# GitHub Advisory malware sweep, 15 October 2026

> GHSA 2026-10-14/15 batch (~9 advisories). Headliner: npm `conx3993` pushed 5 dep-confusion packages (`@mntv-analysis/*`, `@user-interface-common/*`, `monkey-tags-ip`) with per-package tokens beaconing `realwbx.com`. Carve-outs: npm `babel-polyfill-plugin-corejs2` + `eth-react-provider` tarball typosquats; PyPI `saeka` credit-card checker calling `uncoder.eu.org`.

- Published: 2026-10-15
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 9 packages, 46 compromised versions
- Tags: dependency-confusion, typosquat, obfuscation, credential-theft
- Also known as: 2026-10-15 GHSA sweep, conx3993 realwbx.com dep-confusion operator, @mntv-analysis @user-interface-common monkey-tags-ip dep-confusion cluster, babel-polyfill-plugin-corejs2 typosquat (Amazon Inspector backfill), eth-react-provider typosquat (Amazon Inspector backfill), saeka PyPI credit-card checker fraud tool, 2026-10-saeka campaign
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, Amazon Inspector, ESTsecurity, kam193/bad-packages, npm security, PyPI security
- Incident ID: multi-2026-10-15-ghsa-malware-sweep

## Affected packages (9)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@mntv-analysis/ui](https://dependencywatch.io/package/npm/@mntv-analysis/ui) | npm | 99.1.1, 0.0.0-stage |
| [@mntv-analysis/ui-components](https://dependencywatch.io/package/npm/@mntv-analysis/ui-components) | npm | 50.1.1, 0.0.0-stage |
| [@mntv-analysis/workspaces-components](https://dependencywatch.io/package/npm/@mntv-analysis/workspaces-components) | npm | 65.11.3, 0.0.0-stage |
| [@user-interface-common/common-styles](https://dependencywatch.io/package/npm/@user-interface-common/common-styles) | npm | 66.1.6, 0.0.0-stage |
| [@xxxfnbs21/hello-demo](https://dependencywatch.io/package/npm/@xxxfnbs21/hello-demo) | npm | 0.0.0-stage, 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.5, 0.1.6, 0.1.8 |
| [babel-polyfill-plugin-corejs2](https://dependencywatch.io/package/npm/babel-polyfill-plugin-corejs2) | npm | 1.0.1 |
| [eth-react-provider](https://dependencywatch.io/package/npm/eth-react-provider) | npm | 1.0.0 |
| [monkey-tags-ip](https://dependencywatch.io/package/npm/monkey-tags-ip) | npm | 53.4.1, 0.0.0-stage |
| [saeka](https://dependencywatch.io/package/pypi/saeka) | PyPI | 1.0.0, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0, 1.4.0, 1.5.0, 1.6.0, 1.7.0, 1.8.0, 1.8.1, 1.8.2, 2.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0, 9.5, 10.0, 11.1, 11.2, 11.9, 15.0 |

## What happened

Between 2026-10-14 14:00 UTC (yesterday`s sweep cutoff) and 2026-10-15 06:00 UTC (today`s ingest-window start), the GitHub Advisory Database and OpenSSF `malicious-packages` published 9 fresh malware advisories across npm and PyPI. Five form a single operator dep-confusion cluster, two are an Amazon Inspector GHSA-import backfill of August-published tarball-payload typosquats, one is a long-running PyPI credit-card checker fraud tool, and one is a low-info boilerplate takedown.

## Headline

**npm operator `conx3993` pushed FIVE dep-confusion packages targeting `@mntv-analysis/*`, `@user-interface-common/*`, and `monkey-tags-ip` internal names in a single-day burst** (Cluster A). Every one of them ships a `preinstall` hook that runs an "IP geolocation helper" `index.js` (or `ip.js` for `monkey-tags-ip`), sending an HTTPS GET to `realwbx.com` with a hard-coded per-package `Authorization` token. Unlike typical CWE-506 dep-confusion probes that emit a DNS beacon, this one makes an actual outbound HTTPS write and carries a developing operator-side identification scheme - each of the 5 packages has a unique token so the operator can tell which internal name squatted. The non-standard sentinel-version pattern (50.1.1, 65.11.3, 66.1.6, 99.1.1 - just high enough to beat an internal `0.x.y` or `1.x.y` but not the standard `99.99.*`) is the operator`s signature.

## Confirmed-payload carve-outs within the sweep

- **Cluster B** `babel-polyfill-plugin-corejs2@1.0.1` (typosquat of `babel-plugin-polyfill-corejs2`) and `eth-react-provider@1.0.0` (plausible React Ethereum provider lure) - Amazon Inspector GHSA-import backfill. Both carry 110KB obfuscated `Function()`-exec payloads at import time. Originally published to npm on 2026-08-24 and 2026-08-19 respectively; detected by Amazon Inspector; sat on the Amazon Inspector feed for ~7 weeks before GHSA imported them yesterday. The clean `src/index.js` in each repo lacks the payload - the published tarball was tampered with before upload. OSV MAL-2026-14426 and MAL-2026-14300.
- **Cluster C** `saeka` (PyPI, 26 versions `1.0.0`-`15.0`) - credit-card checker fraud tool calling `https://uncoder.eu.org/cc-checker/api.php`. OSV reason `abusing-3rd-api`, campaign tag `2026-10-saeka`. ESTsecurity credited as finder; `kam193` (Kamil Mańkowski) reported it. Unusually long version-list indicates sustained open development on PyPI before takedown.

## Probes

**Cluster D** `@xxxfnbs21/hello-demo` (8 versions) is OSSF-noted "hello-*" / "*-demo" test-pattern naming - either an operator iterating a payload before a real campaign publish, or a dropped bug-bounty automation probe. CWE-506 boilerplate takedown with no published analysis.

## Classification

`sweep`. Severity `high` taken as a whole, driven by Cluster B (confirmed `Function()`-exec payload at import time, albeit boilerplate CWE-506 advisory) and Cluster C (confirmed functional fraud tool with a specific named C2). Cluster A would be `medium` on its own (dep-confusion probe tier, HTTPS beacon not credential-stealing payload) and Cluster D is `medium` boilerplate; neither reduces overall sweep severity.

## Discovery

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `Amazon Inspector` (IN-MAL feed for Cluster B), `ESTsecurity` (Cluster C finder), `kam193/bad-packages` (Cluster C reporter), `npm security`, `PyPI security`.

## Impact

- **Cluster A - npm `conx3993` operator 5-package dep-confusion with `realwbx.com` HTTPS beacon and per-package authorization tokens (dependency-confusion, confirmed HTTPS egress beyond CWE-506 boilerplate)**: `@mntv-analysis/ui` (99.1.1, 0.0.0-stage; GHSA-xrv8-6w5h-xhhf, OSV MAL-2026-17869), `@mntv-analysis/ui-components` (50.1.1, 0.0.0-stage; GHSA-82g4-6666-2x5v, OSV MAL-2026-17870), `@mntv-analysis/workspaces-components` (65.11.3, 0.0.0-stage; GHSA-8qv9-76f6-8h3c, OSV MAL-2026-17871), `@user-interface-common/common-styles` (66.1.6, 0.0.0-stage; GHSA-h9q3-2w8j-vhfr, OSV MAL-2026-17874), `monkey-tags-ip` (53.4.1, 0.0.0-stage; GHSA-88vx-pphm-qg2x, OSV MAL-2026-17875). Operator `conx3993` published every one of them on 2026-10-14. Each package ships a `preinstall` hook that runs `index.js` (or `ip.js` for `monkey-tags-ip`), presenting itself as an "IP geolocation helper" and sending an HTTPS GET to `realwbx.com` with a hard-coded per-package `Authorization` token: `ba95f7810845c0347d6a88d157933c81` (ui-components), `920ff204acf77aa813059be4f3141900` (workspaces-components), `2b6e9d1f4a7c0e3b8d5f2a9c6e1b4d7f` (ui), `bddd640d75c36bd562755a0044764366` (common-styles), `Bearer xHlT6gllTfGbKgdivAKTzWKxrILWlNlv` (monkey-tags-ip). The paths vary (`/ip.php?ip=8.8.8.8` on four of them, `/ip?f=json` on `monkey-tags-ip`) and the response is discarded - the point of the request is that the operator learns the egress IP of the installing host AND which internal package name resolved against the public registry (the unique token identifies the squatted name). Unlike typical CWE-506 dep-confusion boilerplate that merely emits a DNS beacon, these do an actual outbound HTTPS write and carry a developing operator-side identification scheme. Severity `medium` for the cluster alone (dep-confusion probe tier - no further payload beyond the beacon; still catalogued because the unique-token scheme means every match reveals an internal package name)
- **Cluster B - npm Amazon Inspector tarball-payload typosquat GHSA backfill (malicious-package, confirmed obfuscated `Function()`-exec payload at import time but with boilerplate CWE-506 advisory text)**: `babel-polyfill-plugin-corejs2` (1.0.1; GHSA-9g6r-83hw-6cq2, OSV MAL-2026-14426, originally published 2026-08-24, GHSA-imported 2026-10-14) and `eth-react-provider` (1.0.0; GHSA-rr86-r66c-qc54, OSV MAL-2026-14300, originally published 2026-08-19, GHSA-imported 2026-10-14). Both are tarball-payload typosquats originally flagged by Amazon Inspector (IN-MAL-2026-018647 for the first) that sat on the Amazon Inspector feed for ~7 weeks before GHSA imported them yesterday. `babel-polyfill-plugin-corejs2` typosquats the real `babel-plugin-polyfill-corejs2` package (Babel/polyfill ecosystem); `eth-react-provider` is a plausible-sounding React Ethereum provider lure claiming to export `useProvider` and `useSigner` hooks. In both, `lib/index.js` contains unrelated boilerplate followed by roughly 110KB of obfuscated JavaScript that is executed via `Function()` on module `require()`. For `babel-polyfill-plugin-corejs2@1.0.1` the artifact hashes are: `lib/index.js` SHA-256 `e128537a49012ee255e98827ece385ecabeb4827ba8ce8dc2eaca045102666dc`, tarball SHA-1 `076c925c9d1cf6a577096db7b79ab1ef3879459c`. For `eth-react-provider@1.0.0` the `lib/index.js` SHA-256 is `faaf7c7168b80ef8148c54ed779926fed0edd38bb391f980f5e12981bcbb9683`. The clean `src/index.js` in each repo lacks the payload - the published artifact was tampered with before upload. Severity `high` for this cluster (confirmed malicious Function()-exec payload at import time; the long GHSA-import delay means these two have been installable from the npm registry for ~7 weeks without a GHSA entry warning developers)
- **Cluster C - PyPI `saeka` 26-version credit-card checker fraud tool calling `uncoder.eu.org/cc-checker/api.php` (malicious-package, confirmed functional fraud tool with named C2 endpoint)**: `saeka` (1.0.0, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0, 1.4.0, 1.5.0, 1.6.0, 1.7.0, 1.8.0, 1.8.1, 1.8.2, 2.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0, 9.5, 10.0, 11.1, 11.2, 11.9, 15.0; GHSA-mg63-mhjw-2w9m, OSV MAL-2026-17877, campaign `2026-10-saeka`, OSSF reason `abusing-3rd-api`). The package describes itself as a "mass credit card checker" that verifies card validity by abusing live retail services, calling `https://uncoder.eu.org/cc-checker/api.php`. ESTsecurity is credited as finder; `kam193` (Kamil Mańkowski) reported it to OSSF. Unusually long version-list for a fresh advisory (26 versions over `1.0.0` through `15.0`) indicates the package has been developed openly on PyPI for some time before takedown. Severity `high` for this package alone (confirmed functional malicious tool with a specific named C2; the end-victim is a third-party retail service, not the developer installing the package, but any environment running `pip install saeka` is participating in card-abuse traffic to `uncoder.eu.org` and should be treated as needing offline forensic review for stored card data or fraud-ring membership)
- **Cluster D - npm `@xxxfnbs21/hello-demo` 8-version test-pattern probe (malicious-package, CWE-506 boilerplate takedown with no published analysis)**: `@xxxfnbs21/hello-demo` (0.0.0-stage, 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.5, 0.1.6, 0.1.8; GHSA-hf57-6wg3-343x, OSV MAL-2026-17876). Package name uses the OSSF-noted "hello-*" / "*-demo" test-pattern naming that is the signature of an operator iterating a payload before a real campaign publish, OR a dropped bug-bounty automation probe. 8 versions pushed in short succession is consistent with payload iteration. All CWE-506 "fully compromised" boilerplate advisories with no shipped IOC body. Severity `medium` (install-time code execution risk per OSSF typosquat/boilerplate pattern, no vendor runtime analysis published yet)
- **Operator continuity**: today`s material is largely a new wave rather than a continuation of this week`s operators. **No new activity** from: `priyashareek` Accenture+@newspage dep-confusion operator (yesterday - sibling `@newspage` packages continued their GHSA registration today under GHSA-49j3-qrv4-xgwv and GHSA-5m6v-q7rf-gh3x but no new scopes), `dumtban` orderly-plugin GitHub Actions CI-token-abuse operator (yesterday), `kingsize`+`limbomail.com`+`lunexindonesia/node-net-pool` discord-mfa Windows-RAT campaign (quiet since `passwordcracker`/`passwordcrackv2` yesterday), Baileys/libsignal lure operator wave 3 (quiet since `@chatest/baileys` extension yesterday), `kam193` continues as top PyPI malware reporter (`saeka` and `fontcase`/`sysdiagd`/`pyyi` yesterday all attributed), `s4yhii` operator (quiet since 2026-10-13 wave), `185.158.107.175` operator, `64.181.165.115` operator, `hardhat-option` operator, `agentaix` operator, `wgkit` RubyGems operator (quiet since 2026-10-12 wave 2), `xwise8887`, `sharpnes` crates.io, `@tunstock/remact-dom`, Wix dep-confusion, `nfjbill`, `@bitwardne/*`, `reaperhackbot256f`, `ig-gox`. **New operators today**: `conx3993` (5-package npm dep-confusion with `realwbx.com` and per-package tokens - novel operator-side identification scheme). **New standing C2 host**: `realwbx.com` (apex + `/ip.php` + `/ip` paths). **New fraud-service C2 host**: `uncoder.eu.org/cc-checker/api.php` (not a developer-threat sink but worth adding to CI/build-host egress blocks for the fraud-flow visibility it would provide if a workstation ever installed it). TensorLake AI maintainer compromise ([2026-10-08 carve-out](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise)) remains quiet at `tensorlake@0.5.145` with no wave-2 republish

## What to do

1. **For Cluster A (`conx3993` operator `realwbx.com` dep-confusion)**: grep every `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml` for `@mntv-analysis/ui`, `@mntv-analysis/ui-components`, `@mntv-analysis/workspaces-components`, `@user-interface-common/common-styles`, `monkey-tags-ip`. Any match (including the `0.0.0-stage` placeholder) indicates the operator`s dep-confusion resolved against the public registry at least once. Any team using `@mntv-analysis/*`, `@user-interface-common/*`, or `monkey-tags-ip` internally should **immediately scope-lock the internal registry** (`npm config set @mntv-analysis:registry https://internal-registry` and similar for the other scope; namespace-protect `monkey-tags-ip` on the public registry) and hold both scopes with placeholder packages at a safe version. Block `realwbx.com` at egress on all CI/build hosts; the hard-coded `Authorization` tokens in the install hooks (`ba95f78108...`, `920ff204ac...`, `2b6e9d1f4a...`, `bddd640d75...`, `Bearer xHlT6gllTfGbKgdiv...`) are unique per package and signal which internal name the operator was able to squat. Audit CI/build logs for outbound requests to `realwbx.com/ip.php` and `realwbx.com/ip`. The sentinel-version-high pattern (50.1.1, 65.11.3, 66.1.6, 99.1.1 - just high enough to beat an internal `0.x.y` or `1.x.y`) is a non-standard dep-confusion signature; teach contributors that any npm scoped package suddenly jumping to a `>= 50.x.x` first version with no prior history is suspect by construction
2. **For Cluster B (Amazon Inspector tarball-payload typosquats)**: grep every `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml` for `babel-polyfill-plugin-corejs2` (version 1.0.1) and `eth-react-provider` (version 1.0.0). The real packages a developer would have wanted are `babel-plugin-polyfill-corejs2` (lowercase, hyphen-ordered) and - for React Ethereum provider needs - `@reown/appkit`, `wagmi`, `@rainbow-me/rainbowkit`, or `connectkit` depending on the stack. On any hit, treat the installing host as having run a 110KB obfuscated payload via `Function()` and rotate every secret the host had access to in the exposure window (environment vars at build time, npm/CI tokens, cloud-provider SDK credentials, SSH/GPG keys that were unlocked while a dev-shell ran `require('babel-polyfill-plugin-corejs2')` or an app at runtime ran `require('eth-react-provider')`). Image the host if it was a build runner or shared VM. The ~7-week delay between Amazon Inspector detection (2026-08-19 and 2026-08-24) and GHSA import (2026-10-14) means these packages were installable from npm with no GHSA warning for a long time - audit lockfile history as far back as September 2026 for anyone who may have added these before yesterday`s advisories landed
3. **For Cluster C (PyPI `saeka` credit-card checker fraud tool)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, `conda env` for `saeka` (any of the 26 affected versions). On ANY corporate dev-host or CI runner hit: this is a fraud tool used by card-abuse operators, NOT a typical developer dependency - its presence on a corporate host is itself a strong indicator the host or its account has been co-opted for card-abuse workflows. Preserve the host for forensic review (do NOT just `pip uninstall`), scope the investigation to credit card data, retail-abuse traffic, and operator persistence, and loop in internal fraud/anti-money-laundering teams in addition to IR. Block `uncoder.eu.org` apex at egress on all workstations and CI/build hosts; the `/cc-checker/api.php` path is the fraud-flow sink. Note that the end-victim of this package is the retail service being abused, not the developer - but the developer`s host has processed card-validation traffic that may itself have attracted stored card data, so a forensic review for stored card data is warranted
4. **For Cluster D (`@xxxfnbs21/hello-demo` boilerplate probe)**: grep for `@xxxfnbs21/hello-demo` (any of the 8 affected versions). On hit, remove, invalidate any Docker layer or build cache that ran `npm install`, and audit CI logs for environment-variable leakage. CWE-506 boilerplate advisory means the specific payload is undocumented in this GHSA; treat the install as credential-compromised until Socket or a vendor publishes a runtime analysis. The 8-version short-succession publish pattern is characteristic of an operator iterating payload - watch for a wave-2 `@xxxfnbs21/*` scope expansion
5. **NEW outbound denylist entries for CI/build-host egress proxies today**: `realwbx.com` apex + `/ip.php` + `/ip` paths (Cluster A `conx3993` operator dep-confusion C2 host, 5 packages across 3 internal-scope targets); `uncoder.eu.org` apex + `/cc-checker/api.php` path (Cluster C `saeka` fraud-tool C2 host, 26 versions). Keep prior egress blocks in place: `accenture-npm.azurewebsites.net` + `/test` + `/async` + `/mfe`, `limbomail.com` apex + `github.com/lunexindonesia/node-net-pool` + `github.com/trktgq0wbre1/node-net-pool`, `github.com/unicodeces/font-atlas`, `space-z.ai` apex + `preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai` + `b196q82k8891-d.space-z.ai` subdomains, `collector.oob.s4yhii.com` + `*.oob.s4yhii.com` + `s4yhii.com` apex, `64.181.165.115/dc`, `167.88.172.33:8087` + `jsonspack.com`, `goxtools.shop` apex, `minhdong.site` apex + GitHub user `VangBanLaNhat`, `45.138.12.177:8089`, `185.158.107.175:8787`, `ltidi.storage.googleapis.com/depenconf/`, `oob.s4yhii.com:9999/native`, `*.oast.pro`/`*.oast.me`/`*.oast.fun`/`*.oast.site`/`*.oastify.com`, `frjmzbjbhwvtdnsuodmu.supabase.co`, `api.npoint.io` apex, `googleforum.pythonanywhere.com`, `tele.metry.orgin.net`, `morroncr0w.io`, `api.telegram.org` on untrusted CI/build hosts, `appsecc.com`, `webhook.site/*`, `dxpoc.gt.tc`, `nfjbill.ren`, `storage.googleapis.com/depenconf/`, `10.0.19.0/24` + `10.0.49.0/24`, `api.nm-streetwear.space`, Discord webhook URL pattern, `ipify.org` + `ifconfig.me`, `gitflic.ru`, `api.wagmiwallet.org`, `backend-cybersecuritydashboard.onrender.com`, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, `chinazhangsan.ccwu.cc`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `npm-canary.aveliscare.com`, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil patterns, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, `tuamaeaquelaursa.com`, `45.138.0.0/16` RubyGems wgkit CIDRs

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-xrv8-6w5h-xhhf - npm @mntv-analysis/ui (Cluster A - conx3993 operator, realwbx.com beacon, token 2b6e9d1f..., 99.1.1 sentinel, MAL-2026-17869)](https://github.com/advisories/GHSA-xrv8-6w5h-xhhf) - GitHub
- [GHSA-82g4-6666-2x5v - npm @mntv-analysis/ui-components (Cluster A - conx3993 operator, token ba95f781..., 50.1.1 sentinel, MAL-2026-17870)](https://github.com/advisories/GHSA-82g4-6666-2x5v) - GitHub
- [GHSA-8qv9-76f6-8h3c - npm @mntv-analysis/workspaces-components (Cluster A - conx3993 operator, token 920ff204..., 65.11.3 sentinel, MAL-2026-17871)](https://github.com/advisories/GHSA-8qv9-76f6-8h3c) - GitHub
- [GHSA-h9q3-2w8j-vhfr - npm @user-interface-common/common-styles (Cluster A - conx3993 operator, token bddd640d..., 66.1.6 sentinel, MAL-2026-17874)](https://github.com/advisories/GHSA-h9q3-2w8j-vhfr) - GitHub
- [GHSA-88vx-pphm-qg2x - npm monkey-tags-ip (Cluster A - conx3993 operator, Bearer xHlT6gllTfGbKgdiv... token, 53.4.1 sentinel, uses ip.js variant and /ip?f=json path, MAL-2026-17875)](https://github.com/advisories/GHSA-88vx-pphm-qg2x) - GitHub
- [GHSA-9g6r-83hw-6cq2 - npm babel-polyfill-plugin-corejs2 (Cluster B - typosquat of babel-plugin-polyfill-corejs2, 110KB obfuscated Function() payload, originally pub 2026-08-24, GHSA-imported 2026-10-14, Amazon Inspector IN-MAL-2026-018647, MAL-2026-14426)](https://github.com/advisories/GHSA-9g6r-83hw-6cq2) - GitHub
- [OSSF malicious-packages MAL-2026-14426 raw record (babel-polyfill-plugin-corejs2 IOCs: lib/index.js SHA-256 e128537a..., tarball SHA-1 076c925c..., package.json SHA-256 0a2baad7..., finder Amazon Inspector)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/npm/babel-polyfill-plugin-corejs2/MAL-2026-14426.json) - OpenSSF
- [GHSA-rr86-r66c-qc54 - npm eth-react-provider (Cluster B - plausible React Ethereum provider lure, 110KB obfuscated Function() payload, originally pub 2026-08-19, GHSA-imported 2026-10-14, MAL-2026-14300)](https://github.com/advisories/GHSA-rr86-r66c-qc54) - GitHub
- [OSSF malicious-packages MAL-2026-14300 raw record (eth-react-provider IOCs: lib/index.js SHA-256 faaf7c71..., finder Amazon Inspector, web3.js Subscriptions boilerplate+obfuscated payload)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/npm/eth-react-provider/MAL-2026-14300.json) - OpenSSF
- [GHSA-mg63-mhjw-2w9m - pypi saeka (Cluster C - 26-version credit-card checker fraud tool calling uncoder.eu.org/cc-checker/api.php, campaign 2026-10-saeka, OSSF reason abusing-3rd-api, MAL-2026-17877)](https://github.com/advisories/GHSA-mg63-mhjw-2w9m) - GitHub
- [OSSF malicious-packages MAL-2026-17877 raw record (saeka IOCs: uncoder.eu.org host, /cc-checker/api.php path, 26 affected versions, finder ESTsecurity, reporter kam193)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/pypi/saeka/MAL-2026-17877.json) - OpenSSF
- [kam193 bad-packages entry for saeka (reporter`s own detail page for the PyPI advisory)](https://bad-packages.kam193.eu/pypi/package/saeka)
- [GHSA-hf57-6wg3-343x - npm @xxxfnbs21/hello-demo (Cluster D - 8-version test-pattern probe, CWE-506 boilerplate, MAL-2026-17876)](https://github.com/advisories/GHSA-hf57-6wg3-343x) - GitHub
- [DependencyWatch: multi-2026-10-14-ghsa-malware-sweep (prior-day context: dumtban orderly-plugin GITHUB_TOKEN write-back, Accenture dep-confusion + @newspage siblings, fontcase/sysdiagd/pyyi carve-outs, passwordcracker Windows-RAT continuation, opencode2 typosquat family, @chatest/baileys lure wave 3 extension)](https://dependencywatch.io/incident/multi-2026-10-14-ghsa-malware-sweep)
- [DependencyWatch: multi-2026-10-13-ghsa-malware-sweep (Baileys lure wave 3 60+ packages, npp-ml AD-recon, minecraftaccfinder infostealer+RAT, wallet-balance-scanner reverse-shell, s4yhii wave 3)](https://dependencywatch.io/incident/multi-2026-10-13-ghsa-malware-sweep)
- [DependencyWatch: npm-2026-10-08-tensorlake-maintainer-compromise (recent maintainer-compromise carve-out, standing watch)](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise)
- [DependencyWatch: npm-2026-10-12-hridoy-ultimate-fb-credential-stealer (recent FB credential-sink carve-out)](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-15-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-15-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).