family stealer, PyPI `ig-gox` `goxtools.shop` encrypted-loader, and `py2ops` trojaned Python-2 REPL. The 24 RubyGems wgkit wave-2 crypto gems were split into their [own carve-out](https://dependencywatch.io/incident/rubygems-2026-10-12-wgkit-wave-2-crypto-defi-cluster). - Published: 2026-10-12 - Severity: high - Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole. - Ecosystems: npm, PyPI - Scope: 27 packages, 51 compromised versions - Tags: infostealer, credential-theft, obfuscation, dependency-confusion, account-takeover, crypto-wallet-drain, dns-exfiltration - Also known as: 2026-10-12 GHSA sweep, s4yhii operator wave 3, @coopeuch Coopeuch dep-confusion wave, 185.158.107.175:8787 beacon.cjs wave 2, 64.181.165.115/dc native-addon operator, hardhat-option hardhat-promised family wave 2, ig-gox goxtools.shop PyPI operator, py2ops trojaned Python 2 REPL - Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, InvisiRisk, npm security - Incident ID: multi-2026-10-12-ghsa-malware-sweep ## Affected packages (27) Only the exact versions listed were named by the source advisories. Other versions are not implicated. | Package | Ecosystem | Compromised versions | |---|---|---| | [@coopeuch/button](https://dependencywatch.io/package/npm/@coopeuch/button) | npm | 1.999.999 | | [@coopeuch/common](https://dependencywatch.io/package/npm/@coopeuch/common) | npm | 1.999.999 | | [@coopeuch/components](https://dependencywatch.io/package/npm/@coopeuch/components) | npm | 1.999.999 | | [@coopeuch/config](https://dependencywatch.io/package/npm/@coopeuch/config) | npm | 1.999.999 | | [@coopeuch/core](https://dependencywatch.io/package/npm/@coopeuch/core) | npm | 1.999.999 | | [@s4yhiitestpoc/r2-https](https://dependencywatch.io/package/npm/@s4yhiitestpoc/r2-https) | npm | 1.0.0 | | [@s4yhiitestpoc/r3-https](https://dependencywatch.io/package/npm/@s4yhiitestpoc/r3-https) | npm | 1.0.0 | | [@s4yhiitestpoc/scan-https-d](https://dependencywatch.io/package/npm/@s4yhiitestpoc/scan-https-d) | npm | 1.0.0 | | [another-very-long-name](https://dependencywatch.io/package/npm/another-very-long-name) | npm | 1.0.1, 1.1.0, 2.0.0, 2.0.1 | | [cloudflare_module](https://dependencywatch.io/package/npm/cloudflare_module) | npm | 1.0.0, 1.0.1, 3.0.0, 99.0.1 | | [css-nesting-transform](https://dependencywatch.io/package/npm/css-nesting-transform) | npm | 1.0.0 | | [deposit-limit-fe](https://dependencywatch.io/package/npm/deposit-limit-fe) | npm | 100.100.101, 100.100.102, 100.100.106 | | [exodus-firestore-synchronize](https://dependencywatch.io/package/npm/exodus-firestore-synchronize) | npm | 0.0.1 | | [hardhat-option](https://dependencywatch.io/package/npm/hardhat-option) | npm | 2.0.1 | | [ig-gox](https://dependencywatch.io/package/pypi/ig-gox) | PyPI | 1.0.0 | | [kmf-vendor-pack](https://dependencywatch.io/package/npm/kmf-vendor-pack) | npm | 99.0.0 | | [ksp-app](https://dependencywatch.io/package/npm/ksp-app) | npm | 100.100.100 | | [ksp-client-registry](https://dependencywatch.io/package/npm/ksp-client-registry) | npm | 100.100.100, 100.100.101 | | [liferay-workspace-scripts](https://dependencywatch.io/package/npm/liferay-workspace-scripts) | npm | 99.9.1 | | [nested-lib](https://dependencywatch.io/package/npm/nested-lib) | npm | 1.0.0, 1.0.1, 1.1.0 | | [nitro-bundled-dep](https://dependencywatch.io/package/npm/nitro-bundled-dep) | npm | 99.0.1, 2.0.1, 1.1.0 | | [nitro-cjs-requirer](https://dependencywatch.io/package/npm/nitro-cjs-requirer) | npm | 0.0.1, 1.0.0, 1.1.0, 2.0.0, 3.0.0, 99.0.1 | | [pay-methods-kmf](https://dependencywatch.io/package/npm/pay-methods-kmf) | npm | 100.100.100, 100.100.101, 100.100.102 | | [py2ops](https://dependencywatch.io/package/pypi/py2ops) | PyPI | 2.2 | | [react-dropzone-v4](https://dependencywatch.io/package/npm/react-dropzone-v4) | npm | 99.0.0 | | [react-paginate-v5](https://dependencywatch.io/package/npm/react-paginate-v5) | npm | 99.0.0 | | [some-very-long-package-name](https://dependencywatch.io/package/npm/some-very-long-package-name) | npm | 1.0.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1 | ## What happened Between 2026-10-10 11:42 UTC (yesterday`s sweep cutoff) and 2026-10-12 06:11 UTC (today`s ingest-window start), the GitHub Advisory Database and OpenSSF `malicious-packages` published ~50 fresh malware advisories. The 24 RubyGems wgkit wave-2 crypto gems were split into their own [carve-out](https://dependencywatch.io/incident/rubygems-2026-10-12-wgkit-wave-2-crypto-defi-cluster), and the standalone `hridoy-ultimate` Facebook credential stealer into [its own carve-out](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer). The remaining 24 advisories across npm + PyPI are summarised in six operator clusters above. ## Infrastructure signals - `collector.oob.s4yhii.com/_npm-poc/beacon` (Cluster A) - **operator continuity signal**: the `s4yhii` operator is now in wave 3, having pivoted from the native-addon `oob.s4yhii.com:9999/native` payload to postinstall JS targeting the `@coopeuch` scope (Chilean credit cooperative). - `185.158.107.175:8787/_ah/dc` (Cluster B) - **operator wave 2** of the already-tracked `beacon.cjs` dep-confusion operator; 6 new slugs under the same C2. - `64.181.165.115/dc` (Cluster C) - **new operator**; HTTP/1.0 raw-socket beacon from a prebuilt Linux x64 ELF addon; 4 slugs; `pay-methods-kmf` additionally beacons `oast.me`. - `ltidi.storage.googleapis.com/depenconf/` (Cluster D, `liferay-workspace-scripts`) - **standing-denylist reuse**; same storage bucket on `storage.googleapis.com/depenconf/` as previous dep-confusion campaigns. - `167.88.172.33:8087/api/log` (Cluster E, `hardhat-option`) - **`hardhat-promised` family** continuation; copy of `pino` with a 4.5 MB `lib/config.js` carrying BrowserLDB / Discord-token / wallet-storage stealer modules. - `goxtools.shop` (Cluster F, `ig-gox`) - **operator continuity** of the previously-tracked Instagram-abuse operator. ## Classification `sweep`. Severity `high` taken as a whole, driven by `hardhat-option` (confirmed infostealer with known stealer-module names and a working C2) and the s4yhii wave-3 organisational-targeting signal (Coopeuch brand impersonation). Individual clusters, taken alone, would be `medium` (install-time recon beacons without second-stage payload analysis). ## Discovery `GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector` (IN-MAL feed), `InvisiRisk, Inc.` (kmf-vendor-pack 21-second-after-publish flag), `npm security`. ## Impact - **Cluster A - npm s4yhii operator wave 3 (malicious-package, dep-confusion variant; 8 packages across two scopes all beaconing `collector.oob.s4yhii.com/_npm-poc/beacon`)**: three `@s4yhiitestpoc/*` self-labeled test-POC packages - `@s4yhiitestpoc/r3-https@1.0.0` (GHSA-m7mp-74j7-2w45, MAL-2026-17765), `@s4yhiitestpoc/r2-https@1.0.0` (GHSA-r3vq-5g6w-hwmm, MAL-2026-17764), `@s4yhiitestpoc/scan-https-d@1.0.0` (GHSA-845p-jq49-x946, MAL-2026-17766) - and five `@coopeuch/*` dep-confusion packages impersonating the Chilean credit cooperative Coopeuch: `@coopeuch/common@1.999.999` (GHSA-pcjv-x9w3-wc2g, MAL-2026-17760), `@coopeuch/button@1.999.999` (GHSA-gwpw-pvv6-cxg3, MAL-2026-17759), `@coopeuch/core@1.999.999` (GHSA-pxq4-wc36-p967, MAL-2026-17763), `@coopeuch/components@1.999.999` (GHSA-p3q5-2wv6-qx57, MAL-2026-17761), `@coopeuch/config@1.999.999` (GHSA-m89q-pg4c-ffx9, MAL-2026-17762). Every record uses the SAME postinstall JS pattern: a `postinstall.js` sends host, user, network, DNS, container, and CI metadata as JSON to `https://collector.oob.s4yhii.com/_npm-poc/beacon`, PLUS a secondary DNS-exfil beacon to a labeled subdomain under `*.oob.s4yhii.com`. **This is the same `s4yhii` operator as the 2026-10-09/10 native-binary waves** (prior waves used `oob.s4yhii.com:9999/native` with a prebuilt `metrics.node` native addon); wave 3 drops the native addon in favour of plain postinstall JS and spreads across a legitimate-sounding dep-confusion scope (`@coopeuch`). Severity `medium` for the cluster taken alone (install-time recon beacon, no second-stage payload disclosed), BUT **the Coopeuch scope impersonation is high-value organisational targeting** - if your organisation ships internal `@coopeuch/*` packages, treat this as evidence of an active dep-confusion attempt against Coopeuch`s internal registry - **Cluster B - npm `185.158.107.175:8787/_ah/dc` dep-confusion family (malicious-package; 6 packages, same `beacon.cjs` code pattern)**: `nitro-bundled-dep` (99.0.1, 2.0.1, 1.1.0; GHSA-j6mc-gqc2-j75h, MAL-2026-17774), `nitro-cjs-requirer` (0.0.1, 1.0.0, 1.1.0, 2.0.0, 3.0.0, 99.0.1; GHSA-hp5p-fc9h-wfg5, MAL-2026-17775), `nested-lib` (1.0.0, 1.0.1, 1.1.0; GHSA-vhwg-xx2q-m28q, MAL-2026-17773), `cloudflare_module` (1.0.0, 1.0.1, 3.0.0, 99.0.1; GHSA-9p5g-9jf3-6739, MAL-2026-17768 - typosquats Cloudflare branding), `another-very-long-name` (1.0.1, 1.1.0, 2.0.0, 2.0.1; GHSA-9w99-w8fq-2x8w, MAL-2026-17767), `some-very-long-package-name` (1.0.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1; GHSA-rf49-p2c5-fh8p, MAL-2026-17778). Every package ships the SAME `beacon.cjs` code pattern: a `fire()` function collects hostname + `__dirname` + `process.cwd()` + `process.version` + package name and POSTs JSON to `http://185.158.107.175:8787/_ah/dc` on postinstall AND on `require` of the index module (which is a Proxy of no-op functions). `185.158.107.175:8787` was already a known operator IP on the dependencywatch denylist (prior waves) - this is a fresh batch under new slugs. Severity `medium` (confirmed install-time beacon, no second-stage payload disclosed) - **Cluster C - npm `64.181.165.115/dc` HTTP/1.0 native-addon operator (malicious-package; 4 packages, same prebuilt-ELF-addon pattern)**: `ksp-app@100.100.100` (GHSA-2f2f-3rf8-8fgc, MAL-2026-17770), `ksp-client-registry` (100.100.100, 100.100.101; GHSA-8mf7-79w4-6frj, MAL-2026-17771), `pay-methods-kmf` (100.100.100, 100.100.101, 100.100.102; GHSA-7644-gqv2-mhcv, MAL-2026-17776), `deposit-limit-fe` (100.100.101, 100.100.102, 100.100.106; GHSA-pwj2-g23f-p5jg, MAL-2026-17769). Every record ships `prebuilds/linux-x64/addon.node` (a prebuilt Linux x64 ELF with no C sources, no `binding.gyp`, and no build tooling in the tarball), loaded on postinstall and on `require`. The ELF reads `HOSTNAME`, `npm_package_name`, `npm_config_registry` and raw-socket-writes `POST /dc HTTP/1.0 ... h=&p=&u=&r=` to `64.181.165.115`. `pay-methods-kmf` additionally beacons an interactsh OAST subdomain (`db4jlbku53082dmp0d7g3mffj7s7aordk.oast.me` - prefix encodes host + package). The `100.100.1XX` version pattern is dep-confusion sentinel-shaped. Severity `medium` (recon beacon; the ELF has no second-stage decrypt visible, but is prebuilt binary - treat as unknown payload) - **Cluster D - other npm dep-confusion probes and standalone malicious packages**: `liferay-workspace-scripts@99.9.1` (GHSA-p862-3rvq-8852, MAL-2026-17772) pins its `ltidisafe` dep to the raw tarball URL `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz` and lets its lifecycle scripts run with no SHA pin - the `ltidi.storage.googleapis.com/depenconf/` sink has been reused by multiple earlier campaigns and is already on the standing denylist; `react-dropzone-v4@99.0.0` (GHSA-7945-qpg8-rjvv, MAL-2026-17758) flagged by OSSF Package Analysis as "communicates with a domain associated with malicious activity" (specific domain NOT disclosed); `react-paginate-v5@99.0.0` (GHSA-fg5r-8pv8-mvc8, MAL-2026-17777) DNS-beacons `dep-confusion-poc..canarytokens.com` on preinstall (canarytokens.com is a legitimate Thinkst service - the author appears to be running a bounty/pentest canary rather than running a real second-stage); `kmf-vendor-pack@99.0.0` (merged 2026-10-12) postinstall-hooks `node -e` to send hostname + username to `db4fe7a2e2lvaraia8k0n4amgw4ir83az.oast.pro` with path `/dc?pkg=kmf-vendor-pack&h=&u=` (shares `kmf` branding with cluster C`s `pay-methods-kmf` but C2 is a different sink - either same operator spreading across infra or two groups mining the same brand); `exodus-firestore-synchronize@0.0.1` (GHSA-m497-v5g4-6c4q, MAL-2026-16533) is a dep-confusion POC that only `whoami`/`hostname`/env-dumps to STDOUT (no outbound sink in this version - CI log leakage only). Severity `medium` (recon beacons / inert probes) - **Cluster E - standalone malicious npm packages with payloads**: `hardhat-option@2.0.1` (merged 2026-10-12 via OSSF PR #1607) is a copy of the `pino` logger with an added 4.5 MB obfuscated `lib/config.js` that `index.js` loads on import. In sandbox it exfils host/OS/user to `http://167.88.172.33:8087/api/log` with `ukey=309` and tries to launch three stealer modules (`autoUploadScript`, `ldbScript`, `socketScript` - the Browser Local Database / Discord-token / wallet-storage stealer trio). Published by a fake "Robert King " identity with no repo. Second observed in the "hardhat-promised family" that shares infra and tactics with `hardhat-promised` (previously tracked). npm removed it ~6 hours after publication. **Severity `high` for this package alone** - confirmed infostealer with known stealer-module names. `css-nesting-transform@1.0.0` (merged 2026-10-12 via OSSF PR #1602) exfils `whoami`/`id`/`uname -a` to a `webhook.site` collector (exact URL redacted in the OSV record) and poses as a Wix-internal module (`rb_wixui.thunderbolt.manifest.min.json`), from the same publisher account as `css-flow-render-shim` and `css-jptvix-polyfill`. Severity `medium` for this alone (recon beacon with command output but no payload second-stage) - **Cluster F - PyPI standalone malicious packages**: `ig-gox@1.0.0` (merged 2026-10-12 via OSSF PR #1610) `__init__.py` has an obfuscated loader that performs anti-debug / emulator checks, then AES-decrypts and in-memory-executes code downloaded from `goxtools.shop`. README cover story is "runtime engine for Termux". Second-stage payload content not disclosed in the public write-up. `py2ops@2.2` (merged 2026-10-12 via OSSF PR #1613) installs a `python2` console-script shim. The REPL that this fakes is real (so a casual user does not notice), but single-word commands typed into the REPL are forwarded to a remote server as an "unlock" check, and the server can return code that runs in-memory with the REPL as the "whole cover". No specific C2 domain disclosed. Severity `medium` for each alone (confirmed second-stage execution primitive but payload content unknown; low expected reach - Termux niche and Python-2 niche) - **Operator continuity**: today extends several existing operators on this feed. **s4yhii**: wave 3 pivots from the native-addon `oob.s4yhii.com:9999/native` payload family to plain postinstall JS to `collector.oob.s4yhii.com/_npm-poc/beacon` - same operator, different payload shape, now using the `@coopeuch` scope for brand-adjacent dep-confusion against the Chilean credit-cooperative Coopeuch. **`185.158.107.175:8787`**: another wave of the same `beacon.cjs`/Proxy-stub operator, same IP:port, 6 new slugs. **`ltidi.storage.googleapis.com/depenconf/`**: fresh dep pinned to this known sink - operator is still active. **`hardhat-promised` family**: `hardhat-option` is the second package family member seen. **ig-gox / goxtools.shop**: Instagram-abuse operator continuing (previously tracked). **wgkit RubyGems crypto operator**: WAVE 2 of 24 gems split into its [own carve-out](https://dependencywatch.io/incident/rubygems-2026-10-12-wgkit-wave-2-crypto-defi-cluster) - same C2 `45.138.12.177:8089` as the 2026-10-05 wave 1 ## What to do 1. **For Cluster A (s4yhii wave 3 npm)**: grep every `package.json`/`package-lock.json`/`yarn.lock`/`pnpm-lock.yaml` for `@s4yhiitestpoc/r3-https`, `@s4yhiitestpoc/r2-https`, `@s4yhiitestpoc/scan-https-d`, `@coopeuch/common`, `@coopeuch/button`, `@coopeuch/core`, `@coopeuch/components`, `@coopeuch/config`. On hit, treat the installer host as recon-enumerated (host, user, network, DNS, container, CI metadata leaked) and rotate any credential the Node runtime could reach. If your organisation publishes an internal `@coopeuch/*` scope (Coopeuch`s own CI, or any contractor pipeline that resolves `@coopeuch/*` from an internal registry), scope-lock the internal registry (`npm config set @coopeuch:registry https://internal.registry.coopeuch.cl`) and hold the public `@coopeuch` scope with placeholder packages at a safe version. Add `collector.oob.s4yhii.com`, `*.oob.s4yhii.com`, and the `s4yhii.com` apex to the standing CI/build-host egress denylist (the entire `s4yhii.com` apex is operator-controlled - block the apex, not individual subdomains) 2. **For Cluster B (`185.158.107.175:8787/_ah/dc` operator)**: grep lockfiles for `nitro-bundled-dep`, `nitro-cjs-requirer`, `nested-lib`, `cloudflare_module`, `another-very-long-name`, `some-very-long-package-name`. On hit, same remediation as Cluster A (install-time recon beacon, no further payload disclosed). Keep `185.158.107.175:8787` on the CI/build-host egress denylist. The `beacon.cjs` + Proxy no-op `index.js` pattern is this operator`s signature across waves - add a CI rule rejecting any npm package whose main entry is a Proxy that returns no-op functions and whose `scripts.postinstall` is `node beacon.cjs` 3. **For Cluster C (`64.181.165.115/dc` prebuilt-ELF native-addon operator)**: grep lockfiles for `ksp-app`, `ksp-client-registry`, `pay-methods-kmf`, `deposit-limit-fe`. On hit, treat as recon leak PLUS unknown-payload native-addon run (the ELF is prebuilt binary, so a second-stage could be in it even if the primary beacon is `h=&u=&p=&r=`). Image the installer host. Add `64.181.165.115` to the CI/build-host egress denylist. **Flag any npm package that ships `prebuilds//addon.node` without a corresponding `binding.gyp` and C/C++/Rust sources in the tarball** - that is the dep-confusion-via-prebuilt-ELF primitive, and it should fail CI by default 4. **For Cluster D (other dep-confusion probes)**: grep for `liferay-workspace-scripts`, `react-dropzone-v4`, `react-paginate-v5`, `kmf-vendor-pack`, `exodus-firestore-synchronize`, and for the ANTI-PATTERN `"ltidisafe"` or raw tarball URLs under `ltidi.storage.googleapis.com/depenconf/`. On any hit, remove, invalidate the Docker layer or build cache that ran `npm install`, and audit for environment-variable leakage in CI logs (`exodus-firestore-synchronize` writes `TOKEN|SECRET|KEY|AUTH|npm` values to STDOUT so they end up in CI archive logs even without an outbound sink). Add `ltidi.storage.googleapis.com/depenconf/` (standing), `*.oast.pro`, `*.oast.me`, `*.canarytokens.com` to the CI/build-host egress denylist (canarytokens is legitimate for AUTHORISED canary users, but any npm package phoning its canary during an unauthorised install is still a signal) 5. **For Cluster E (`hardhat-option` stealer)**: grep lockfiles for `hardhat-option` (any version). On ANY hit, treat the installer host as compromised with a Browser Local Database stealer / Discord-token stealer / wallet-storage stealer trio. Rotate ALL browser-stored credentials, all Discord tokens, revoke all browser-stored session cookies, rotate crypto wallet seeds, image the host. Add `167.88.172.33:8087` to the egress denylist and `jsonspack.com` to the publisher-email denylist. Also grep for `hardhat-promised` as a family-member of the same operator 6. **For Cluster F (PyPI `ig-gox`, `py2ops`)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock` for `ig-gox` and `py2ops`. On hit, assume in-memory second-stage execution. Rotate credentials reachable from the Python runtime. Add `goxtools.shop` apex to the standing CI/build-host egress denylist. If a developer has installed `py2ops` and been typing into its REPL, the "unlock" commands they tried are known to the operator; audit for subsequent code execution on the host 7. **NEW outbound denylist entries for CI/build-host egress proxies today**: `collector.oob.s4yhii.com` (exact subdomain - Cluster A), `*.oob.s4yhii.com` + `s4yhii.com` apex (Cluster A plus standing wave 1 and 2 continuity), `64.181.165.115` (Cluster C), `167.88.172.33:8087` + `jsonspack.com` publisher-email + the stealer-module names `autoUploadScript`/`ldbScript`/`socketScript` as text signatures for CI vet pipelines (Cluster E `hardhat-option`), `goxtools.shop` apex (Cluster F `ig-gox`), `minhdong.site` apex (today`s `hridoy-ultimate` [carve-out](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer)) + GitHub user `VangBanLaNhat`, `45.138.12.177:8089` (today`s [wgkit wave-2 RubyGems carve-out](https://dependencywatch.io/incident/rubygems-2026-10-12-wgkit-wave-2-crypto-defi-cluster)). Keep prior egress blocks in place: `185.158.107.175:8787` (now wave 2), `ltidi.storage.googleapis.com/depenconf/` (continuing), `oob.s4yhii.com:9999/native` (wave 1 + 2 of s4yhii), `*.oast.pro`/`*.oast.me`/`*.oast.fun`/`*.oast.site`/`*.oastify.com` OAST apex set, `frjmzbjbhwvtdnsuodmu.supabase.co`, `api.npoint.io`, `googleforum.pythonanywhere.com`, `oob.s4yhii.com`, `tele.metry.orgin.net`, `morroncr0w.io`, `api.telegram.org` on untrusted CI/build hosts, `appsecc.com`, `webhook.site/*`, `dxpoc.gt.tc`, `nfjbill.ren`, `storage.googleapis.com/depenconf/`, `10.0.19.0/24` + `10.0.49.0/24`, `api.nm-streetwear.space`, Discord webhook URL pattern, `ipify.org` + `ifconfig.me`, `gitflic.ru`, `api.wagmiwallet.org`, `backend-cybersecuritydashboard.onrender.com`, Monero mining pools, Ethereum + Sepolia + Arbitrum + Polygon RPC endpoints, `chinazhangsan.ccwu.cc`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `npm-canary.aveliscare.com`, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil patterns, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, `tuamaeaquelaursa.com` publisher-email domain, `45.138.0.0/16` RubyGems wgkit CIDRs ## Check your own dependencies - Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json - Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt The scan runs entirely in the browser; lockfile contents are never uploaded. ## References - [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub - [GHSA-m7mp-74j7-2w45 - npm @s4yhiitestpoc/r3-https (Cluster A - s4yhii wave 3, collector.oob.s4yhii.com)](https://github.com/advisories/GHSA-m7mp-74j7-2w45) - GitHub - [GHSA-r3vq-5g6w-hwmm - npm @s4yhiitestpoc/r2-https (Cluster A)](https://github.com/advisories/GHSA-r3vq-5g6w-hwmm) - GitHub - [GHSA-845p-jq49-x946 - npm @s4yhiitestpoc/scan-https-d (Cluster A)](https://github.com/advisories/GHSA-845p-jq49-x946) - GitHub - [GHSA-pcjv-x9w3-wc2g - npm @coopeuch/common (Cluster A - Coopeuch brand dep-confusion)](https://github.com/advisories/GHSA-pcjv-x9w3-wc2g) - GitHub - [GHSA-gwpw-pvv6-cxg3 - npm @coopeuch/button (Cluster A)](https://github.com/advisories/GHSA-gwpw-pvv6-cxg3) - GitHub - [GHSA-pxq4-wc36-p967 - npm @coopeuch/core (Cluster A)](https://github.com/advisories/GHSA-pxq4-wc36-p967) - GitHub - [GHSA-p3q5-2wv6-qx57 - npm @coopeuch/components (Cluster A)](https://github.com/advisories/GHSA-p3q5-2wv6-qx57) - GitHub - [GHSA-m89q-pg4c-ffx9 - npm @coopeuch/config (Cluster A)](https://github.com/advisories/GHSA-m89q-pg4c-ffx9) - GitHub - [GHSA-j6mc-gqc2-j75h - npm nitro-bundled-dep (Cluster B - 185.158.107.175:8787/_ah/dc)](https://github.com/advisories/GHSA-j6mc-gqc2-j75h) - GitHub - [GHSA-hp5p-fc9h-wfg5 - npm nitro-cjs-requirer (Cluster B)](https://github.com/advisories/GHSA-hp5p-fc9h-wfg5) - GitHub - [GHSA-vhwg-xx2q-m28q - npm nested-lib (Cluster B)](https://github.com/advisories/GHSA-vhwg-xx2q-m28q) - GitHub - [GHSA-9p5g-9jf3-6739 - npm cloudflare_module (Cluster B - typosquats Cloudflare)](https://github.com/advisories/GHSA-9p5g-9jf3-6739) - GitHub - [GHSA-9w99-w8fq-2x8w - npm another-very-long-name (Cluster B)](https://github.com/advisories/GHSA-9w99-w8fq-2x8w) - GitHub - [GHSA-rf49-p2c5-fh8p - npm some-very-long-package-name (Cluster B)](https://github.com/advisories/GHSA-rf49-p2c5-fh8p) - GitHub - [GHSA-2f2f-3rf8-8fgc - npm ksp-app (Cluster C - 64.181.165.115/dc, prebuilt ELF addon)](https://github.com/advisories/GHSA-2f2f-3rf8-8fgc) - GitHub - [GHSA-8mf7-79w4-6frj - npm ksp-client-registry (Cluster C)](https://github.com/advisories/GHSA-8mf7-79w4-6frj) - GitHub - [GHSA-7644-gqv2-mhcv - npm pay-methods-kmf (Cluster C)](https://github.com/advisories/GHSA-7644-gqv2-mhcv) - GitHub - [GHSA-pwj2-g23f-p5jg - npm deposit-limit-fe (Cluster C)](https://github.com/advisories/GHSA-pwj2-g23f-p5jg) - GitHub - [GHSA-p862-3rvq-8852 - npm liferay-workspace-scripts (Cluster D - ltidi.storage.googleapis.com/depenconf/)](https://github.com/advisories/GHSA-p862-3rvq-8852) - GitHub - [GHSA-7945-qpg8-rjvv - npm react-dropzone-v4 (Cluster D - OSSF Package Analysis flag)](https://github.com/advisories/GHSA-7945-qpg8-rjvv) - GitHub - [GHSA-fg5r-8pv8-mvc8 - npm react-paginate-v5 (Cluster D - canarytokens.com)](https://github.com/advisories/GHSA-fg5r-8pv8-mvc8) - GitHub - [OSSF malicious-packages PR #1615 - kmf-vendor-pack (Cluster D - oast.pro)](https://github.com/ossf/malicious-packages/pull/1615) - OpenSSF - [GHSA-m497-v5g4-6c4q - npm exodus-firestore-synchronize (Cluster D - STDOUT-only dep-confusion POC)](https://github.com/advisories/GHSA-m497-v5g4-6c4q) - GitHub - [OSSF malicious-packages PR #1607 - hardhat-option (Cluster E - hardhat-promised family, 167.88.172.33 stealer trio)](https://github.com/ossf/malicious-packages/pull/1607) - OpenSSF - [OSSF malicious-packages PR #1602 - css-nesting-transform (Cluster E - Wix impersonation, webhook.site)](https://github.com/ossf/malicious-packages/pull/1602) - OpenSSF - [OSSF malicious-packages PR #1610 - PyPI ig-gox (Cluster F - goxtools.shop encrypted loader)](https://github.com/ossf/malicious-packages/pull/1610) - OpenSSF - [OSSF malicious-packages PR #1613 - PyPI py2ops (Cluster F - trojaned python2 REPL)](https://github.com/ossf/malicious-packages/pull/1613) - OpenSSF - [DependencyWatch: rubygems-2026-10-12-wgkit-wave-2-crypto-defi-cluster (today`s companion carve-out, 24 crypto gems)](https://dependencywatch.io/incident/rubygems-2026-10-12-wgkit-wave-2-crypto-defi-cluster) - [DependencyWatch: npm-2026-10-12-hridoy-ultimate-fb-credential-stealer (today`s companion carve-out, FB credential sink)](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer) - [DependencyWatch: multi-2026-10-11-ghsa-malware-sweep (prior-day context: webreader+pafer pickle RAT, agentaix cluster)](https://dependencywatch.io/incident/multi-2026-10-11-ghsa-malware-sweep) - [DependencyWatch: multi-2026-10-10-ghsa-malware-sweep (prior-day context: s4yhii native-binary wave 1-2)](https://dependencywatch.io/incident/multi-2026-10-10-ghsa-malware-sweep) - [DependencyWatch: rubygems-2026-10-05-eth-crypto-wgkit-cluster (wgkit RubyGems operator wave 1)](https://dependencywatch.io/incident/rubygems-2026-10-05-eth-crypto-wgkit-cluster) --- Canonical page: https://dependencywatch.io/incident/multi-2026-10-12-ghsa-malware-sweep Markdown version: https://dependencywatch.io/incident/multi-2026-10-12-ghsa-malware-sweep.md Site index for agents: https://dependencywatch.io/llms.txt DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).