GitHub Advisory malware sweep, 14 October 2026

The full picture

23 packages 34 versions

• npm@accenturecodefoundry/mfe-pot-shared-ui-scds-core99.99.299.99.499.99.41→
• npm@chatest/baileys*→
• npm@kre64/hello-npm-test1.0.0→
• npm@newspage/lib-ng-async-routes-ui*→
• npm@newspage/libx-amount*→
• npmbrass-common99.9.1→
• PyPIcrelic-bqwheel-52f66a3f1d0.0.1→
• PyPIfontcase0.1.00.1.10.1.2→
• npmopencode2*→
• npmopencode2-darwin-arm64*→
• npmopencode2-darwin-x64*→
• npmopencode2-linux-arm64*→
• npmopencode2-linux-arm64-musl*→
• npmopencode2-linux-x64*→
• npmopencode2-linux-x64-musl*→
• npmopencode2-windows-arm64*→
• npmopencode2-windows-x64*→
• npmorderly-plugin-liquidity-heatmap1.0.01.0.11.0.21.0.31.0.41.0.6→
• npmpasswordcracker*→
• npmpasswordcrackv2*→
• PyPIpyyi2.4.1→
• PyPIsysdiagd1.2.11.2.21.2.3→
• npmyoodan-github-single-ver-pkg1.0.1→

What it does if you installed it

• Cluster A - npm orderly-plugin-liquidity-heatmap GitHub Actions GITHUB_TOKEN abuse (malicious-package, confirmed payload with novel CI-token write-back mechanism): orderly-plugin-liquidity-heatmap (1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.6; GHSA-fp2f-2254-46g7, OSV MAL-2026-17848). Publisher dumtban on npm pushed six versions between 13:12 and 16:05 UTC on 2026-10-11, each extending the previous versions reach into the installers CI runner. The package exports an empty stub and advertises itself as "a liquidity heatmap plugin for the Orderly Network orderbook widget" - the real behavior is in a postinstall hook that runs node ./scripts/setup.js. On an installers GitHub Actions runner the hook: (1) collects runner host, user, repository name, environment variable names, GITHUB_TOKEN presence and length, and network egress; (2) requests an OIDC token from ACTIONS_ID_TOKEN_REQUEST_URL; (3) **from 1.0.2 onwards, uses the workflows GITHUB_TOKEN to commit heatmap-setup-report.json to the default branch of the installing repository (a verifiable write-back indicator); (4) from 1.0.4/1.0.6, additionally force-pushes a heatmap-setup-<timestamp> git tag using the credentials that actions/checkout persists in .git/config*. Credited to InvisiRisk, Inc. Severity high on this package alone - the CI-token write-back means every victim repo whose default branch has heatmap-setup-report.json or whose tag list has a `heatmap-setup-` tag has already given the operator write access to their default branch at least once; roll back those commits/tags, rotate anything the workflow could reach, and investigate what other write-backs the operator may have made under the same token
• Cluster B - PyPI fontcase infostealer + Telegram bot C2 (malicious-package, confirmed payload with named stealer-module list): fontcase (0.1.0, 0.1.1, 0.1.2; GHSA-g72q-7v8m-7r9j, OSV MAL-2026-17862, campaign tag 2026-10-fontcase). On import, the package downloads and executes process-manager.exe from github.com/unicodeces/font-atlas (three distinct raw-file URLs plus the repo page serve the same payload). The infostealer uses a Telegram bot for C2 and exfiltrates browser data and credentials. A VirusTotal detection page, a Tria.ge sandbox report, and the kam193 reporters own detail page corroborate the behavior. Severity high for this package alone (confirmed infostealer with named sink and payload URL - any pip install fontcase` on a Windows host with a browser profile should be treated as credential-compromised)
• Cluster C - PyPI sysdiagd Discord-bot RAT (malicious-package, confirmed multi-capability RAT+infostealer+spyware): sysdiagd (1.2.1, 1.2.2, 1.2.3; GHSA-64w9-pjq6-x8rh, OSV MAL-2026-17861, campaign tag 2026-10-sysdiagd). The package presents itself as a system monitoring tool but delivers a Discord bot acting as a RAT. Confirmed capabilities per the OSV record: credentials, browser data, and file theft; audio recording, screenshot capture, video capture; persistence; infostealer and spyware. The bot needs operator-supplied Discord credentials to activate - installations without the operators credentials are latent but every pip install sysdiagd has still installed a RAT whose activation is one Discord token away. Severity high` for this package alone (confirmed multi-capability RAT at import time)
• Cluster D - PyPI pyyi python2 interpreter impersonator (malicious-package, confirmed covert REPL input capture + in-memory remote-payload exec): pyyi (2.4.1; GHSA-4vr9-vg98-9xpf, OSV MAL-2026-17866, wheel SHA-256 003828175a747a9a3de8029e6a028ad2c3739abf1dad7b468b25636e391e91f4). The wheel declares a console command named python2 (entry point pyyi.cli:main). On first run the REPL registers with preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai/api/cli/init (host+OS fingerprint), stores the returned apiKey in ~/.python2/config.json, then shows a NORMAL Python banner so the operator cannot tell they are inside the impersonator. Single-token user inputs that match the eligibility filter are silently POSTed to /api/cli/unlock as the password field (that is: any string a developer types at a REPL prompt expecting Python 2 behavior could be leaked). The run_payload() path fetches code from /api/cli/payload, decodes/decompresses it, and runs it in memory via exec at pyyi/cli.py:640. Severity high (confirmed functional covert REPL exfil + remote in-memory exec; any dev who ran python2 on a host where pyyi was installed has leaked whatever they typed to space-z.ai)
• Cluster E - npm @accenturecodefoundry/mfe-pot-shared-ui-scds-core Accenture internal-scope dep-confusion with confirmed C2 (dependency-confusion, confirmed payload beyond CWE-506 boilerplate): @accenturecodefoundry/mfe-pot-shared-ui-scds-core (99.99.2, 99.99.4, 99.99.41; GHSA-36v8-chg8-q674, OSV MAL-2026-17867). Operator priyashareek on npm. Preinstall hook node index.js || true runs on install (the || true suppresses errors so the install succeeds silently). Beacon payload by version: 99.99.2 sends hex-encoded hostname+username to accenture-npm.azurewebsites.net/test; 99.99.4 beacons accenture-npm.azurewebsites.net/async; 99.99.41 beacons accenture-npm.azurewebsites.net/mfe. Each beacon leaks the victims egress IP and confirms the dep-confusion resolved against Accenture Code Foundrys internal registry. Same publisher also controls @newspage/libx-amount and @newspage/lib-ng-async-routes-ui, which call back to the same host (second internal-scope target @newspage on the same operator). Credited by InvisiRisk, Inc. and SafeDep. Severity high for this cluster alone (dep-confusion WITH confirmed C2 - unlike most dep-confusion probes which stop at a DNS beacon, this one has an actual outbound HTTPS write and a developing payload surface). Any Accenture Code Foundry team using @accenturecodefoundry/* or @newspage/* internally should scope-lock their internal registry immediately
• Cluster F - npm passwordcracker+passwordcrackv2 kingsize-operator limbomail.com+lunexindonesia/node-net-pool continuation of discord-mfa-solver campaign (malicious-package, confirmed Windows RAT loader with persistence): passwordcracker (all versions; GHSA-jwr3-9ch5-2qw5, OSV MAL-2026-17864) and passwordcrackv2 (all versions; GHSA-75f2-wpm3-2h52, OSV MAL-2026-17865). Operator kingsize on npm, published 2026-10-09/10. Both packages claim to be a "dependency-free Discord MFA library"; both ship identical loader code in lib/cache.js (SHA-256 40ad444731103c356ac7643b1a58e6093fcce1ea2f43977fb07f34833d37178a) that require()s node-net-pool on load. node-net-pool is pulled from github.com/lunexindonesia/node-net-pool and github.com/trktgq0wbre1/node-net-pool. On Windows the second stage downloads a third-stage script from limbomail.com, saves it as a hidden winsvc.js in %APPDATA%, %LOCALAPPDATA%, or %TEMP%, and launches it via a hidden WinSvcHost.vbs. Persistence through HKCU Run (value WinSvcHost), RunOnce (value WinSvcHostUpd), UserInitMprLogonScript, and a WinSvcHost.lnk Startup shortcut; the loader re-checks for updates every two hours. Same loader stub previously appeared in discord-mfa-solver (MAL-2026-16100, discord-mfa v3.0.1, mfaby v1.0.0, mfakit) - this is a 4th+5th package in the long-running kingsize/limbomail.com Windows-RAT campaign targeting the Discord-MFA niche. Severity high for this cluster (confirmed functional Windows RAT with persistence; dev-workstation and juvenile-user hosts; credentials recycled across Discord/Google/Microsoft catastrophic)
• *Cluster G - npm `opencode2 10-slug typosquat family of @opencode-ai/cli (typosquat, 10 packages, all CWE-506 boilerplate takedowns following the real @opencode-ai/cli platform-binary split)**: opencode2 (GHSA-8w65-j2wh-mqv7, OSV MAL-2026-17852) plus 9 platform-binary slugs matching the real @opencode-ai/cli prebuild distribution pattern: opencode2-darwin-arm64 (GHSA-36mq-frp2-jc97), opencode2-darwin-x64 (GHSA-pmv2-r2q9-rmg9), opencode2-linux-arm64 (GHSA-xwcq-r6hw-mc5p), opencode2-linux-arm64-musl (GHSA-cm8m-24p9-hh65), opencode2-linux-x64 (GHSA-3jr5-3qvm-r54h), opencode2-linux-x64-musl (GHSA-qx7m-vw4p-xv3j), opencode2-windows-arm64 (GHSA-xr5m-85hf-27r5), opencode2-windows-x64 (GHSA-6x5j-r784-fx6j), opencode2-darwin-arm64 (GHSA-36mq-frp2-jc97). The real opencode SST CLI publishes a top-level package plus one per-platform binary slug via optionalDependencies, so a opencode2 typosquat installing the matching platform binary is a transparent 1-to-1 mimic of the authentic distribution shape - meaning a developer who runs npm install opencode2 will cross-fetch whichever platform-arch slug matches their OS without any additional CLI argument. All CWE-506 "fully compromised" boilerplate advisories with no shipped IOC body. Severity medium` for the typosquat (install-time code execution risk per OSSF typosquat pattern, no vendor runtime analysis published yet)
• Cluster H - npm @chatest/baileys Baileys lure operator wave 3 continuation (malicious-package, continuation of 2026-10-13 sweep Cluster A @WhiskeySockets/Baileys WhatsApp-automation lure campaign): @chatest/baileys (all versions; GHSA-c2gc-jwcq-w8r3). The @chatest scope is a new 61st family in the Baileys/libsignal lure operator wave 3 that peaked on 2026-10-13 with 60+ packages across 30+ publisher scopes. CWE-506 "fully compromised" boilerplate with no shipped IOC. Same operator-side pattern: brand-impersonation of the real @WhiskeySockets/baileys WhatsApp-automation library consumer base (small-business/consumer WhatsApp-bot developers on cheap VPS instances). Severity medium for the cluster alone (install-time recon per campaign pattern, no shipped IOC in this GHSA)
• Cluster I - npm/PyPI dep-confusion probes and pentest artefacts (dependency-confusion or malicious-package; 4 packages, all low-info CWE-506 boilerplate): brass-common@99.9.1 (npm, GHSA-fcgr-wqxm-5qqr, OSV MAL-2026-17849 - OpenSSF Package Analysis flagged "communicates with a domain associated with malicious activity"; sentinel version 99.9.1 is the signature); crelic-bqwheel-52f66a3f1d@0.0.1 (PyPI, GHSA-xwrx-mm2v-334v, OSV MAL-2026-17863 - package self-describes as "research for BigQuery user-defined functions"; collects hostname/IP/username; abuses Python .pth files to run code at interpreter startup; classified by OSSF as "probably pentest" but still malicious); @kre64/hello-npm-test@1.0.0 (npm, GHSA-c43r-xf4h-m548 - test-pattern name, CWE-506 boilerplate only); yoodan-github-single-ver-pkg@1.0.1 (npm, GHSA-2946-w5c6-hcw2 - "single-version package" naming is the signature of a 2024-era bug-bounty automation probe). Severity medium for each (CWE-506 boilerplate; brass-common and crelic-bqwheel-52f66a3f1d have corroborating OpenSSF notes, the other two are plain takedowns)
• Operator continuity: todays material continues several operators tracked across this week: **Baileys/libsignal lure operator wave 3** (@chatest/baileys extends yesterdays 60+ package wave to 61 scopes - same @WhiskeySockets/Baileys consumer-base targeting). kingsize+limbomail.com+lunexindonesia/node-net-pool discord-mfa Windows-RAT campaign (passwordcracker + passwordcrackv2 are the 4th and 5th package in the chain previously comprising discord-mfa-solver, discord-mfa, mfaby, mfakit). priyashareek Accenture+@newspage dep-confusion operator (new today - 3 Accenture-brand versions + 2 @newspage sibling packages targeting the same accenture-npm.azurewebsites.net C2). dumtban orderly-plugin GitHub Actions CI-token-abuse operator (new today - 6-version burst on 2026-10-11, 3 hours of iteration refining the GITHUB_TOKEN write-back payload). kam193 continues as the top PyPI malware reporter (fontcase, sysdiagd, and other recent carve-outs attributed). No new activity from: s4yhii operator (yesterdays wave 3 quiet after @s4yhiitestpoc/r2-https-b), 185.158.107.175 operator, 64.181.165.115 operator, hardhat-option operator, agentaix operator, wgkit RubyGems operator, xwise8887, sharpnes crates.io, @tunstock/remact-dom, Wix dep-confusion, nfjbill, @bitwardne/*, reaperhackbot256f, ig-gox all quiet. TensorLake AI maintainer compromise ([2026-10-08 carve-out](/incident/npm-2026-10-08-tensorlake-maintainer-compromise)) remains quiet at tensorlake@0.5.145` with no wave-2 republish

Clean-up steps

1. 1For Cluster A (orderly-plugin-liquidity-heatmap CI-token abuse): grep every package.json, package-lock.json, yarn.lock, pnpm-lock.yaml for orderly-plugin-liquidity-heatmap (versions 1.0.0-1.0.6). On ANY hit on a repo whose CI runs npm install with a GITHUB_TOKEN: (1) check the default branch git log for a commit adding heatmap-setup-report.json and REVERT it; (2) list repository tags for anything matching heatmap-setup-* and DELETE them (git push origin --delete tag heatmap-setup-<timestamp>); (3) check for heatmap-exec-trace.log under any CI artifact storage; (4) rotate every secret, OIDC trust, and PAT the workflows GITHUB_TOKEN could reach; (5) audit any OTHER commits or tags pushed from that workflow in the exposure window (the operator may have made additional write-backs under the same token the advisory did not catalogue). This operators write-back mechanism means the usual "remove node_modules, pin away" response is insufficient - you also need to clean up the repository state the operator left behind
2. 2For Cluster B (PyPI fontcase infostealer + Telegram bot): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda env for fontcase (versions 0.1.0, 0.1.1, 0.1.2). On hit, assume: Telegram-bot C2 established, browser credential vault extracted, process-manager.exe dropped from github.com/unicodeces/font-atlas. Block the GitHub repo unicodeces/font-atlas at any workstation egress filter (its raw-file URLs are the payload serve). Image the host. The Telegram-bot pattern means the operator can walk back the C2 trail from Telegram if you capture the bot token in an on-host IR step
3. 3For Cluster C (PyPI sysdiagd Discord RAT): grep for sysdiagd (versions 1.2.1, 1.2.2, 1.2.3). On hit on a Windows/Linux dev host, assume the RAT is installed and latent (waiting for operator Discord credentials). Image the host regardless of whether the operator has activated it - a latent RAT with persistence is still a persistent presence. Audit for Discord bot-token traffic. Rotate browser-stored credentials and 2FA seeds
4. 4For Cluster D (PyPI pyyi python2 impersonator): grep for pyyi (version 2.4.1). On hit, treat EVERY developer that typed into python2 on that host as having leaked their input to space-z.ai. Rotate the specific credentials they would have typed at a REPL prompt (one-off API tokens pasted for a smoke test, DB connection strings tested from a shell, SSH keys unlocked at a prompt). Block space-z.ai apex at egress; delete ~/.python2/config.json; audit ~/.local/bin/python2 and remove it. Teach contributors that python2 is end-of-life and the ONLY python2 command is one your distro or pyenv installed - a python2 installed by pip is an impersonator by construction
5. 5For Cluster E (@accenturecodefoundry + @newspage Accenture dep-confusion): grep for @accenturecodefoundry/mfe-pot-shared-ui-scds-core (99.99.2, 99.99.4, 99.99.41), @newspage/libx-amount, @newspage/lib-ng-async-routes-ui. Any Accenture Code Foundry team using @accenturecodefoundry/* or @newspage/* internally should immediately scope-lock the internal registry (npm config set @accenturecodefoundry:registry https://internal-registry && npm config set @newspage:registry https://internal-registry) and hold both public scopes with placeholder packages at a safe version. Block accenture-npm.azurewebsites.net at egress on all CI/build hosts. Audit CI logs for outbound requests to /test, /async, /mfe under that host. The sentinel-version pattern (99.99.x) is the dep-confusion operator-side signature - teach contributors that any 99.99.* npm version is suspect by construction
6. 6For Cluster F (passwordcracker+passwordcrackv2 limbomail.com continuation): grep for passwordcracker, passwordcrackv2, and the sibling discord-mfa-solver, discord-mfa, mfaby, mfakit (any version of any of them). On a Windows host that installed any of these, treat as fully compromised: check %APPDATA%, %LOCALAPPDATA%, %TEMP% for winsvc.js and WinSvcHostCfg.vbs; check HKCU Run for value WinSvcHost, RunOnce for WinSvcHostUpd, UserInitMprLogonScript; check Startup folder for WinSvcHost.lnk; purge all of them. Add limbomail.com apex to the standing egress denylist; add github.com/lunexindonesia/node-net-pool and github.com/trktgq0wbre1/node-net-pool to the egress block (any node-net-pool npm/GitHub reference is suspect). Rotate Discord tokens, Microsoft Account, Google Account credentials - the Discord-MFA niche overlaps with juvenile-user hosts where credential reuse is the norm
7. 7*For Cluster G (`opencode2 typosquat family)**: grep for the top-level opencode2 AND any of its 9 platform-binary slugs opencode2-darwin-arm64, opencode2-darwin-x64, opencode2-linux-arm64, opencode2-linux-arm64-musl, opencode2-linux-x64, opencode2-linux-x64-musl, opencode2-windows-arm64, opencode2-windows-x64. On hit, remove and pin away; the real package is @opencode-ai/cli (or opencode top-level, which also exists under the opencode-ai org) - teach contributors the authentic name and warn that opencode2` is a typosquat. CWE-506 boilerplate means the specific payload is undocumented; treat the install as credential-compromised until Socket or a vendor publishes a runtime analysis
8. 8For Cluster H (@chatest/baileys Baileys lure wave 3 extension): grep for @chatest/baileys (any version). Standing guidance from yesterdays wave 3 cluster A still applies: the ONLY legitimate upstream is @whiskeysockets/baileys (lowercase, hyphen-free). Add @chatest scope to the internal denylist alongside the 30+ Baileys-lure scopes from yesterdays sweep. If any WhatsApp-automation workload installed @chatest/baileys, rotate the VPS cloud-provider API keys and any Telegram/WhatsApp bot tokens on the host (Baileys-consumer audience pattern)
9. 9For Cluster I (small dep-confusion/pentest probes): grep for brass-common@99.9.1 (npm), crelic-bqwheel-52f66a3f1d@0.0.1 (PyPI), @kre64/hello-npm-test@1.0.0 (npm), yoodan-github-single-ver-pkg@1.0.1 (npm). On hit, remove, invalidate any Docker layer or build cache that ran npm install/pip install, and audit CI logs for environment-variable leakage. For crelic-bqwheel-52f66a3f1d, also check ~/.pth files and site-packages/*.pth for interpreter-startup hijacks
10. 10NEW outbound denylist entries for CI/build-host egress proxies today: accenture-npm.azurewebsites.net apex + /test + /async + /mfe paths (Cluster E @accenturecodefoundry + @newspage dep-confusion C2); limbomail.com apex (Cluster F passwordcracker third-stage payload serve); github.com/lunexindonesia/node-net-pool + github.com/trktgq0wbre1/node-net-pool repo URLs (Cluster F loader source); github.com/unicodeces/font-atlas repo URL (Cluster B fontcase payload serve - block raw-file access specifically); space-z.ai apex + preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai + b196q82k8891-d.space-z.ai subdomains (Cluster D pyyi REPL C2). Keep prior egress blocks in place: collector.oob.s4yhii.com + *.oob.s4yhii.com + s4yhii.com apex, 64.181.165.115/dc, 167.88.172.33:8087 + jsonspack.com publisher-email, goxtools.shop apex, minhdong.site apex + GitHub user VangBanLaNhat, 45.138.12.177:8089, 185.158.107.175:8787, ltidi.storage.googleapis.com/depenconf/, oob.s4yhii.com:9999/native, *.oast.pro/*.oast.me/*.oast.fun/*.oast.site/*.oastify.com, frjmzbjbhwvtdnsuodmu.supabase.co, api.npoint.io apex, googleforum.pythonanywhere.com, tele.metry.orgin.net, morroncr0w.io, api.telegram.org on untrusted CI/build hosts, appsecc.com, webhook.site/*, dxpoc.gt.tc, nfjbill.ren, storage.googleapis.com/depenconf/, 10.0.19.0/24 + 10.0.49.0/24, api.nm-streetwear.space, Discord webhook URL pattern, ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, chinazhangsan.ccwu.cc, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil patterns, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com publisher-email domain, 45.138.0.0/16 RubyGems wgkit CIDRs

Sources

• GitHub Advisory Database - recent malware advisoriesgithub.comGitHub
• GHSA-fp2f-2254-46g7 - npm orderly-plugin-liquidity-heatmap (Cluster A - GITHUB_TOKEN write-back to victim repo, MAL-2026-17848, publisher dumtban, 6 versions in 3h)github.comGitHub
• OSSF malicious-packages MAL-2026-17848 raw record (orderly-plugin-liquidity-heatmap IOCs: heatmap-setup-report.json, heatmap-setup-* tags, heatmap-exec-trace.log, per-version SHA-256s)github.comOpenSSF
• GHSA-g72q-7v8m-7r9j - pypi fontcase (Cluster B - infostealer + Telegram bot, campaign 2026-10-fontcase, MAL-2026-17862)github.comGitHub
• OSSF malicious-packages MAL-2026-17862 raw record (fontcase: process-manager.exe payload from github.com/unicodeces/font-atlas, Telegram bot C2, VirusTotal + Tria.ge references)github.comOpenSSF
• GHSA-64w9-pjq6-x8rh - pypi sysdiagd (Cluster C - Discord-bot RAT with cred/browser/file theft + audio/screenshot/video capture, campaign 2026-10-sysdiagd, MAL-2026-17861)github.comGitHub
• OSSF malicious-packages MAL-2026-17861 raw record (sysdiagd Discord-bot infostealer+RAT capability list)github.comOpenSSF
• GHSA-4vr9-vg98-9xpf - pypi pyyi (Cluster D - python2 REPL impersonator, space-z.ai C2 /api/cli/init /unlock /payload, in-memory exec, MAL-2026-17866)github.comGitHub
• OSSF malicious-packages MAL-2026-17866 raw record (pyyi IOCs: wheel SHA-256 003828175a..., space-z.ai subdomains, three C2 URLs)github.comOpenSSF
• GHSA-36v8-chg8-q674 - npm @accenturecodefoundry/mfe-pot-shared-ui-scds-core (Cluster E - Accenture internal-scope dep-confusion with accenture-npm.azurewebsites.net C2, operator priyashareek, MAL-2026-17867)github.comGitHub
• OSSF malicious-packages MAL-2026-17867 raw record (@accenturecodefoundry IOCs: /test /async /mfe paths, per-version SHA-256s, sibling @newspage packages, finders InvisiRisk + SafeDep)github.comOpenSSF
• GHSA-jwr3-9ch5-2qw5 - npm passwordcracker (Cluster F - kingsize+limbomail.com+lunexindonesia node-net-pool continuation, MAL-2026-17864)github.comGitHub
• GHSA-75f2-wpm3-2h52 - npm passwordcrackv2 (Cluster F - identical loader to passwordcracker, MAL-2026-17865)github.comGitHub
• OSSF malicious-packages MAL-2026-17864 raw record (passwordcracker IOCs: lib/cache.js SHA-256, winsvc.js dropper paths, HKCU persistence keys, limbomail.com + lunexindonesia + trktgq0wbre1 node-net-pool references)github.comOpenSSF
• MAL-2026-16100 (prior discord-mfa-solver record linking the identical loader stub)github.comGitHub
• GHSA-8w65-j2wh-mqv7 - npm opencode2 (Cluster G - top-level typosquat of @opencode-ai/cli, MAL-2026-17852)github.comGitHub
• GHSA-36mq-frp2-jc97 - npm opencode2-darwin-arm64 (Cluster G - macOS ARM64 platform-binary typosquat)github.comGitHub
• GHSA-pmv2-r2q9-rmg9 - npm opencode2-darwin-x64 (Cluster G - macOS Intel platform-binary typosquat)github.comGitHub
• GHSA-xwcq-r6hw-mc5p - npm opencode2-linux-arm64 (Cluster G - Linux ARM64 platform-binary typosquat)github.comGitHub
• GHSA-cm8m-24p9-hh65 - npm opencode2-linux-arm64-musl (Cluster G - Linux ARM64 musl platform-binary typosquat)github.comGitHub
• GHSA-3jr5-3qvm-r54h - npm opencode2-linux-x64 (Cluster G - Linux x64 platform-binary typosquat)github.comGitHub
• GHSA-qx7m-vw4p-xv3j - npm opencode2-linux-x64-musl (Cluster G - Linux x64 musl platform-binary typosquat)github.comGitHub
• GHSA-xr5m-85hf-27r5 - npm opencode2-windows-arm64 (Cluster G - Windows ARM64 platform-binary typosquat)github.comGitHub
• GHSA-6x5j-r784-fx6j - npm opencode2-windows-x64 (Cluster G - Windows x64 platform-binary typosquat)github.comGitHub
• GHSA-c2gc-jwcq-w8r3 - npm @chatest/baileys (Cluster H - Baileys/libsignal lure operator wave 3 continuation, 61st family in the campaign)github.comGitHub
• GHSA-fcgr-wqxm-5qqr - npm brass-common (Cluster I - sentinel 99.9.1 dep-confusion probe with OpenSSF-flagged malicious domain, MAL-2026-17849)github.comGitHub
• GHSA-xwrx-mm2v-334v - pypi crelic-bqwheel-52f66a3f1d (Cluster I - BigQuery UDF research pentest probe with .pth-hijack, MAL-2026-17863)github.comGitHub
• GHSA-c43r-xf4h-m548 - npm @kre64/hello-npm-test (Cluster I - test-pattern name, CWE-506 boilerplate)github.comGitHub
• GHSA-2946-w5c6-hcw2 - npm yoodan-github-single-ver-pkg (Cluster I - "single-version-package" naming signature of 2024-era bug-bounty automation probe)github.comGitHub
• DependencyWatch: multi-2026-10-13-ghsa-malware-sweep (prior-day context: Baileys lure wave 3 60+ packages, npp-ml AD-recon, minecraftaccfinder infostealer+RAT, wallet-balance-scanner reverse-shell, s4yhii wave 3)dependencywatch.io
• DependencyWatch: multi-2026-10-12-ghsa-malware-sweep (s4yhii wave 3 kickoff + Coopeuch, 185.158.107.175 beacon.cjs wave 2, hardhat-option infostealer)dependencywatch.io
• DependencyWatch: npm-2026-10-08-tensorlake-maintainer-compromise (recent maintainer-compromise carve-out, standing watch)dependencywatch.io
• DependencyWatch: npm-2026-10-12-hridoy-ultimate-fb-credential-stealer (recent FB credential-sink carve-out)dependencywatch.io