# GitHub Advisory malware sweep, 14 October 2026 > GHSA 2026-10-13/14 batch (~21 fresh malware advisories). Headliner: [`orderly-plugin-liquidity-heatmap`](https://github.com/advisories/GHSA-fp2f-2254-46g7) abuses the installer`s GitHub Actions `GITHUB_TOKEN` to commit `heatmap-setup-report.json` and force-push a `heatmap-setup-` tag into the victim`s own repository. Confirmed-payload carve-outs: PyPI [`fontcase`](https://github.com/advisories/GHSA-g72q-7v8m-7r9j) infostealer + Telegram bot, PyPI [`sysdiagd`](https://github.com/advisories/GHSA-64w9-pjq6-x8rh) Discord RAT, PyPI [`pyyi`](https://github.com/advisories/GHSA-4vr9-vg98-9xpf) `python2` impersonator, npm Accenture-brand dep-confusion with `azurewebsites.net` C2, npm `passwordcracker` continuing `limbomail.com`, plus a 10-slug `opencode2*` typosquat of `@opencode-ai/cli`. - Published: 2026-10-14 - Severity: high - Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole. - Ecosystems: npm, PyPI - Scope: 23 packages, 34 compromised versions - Tags: infostealer, credential-theft, ci-cd-compromise, dependency-confusion, typosquat, obfuscation, account-takeover - Also known as: 2026-10-14 GHSA sweep, orderly-plugin-liquidity-heatmap GITHUB_TOKEN write-back, dumtban Orderly plugin CI token abuse, fontcase PyPI Telegram bot infostealer, sysdiagd PyPI Discord RAT, pyyi PyPI python2 impersonator space-z.ai, @accenturecodefoundry @newspage priyashareek dep-confusion, passwordcracker passwordcrackv2 kingsize limbomail continuation, opencode2 npm typosquat family, Baileys libsignal lure operator wave 3 (chatest extension) - Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, InvisiRisk, SafeDep, kam193/bad-packages, Amazon Inspector, npm security, PyPI security - Incident ID: multi-2026-10-14-ghsa-malware-sweep ## Affected packages (23) Only the exact versions listed were named by the source advisories. Other versions are not implicated. | Package | Ecosystem | Compromised versions | |---|---|---| | [@accenturecodefoundry/mfe-pot-shared-ui-scds-core](https://dependencywatch.io/package/npm/@accenturecodefoundry/mfe-pot-shared-ui-scds-core) | npm | 99.99.2, 99.99.4, 99.99.41 | | [@chatest/baileys](https://dependencywatch.io/package/npm/@chatest/baileys) | npm | * | | [@kre64/hello-npm-test](https://dependencywatch.io/package/npm/@kre64/hello-npm-test) | npm | 1.0.0 | | [@newspage/lib-ng-async-routes-ui](https://dependencywatch.io/package/npm/@newspage/lib-ng-async-routes-ui) | npm | * | | [@newspage/libx-amount](https://dependencywatch.io/package/npm/@newspage/libx-amount) | npm | * | | [brass-common](https://dependencywatch.io/package/npm/brass-common) | npm | 99.9.1 | | [crelic-bqwheel-52f66a3f1d](https://dependencywatch.io/package/pypi/crelic-bqwheel-52f66a3f1d) | PyPI | 0.0.1 | | [fontcase](https://dependencywatch.io/package/pypi/fontcase) | PyPI | 0.1.0, 0.1.1, 0.1.2 | | [opencode2](https://dependencywatch.io/package/npm/opencode2) | npm | * | | [opencode2-darwin-arm64](https://dependencywatch.io/package/npm/opencode2-darwin-arm64) | npm | * | | [opencode2-darwin-x64](https://dependencywatch.io/package/npm/opencode2-darwin-x64) | npm | * | | [opencode2-linux-arm64](https://dependencywatch.io/package/npm/opencode2-linux-arm64) | npm | * | | [opencode2-linux-arm64-musl](https://dependencywatch.io/package/npm/opencode2-linux-arm64-musl) | npm | * | | [opencode2-linux-x64](https://dependencywatch.io/package/npm/opencode2-linux-x64) | npm | * | | [opencode2-linux-x64-musl](https://dependencywatch.io/package/npm/opencode2-linux-x64-musl) | npm | * | | [opencode2-windows-arm64](https://dependencywatch.io/package/npm/opencode2-windows-arm64) | npm | * | | [opencode2-windows-x64](https://dependencywatch.io/package/npm/opencode2-windows-x64) | npm | * | | [orderly-plugin-liquidity-heatmap](https://dependencywatch.io/package/npm/orderly-plugin-liquidity-heatmap) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.6 | | [passwordcracker](https://dependencywatch.io/package/npm/passwordcracker) | npm | * | | [passwordcrackv2](https://dependencywatch.io/package/npm/passwordcrackv2) | npm | * | | [pyyi](https://dependencywatch.io/package/pypi/pyyi) | PyPI | 2.4.1 | | [sysdiagd](https://dependencywatch.io/package/pypi/sysdiagd) | PyPI | 1.2.1, 1.2.2, 1.2.3 | | [yoodan-github-single-ver-pkg](https://dependencywatch.io/package/npm/yoodan-github-single-ver-pkg) | npm | 1.0.1 | ## What happened Between 2026-10-13 06:00 UTC (yesterday`s sweep cutoff) and 2026-10-14 14:00 UTC (today`s ingest-window start), the GitHub Advisory Database and OpenSSF `malicious-packages` published ~21 fresh malware advisories across npm and PyPI. Six carry confirmed functional payloads worth a cluster each; the rest cluster into a 10-slug `opencode2*` typosquat family of `@opencode-ai/cli` and 4 small dep-confusion/pentest probes. ## Headline **`orderly-plugin-liquidity-heatmap` abuses the installer`s GitHub Actions `GITHUB_TOKEN` to write back into the victim`s own repository** (Cluster A). Six versions (1.0.0-1.0.6) published by npm account `dumtban` on 2026-10-11 between 13:12 and 16:05 UTC, each extending the previous version`s reach into the installer`s CI runner. The 1.0.2 payload commits `heatmap-setup-report.json` to the default branch of the installing repository; 1.0.4+ additionally force-pushes a `heatmap-setup-` git tag using credentials that `actions/checkout` persists in `.git/config`. This is a novel operator-side pattern: unlike a typical postinstall beacon that only leaks data OUTBOUND, this one leaves VERIFIABLE INBOUND write-backs in the victim repository that need to be cleaned up as part of IR. Credited to InvisiRisk, Inc. ## Confirmed-payload carve-outs within the sweep - **Cluster B** `fontcase` (PyPI, 0.1.0-0.1.2) - infostealer with Telegram bot C2 and `process-manager.exe` payload served from `github.com/unicodeces/font-atlas`. OSV MAL-2026-17862, campaign tag `2026-10-fontcase`. Reporter `kam193`. VirusTotal + Tria.ge corroboration available. - **Cluster C** `sysdiagd` (PyPI, 1.2.1-1.2.3) - Discord-bot RAT with credential/browser/file theft, audio/screenshot/video capture, persistence, spyware behavior. OSV MAL-2026-17861, campaign tag `2026-10-sysdiagd`. Reporter `kam193`. Needs operator-supplied Discord credentials to activate. - **Cluster D** `pyyi` (PyPI, 2.4.1) - `python2` interpreter impersonator. Registers host with `space-z.ai`, stores API key in `~/.python2/config.json`, shows a normal Python banner, silently POSTs single-token REPL inputs to `/api/cli/unlock`, runs remote-fetched payload in memory via `exec`. OSV MAL-2026-17866. Finder `smiling-hyena`. - **Cluster E** `@accenturecodefoundry/mfe-pot-shared-ui-scds-core` (npm, 99.99.2/99.99.4/99.99.41) - Accenture internal-scope dep-confusion with confirmed `accenture-npm.azurewebsites.net` C2 beacon. Operator `priyashareek`. Sibling `@newspage/libx-amount` and `@newspage/lib-ng-async-routes-ui` call back to the same host (second internal-scope target `@newspage`). OSV MAL-2026-17867. Credited to InvisiRisk, Inc. and SafeDep. - **Cluster F** `passwordcracker` + `passwordcrackv2` (npm) - 4th and 5th package in the ongoing `kingsize`+`limbomail.com`+`lunexindonesia/node-net-pool` discord-mfa-solver Windows-RAT campaign. Identical loader stub to prior `discord-mfa-solver` ([MAL-2026-16100](https://github.com/advisories/GHSA-prf3-vr2f-rhff)), `discord-mfa` v3.0.1, `mfaby` v1.0.0, `mfakit`. OSV MAL-2026-17864/17865. ## Typosquat and probes **Cluster G** `opencode2*` (npm, 10 slugs) is a 1-to-1 mimic of the real `@opencode-ai/cli` platform-binary distribution (top-level + 9 platform-arch slugs served via `optionalDependencies`). All CWE-506 "fully compromised" boilerplate. **Cluster H** `@chatest/baileys` is a 61st family in yesterday`s Baileys/libsignal lure operator wave 3. **Cluster I** rounds out with 4 dep-confusion/pentest probes: `brass-common@99.9.1` (npm, OpenSSF-flagged suspicious domain), `crelic-bqwheel-52f66a3f1d@0.0.1` (PyPI, "probably pentest" BigQuery UDF research with .pth-hijack), `@kre64/hello-npm-test@1.0.0` (npm, boilerplate), `yoodan-github-single-ver-pkg@1.0.1` (npm, boilerplate). ## Classification `sweep`. Severity `high` taken as a whole, driven by six confirmed-payload clusters (A `orderly-plugin-liquidity-heatmap`, B `fontcase`, C `sysdiagd`, D `pyyi`, E Accenture dep-confusion with C2, F `passwordcracker` discord-mfa continuation). The typosquat (Cluster G) and small probes (Cluster I) would be `medium` on their own but do not reduce overall sweep severity. ## Discovery `GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector` (IN-MAL feed), `kam193/bad-packages`, `InvisiRisk, Inc.`, `SafeDep`, `smiling-hyena`, `npm security`, `PyPI security`. ## Impact - **Cluster A - npm `orderly-plugin-liquidity-heatmap` GitHub Actions GITHUB_TOKEN abuse (malicious-package, confirmed payload with novel CI-token write-back mechanism)**: `orderly-plugin-liquidity-heatmap` (1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.6; GHSA-fp2f-2254-46g7, OSV MAL-2026-17848). Publisher `dumtban` on npm pushed six versions between 13:12 and 16:05 UTC on 2026-10-11, each extending the previous version`s reach into the installer`s CI runner. The package exports an empty stub and advertises itself as "a liquidity heatmap plugin for the Orderly Network orderbook widget" - the real behavior is in a `postinstall` hook that runs `node ./scripts/setup.js`. On an installer`s GitHub Actions runner the hook: (1) collects runner host, user, repository name, environment variable names, GITHUB_TOKEN presence and length, and network egress; (2) requests an OIDC token from `ACTIONS_ID_TOKEN_REQUEST_URL`; (3) **from 1.0.2 onwards, uses the workflow`s GITHUB_TOKEN to commit `heatmap-setup-report.json` to the default branch of the installing repository** (a verifiable write-back indicator); (4) **from 1.0.4/1.0.6, additionally force-pushes a `heatmap-setup-` git tag using the credentials that `actions/checkout` persists in `.git/config`**. Credited to InvisiRisk, Inc. Severity `high` on this package alone - the CI-token write-back means every victim repo whose default branch has `heatmap-setup-report.json` or whose tag list has a `heatmap-setup-*` tag has already given the operator write access to their default branch at least once; roll back those commits/tags, rotate anything the workflow could reach, and investigate what other write-backs the operator may have made under the same token - **Cluster B - PyPI `fontcase` infostealer + Telegram bot C2 (malicious-package, confirmed payload with named stealer-module list)**: `fontcase` (0.1.0, 0.1.1, 0.1.2; GHSA-g72q-7v8m-7r9j, OSV MAL-2026-17862, campaign tag `2026-10-fontcase`). On import, the package downloads and executes `process-manager.exe` from `github.com/unicodeces/font-atlas` (three distinct raw-file URLs plus the repo page serve the same payload). The infostealer uses a Telegram bot for C2 and exfiltrates browser data and credentials. A VirusTotal detection page, a Tria.ge sandbox report, and the `kam193` reporter`s own detail page corroborate the behavior. Severity `high` for this package alone (confirmed infostealer with named sink and payload URL - any `pip install fontcase` on a Windows host with a browser profile should be treated as credential-compromised) - **Cluster C - PyPI `sysdiagd` Discord-bot RAT (malicious-package, confirmed multi-capability RAT+infostealer+spyware)**: `sysdiagd` (1.2.1, 1.2.2, 1.2.3; GHSA-64w9-pjq6-x8rh, OSV MAL-2026-17861, campaign tag `2026-10-sysdiagd`). The package presents itself as a system monitoring tool but delivers a Discord bot acting as a RAT. Confirmed capabilities per the OSV record: credentials, browser data, and file theft; audio recording, screenshot capture, video capture; persistence; infostealer and spyware. The bot needs operator-supplied Discord credentials to activate - installations without the operator`s credentials are latent but every `pip install sysdiagd` has still installed a RAT whose activation is one Discord token away. Severity `high` for this package alone (confirmed multi-capability RAT at import time) - **Cluster D - PyPI `pyyi` `python2` interpreter impersonator (malicious-package, confirmed covert REPL input capture + in-memory remote-payload exec)**: `pyyi` (2.4.1; GHSA-4vr9-vg98-9xpf, OSV MAL-2026-17866, wheel SHA-256 `003828175a747a9a3de8029e6a028ad2c3739abf1dad7b468b25636e391e91f4`). The wheel declares a console command named `python2` (entry point `pyyi.cli:main`). On first run the REPL registers with `preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai/api/cli/init` (host+OS fingerprint), stores the returned `apiKey` in `~/.python2/config.json`, then shows a NORMAL Python banner so the operator cannot tell they are inside the impersonator. **Single-token user inputs that match the eligibility filter are silently POSTed to `/api/cli/unlock` as the `password` field** (that is: any string a developer types at a REPL prompt expecting Python 2 behavior could be leaked). The `run_payload()` path fetches code from `/api/cli/payload`, decodes/decompresses it, and runs it in memory via `exec` at `pyyi/cli.py:640`. Severity `high` (confirmed functional covert REPL exfil + remote in-memory exec; any dev who ran `python2` on a host where `pyyi` was installed has leaked whatever they typed to `space-z.ai`) - **Cluster E - npm `@accenturecodefoundry/mfe-pot-shared-ui-scds-core` Accenture internal-scope dep-confusion with confirmed C2 (dependency-confusion, confirmed payload beyond CWE-506 boilerplate)**: `@accenturecodefoundry/mfe-pot-shared-ui-scds-core` (99.99.2, 99.99.4, 99.99.41; GHSA-36v8-chg8-q674, OSV MAL-2026-17867). Operator `priyashareek` on npm. Preinstall hook `node index.js || true` runs on install (the `|| true` suppresses errors so the install succeeds silently). Beacon payload by version: 99.99.2 sends hex-encoded hostname+username to `accenture-npm.azurewebsites.net/test`; 99.99.4 beacons `accenture-npm.azurewebsites.net/async`; 99.99.41 beacons `accenture-npm.azurewebsites.net/mfe`. Each beacon leaks the victim`s egress IP and confirms the dep-confusion resolved against Accenture Code Foundry`s internal registry. Same publisher also controls `@newspage/libx-amount` and `@newspage/lib-ng-async-routes-ui`, which call back to the same host (second internal-scope target `@newspage` on the same operator). Credited by InvisiRisk, Inc. and SafeDep. Severity `high` for this cluster alone (dep-confusion WITH confirmed C2 - unlike most dep-confusion probes which stop at a DNS beacon, this one has an actual outbound HTTPS write and a developing payload surface). Any Accenture Code Foundry team using `@accenturecodefoundry/*` or `@newspage/*` internally should scope-lock their internal registry immediately - **Cluster F - npm `passwordcracker`+`passwordcrackv2` kingsize-operator `limbomail.com`+`lunexindonesia/node-net-pool` continuation of discord-mfa-solver campaign (malicious-package, confirmed Windows RAT loader with persistence)**: `passwordcracker` (all versions; GHSA-jwr3-9ch5-2qw5, OSV MAL-2026-17864) and `passwordcrackv2` (all versions; GHSA-75f2-wpm3-2h52, OSV MAL-2026-17865). Operator `kingsize` on npm, published 2026-10-09/10. Both packages claim to be a "dependency-free Discord MFA library"; both ship identical loader code in `lib/cache.js` (SHA-256 `40ad444731103c356ac7643b1a58e6093fcce1ea2f43977fb07f34833d37178a`) that `require()`s `node-net-pool` on load. `node-net-pool` is pulled from `github.com/lunexindonesia/node-net-pool` and `github.com/trktgq0wbre1/node-net-pool`. On Windows the second stage downloads a third-stage script from `limbomail.com`, saves it as a hidden `winsvc.js` in `%APPDATA%`, `%LOCALAPPDATA%`, or `%TEMP%`, and launches it via a hidden `WinSvcHost.vbs`. Persistence through HKCU `Run` (value `WinSvcHost`), `RunOnce` (value `WinSvcHostUpd`), `UserInitMprLogonScript`, and a `WinSvcHost.lnk` Startup shortcut; the loader re-checks for updates every two hours. **Same loader stub previously appeared in `discord-mfa-solver` ([MAL-2026-16100](https://github.com/advisories/GHSA-prf3-vr2f-rhff), `discord-mfa` v3.0.1, `mfaby` v1.0.0, `mfakit`)** - this is a 4th+5th package in the long-running `kingsize`/`limbomail.com` Windows-RAT campaign targeting the Discord-MFA niche. Severity `high` for this cluster (confirmed functional Windows RAT with persistence; dev-workstation and juvenile-user hosts; credentials recycled across Discord/Google/Microsoft catastrophic) - **Cluster G - npm `opencode2*` 10-slug typosquat family of `@opencode-ai/cli` (typosquat, 10 packages, all CWE-506 boilerplate takedowns following the real `@opencode-ai/cli` platform-binary split)**: `opencode2` (GHSA-8w65-j2wh-mqv7, OSV MAL-2026-17852) plus 9 platform-binary slugs matching the real `@opencode-ai/cli` prebuild distribution pattern: `opencode2-darwin-arm64` (GHSA-36mq-frp2-jc97), `opencode2-darwin-x64` (GHSA-pmv2-r2q9-rmg9), `opencode2-linux-arm64` (GHSA-xwcq-r6hw-mc5p), `opencode2-linux-arm64-musl` (GHSA-cm8m-24p9-hh65), `opencode2-linux-x64` (GHSA-3jr5-3qvm-r54h), `opencode2-linux-x64-musl` (GHSA-qx7m-vw4p-xv3j), `opencode2-windows-arm64` (GHSA-xr5m-85hf-27r5), `opencode2-windows-x64` (GHSA-6x5j-r784-fx6j), `opencode2-darwin-arm64` (GHSA-36mq-frp2-jc97). The real `opencode` SST CLI publishes a top-level package plus one per-platform binary slug via `optionalDependencies`, so a `opencode2` typosquat installing the matching platform binary is a transparent 1-to-1 mimic of the authentic distribution shape - meaning a developer who runs `npm install opencode2` will cross-fetch whichever platform-arch slug matches their OS without any additional CLI argument. All CWE-506 "fully compromised" boilerplate advisories with no shipped IOC body. Severity `medium` for the typosquat (install-time code execution risk per OSSF typosquat pattern, no vendor runtime analysis published yet) - **Cluster H - npm `@chatest/baileys` Baileys lure operator wave 3 continuation (malicious-package, continuation of 2026-10-13 sweep Cluster A `@WhiskeySockets/Baileys` WhatsApp-automation lure campaign)**: `@chatest/baileys` (all versions; GHSA-c2gc-jwcq-w8r3). The `@chatest` scope is a new 61st family in the Baileys/libsignal lure operator wave 3 that peaked on 2026-10-13 with 60+ packages across 30+ publisher scopes. CWE-506 "fully compromised" boilerplate with no shipped IOC. Same operator-side pattern: brand-impersonation of the real `@WhiskeySockets/baileys` WhatsApp-automation library consumer base (small-business/consumer WhatsApp-bot developers on cheap VPS instances). Severity `medium` for the cluster alone (install-time recon per campaign pattern, no shipped IOC in this GHSA) - **Cluster I - npm/PyPI dep-confusion probes and pentest artefacts (dependency-confusion or malicious-package; 4 packages, all low-info CWE-506 boilerplate)**: `brass-common@99.9.1` (npm, GHSA-fcgr-wqxm-5qqr, OSV MAL-2026-17849 - OpenSSF Package Analysis flagged "communicates with a domain associated with malicious activity"; sentinel version 99.9.1 is the signature); `crelic-bqwheel-52f66a3f1d@0.0.1` (PyPI, GHSA-xwrx-mm2v-334v, OSV MAL-2026-17863 - package self-describes as "research for BigQuery user-defined functions"; collects hostname/IP/username; abuses Python `.pth` files to run code at interpreter startup; classified by OSSF as "probably pentest" but still malicious); `@kre64/hello-npm-test@1.0.0` (npm, GHSA-c43r-xf4h-m548 - test-pattern name, CWE-506 boilerplate only); `yoodan-github-single-ver-pkg@1.0.1` (npm, GHSA-2946-w5c6-hcw2 - "single-version package" naming is the signature of a 2024-era bug-bounty automation probe). Severity `medium` for each (CWE-506 boilerplate; `brass-common` and `crelic-bqwheel-52f66a3f1d` have corroborating OpenSSF notes, the other two are plain takedowns) - **Operator continuity**: today`s material continues several operators tracked across this week: **Baileys/libsignal lure operator wave 3** (`@chatest/baileys` extends yesterday`s 60+ package wave to 61 scopes - same `@WhiskeySockets/Baileys` consumer-base targeting). **`kingsize`+`limbomail.com`+`lunexindonesia/node-net-pool` discord-mfa Windows-RAT campaign** (passwordcracker + passwordcrackv2 are the 4th and 5th package in the chain previously comprising `discord-mfa-solver`, `discord-mfa`, `mfaby`, `mfakit`). **`priyashareek` Accenture+@newspage dep-confusion operator** (new today - 3 Accenture-brand versions + 2 @newspage sibling packages targeting the same `accenture-npm.azurewebsites.net` C2). **`dumtban` orderly-plugin GitHub Actions CI-token-abuse operator** (new today - 6-version burst on 2026-10-11, 3 hours of iteration refining the GITHUB_TOKEN write-back payload). **`kam193` continues as the top PyPI malware reporter** (fontcase, sysdiagd, and other recent carve-outs attributed). **No new activity** from: s4yhii operator (yesterday`s wave 3 quiet after `@s4yhiitestpoc/r2-https-b`), 185.158.107.175 operator, 64.181.165.115 operator, `hardhat-option` operator, `agentaix` operator, `wgkit` RubyGems operator, `xwise8887`, `sharpnes` crates.io, `@tunstock/remact-dom`, Wix dep-confusion, `nfjbill`, `@bitwardne/*`, `reaperhackbot256f`, `ig-gox` all quiet. TensorLake AI maintainer compromise ([2026-10-08 carve-out](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise)) remains quiet at `tensorlake@0.5.145` with no wave-2 republish ## What to do 1. **For Cluster A (`orderly-plugin-liquidity-heatmap` CI-token abuse)**: grep every `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml` for `orderly-plugin-liquidity-heatmap` (versions 1.0.0-1.0.6). On ANY hit on a repo whose CI runs `npm install` with a GITHUB_TOKEN: (1) check the default branch git log for a commit adding `heatmap-setup-report.json` and REVERT it; (2) list repository tags for anything matching `heatmap-setup-*` and DELETE them (`git push origin --delete tag heatmap-setup-`); (3) check for `heatmap-exec-trace.log` under any CI artifact storage; (4) rotate every secret, OIDC trust, and PAT the workflow`s GITHUB_TOKEN could reach; (5) audit any OTHER commits or tags pushed from that workflow in the exposure window (the operator may have made additional write-backs under the same token the advisory did not catalogue). This operator`s write-back mechanism means the usual "remove node_modules, pin away" response is insufficient - you also need to clean up the repository state the operator left behind 2. **For Cluster B (PyPI `fontcase` infostealer + Telegram bot)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, `conda env` for `fontcase` (versions 0.1.0, 0.1.1, 0.1.2). On hit, assume: Telegram-bot C2 established, browser credential vault extracted, `process-manager.exe` dropped from `github.com/unicodeces/font-atlas`. Block the GitHub repo `unicodeces/font-atlas` at any workstation egress filter (its raw-file URLs are the payload serve). Image the host. The Telegram-bot pattern means the operator can walk back the C2 trail from Telegram if you capture the bot token in an on-host IR step 3. **For Cluster C (PyPI `sysdiagd` Discord RAT)**: grep for `sysdiagd` (versions 1.2.1, 1.2.2, 1.2.3). On hit on a Windows/Linux dev host, assume the RAT is installed and latent (waiting for operator Discord credentials). Image the host regardless of whether the operator has activated it - a latent RAT with persistence is still a persistent presence. Audit for Discord bot-token traffic. Rotate browser-stored credentials and 2FA seeds 4. **For Cluster D (PyPI `pyyi` python2 impersonator)**: grep for `pyyi` (version 2.4.1). On hit, treat EVERY developer that typed into `python2` on that host as having leaked their input to `space-z.ai`. Rotate the specific credentials they would have typed at a REPL prompt (one-off API tokens pasted for a smoke test, DB connection strings tested from a shell, SSH keys unlocked at a prompt). Block `space-z.ai` apex at egress; delete `~/.python2/config.json`; audit `~/.local/bin/python2` and remove it. Teach contributors that `python2` is end-of-life and the ONLY `python2` command is one your distro or `pyenv` installed - a `python2` installed by `pip` is an impersonator by construction 5. **For Cluster E (`@accenturecodefoundry` + `@newspage` Accenture dep-confusion)**: grep for `@accenturecodefoundry/mfe-pot-shared-ui-scds-core` (99.99.2, 99.99.4, 99.99.41), `@newspage/libx-amount`, `@newspage/lib-ng-async-routes-ui`. Any Accenture Code Foundry team using `@accenturecodefoundry/*` or `@newspage/*` internally should **immediately scope-lock the internal registry** (`npm config set @accenturecodefoundry:registry https://internal-registry && npm config set @newspage:registry https://internal-registry`) and hold both public scopes with placeholder packages at a safe version. Block `accenture-npm.azurewebsites.net` at egress on all CI/build hosts. Audit CI logs for outbound requests to `/test`, `/async`, `/mfe` under that host. The sentinel-version pattern (99.99.x) is the dep-confusion operator-side signature - teach contributors that any `99.99.*` npm version is suspect by construction 6. **For Cluster F (`passwordcracker`+`passwordcrackv2` `limbomail.com` continuation)**: grep for `passwordcracker`, `passwordcrackv2`, and the sibling `discord-mfa-solver`, `discord-mfa`, `mfaby`, `mfakit` (any version of any of them). On a Windows host that installed any of these, treat as fully compromised: check `%APPDATA%`, `%LOCALAPPDATA%`, `%TEMP%` for `winsvc.js` and `WinSvcHostCfg.vbs`; check HKCU `Run` for value `WinSvcHost`, `RunOnce` for `WinSvcHostUpd`, `UserInitMprLogonScript`; check Startup folder for `WinSvcHost.lnk`; purge all of them. Add `limbomail.com` apex to the standing egress denylist; add `github.com/lunexindonesia/node-net-pool` and `github.com/trktgq0wbre1/node-net-pool` to the egress block (any `node-net-pool` npm/GitHub reference is suspect). Rotate Discord tokens, Microsoft Account, Google Account credentials - the Discord-MFA niche overlaps with juvenile-user hosts where credential reuse is the norm 7. **For Cluster G (`opencode2*` typosquat family)**: grep for the top-level `opencode2` AND any of its 9 platform-binary slugs `opencode2-darwin-arm64`, `opencode2-darwin-x64`, `opencode2-linux-arm64`, `opencode2-linux-arm64-musl`, `opencode2-linux-x64`, `opencode2-linux-x64-musl`, `opencode2-windows-arm64`, `opencode2-windows-x64`. On hit, remove and pin away; the real package is `@opencode-ai/cli` (or `opencode` top-level, which also exists under the `opencode-ai` org) - teach contributors the authentic name and warn that `opencode2` is a typosquat. CWE-506 boilerplate means the specific payload is undocumented; treat the install as credential-compromised until Socket or a vendor publishes a runtime analysis 8. **For Cluster H (`@chatest/baileys` Baileys lure wave 3 extension)**: grep for `@chatest/baileys` (any version). Standing guidance from yesterday`s wave 3 cluster A still applies: the ONLY legitimate upstream is `@whiskeysockets/baileys` (lowercase, hyphen-free). Add `@chatest` scope to the internal denylist alongside the 30+ Baileys-lure scopes from yesterday`s sweep. If any WhatsApp-automation workload installed `@chatest/baileys`, rotate the VPS cloud-provider API keys and any Telegram/WhatsApp bot tokens on the host (Baileys-consumer audience pattern) 9. **For Cluster I (small dep-confusion/pentest probes)**: grep for `brass-common@99.9.1` (npm), `crelic-bqwheel-52f66a3f1d@0.0.1` (PyPI), `@kre64/hello-npm-test@1.0.0` (npm), `yoodan-github-single-ver-pkg@1.0.1` (npm). On hit, remove, invalidate any Docker layer or build cache that ran `npm install`/`pip install`, and audit CI logs for environment-variable leakage. For `crelic-bqwheel-52f66a3f1d`, also check `~/.pth` files and `site-packages/*.pth` for interpreter-startup hijacks 10. **NEW outbound denylist entries for CI/build-host egress proxies today**: `accenture-npm.azurewebsites.net` apex + `/test` + `/async` + `/mfe` paths (Cluster E `@accenturecodefoundry` + `@newspage` dep-confusion C2); `limbomail.com` apex (Cluster F `passwordcracker` third-stage payload serve); `github.com/lunexindonesia/node-net-pool` + `github.com/trktgq0wbre1/node-net-pool` repo URLs (Cluster F loader source); `github.com/unicodeces/font-atlas` repo URL (Cluster B `fontcase` payload serve - block raw-file access specifically); `space-z.ai` apex + `preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai` + `b196q82k8891-d.space-z.ai` subdomains (Cluster D `pyyi` REPL C2). Keep prior egress blocks in place: `collector.oob.s4yhii.com` + `*.oob.s4yhii.com` + `s4yhii.com` apex, `64.181.165.115/dc`, `167.88.172.33:8087` + `jsonspack.com` publisher-email, `goxtools.shop` apex, `minhdong.site` apex + GitHub user `VangBanLaNhat`, `45.138.12.177:8089`, `185.158.107.175:8787`, `ltidi.storage.googleapis.com/depenconf/`, `oob.s4yhii.com:9999/native`, `*.oast.pro`/`*.oast.me`/`*.oast.fun`/`*.oast.site`/`*.oastify.com`, `frjmzbjbhwvtdnsuodmu.supabase.co`, `api.npoint.io` apex, `googleforum.pythonanywhere.com`, `tele.metry.orgin.net`, `morroncr0w.io`, `api.telegram.org` on untrusted CI/build hosts, `appsecc.com`, `webhook.site/*`, `dxpoc.gt.tc`, `nfjbill.ren`, `storage.googleapis.com/depenconf/`, `10.0.19.0/24` + `10.0.49.0/24`, `api.nm-streetwear.space`, Discord webhook URL pattern, `ipify.org` + `ifconfig.me`, `gitflic.ru`, `api.wagmiwallet.org`, `backend-cybersecuritydashboard.onrender.com`, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, `chinazhangsan.ccwu.cc`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `npm-canary.aveliscare.com`, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil patterns, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, `tuamaeaquelaursa.com` publisher-email domain, `45.138.0.0/16` RubyGems wgkit CIDRs ## Check your own dependencies - Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json - Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt The scan runs entirely in the browser; lockfile contents are never uploaded. ## References - [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub - [GHSA-fp2f-2254-46g7 - npm orderly-plugin-liquidity-heatmap (Cluster A - GITHUB_TOKEN write-back to victim repo, MAL-2026-17848, publisher dumtban, 6 versions in 3h)](https://github.com/advisories/GHSA-fp2f-2254-46g7) - GitHub - [OSSF malicious-packages MAL-2026-17848 raw record (orderly-plugin-liquidity-heatmap IOCs: heatmap-setup-report.json, heatmap-setup-* tags, heatmap-exec-trace.log, per-version SHA-256s)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/orderly-plugin-liquidity-heatmap/MAL-2026-17848.json) - OpenSSF - [GHSA-g72q-7v8m-7r9j - pypi fontcase (Cluster B - infostealer + Telegram bot, campaign 2026-10-fontcase, MAL-2026-17862)](https://github.com/advisories/GHSA-g72q-7v8m-7r9j) - GitHub - [OSSF malicious-packages MAL-2026-17862 raw record (fontcase: process-manager.exe payload from github.com/unicodeces/font-atlas, Telegram bot C2, VirusTotal + Tria.ge references)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/fontcase/MAL-2026-17862.json) - OpenSSF - [GHSA-64w9-pjq6-x8rh - pypi sysdiagd (Cluster C - Discord-bot RAT with cred/browser/file theft + audio/screenshot/video capture, campaign 2026-10-sysdiagd, MAL-2026-17861)](https://github.com/advisories/GHSA-64w9-pjq6-x8rh) - GitHub - [OSSF malicious-packages MAL-2026-17861 raw record (sysdiagd Discord-bot infostealer+RAT capability list)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/sysdiagd/MAL-2026-17861.json) - OpenSSF - [GHSA-4vr9-vg98-9xpf - pypi pyyi (Cluster D - python2 REPL impersonator, space-z.ai C2 /api/cli/init /unlock /payload, in-memory exec, MAL-2026-17866)](https://github.com/advisories/GHSA-4vr9-vg98-9xpf) - GitHub - [OSSF malicious-packages MAL-2026-17866 raw record (pyyi IOCs: wheel SHA-256 003828175a..., space-z.ai subdomains, three C2 URLs)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pyyi/MAL-2026-17866.json) - OpenSSF - [GHSA-36v8-chg8-q674 - npm @accenturecodefoundry/mfe-pot-shared-ui-scds-core (Cluster E - Accenture internal-scope dep-confusion with accenture-npm.azurewebsites.net C2, operator priyashareek, MAL-2026-17867)](https://github.com/advisories/GHSA-36v8-chg8-q674) - GitHub - [OSSF malicious-packages MAL-2026-17867 raw record (@accenturecodefoundry IOCs: /test /async /mfe paths, per-version SHA-256s, sibling @newspage packages, finders InvisiRisk + SafeDep)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@accenturecodefoundry/mfe-pot-shared-ui-scds-core/MAL-2026-17867.json) - OpenSSF - [GHSA-jwr3-9ch5-2qw5 - npm passwordcracker (Cluster F - kingsize+limbomail.com+lunexindonesia node-net-pool continuation, MAL-2026-17864)](https://github.com/advisories/GHSA-jwr3-9ch5-2qw5) - GitHub - [GHSA-75f2-wpm3-2h52 - npm passwordcrackv2 (Cluster F - identical loader to passwordcracker, MAL-2026-17865)](https://github.com/advisories/GHSA-75f2-wpm3-2h52) - GitHub - [OSSF malicious-packages MAL-2026-17864 raw record (passwordcracker IOCs: lib/cache.js SHA-256, winsvc.js dropper paths, HKCU persistence keys, limbomail.com + lunexindonesia + trktgq0wbre1 node-net-pool references)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/passwordcracker/MAL-2026-17864.json) - OpenSSF - [MAL-2026-16100 (prior discord-mfa-solver record linking the identical loader stub)](https://github.com/advisories/GHSA-prf3-vr2f-rhff) - GitHub - [GHSA-8w65-j2wh-mqv7 - npm opencode2 (Cluster G - top-level typosquat of @opencode-ai/cli, MAL-2026-17852)](https://github.com/advisories/GHSA-8w65-j2wh-mqv7) - GitHub - [GHSA-36mq-frp2-jc97 - npm opencode2-darwin-arm64 (Cluster G - macOS ARM64 platform-binary typosquat)](https://github.com/advisories/GHSA-36mq-frp2-jc97) - GitHub - [GHSA-pmv2-r2q9-rmg9 - npm opencode2-darwin-x64 (Cluster G - macOS Intel platform-binary typosquat)](https://github.com/advisories/GHSA-pmv2-r2q9-rmg9) - GitHub - [GHSA-xwcq-r6hw-mc5p - npm opencode2-linux-arm64 (Cluster G - Linux ARM64 platform-binary typosquat)](https://github.com/advisories/GHSA-xwcq-r6hw-mc5p) - GitHub - [GHSA-cm8m-24p9-hh65 - npm opencode2-linux-arm64-musl (Cluster G - Linux ARM64 musl platform-binary typosquat)](https://github.com/advisories/GHSA-cm8m-24p9-hh65) - GitHub - [GHSA-3jr5-3qvm-r54h - npm opencode2-linux-x64 (Cluster G - Linux x64 platform-binary typosquat)](https://github.com/advisories/GHSA-3jr5-3qvm-r54h) - GitHub - [GHSA-qx7m-vw4p-xv3j - npm opencode2-linux-x64-musl (Cluster G - Linux x64 musl platform-binary typosquat)](https://github.com/advisories/GHSA-qx7m-vw4p-xv3j) - GitHub - [GHSA-xr5m-85hf-27r5 - npm opencode2-windows-arm64 (Cluster G - Windows ARM64 platform-binary typosquat)](https://github.com/advisories/GHSA-xr5m-85hf-27r5) - GitHub - [GHSA-6x5j-r784-fx6j - npm opencode2-windows-x64 (Cluster G - Windows x64 platform-binary typosquat)](https://github.com/advisories/GHSA-6x5j-r784-fx6j) - GitHub - [GHSA-c2gc-jwcq-w8r3 - npm @chatest/baileys (Cluster H - Baileys/libsignal lure operator wave 3 continuation, 61st family in the campaign)](https://github.com/advisories/GHSA-c2gc-jwcq-w8r3) - GitHub - [GHSA-fcgr-wqxm-5qqr - npm brass-common (Cluster I - sentinel 99.9.1 dep-confusion probe with OpenSSF-flagged malicious domain, MAL-2026-17849)](https://github.com/advisories/GHSA-fcgr-wqxm-5qqr) - GitHub - [GHSA-xwrx-mm2v-334v - pypi crelic-bqwheel-52f66a3f1d (Cluster I - BigQuery UDF research pentest probe with .pth-hijack, MAL-2026-17863)](https://github.com/advisories/GHSA-xwrx-mm2v-334v) - GitHub - [GHSA-c43r-xf4h-m548 - npm @kre64/hello-npm-test (Cluster I - test-pattern name, CWE-506 boilerplate)](https://github.com/advisories/GHSA-c43r-xf4h-m548) - GitHub - [GHSA-2946-w5c6-hcw2 - npm yoodan-github-single-ver-pkg (Cluster I - "single-version-package" naming signature of 2024-era bug-bounty automation probe)](https://github.com/advisories/GHSA-2946-w5c6-hcw2) - GitHub - [DependencyWatch: multi-2026-10-13-ghsa-malware-sweep (prior-day context: Baileys lure wave 3 60+ packages, npp-ml AD-recon, minecraftaccfinder infostealer+RAT, wallet-balance-scanner reverse-shell, s4yhii wave 3)](https://dependencywatch.io/incident/multi-2026-10-13-ghsa-malware-sweep) - [DependencyWatch: multi-2026-10-12-ghsa-malware-sweep (s4yhii wave 3 kickoff + Coopeuch, 185.158.107.175 beacon.cjs wave 2, hardhat-option infostealer)](https://dependencywatch.io/incident/multi-2026-10-12-ghsa-malware-sweep) - [DependencyWatch: npm-2026-10-08-tensorlake-maintainer-compromise (recent maintainer-compromise carve-out, standing watch)](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise) - [DependencyWatch: npm-2026-10-12-hridoy-ultimate-fb-credential-stealer (recent FB credential-sink carve-out)](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer) --- Canonical page: https://dependencywatch.io/incident/multi-2026-10-14-ghsa-malware-sweep Markdown version: https://dependencywatch.io/incident/multi-2026-10-14-ghsa-malware-sweep.md Site index for agents: https://dependencywatch.io/llms.txt DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).