DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 15 October 2026

HighAdvisory sweepnpmPyPI

GHSA 2026-10-14/15 batch (~9 advisories). Headliner: npm conx3993 pushed 5 dep-confusion packages (@mntv-analysis/*, @user-interface-common/*, monkey-tags-ip) with per-package tokens beaconing realwbx.com. Carve-outs: npm babel-polyfill-plugin-corejs2 + eth-react-provider tarball typosquats; PyPI saeka credit-card checker calling uncoder.eu.org.

Published 15 Oct 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-10-15-ghsa-malware-sweep
9
Packages tracked46 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
15 Oct 2026
Ecosystems
npmPyPI
Detected by
GitHub Advisory Database, OpenSSF malicious-packages, Amazon Inspector, ESTsecurity, kam193/bad-packages, npm security, PyPI security
Also known as
2026-10-15 GHSA sweep, conx3993 realwbx.com dep-confusion operator, @mntv-analysis @user-interface-common monkey-tags-ip dep-confusion cluster

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

Between 2026-10-14 14:00 UTC (yesterdays sweep cutoff) and 2026-10-15 06:00 UTC (todays ingest-window start), the GitHub Advisory Database and OpenSSF malicious-packages published 9 fresh malware advisories across npm and PyPI. Five form a single operator dep-confusion cluster, two are an Amazon Inspector GHSA-import backfill of August-published tarball-payload typosquats, one is a long-running PyPI credit-card checker fraud tool, and one is a low-info boilerplate takedown.

Headline

*npm operator conx3993 pushed FIVE dep-confusion packages targeting `@mntv-analysis/, @user-interface-common/, and monkey-tags-ip` internal names in a single-day burst (Cluster A). Every one of them ships a preinstall hook that runs an "IP geolocation helper" index.js (or ip.js for monkey-tags-ip), sending an HTTPS GET to realwbx.com with a hard-coded per-package Authorization token. Unlike typical CWE-506 dep-confusion probes that emit a DNS beacon, this one makes an actual outbound HTTPS write and carries a developing operator-side identification scheme - each of the 5 packages has a unique token so the operator can tell which internal name squatted. The non-standard sentinel-version pattern (50.1.1, 65.11.3, 66.1.6, 99.1.1 - just high enough to beat an internal 0.x.y or 1.x.y but not the standard `99.99.) is the operators signature.

Confirmed-payload carve-outs within the sweep

  • Cluster B babel-polyfill-plugin-corejs2@1.0.1 (typosquat of babel-plugin-polyfill-corejs2) and eth-react-provider@1.0.0 (plausible React Ethereum provider lure) - Amazon Inspector GHSA-import backfill. Both carry 110KB obfuscated Function()-exec payloads at import time. Originally published to npm on 2026-08-24 and 2026-08-19 respectively; detected by Amazon Inspector; sat on the Amazon Inspector feed for ~7 weeks before GHSA imported them yesterday. The clean src/index.js in each repo lacks the payload - the published tarball was tampered with before upload. OSV MAL-2026-14426 and MAL-2026-14300.
  • Cluster C saeka (PyPI, 26 versions 1.0.0-15.0) - credit-card checker fraud tool calling https://uncoder.eu.org/cc-checker/api.php. OSV reason abusing-3rd-api, campaign tag 2026-10-saeka. ESTsecurity credited as finder; kam193 (Kamil Mańkowski) reported it. Unusually long version-list indicates sustained open development on PyPI before takedown.

Probes

Cluster D @xxxfnbs21/hello-demo (8 versions) is OSSF-noted "hello-" / "-demo" test-pattern naming - either an operator iterating a payload before a real campaign publish, or a dropped bug-bounty automation probe. CWE-506 boilerplate takedown with no published analysis.

Classification

sweep. Severity high taken as a whole, driven by Cluster B (confirmed Function()-exec payload at import time, albeit boilerplate CWE-506 advisory) and Cluster C (confirmed functional fraud tool with a specific named C2). Cluster A would be medium on its own (dep-confusion probe tier, HTTPS beacon not credential-stealing payload) and Cluster D is medium boilerplate; neither reduces overall sweep severity.

Discovery

GitHub Advisory Database, OpenSSF malicious-packages, Amazon Inspector (IN-MAL feed for Cluster B), ESTsecurity (Cluster C finder), kam193/bad-packages (Cluster C reporter), npm security, PyPI security.

dependency-confusiontyposquatobfuscationcredential-theft
Affected packages

9 packages 46 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • Cluster A - npm conx3993 operator 5-package dep-confusion with realwbx.com HTTPS beacon and per-package authorization tokens (dependency-confusion, confirmed HTTPS egress beyond CWE-506 boilerplate): @mntv-analysis/ui (99.1.1, 0.0.0-stage; GHSA-xrv8-6w5h-xhhf, OSV MAL-2026-17869), @mntv-analysis/ui-components (50.1.1, 0.0.0-stage; GHSA-82g4-6666-2x5v, OSV MAL-2026-17870), @mntv-analysis/workspaces-components (65.11.3, 0.0.0-stage; GHSA-8qv9-76f6-8h3c, OSV MAL-2026-17871), @user-interface-common/common-styles (66.1.6, 0.0.0-stage; GHSA-h9q3-2w8j-vhfr, OSV MAL-2026-17874), monkey-tags-ip (53.4.1, 0.0.0-stage; GHSA-88vx-pphm-qg2x, OSV MAL-2026-17875). Operator conx3993 published every one of them on 2026-10-14. Each package ships a preinstall hook that runs index.js (or ip.js for monkey-tags-ip), presenting itself as an "IP geolocation helper" and sending an HTTPS GET to realwbx.com with a hard-coded per-package Authorization token: ba95f7810845c0347d6a88d157933c81 (ui-components), 920ff204acf77aa813059be4f3141900 (workspaces-components), 2b6e9d1f4a7c0e3b8d5f2a9c6e1b4d7f (ui), bddd640d75c36bd562755a0044764366 (common-styles), Bearer xHlT6gllTfGbKgdivAKTzWKxrILWlNlv (monkey-tags-ip). The paths vary (/ip.php?ip=8.8.8.8 on four of them, /ip?f=json on monkey-tags-ip) and the response is discarded - the point of the request is that the operator learns the egress IP of the installing host AND which internal package name resolved against the public registry (the unique token identifies the squatted name). Unlike typical CWE-506 dep-confusion boilerplate that merely emits a DNS beacon, these do an actual outbound HTTPS write and carry a developing operator-side identification scheme. Severity medium for the cluster alone (dep-confusion probe tier - no further payload beyond the beacon; still catalogued because the unique-token scheme means every match reveals an internal package name)
  • Cluster B - npm Amazon Inspector tarball-payload typosquat GHSA backfill (malicious-package, confirmed obfuscated Function()-exec payload at import time but with boilerplate CWE-506 advisory text): babel-polyfill-plugin-corejs2 (1.0.1; GHSA-9g6r-83hw-6cq2, OSV MAL-2026-14426, originally published 2026-08-24, GHSA-imported 2026-10-14) and eth-react-provider (1.0.0; GHSA-rr86-r66c-qc54, OSV MAL-2026-14300, originally published 2026-08-19, GHSA-imported 2026-10-14). Both are tarball-payload typosquats originally flagged by Amazon Inspector (IN-MAL-2026-018647 for the first) that sat on the Amazon Inspector feed for ~7 weeks before GHSA imported them yesterday. babel-polyfill-plugin-corejs2 typosquats the real babel-plugin-polyfill-corejs2 package (Babel/polyfill ecosystem); eth-react-provider is a plausible-sounding React Ethereum provider lure claiming to export useProvider and useSigner hooks. In both, lib/index.js contains unrelated boilerplate followed by roughly 110KB of obfuscated JavaScript that is executed via Function() on module require(). For babel-polyfill-plugin-corejs2@1.0.1 the artifact hashes are: lib/index.js SHA-256 e128537a49012ee255e98827ece385ecabeb4827ba8ce8dc2eaca045102666dc, tarball SHA-1 076c925c9d1cf6a577096db7b79ab1ef3879459c. For eth-react-provider@1.0.0 the lib/index.js SHA-256 is faaf7c7168b80ef8148c54ed779926fed0edd38bb391f980f5e12981bcbb9683. The clean src/index.js in each repo lacks the payload - the published artifact was tampered with before upload. Severity high for this cluster (confirmed malicious Function()-exec payload at import time; the long GHSA-import delay means these two have been installable from the npm registry for ~7 weeks without a GHSA entry warning developers)
  • Cluster C - PyPI saeka 26-version credit-card checker fraud tool calling uncoder.eu.org/cc-checker/api.php (malicious-package, confirmed functional fraud tool with named C2 endpoint): saeka (1.0.0, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0, 1.4.0, 1.5.0, 1.6.0, 1.7.0, 1.8.0, 1.8.1, 1.8.2, 2.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0, 9.5, 10.0, 11.1, 11.2, 11.9, 15.0; GHSA-mg63-mhjw-2w9m, OSV MAL-2026-17877, campaign 2026-10-saeka, OSSF reason abusing-3rd-api). The package describes itself as a "mass credit card checker" that verifies card validity by abusing live retail services, calling https://uncoder.eu.org/cc-checker/api.php. ESTsecurity is credited as finder; kam193 (Kamil Mańkowski) reported it to OSSF. Unusually long version-list for a fresh advisory (26 versions over 1.0.0 through 15.0) indicates the package has been developed openly on PyPI for some time before takedown. Severity high for this package alone (confirmed functional malicious tool with a specific named C2; the end-victim is a third-party retail service, not the developer installing the package, but any environment running pip install saeka is participating in card-abuse traffic to uncoder.eu.org and should be treated as needing offline forensic review for stored card data or fraud-ring membership)
  • Cluster D - npm @xxxfnbs21/hello-demo 8-version test-pattern probe (malicious-package, CWE-506 boilerplate takedown with no published analysis): @xxxfnbs21/hello-demo (0.0.0-stage, 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.5, 0.1.6, 0.1.8; GHSA-hf57-6wg3-343x, OSV MAL-2026-17876). Package name uses the OSSF-noted "hello-" / "-demo" test-pattern naming that is the signature of an operator iterating a payload before a real campaign publish, OR a dropped bug-bounty automation probe. 8 versions pushed in short succession is consistent with payload iteration. All CWE-506 "fully compromised" boilerplate advisories with no shipped IOC body. Severity medium (install-time code execution risk per OSSF typosquat/boilerplate pattern, no vendor runtime analysis published yet)
  • Operator continuity: todays material is largely a new wave rather than a continuation of this weeks operators. No new activity from: priyashareek Accenture+@newspage dep-confusion operator (yesterday - sibling @newspage packages continued their GHSA registration today under GHSA-49j3-qrv4-xgwv and GHSA-5m6v-q7rf-gh3x but no new scopes), dumtban orderly-plugin GitHub Actions CI-token-abuse operator (yesterday), kingsize+limbomail.com+lunexindonesia/node-net-pool discord-mfa Windows-RAT campaign (quiet since passwordcracker/passwordcrackv2 yesterday), Baileys/libsignal lure operator wave 3 (quiet since @chatest/baileys extension yesterday), kam193 continues as top PyPI malware reporter (saeka and fontcase/sysdiagd/pyyi yesterday all attributed), s4yhii operator (quiet since 2026-10-13 wave), 185.158.107.175 operator, 64.181.165.115 operator, hardhat-option operator, agentaix operator, wgkit RubyGems operator (quiet since 2026-10-12 wave 2), xwise8887, sharpnes crates.io, @tunstock/remact-dom, Wix dep-confusion, nfjbill, @bitwardne/*, reaperhackbot256f, ig-gox. New operators today: conx3993 (5-package npm dep-confusion with realwbx.com and per-package tokens - novel operator-side identification scheme). New standing C2 host: realwbx.com (apex + /ip.php + /ip paths). New fraud-service C2 host: uncoder.eu.org/cc-checker/api.php (not a developer-threat sink but worth adding to CI/build-host egress blocks for the fraud-flow visibility it would provide if a workstation ever installed it). TensorLake AI maintainer compromise (2026-10-08 carve-out) remains quiet at tensorlake@0.5.145 with no wave-2 republish
What to do

Clean-up steps

  1. For Cluster A (conx3993 operator realwbx.com dep-confusion): grep every package.json, package-lock.json, yarn.lock, pnpm-lock.yaml for @mntv-analysis/ui, @mntv-analysis/ui-components, @mntv-analysis/workspaces-components, @user-interface-common/common-styles, monkey-tags-ip. Any match (including the 0.0.0-stage placeholder) indicates the operators dep-confusion resolved against the public registry at least once. Any team using @mntv-analysis/, @user-interface-common/, or monkey-tags-ip internally should **immediately scope-lock the internal registry** (npm config set @mntv-analysis:registry https://internal-registry and similar for the other scope; namespace-protect monkey-tags-ip on the public registry) and hold both scopes with placeholder packages at a safe version. Block realwbx.com at egress on all CI/build hosts; the hard-coded Authorization tokens in the install hooks (ba95f78108..., 920ff204ac..., 2b6e9d1f4a..., bddd640d75..., Bearer xHlT6gllTfGbKgdiv...) are unique per package and signal which internal name the operator was able to squat. Audit CI/build logs for outbound requests to realwbx.com/ip.php and realwbx.com/ip. The sentinel-version-high pattern (50.1.1, 65.11.3, 66.1.6, 99.1.1 - just high enough to beat an internal 0.x.y or 1.x.y) is a non-standard dep-confusion signature; teach contributors that any npm scoped package suddenly jumping to a >= 50.x.x` first version with no prior history is suspect by construction
  2. For Cluster B (Amazon Inspector tarball-payload typosquats): grep every package.json, package-lock.json, yarn.lock, pnpm-lock.yaml for babel-polyfill-plugin-corejs2 (version 1.0.1) and eth-react-provider (version 1.0.0). The real packages a developer would have wanted are babel-plugin-polyfill-corejs2 (lowercase, hyphen-ordered) and - for React Ethereum provider needs - @reown/appkit, wagmi, @rainbow-me/rainbowkit, or connectkit depending on the stack. On any hit, treat the installing host as having run a 110KB obfuscated payload via Function() and rotate every secret the host had access to in the exposure window (environment vars at build time, npm/CI tokens, cloud-provider SDK credentials, SSH/GPG keys that were unlocked while a dev-shell ran require('babel-polyfill-plugin-corejs2') or an app at runtime ran require('eth-react-provider')). Image the host if it was a build runner or shared VM. The ~7-week delay between Amazon Inspector detection (2026-08-19 and 2026-08-24) and GHSA import (2026-10-14) means these packages were installable from npm with no GHSA warning for a long time - audit lockfile history as far back as September 2026 for anyone who may have added these before yesterday`s advisories landed
  3. For Cluster C (PyPI saeka credit-card checker fraud tool): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda env for saeka (any of the 26 affected versions). On ANY corporate dev-host or CI runner hit: this is a fraud tool used by card-abuse operators, NOT a typical developer dependency - its presence on a corporate host is itself a strong indicator the host or its account has been co-opted for card-abuse workflows. Preserve the host for forensic review (do NOT just pip uninstall), scope the investigation to credit card data, retail-abuse traffic, and operator persistence, and loop in internal fraud/anti-money-laundering teams in addition to IR. Block uncoder.eu.org apex at egress on all workstations and CI/build hosts; the /cc-checker/api.php path is the fraud-flow sink. Note that the end-victim of this package is the retail service being abused, not the developer - but the developer`s host has processed card-validation traffic that may itself have attracted stored card data, so a forensic review for stored card data is warranted
  4. For Cluster D (@xxxfnbs21/hello-demo boilerplate probe): grep for @xxxfnbs21/hello-demo (any of the 8 affected versions). On hit, remove, invalidate any Docker layer or build cache that ran npm install, and audit CI logs for environment-variable leakage. CWE-506 boilerplate advisory means the specific payload is undocumented in this GHSA; treat the install as credential-compromised until Socket or a vendor publishes a runtime analysis. The 8-version short-succession publish pattern is characteristic of an operator iterating payload - watch for a wave-2 @xxxfnbs21/* scope expansion
  5. NEW outbound denylist entries for CI/build-host egress proxies today: realwbx.com apex + /ip.php + /ip paths (Cluster A conx3993 operator dep-confusion C2 host, 5 packages across 3 internal-scope targets); uncoder.eu.org apex + /cc-checker/api.php path (Cluster C saeka fraud-tool C2 host, 26 versions). Keep prior egress blocks in place: accenture-npm.azurewebsites.net + /test + /async + /mfe, limbomail.com apex + github.com/lunexindonesia/node-net-pool + github.com/trktgq0wbre1/node-net-pool, github.com/unicodeces/font-atlas, space-z.ai apex + preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai + b196q82k8891-d.space-z.ai subdomains, collector.oob.s4yhii.com + *.oob.s4yhii.com + s4yhii.com apex, 64.181.165.115/dc, 167.88.172.33:8087 + jsonspack.com, goxtools.shop apex, minhdong.site apex + GitHub user VangBanLaNhat, 45.138.12.177:8089, 185.158.107.175:8787, ltidi.storage.googleapis.com/depenconf/, oob.s4yhii.com:9999/native, *.oast.pro/*.oast.me/*.oast.fun/*.oast.site/*.oastify.com, frjmzbjbhwvtdnsuodmu.supabase.co, api.npoint.io apex, googleforum.pythonanywhere.com, tele.metry.orgin.net, morroncr0w.io, api.telegram.org on untrusted CI/build hosts, appsecc.com, webhook.site/*, dxpoc.gt.tc, nfjbill.ren, storage.googleapis.com/depenconf/, 10.0.19.0/24 + 10.0.49.0/24, api.nm-streetwear.space, Discord webhook URL pattern, ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, chinazhangsan.ccwu.cc, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil patterns, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com, 45.138.0.0/16 RubyGems wgkit CIDRs
References

Sources

multi-2026-10-15-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents