DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
HighAdvisory sweepPublished 13 Oct 202687 packages · 109 versions

GitHub Advisory malware sweep - 2026-10-13 (**Baileys/libsignal lure operator wave 3** - 60+ npm packages across `@revizahoshii/*`, `@fazzcodestudio/*`, `@sanzoffc/*`, `@wanzlonely/*`, `@mikudeveloper/*`, `@modss/*`, `@ikanngeming/*`, `@fhkryxv/*`, `@saazkira/*`, `@badzz88/*`, `@alipclutch/*`, `@mivesensei/*`, `@kanaraa/*`, `@chatunity/*`, `@zanta/*`, `@yudzxml/*`, `@zeronexcode/*`, plus `baileys-xbats`/`bailslonely`/`nakkinpm`/`amprem` unscoped - all CWE-506 boilerplate takedowns against `@WhiskeySockets/Baileys` WhatsApp-automation lures; **confirmed-payload carve-outs within the sweep**: PyPI `npp-ml` Notepad++ impersonator deploying ADExplorer AD-recon tool, PyPI `minecraftaccfinder` Gmail/Roblox/Discord/Minecraft infostealer+RAT with keylogger/screenshots/browser-creds, RubyGems `wallet-balance-scanner` fake-native-extension reverse-shell to hardcoded endpoint; **s4yhii wave 3 continuation** `@s4yhiitestpoc/r2-https-b` on `collector.oob.s4yhii.com`; plus 25+ dep-confusion probes at `99.x`/`100.x`/`101.x` sentinels: `@myorder-frontend-commons/*`, `risk-detection`, `unified-platform`, `@pinecone-experience/*`, `@airbnb-extended/*`, `@tesla-insurance/*`, `@user-services/*`, `app-sca-info-banking`, `com.apple.unityplugin.storekit` Apple-brand impersonator, and more)

Summary

GHSA 2026-10-12 batch (ingested 2026-10-13): ~90 fresh malware advisories, dominated by a Baileys/libsignal lure operator wave 3 of 60+ WhatsApp-automation-brand typosquats (continuation of 2026-10-10 Cluster C). Confirmed payloads: PyPI npp-ml Notepad++ impersonator deploying ADExplorer, PyPI minecraftaccfinder multi-platform infostealer+RAT, RubyGems wallet-balance-scanner fake-native-extension reverse shell. Plus @s4yhiitestpoc/r2-https-b continuing s4yhii wave 3 and 25+ dep-confusion sentinel probes.

infostealercredential-theftobfuscationdependency-confusionaccount-takeovertyposquatdns-exfiltration
Incident type
Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis · Amazon Inspector · kam193/bad-packages · npm security · PyPI security · RubyGems security
Also known as
2026-10-13 GHSA sweep · Baileys libsignal lure operator wave 3 · npp-ml Notepad++ ADExplorer AD-recon · minecraftaccfinder PyPI infostealer RAT · wallet-balance-scanner RubyGems reverse-shell · s4yhiitestpoc r2-https-b s4yhii wave 3 extension
Ecosystems
npmPyPIRubyGems
Packages tracked
87

What happened

Between 2026-10-12 06:11 UTC (yesterdays sweep cutoff) and 2026-10-13 (todays ingest-window start), the GitHub Advisory Database and OpenSSF malicious-packages published ~90 fresh malware advisories across npm, PyPI, and RubyGems. Three records carry confirmed functional payloads (worth a cluster each); the rest cluster into a 60+ package Baileys/libsignal lure operator wave 3 and a scattered 25+ dep-confusion sentinel probe batch.

Headline

60+ Baileys/libsignal-node typosquats in one UTC day - this is the third consecutive wave on this operator family (16 packages 2026-10-09, 13 packages 2026-10-10, now 60+ today). Every record is CWE-506 boilerplate ("fully compromised" wording) with no shipped runtime IOC; GitHub Security Lab appears to be bulk-flagging a long tail of brand-impersonation lures the operator has quietly been publishing. The @WhiskeySockets/Baileys WhatsApp-automation library is the real upstream being impersonated; the lure audience is small-business/consumer WhatsApp-bot developers running on cheap VPS instances.

Confirmed-payload carve-outs within the sweep

  • Cluster B npp-ml (PyPI, 0.1.7-0.1.9) - Notepad++ impersonator. On install, drops ADExplorer.exe (Microsoft Sysinternals Active Directory analysis tool). Payload is a signed Microsoft binary used for red-team AD enumeration; EDR will not alert, but LDAP telemetry from a dev workstation is the detection surface. Impersonation campaign tag 2026-10-npp-ml.
  • Cluster C minecraftaccfinder (PyPI, 0.1.0-3.0.0) - cross-platform infostealer+RAT. Confirmed capabilities: persistence, Gmail/Roblox/Discord/Minecraft credential theft, inbound C2 port, keylogger, screenshot capture, browser credential-vault extraction, anti-emulator detection. Reach is the Minecraft-cheat niche.
  • Cluster D wallet-balance-scanner (RubyGems, 0.9.1) - fake native extension. Declares a C extension to force extconf.rb execution on gem install, but ships no C source - the install script IS the payload, opening a reverse shell to a hardcoded endpoint named verbatim in OSSF OSV record MAL-2026-17799.json. Severity high because reverse-shell at gem install means every developer-workstation installer has already given the operator a shell.

Baileys/libsignal lure operator wave 3 (Cluster A)

Mass takedown of 60+ brand-impersonation lures against the Baileys WhatsApp-automation library. Publisher scopes seen today: @revizahoshii, @fazzcodestudio, @sanzoffc, @saazkira, @fhkryxv, @wanzlonely, @wanzlonelyy, @wanzxlonelyy, @modss, @mikudeveloper, @badzz88, @ikanngeming, @alipclutch, @mivesensei, @kanaraa, @chatunity, @zanta, @yudzxml, @zeronexcode, @xrelly-stack, @wenzyx1, @sakataoffc, @sairidev, @lekzo, @lekzo_dev, @lendxntaa, @nexustechpro, @astracode, @jojoxyz, @we3js. Unscoped slugs: baileys-xbats, bailslonely, nakkinpm, amprem, node-telegram-sockets, alipclutch-baileys. Each GHSA record is CWE-506 boilerplate with no technical analysis body; the scale, the uniform -baileys/-signal/-libsignal-node suffix, and the operator-side continuity with the 29+ packages already catalogued (2026-10-09 Cluster + 2026-10-10 Cluster C) confirm single long-running campaign.

s4yhii wave 3 continuation (Cluster E)

@s4yhiitestpoc/r2-https-b@1.0.0 extends yesterdays 3+5-slug wave 3. Same collector.oob.s4yhii.com/_npm-poc/beacon` postinstall JS pattern. See 2026-10-12 sweep for the full operator profile.

Dep-confusion sentinel probes (Cluster F)

25+ probes at 99.x / 100.x / 101.x / 3.0.0 / 99.9.1 / 0.0.0-stage sentinel versions, impersonating internal registries and corporate SDKs. Standout targets: @airbnb-extended/typescript-config (Airbnb brand), @tesla-insurance/vinless-quote (Tesla brand), com.apple.unityplugin.storekit (Apple Unity-plugin StoreKit SDK impersonator - the com.apple.* reverse-DNS naming is Unity Package Manager convention; any com.apple.* npm package is dep-confusion by construction), app-sca-info-banking (banking-industry internal registry), @myorder-frontend-commons/analytics (operator continuation at 14 sentinel versions on one slug), @library-wide/library-shell (standing operator from 2026-10-11 Cluster C). All CWE-506 boilerplate.

Duplicate GHSAs (Cluster G - cross-reference only)

GHSA re-publication for 9 packages already in the 2026-10-12 sweep: liferay-workspace-scripts (now also GHSA-rm73-xcfr-76qq), css-nesting-transform (now also GHSA-3p4f-rhj3-crjv), py2ops (now also GHSA-hfr2-qh7r-7xrr), @coopeuch/common/button/core/components/config (5 new GHSA IDs), and @s4yhiitestpoc/r3-https (new GHSA ID). No new material; the primary record stays with yesterday`s file.

Classification

sweep. Severity high taken as a whole, driven by three confirmed-payload clusters (B npp-ml, C minecraftaccfinder, D wallet-balance-scanner). The Baileys mass takedown (Cluster A) and the dep-confusion probes (Cluster F) would be medium on their own but do not reduce overall sweep severity.

Discovery

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector (IN-MAL feed), kam193/bad-packages, npm security, PyPI security, RubyGems security.

Affected packages (87)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.jsonCheck requirements.txt

Impact

  • *Cluster A - npm Baileys/libsignal lure operator wave 3 (malicious-package, 60+ packages continuing 2026-10-10 Cluster C @fer2809fl+cloud-baileys+arsya-baileys+`asepxyz 13-package set and 2026-10-09 Cluster @bellaxchuu/+@xayz/libsignal-node+my-baileys+@kxafunc/xbails 16-package set, all CWE-506 boilerplate takedowns against the @WhiskeySockets/Baileys` WhatsApp-automation consumer base, no vendor runtime analysis published): today adds a MASS wave of 60+ Baileys/libsignal-node/bails-named packages across many publisher scopes - 12 `@revizahoshii/ scope slugs (hoshino, hoshino-wam, hoshino-voip, hoshino-native, hoshino-mcp-server, hoshino-fake-server, hoshino-store-mongo, hoshino-store-mysql, hoshino-store-redis, hoshino-store-postgres, hoshino-store-sqlite, hoshino-media-utils, baileys), 5 @fazzcodestudio/ (fbot, wa-web, baileys, mediaformater, plus @we3js/framework from same publisher), 2 @sanzoffc/ (libsignal-node, baileys), 2 @saazkira/ (libsignal-node, baileys), 2 @fhkryxv/ (baileys-new, baileys), 5 @wanzlonely/ and @wanzlonelyy/ and @wanzxlonelyy/ (bails4u, bailslonely, bailsforme, bailsme), 3 @modss/+@mikudeveloper/ (baileys, libsignal, baileys+libsignal-node+grace), 2 @badzz88/ (baileys, eslint-config), 4 @ikanngeming/ (ikannbail, npm, blubub, plus unscoped ikanngeming), 2 @alipclutch/ + alipclutch-baileys, plus @mivesensei/baileys, @kanaraa/baileys, @chatunity/baileys, @zanta/baileys, @yudzxml/baileys, @zeronexcode/baileys, @xrelly-stack/bails, @wenzyx1/bails, @sakataoffc/baileys, @sairidev/baileys-new, @lekzo/baileys, @lekzo_dev/amprem, @lendxntaa/baileys, @nexustechpro/baileys, @astracode/byles-new, @jojoxyz/condemnedforce-baileys, and unscoped baileys-xbats, bailslonely, nakkinpm, amprem, node-telegram-sockets. All records are GHSA CWE-506 "fully compromised" boilerplate with no shipped IOC. The scale (60+ in one UTC day), the SAME -baileys/-signal/-libsignal-node naming suffix across unrelated-looking publisher accounts, and the operator continuity from the 29+ Baileys-lure packages already catalogued across the 2026-10-09 and 2026-10-10 sweeps all confirm a single long-running campaign against the Baileys WhatsApp-automation library consumer base. Severity medium` for the cluster taken alone (install-time recon per campaign pattern, no shipped IOC in these GHSAs)
  • Cluster B - PyPI npp-ml Notepad++ impersonator deploying ADExplorer AD-recon tool (malicious-package, confirmed payload with named tool): npp-ml (0.1.7, 0.1.8, 0.1.9; GHSA-hmg9-h2ww-x4x3, OSV MAL-2026-17xxx, campaign tag 2026-10-npp-ml). The packages own metadata presents itself as a Notepad++ distribution (impersonation + "other" are the two reasons listed on the OSV record), but on install it deploys ADExplorer (AD Explorer, Microsoft Sysinternals Active Directory discovery/analysis tool, built for red-team-grade AD enumeration). An attacker who gets a developer to pip install npp-ml under a Windows session with AD-joined credentials can enumerate the local domains entire user/group/OU/trust tree without raising native EDR alerts, because ADExplorer.exe is a signed Microsoft binary. Severity high (confirmed deployment of a named Sysinternals tool typically used for AD recon by operators preparing a lateral-movement stage; the tool itself has no outbound sink but the attacker gains full AD enumeration on the host)
  • Cluster C - PyPI minecraftaccfinder multi-platform infostealer+RAT (malicious-package, confirmed cross-platform infostealer+RAT with explicit payload capability list): minecraftaccfinder (0.1.0, 0.1.1, 0.1.2, 0.3.0, 0.3.1, 0.4.0, 2.0.0, 3.0.0; GHSA-gw9m-gc3w-389x, OSV MAL-2026-17809). On import the package (1) installs persistence and a RAT, (2) steals credentials with a focus on Gmail / Roblox / Discord / Minecraft, (3) opens an inbound port and waits for operator C2, (4) runs a keylogger, (5) periodically takes screenshots, (6) extracts credentials from the browser user-data directory, (7) uses detection-evasion/anti-emulator checks. The author shipped multiple non-working versions (0.1.0, 0.1.1, 0.1.2 are listed by the advisory as "may not be fully functional"), but 0.3.x and 2.0.0/3.0.0 are confirmed functional. Severity high (confirmed functional multi-platform infostealer+RAT with named stealer-module list; the Minecraft-cheat niche gives it reach into juvenile-user Windows-gaming hosts where credentials recycled across Discord/Google are catastrophic)
  • Cluster D - RubyGems wallet-balance-scanner fake-native-extension reverse shell (malicious-package, confirmed reverse-shell payload at gem install time; Oct 11 straggler not caught by the 2026-10-11 sweep): wallet-balance-scanner@0.9.1 (GHSA-g92c-g6pm-wf38, OSV MAL-2026-17799). The gem declares a native extension (so gem install runs its extconf.rb as part of the regular Ruby native-extension build pipeline), but ships NO C source and NO build artefact - instead the install script IS the payload, and runs during the install hook. It opens a reverse shell to a hardcoded remote endpoint (specific IOC in the OSSF OSV record MAL-2026-17799.json). The library code and README are decoy stubs completely unrelated to any wallet-scanning functionality. This is a strict operator-side reproduction of the extconf.rb-is-the-payload technique seen earlier this year on the rubygems-2026-05-11-gemstuffer-flood wave. Severity high for this package alone (confirmed reverse-shell to attacker-controlled endpoint on any gem install; dev-workstation targeting). Grouped into today`s sweep as a one-package carve-worthy item that is small enough not to justify its own file
  • Cluster E - npm @s4yhiitestpoc/r2-https-b s4yhii wave 3 additional slug (malicious-package, operator continuation of yesterday`s s4yhii wave 3): @s4yhiitestpoc/r2-https-b@1.0.0 (GHSA-whjq-6xm5-ggvh). Same collector.oob.s4yhii.com/_npm-poc/beacon postinstall JS + DNS-exfil pattern as yesterdays 3 @s4yhiitestpoc/ + 5 @coopeuch/ Cluster A (see [2026-10-12 sweep](/incident/multi-2026-10-12-ghsa-malware-sweep) for the full operator profile). Severity medium for this one package (install-time recon beacon, no second-stage payload disclosed), but KEEP the s4yhii.com` apex on the standing CI/build-host egress denylist
  • Cluster F - npm dep-confusion probes and standalone malicious packages (dependency-confusion or malicious-package depending on name pattern; 25+ packages, all CWE-506 boilerplate takedowns): today adds another large batch of dep-confusion sentinel-version probes against internal-registry namespaces: @myorder-frontend-commons/analytics (14 sentinel versions 0.0.0-stage through 101.0.0 - the broadest sentinel-version sweep of the day; MAL-2026-17xxx continuation of yesterdays @myorder-frontend-commons/ dep-confusion scope); @pinecone-experience/messages, @airbnb-extended/typescript-config (Airbnb-brand impersonator - @airbnb/ is a real published scope so this is dep-confusion against an internal registry, not an npmjs typosquat), @tesla-insurance/vinless-quote (Tesla-brand impersonator), @user-services/web-components (internal scope impersonator), @zaka13/zakasite, @dransay/api (continuation of the @dransay/ 2026-10-09 operator), @smwebserver/static, com.apple.unityplugin.storekit` (Apple Unity-plugin StoreKit SDK impersonator - the `com.apple. reverse-DNS naming is Unity Package Manager convention, so this is dep-confusion targeting a Unity-based iOS/App-Store teams internal registry; blocking this is high-value for any Unity+iOS dev org), @library-wide/library-shell (standing operator continuation from 2026-10-11 Cluster C), risk-detection, unified-platform, app-sca-info-banking (banking-industry internal-registry impersonator), eslint-config-compact-base, webpackbootstrap5, helpersutils-dev-tools, testmgkregme, npmscript_tesstalert_unpkg, ap3-foundations-ui, api-nebula, llm-nebula, pino-testkit (pino-ecosystem impersonator), node-telegram-sockets (Telegram-ecosystem impersonator). Severity medium for each (CWE-506 boilerplate, no shipped runtime IOC)
  • Cluster G - duplicate GHSAs for packages already catalogued (noted for the audit trail): GHSA re-publication for 9 packages already in the 2026-10-12 sweep - liferay-workspace-scripts (GHSA-rm73-xcfr-76qq is a dup for a package also at GHSA-p862-3rvq-8852), css-nesting-transform (GHSA-3p4f-rhj3-crjv dup of GHSA; from the @webhook.site Wix-impersonation operator), py2ops (GHSA-hfr2-qh7r-7xrr dup), and new GHSA IDs for the 5 @coopeuch/* + 1 @s4yhiitestpoc/r3-https slugs already covered yesterday. No new material - cross-referenced here so a lockfile scan sees the full picture; the primary record lives in yesterday`s file
  • Operator continuity: todays material continues several operators tracked across this week: **Baileys/libsignal lure operator** (wave 3 - 60+ packages after yesterdays nothing, 2026-10-10s 13 packages, and 2026-10-09s 16 packages; same brand-impersonation campaign against @WhiskeySockets/Baileys WhatsApp-automation consumers), s4yhii operator wave 3 (@s4yhiitestpoc/r2-https-b extends yesterdays 3+5 package set; collector.oob.s4yhii.com/_npm-poc/beacon remains active), **@dransay/` dep-confusion operator (quiet since 2026-10-09, resurfaced today with @dransay/api), `@myorder-frontend-commons/ dep-confusion operator** (yesterdays single-slug entry expanded today to 14 sentinel versions on one slug), *`@library-wide/ dep-confusion operator** (@library-wide/library-shell had a fresh GHSA dup today). The TensorLake AI maintainer compromise ([2026-10-08 carve-out](/incident/npm-2026-10-08-tensorlake-maintainer-compromise)) remains quiet at tensorlake@0.5.145 with no wave-2 republish. **No new activity** from: 185.158.107.175:8787/_ah/dc operator (yesterdays Cluster B went quiet), 64.181.165.115/dc operator (yesterdays Cluster C quiet), hardhat-promised operator (hardhat-option cluster quiet), ig-gox operator (quiet, standing denylist entry still in place), agentaix operator (2026-10-11 cluster quiet), wgkit RubyGems operator (yesterdays wave 2 carve-out quiet), xwise8887, sharpnes crates.io, @tunstock/remact-dom, Wix dep-confusion, nfjbill, @bitwardne/*, reaperhackbot256f all quiet

What to do

  1. 1For Cluster A (Baileys/libsignal lure operator wave 3 - 60+ packages): grep every package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, npm-shrinkwrap.json for any of the 60+ names listed below. On hit, treat as a WhatsApp-automation lure (the Baileys-consumer audience often runs these on cheap VPS instances for mass-messaging workloads, so credential rotation on hit should include VPS cloud-provider API keys and any Telegram/WhatsApp bot tokens on the host). Add publisher scopes to the internal denylist: @revizahoshii, @fazzcodestudio, @sanzoffc, @saazkira, @fhkryxv, @wanzlonely, @wanzlonelyy, @wanzxlonelyy, @modss, @mikudeveloper, @badzz88, @ikanngeming, @alipclutch, @mivesensei, @kanaraa, @chatunity, @zanta, @yudzxml, @zeronexcode, @xrelly-stack, @wenzyx1, @sakataoffc, @sairidev, @lekzo, @lekzo_dev, @lendxntaa, @nexustechpro, @astracode, @jojoxyz, @we3js. The ONLY legitimate Baileys upstream is @whiskeysockets/baileys (lowercase, hyphen-free) on npm; teach contributors that any other scope hosting a baileys package is a lure
  2. 2For Cluster B (PyPI npp-ml Notepad++ impersonator + ADExplorer AD-recon deployment): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda env for npp-ml (versions 0.1.7, 0.1.8, 0.1.9). On ANY hit on a Windows host with an AD-joined session, treat the full local domain as recon-enumerated: assume the operator has pulled the entire user/group/OU/trust tree. Rotate privileged service-account passwords, review Kerberoastable SPNs, audit for anomalous LDAP searches during the exposure window, and quarantine the host. The ADExplorer.exe deployment is signed Microsoft Sysinternals so native EDR will NOT alert on it - rely on process-launch telemetry naming the executable or network telemetry showing LDAP enumeration from a dev workstation. Teach the correct spelling: Notepad++ has NO legitimate pip install distribution; npp-ml is an impersonator
  3. 3For Cluster C (PyPI minecraftaccfinder infostealer+RAT): grep every Python manifest for minecraftaccfinder (0.1.0 through 3.0.0 - the 0.1.x line was non-functional per the advisory, but a non-functional stealer attempt still means a developer intended to install a malware package, so the host should be considered compromised regardless of version). On hit, assume: Gmail/Roblox/Discord/Minecraft credentials stolen, keylogger active, periodic screenshots exfiltrated, browser credential vault emptied, inbound port awaiting operator C2. This is Minecraft-cheat/account-finder niche - juvenile-user Windows-gaming hosts; credential rotation must cover Discord tokens, Google account recovery flows, Minecraft/Microsoft accounts, Roblox accounts, and any browser-stored passwords. Image the host
  4. 4For Cluster D (RubyGems wallet-balance-scanner reverse-shell): grep every Gemfile.lock, Gemfile, .gemspec, gems/cached/ for wallet-balance-scanner@0.9.1. On hit, assume a reverse-shell has already run during gem install (the extconf.rb-is-the-payload technique means the shell fires at install time with no explicit opt-in). Treat the developer workstation as fully compromised. Audit for persistent reverse-shell artefacts (added SSH keys to ~/.ssh/authorized_keys, cron entries, LaunchAgents on macOS, systemd user units on Linux, Scheduled Tasks on Windows), rotate any credential the Ruby process could have reached (AWS keys in ~/.aws/credentials, GitHub tokens, SSH keys, 1Password/Bitwarden session tokens), and add the hardcoded remote endpoint from the OSV record MAL-2026-17799.json to the standing egress denylist
  5. 5For Cluster E (@s4yhiitestpoc/r2-https-b npm, s4yhii wave 3 extension): grep for @s4yhiitestpoc/r2-https-b. On hit, same remediation as yesterdays Cluster A (install-time recon beacon leaks host, user, network, DNS, container, CI metadata to collector.oob.s4yhii.com/_npm-poc/beacon; rotate credentials the Node runtime could reach; keep the s4yhii.com apex on the egress denylist). The s4yhiitestpoc` naming suggests this operator is iterating on test POCs - expect more slugs under the same scope in coming days
  6. 6For Cluster F (dep-confusion probes): grep for all 25+ Cluster F slugs. On hit, remove, invalidate any Docker layer or build cache that ran npm install, and audit CI logs for environment-variable leakage. Add publisher scopes to the internal denylist: @myorder-frontend-commons, @pinecone-experience, @airbnb-extended, @tesla-insurance, @user-services, @zaka13, @dransay, @smwebserver, com.apple.* on npm (the com.apple.* reverse-DNS naming is Unity Package Manager convention and should NOT appear on npm; any com.apple.* npm package is dep-confusion by construction), @library-wide. If your organisation ships internal registries that could be confused with any of these scopes, scope-lock the internal registry (npm config set @scope:registry https://internal-registry) and hold the public scope with placeholder packages at a safe version. The Airbnb, Tesla, and Apple-brand impersonators specifically target orgs with internal Unity/iOS/corporate SDK pipelines - audit those pipelines first
  7. 7For Cluster G (duplicate GHSAs): no new action required - these are cross-reference GHSA IDs for packages already in the 2026-10-12 sweep; if your SBOM has flagged these new GHSA IDs you can confirm by matching the package names to the Oct 12 record
  8. 8NEW outbound denylist entries for CI/build-host egress proxies today: the hardcoded reverse-shell endpoint in MAL-2026-17799.json (Cluster D - wallet-balance-scanner; endpoint IP is in the OSSF OSV record), and the publisher scopes listed in Cluster A and Cluster F recommendations. Keep prior egress blocks in place: collector.oob.s4yhii.com + *.oob.s4yhii.com + s4yhii.com apex (Cluster E continuation), 64.181.165.115/dc, 167.88.172.33:8087 + jsonspack.com publisher-email, goxtools.shop apex, minhdong.site apex + GitHub user VangBanLaNhat, 45.138.12.177:8089, 185.158.107.175:8787, ltidi.storage.googleapis.com/depenconf/, oob.s4yhii.com:9999/native, *.oast.pro/*.oast.me/*.oast.fun/*.oast.site/*.oastify.com, frjmzbjbhwvtdnsuodmu.supabase.co, api.npoint.io apex, googleforum.pythonanywhere.com, tele.metry.orgin.net, morroncr0w.io, api.telegram.org on untrusted CI/build hosts, appsecc.com, webhook.site/*, dxpoc.gt.tc, nfjbill.ren, storage.googleapis.com/depenconf/, 10.0.19.0/24 + 10.0.49.0/24, api.nm-streetwear.space, Discord webhook URL pattern, ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, chinazhangsan.ccwu.cc, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil patterns, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com publisher-email domain, 45.138.0.0/16 RubyGems wgkit CIDRs

References

Back to feedSubmit a correction
multi-2026-10-13-ghsa-malware-sweep