DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 16 October 2026

HighAdvisory sweepnpmPyPI

GHSA 2026-10-15/16 batch (20 advisories). PyPI agentaix wave 2 adds py-worm+py-wormgpt+py-sock2 with GitHub-raw stage-2 and googleforum.pythonanywhere.com C2. npm Wix dep-confusion wave 3 ships util-foriepft reusing the K8s-SA-token-theft thunderboltRegistry.js family. seapy-ops adds concealed-upload + in-memory exec; getpubip infostealer.

Published 16 Oct 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-10-16-ghsa-malware-sweep
20
Packages tracked32 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
16 Oct 2026
Ecosystems
npmPyPI
Detected by
GitHub Advisory Database, OpenSSF malicious-packages, kam193/bad-packages, InvisiRisk, OpenSSF Package Analysis, smiling-hyena, npm security, PyPI security
Also known as
2026-10-16 GHSA sweep, agentaix operator wave 2 (py-worm, py-wormgpt, py-sock2), 2026-10-agentaix campaign wave 2

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

Between 2026-10-15 06:00 UTC (yesterdays sweep cutoff) and 2026-10-16 06:00 UTC (todays ingest-window start), the GitHub Advisory Database and OpenSSF malicious-packages published 20 fresh malware advisories across npm and PyPI, split roughly evenly: 11 npm (7 of them from the Baileys lure wave 4) and 9 PyPI. Todays material is largely a continuation of week-running operators rather than a new wave; four of eight clusters are explicit continuations of operators tracked across this weeks sweeps.

Headlines

PyPI agentaix operator wave 2 (Cluster A): three new first-publish RAT packages py-worm+py-wormgpt+py-sock2 extend the 2026-10-11 agentaix+agent-vx+media-manager5 cluster to 6 total packages / 8 versions, sharing the campaign tag 2026-10-agentaix and the googleforum.pythonanywhere.com C2 - and now with a disclosed GitHub-attacker-account IOC. On import of py-worm's agentaix module, the package downloads a mutable Python file from raw.githubusercontent.com/anonrider404/pypl/9395c5802b11bc088925d7adf6e2f66b8b0709fd/readme.txt (also fetched via the refs/heads/main/readme.txt branch form) and runs it hidden on Windows. The remote file is a remote file-management client with Windows-registry persistence and C2-style polling. Versions 0.1.0 and 2.0.0 run the download during import; 2.0.1 moves it to a background thread (anti-sandbox refinement over 2 versions). Because anonrider404/pypl is a live GitHub repo under attacker control, the stage-2 payload is mutable - the operator can swap it between the time GHSA ingested the record and the time a victim actually runs the package.

npm Wix dep-confusion operator wave 3 (Cluster B): util-foriepft@1.0.0 carries a thunderboltRegistry.js payload the OSSF record explicitly calls "nearly identical to the payload of css-overscroll-contain@1.0.1" (that 2026-10-09 Cluster B package read /var/run/secrets/kubernetes.io/serviceaccount/token, scraped env vars matching secret-like patterns, and attempted unshare --user --mount + devtmpfs/cgroup/release_agent container-escape). Same dxpoc.gt.tc collector. Same operator (regex33-hackerone on npm). This is the third Wix-targeting slug in two weeks and the second to carry the K8s SA-token-stealing payload family.

Confirmed-payload carve-outs within the sweep

  • Cluster C seapy-ops (PyPI, 8 versions 1.0.0-1.2.2) - concealed-upload tool with symlink-target exfiltration and server-side path-traversal writes in 1.0.0-1.1.2, pivoted to REPL-impersonation + in-memory Base64/gzip code execution in 1.2.1-1.2.2. C2 at *.space-z.ai (same apex as the 2026-10-14 pyyi REPL C2). SHA-256 payloads disclosed for seapy/cli.py on each version.
  • Cluster D getpubip (PyPI, 3 versions 0.1.0-0.1.2) - obfuscated import-time infostealer downloading from api-bsx.pages.dev/download with "similarities to campaign 2026-10-fontcase" (yesterday`s Cluster B carve-out). Behavioural reasons: remote-executable download, infostealer, browser-data exfiltration, obfuscation.
  • Cluster E 3-package proxyrubika operator (PyPI) - Android-targeted file exfiltration against the Rubika messaging-service user base. Dev-fleet exposure low (not a typical developer dependency), but the installer`s files are exfiltrated.

Probes and typosquats

Cluster F @flexmr/ui@99.99.99 + @flexmr/utils - dep-confusion probe against FlexMR (UK market research). HTTP beacon to 177.7.60.239:48080 + DNS canary under oob.recon.dev. Cluster G tailwindcss-form + tailwindcss-uniform - Tailwind-form typosquat operators continued -form/-uniform sibling-pair signature. **Cluster H** 7-package Baileys lure wave 4 - CWE-506 boilerplate takedowns under new scopes @developmentyora/ and @celestial-community/` plus Indonesian/Kenyan-themed standalone slugs.

Classification

sweep. Severity high taken as a whole, driven by Cluster A (confirmed RAT with mutable GitHub-raw stage-2 + Windows registry persistence; 6-package operator continuity), Cluster B (confirmed shared payload with K8s-SA-token-stealing css-overscroll-contain family), Cluster C (functional file exfiltration + in-memory code execution + 8-version iteration), and Cluster D (confirmed functional infostealer with browser-data target + stage-2 URL + fontcase-campaign kinship). Clusters E through H are medium on their own and do not reduce overall sweep severity.

Discovery

GitHub Advisory Database, OpenSSF malicious-packages, kam193/bad-packages (7 of 11 PyPI records), InvisiRisk, Inc. (Cluster F @flexmr/ui finder), ossf-package-analysis (Cluster F @flexmr/utils), smiling-hyena (Cluster C seapy-ops finder), npm security, PyPI security.

dependency-confusiontyposquatinfostealercredential-theftobfuscation
Affected packages

20 packages 32 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • Cluster A - PyPI agentaix operator wave 2: 3-package first-publish RAT cluster py-worm+py-wormgpt+py-sock2 (malicious-package, confirmed persistent RAT + remote code execution + autorun persistence + GitHub-raw second-stage download; same googleforum.pythonanywhere.com C2 as 2026-10-11 cluster): py-worm (0.1.0, 2.0.0, 2.0.1; GHSA-483q-j87r-c97c, OSV MAL-2026-17883), py-wormgpt (1.0.0; GHSA-q9mx-j265-447m, OSV MAL-2026-17886), py-sock2 (0.1.0; GHSA-mrm7-9jxf-vx65, OSV MAL-2026-17881). All three carry the campaign tag 2026-10-agentaix and share the IOC domain googleforum.pythonanywhere.com with the 2026-10-11 cluster (agentaix, agent-vx, media-manager5), bringing the operator to 6 packages / 8 versions total since 2026-10-10. py-worm adds a disclosed second-stage: on import of the agentaix module (yes, the same module name - the operator reused the lure name internally), the package downloads a mutable Python file from https://raw.githubusercontent.com/anonrider404/pypl/9395c5802b11bc088925d7adf6e2f66b8b0709fd/readme.txt (also fetched via the refs/heads/main/readme.txt branch form) and runs it hidden on Windows. Versions 0.1.0 and 2.0.0 do this during import; version 2.0.1 does it in a background thread (anti-sandbox refinement over 2 versions). The remote file reportedly includes a remote file-management client with registry-based persistence, C2-style polling of the googleforum.pythonanywhere.com domain, and capabilities for file transfer, deletion, and command execution. The record notes that the remote files contents at the time of victim execution have not been established (anonrider404/pypl is a live GitHub repo under attacker control - the operator can change what readme.txt serves at any time). Reporter kam193 (Kamil Mańkowski) credits ESTsecurity-adjacent and OpenSSF for the finders. Severity high` for this cluster (persistent RAT with mutable GitHub-raw stage-2 server + Windows registry persistence + explicit RAT behaviour; the 6-package operator continuity across 2 waves and a disclosed GitHub-attacker-account IOC makes this one of the stronger PyPI RAT campaigns of October)
  • Cluster B - npm Wix dep-confusion operator wave 3: util-foriepft@1.0.0 (dependency-confusion, confirmed install-time host-command exfiltration via thunderboltRegistry.js payload nearly identical to 2026-10-09 css-overscroll-contain@1.0.1 family, same dxpoc.gt.tc collector, SHA-256 payload hash disclosed): util-foriepft (1.0.0; GHSA-jc4x-j69j-jf5c, OSV MAL-2026-17878, published 2026-10-08 17:34 UTC by npm user regex33-hackerone, still available 2026-10-11, GHSA-ingested 2026-10-15). Shadows Wix-internal registry module names via registry-manifest.min.json (SHA-256 c8e3101a375550ae7559c94b2720f81dc63cac44c4c8aace17211e5eed71751d) that calls out Wix-internal modules. On module load, thunderboltRegistry.js (SHA-256 0bebf66b8f89240b99cbe6dadc92023156e6155740e272d3e7a43aa138b8b675) runs host commands via child_process and POSTs their output to dxpoc[.]gt[.]tc. The OSSF record explicitly says this payload is nearly identical to the payload of css-overscroll-contain@1.0.1 published from the same account - that package (MAL-2026-17705, 2026-10-09 Cluster B) read /var/run/secrets/kubernetes.io/serviceaccount/token, scraped env vars matching secret-like patterns, and attempted unshare --user --mount + devtmpfs/cgroup/release_agent container-escape. Operator continuity makes this slug a direct wave-3 extension (wave 1: css-jptvix-polyfill + appsecc.com/js on 2026-10-07; wave 2: wix-reg-poc-bypass + css-overscroll-contain on 2026-10-09; wave 3: util-foriepft surfaced today). Severity high for this package (confirmed shared payload with the K8s-SA-token-stealing css-overscroll-contain family; any installing pod must assume the same tokens and env-vars were scraped and the same container-escape attempted)
  • *Cluster C - PyPI seapy-ops 8-version concealed-upload tool with in-memory Base64/gzip code execution + REPL impersonation (malicious-package, confirmed file exfiltration + remote-code execution, 2-stage version-split payload design, `.space-z.ai C2)**: seapy-ops (1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.1, 1.2.2; GHSA-5j6r-jv3q-c93f, OSV MAL-2026-17880, finder smiling-hyena). Advertised as a "local file analyzer". Versions 1.0.0 through 1.1.2 hide folder-collection and upload behind an unlock gate: once unlocked, the tool recursively uploads eligible files from the working directory to a configured remote server. A hidden prompt command also uploads the folder before the first prompt. Symlinks can expose content outside the directory, and server-supplied result paths can write files outside the working directory (path traversal on writes). Versions 1.2.1 and 1.2.2 shift the payload: the tool shows a Python REPL that silently sends eligible single-token input to a server as an unlock password, then fetches Base64-encoded, gzip-compressed code, runs it in memory, and calls its main function. Loader errors are disguised as file-not-found errors (failure-concealment). Confirmed C2 domains: preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai and b196q82k8891-d.space-z.ai. The space-z.ai apex was previously named in the 2026-10-14 sweep (Cluster D pyyi REPL C2 - same operator profile across REPL-impersonation campaigns). SHA-256 payloads for seapy/cli.py on each affected version are listed in the OSV record. Severity high` for this package (functional file exfiltration + working in-memory Base64/gzip code loader + 8-version iteration; REPL-impersonation is a sophisticated anti-analysis primitive beyond CWE-506 boilerplate)
  • Cluster D - PyPI getpubip 3-version infostealer with "api-bsx.pages.dev" second-stage URL and campaign-link to yesterday`s fontcase (malicious-package, confirmed infostealer + browser-data exfiltration + obfuscation + remote-executable download): getpubip (0.1.0, 0.1.1, 0.1.2; GHSA-7j9m-mhr6-9jj6, OSV MAL-2026-17884, campaign 2026-10-getpubip, reporter kam193). On import, obfuscated code downloads and executes an infostealer. Record notes "some similarities with the campaign 2026-10-fontcase" - fontcase was yesterdays Cluster B carve-out from the 2026-10-14 sweep (3-package fontcase/sysdiagd/pyyi cluster, also kam193-reported). IOCs: domain api-bsx.pages.dev, URL https://api-bsx.pages.dev/download (a Cloudflare Pages deployment under attacker control - throwaway edge hosting). Behavioural reasons: downloads and executes a remote executable, infostealer, browser-data exfiltration, obfuscation. Also linked via Triage analysis tria.ge/261015-hppmhsgx51. Severity high` for this package (confirmed functional infostealer with browser-data target + disclosed stage-2 URL + fontcase-campaign kinship)
  • Cluster E - PyPI 3-package proxyrubika operator cluster with Android-targeted file exfiltration (malicious-package, confirmed files-exfiltration + target:android behaviour; shared campaign tag 2026-10-proxyrubika, no C2 disclosed in record): proxyrobika (0.1.0; GHSA-ch77-7g6p-3v7x, OSV MAL-2026-17889), proxy-rubikis (0.1.0; GHSA-j493-92mg-8qj9, OSV MAL-2026-17887), proxyrubika (0.1.0; GHSA-rmvf-4vh2-pv34, OSV MAL-2026-17885). All three share the campaign tag 2026-10-proxyrubika and the OSSF reasons files-exfiltration + target:android. All reported by kam193; package names are slight variations of each other, consistent with a single-operator spray against the "Rubika" messaging-service user base (Rubika is a popular Iranian/Persian messaging and social app, so the Android focus and Persian-looking naming suggests the targets are Android-side Rubika accounts, not developers directly). Record body is terse: "The package contains code for automated files exfiltration." No HTTP endpoint, IP, or specific hash published beyond each tarballs source identifier. Severity medium` for this cluster (confirmed file exfiltration behaviour but no disclosed C2 or payload details; the attack vector is unusual - the installer is likely a hobbyist Rubika-automation user who runs the package on their phone or workstation, not a typical dev-tooling consumer, so dev-fleet exposure is low)
  • *Cluster F - npm `@flexmr/ 2-package dep-confusion probe: @flexmr/ui + @flexmr/utils (dependency-confusion, confirmed install-time HTTP beacon + DNS OAST canary + 99.99.99 sentinel version; InvisiRisk-flagged on @flexmr/ui and ossf-package-analysis-flagged on @flexmr/utils)**: @flexmr/ui@99.99.99 (GHSA-ccxj-49h8-hp3q, OSV MAL-2026-17879, finder InvisiRisk, Inc.) and @flexmr/utils (1.0.0, 3.0.12; GHSA-f8pr-fqvq-vvxv, OSV MAL-2026-17888, finder ossf-package-analysis). @flexmr/ui@99.99.99 is the canonical dep-confusion sentinel (99.99.99 was the version pattern of the FlexMR dep-confusion probe operator - the package was published to npm 2026-10-13 and GHSA-registered 2026-10-15). Its beacon.js (SHA-256 bdee8d65c1c5b40df70e851eda298aa0729f0a618e11d702a6e9a35285c4e2c3) runs during preinstall, install, and postinstall lifecycle events, sends the package name, lifecycle event, a fixed token, and host identity details to http://177.7.60.239:48080, and encodes the hostname in a DNS query under oob.recon.dev ("recon.dev" is a known bug-bounty / recon OAST brand - this is a bug-bounty-adjacent probe against FlexMR, a UK market-research platform). @flexmr/utils@1.0.0/3.0.12 is a second scope slug flagged by OpenSSF Package Analysis for "executes commands associated with malicious behavior" (specific IOCs not disclosed on /utils; the 3.0.12 non-sentinel version is noteworthy - its a plausibly-realistic version jump rather than a 99.x sentinel, so the operator may be probing both the canonical dep-confusion fingerprint and a plausible-looking version to beat an internal 3.0.11). Severity medium for the cluster (dep-confusion probe tier, confirmed HTTPS beacon on /ui but no credential-stealing payload yet)
  • Cluster G - npm tailwindcss-form + tailwindcss-uniform 2-package typosquat continuation of the 2026-10-10 Tailwind-form operator (typosquat, CWE-506 boilerplate takedowns with no runtime analysis published; naming pattern directly extends 2026-10-10 tailwind-animatecss-uniform/-form wave): tailwindcss-form (all versions; GHSA-c8m9-qwg6-5cv9) and tailwindcss-uniform (all versions; GHSA-r7f7-6833-rxh9). Both typosquat the real @tailwindcss/forms npm package (the scoped form the Tailwind team maintains). The 2026-10-10 sweep (Cluster D in that write-up) noted the same operator published tailwind-animatecss-uniform and tailwind-animatecss-form as a continuation of the 2026-10-09 tailwindcss-ui-extensions+tailwindcss-effects-kit cluster - todays pair drops the "animatecss" infix and goes with the simpler tailwindcss-* form, closer to the real @tailwindcss/forms slug. The pattern of two sibling slugs (-form and -uniform) in each wave is the operators signature. GHSA bodies are CWE-506 "fully compromised" boilerplate with no IOCs. Severity medium for this cluster (install-time code execution risk per CWE-506 pattern, no vendor runtime analysis published)
  • *Cluster H - npm Baileys lure operator wave 4: 7 new scoped and standalone packages (malicious-package, CWE-506 boilerplate takedowns, no runtime analysis published; naming lineage continues the 2026-10-09 `@bellaxchuu/+@xayz/libsignal-node+my-baileys+@kxafunc/xbails 16-package Cluster D and the 2026-10-13 60+ package wave 3)**: xmd-baileys (all versions; GHSA-m3qf-j9rf-pqrh), @developmentyora/baileyss (all versions; GHSA-v8xh-mr86-2fpq), @developmentyora/yorakids (all versions; GHSA-xgr5-84p3-qqmf), @celestial-community/baileys (all versions; GHSA-5ghv-64gv-gv29), bungoma (all versions; GHSA-jj55-mvw9-496r), kiyoramarkets (all versions; GHSA-23wg-cgvp-f8w7), asistenyorstore (all versions; GHSA-qgh5-36wr-3vvw). Three slugs are explicit Baileys-brand-impersonations (xmd-baileys, @developmentyora/baileyss, @celestial-community/baileys); @developmentyora/yorakids is the sibling slug under the same new @developmentyora scope and ties the fourth non-baileys-named slug into the cluster. bungoma, kiyoramarkets, asistenyorstore are the three standalone-slug entries whose GHSA bodies are identical boilerplate - the naming has an Indonesian/Yoruba/Swahili theme (Bungoma is a town in Kenya, Kiyora is an Indonesian retailer, "asisten yor store" reads as Indonesian for "assistant yor store") consistent with earlier Baileys-operator "lunexindonesia" and @fer2809fl/baileys/arsya-baileys Indonesian-naming fingerprints from the 2026-10-10 wave. All 7 CWE-506 boilerplate advisories with no published IOCs. Severity medium for this cluster (coordinated wave-4 co-publication confirmed by naming + scope pattern, runtime payload family consistent with prior Baileys-lure waves but todays specific payload not yet documented in the GHSA bodies)
  • Operator continuity: this sweep extends several week-running operators rather than introducing new ones. agentaix operator is confirmed-continuing from the 2026-10-11 cluster (same campaign tag, same googleforum.pythonanywhere.com C2; todays wave now has a disclosed GitHub-attacker-account IOC anonrider404/pypl with mutable second-stage via readme.txt). **Wix dep-confusion operator** continues from the 2026-10-07/09 clusters (same thunderboltRegistry.js payload family + dxpoc.gt.tc exfil - with the OSSF record explicitly saying util-foriepft's payload is nearly identical to css-overscroll-contain@1.0.1). **Tailwind-form typosquat operator** continues from 2026-10-09/10 waves (same -form/-uniform sibling-pair signature). **Baileys lure operator** continues from the 2026-10-09 16-package cluster through the 2026-10-13 60+ package wave 3 (todays wave 4 adds 7 packages; the Indonesian/Kenyan naming lineage is the operator continuity signal). kam193 continues as top PyPI reporter - today reports py-worm, py-wormgpt, py-sock2, getpubip, and the 3 proxyrubika variants (7 of 11 PyPI advisories). No new activity from: priyashareek Accenture+@newspage dep-confusion operator (quiet since 2026-10-14), dumtban orderly-plugin GitHub Actions CI-token-abuse operator (quiet since 2026-10-14), kingsize+limbomail.com+lunexindonesia/node-net-pool discord-mfa Windows-RAT campaign, conx3993 operator (yesterdays 5-package realwbx.com dep-confusion cluster quiet), saeka fraud-tool campaign (yesterdays PyPI credit-card checker quiet), 185.158.107.175 operator, 64.181.165.115 operator, hardhat-option operator, wgkit RubyGems operator, xwise8887, sharpnes crates.io, @tunstock/remact-dom, nfjbill, @bitwardne/*, reaperhackbot256f, ig-gox, s4yhii operator. New disclosed attacker-controlled hosts today: anonrider404/pypl GitHub repo (Cluster A py-worm second-stage), api-bsx.pages.dev apex + /download path (Cluster D getpubip second-stage), 177.7.60.239:48080 (Cluster F @flexmr/ui HTTP beacon), oob.recon.dev apex (Cluster F @flexmr/ui DNS OAST canary). TensorLake AI maintainer compromise (2026-10-08 carve-out) remains quiet at tensorlake@0.5.145 with no wave-2 republish
What to do

Clean-up steps

  1. For Cluster A (agentaix PyPI operator wave 2 - py-worm+py-wormgpt+py-sock2): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda env for py-worm (0.1.0, 2.0.0, 2.0.1), py-wormgpt (1.0.0), and py-sock2 (0.1.0). On ANY hit: treat the installing host as having run a persistent RAT with GitHub-raw stage-2 download. Rotate every credential reachable from the hosts Python runtime (API tokens, SSH/GPG keys unlocked during the install window, cloud SDK credentials, env-exported secrets). On Windows hosts, check for registry persistence under HKCU\Software\Microsoft\Windows\CurrentVersion\Run and Scheduled Tasks (the record notes "registry-based persistence"); the py-worm@2.0.1 background-thread variant means the hidden Python process may still be running after the install call returned. Add egress blocks: googleforum.pythonanywhere.com exact subdomain (do NOT blanket-block pythonanywhere.com apex - it is a legitimate PaaS), raw.githubusercontent.com/anonrider404/pypl/* path (block the specific attacker-controlled repo path at egress proxies), and github.com/anonrider404/pypl repo access on build hosts. Report the anonrider404 GitHub account to GitHub for abuse takedown. Also audit for leftover autorun entries that match the operator signature from the 2026-10-11 Cluster B (same agentaix campaign tag): ~/.config/autostart/ on Linux, ~/Library/LaunchAgents/ on macOS, user-level cron / systemd --user. The 6-package operator continuity means a host that installed one may have been retargeted with another; grep for the full set agentaix, agent-vx, media-manager5, py-worm, py-wormgpt, py-sock2` together
  2. For Cluster B (util-foriepft npm Wix dep-confusion operator wave 3): grep every package.json, package-lock.json, yarn.lock, pnpm-lock.yaml for util-foriepft (version 1.0.0). On hit: assume the same K8s SA-token theft + env-variable scraping + container-escape attempt as css-overscroll-contain@1.0.1 (the OSSF record explicitly says the payload is nearly identical). On any pod/node that resolved the package, rotate the Kubernetes service-account token, rotate every env-exported credential the pod could reach, audit /proc/self/mountinfo for lingering attacker mounts, and treat the pod image as compromised and rebuild from known-good. Add egress blocks on dxpoc.gt.tc apex (already in the standing denylist from 2026-10-09 - do not remove) and add detection rules for the IOC files thunderboltRegistry.js (SHA-256 0bebf66b8f89240b99cbe6dadc92023156e6155740e272d3e7a43aa138b8b675) and registry-manifest.min.json (SHA-256 c8e3101a375550ae7559c94b2720f81dc63cac44c4c8aace17211e5eed71751d) under any npm package name. If your org publishes under Wix-internal *Registry* names (thunderboltRegistry, corvidRegistry, editorRegistry, siteAssetsRegistry), scope-lock the internal registry (npm config set @your-wix-scope:registry https://internal-registry) and hold the public slugs with placeholder packages at a safe version. Report npm user regex33-hackerone for the published name util-foriepft@1.0.0 as the same operator who shipped css-overscroll-contain
  3. For Cluster C (seapy-ops PyPI 8-version concealed-upload tool): grep for seapy-ops (any of 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.1, 1.2.2). On hit: preserve the host for forensic review. For versions 1.0.0-1.1.2, assume the recursive upload has fired against the directory where seapy was run (and against any symlink targets outside that directory); treat all files in those directories as having left the host. For versions 1.2.1-1.2.2, assume the single-token REPL input was captured as a password AND the in-memory Base64/gzip code loader fired - the actual payload is undocumented, so treat the host as compromised and rotate every credential reachable from it. Add egress blocks: space-z.ai apex (already in the standing denylist from 2026-10-14 - keep it), preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai and b196q82k8891-d.space-z.ai exact subdomains. Add detection rules for seapy/cli.py with any of the 8 published SHA-256 hashes (listed in the OSV record). The REPL-impersonation primitive (a prompt that looks like Python`s built-in REPL but silently exfils typed tokens) is novel enough to call out in security awareness: contributors should treat any Python prompt from an unexpected source with the same suspicion as a sudo prompt from an unexpected source
  4. For Cluster D (getpubip PyPI infostealer): grep for getpubip (any of 0.1.0, 0.1.1, 0.1.2). On hit, assume the obfuscated import-time payload fired - the browser-data target means Chrome/Firefox/Edge profile credentials, cookies, and saved sessions are presumed exfiltrated. Rotate every login on the host and clear browser profiles. Add egress blocks: api-bsx.pages.dev apex + /download path. pages.dev is Cloudflare Pages (legitimate edge hosting) - block the specific api-bsx subdomain, do NOT blanket-block pages.dev apex. Reference Triage report tria.ge/261015-hppmhsgx51 for dynamic-analysis IOCs. The campaign kinship with yesterdays fontcase (2026-10-14 Cluster B carve-out) means hosts that installed fontcase or sysdiagd or pyyi should also be audited for getpubip` by the same operator profile
  5. For Cluster E (3-package proxyrubika PyPI Android file-exfiltration cluster): grep for proxyrobika (0.1.0), proxy-rubikis (0.1.0), proxyrubika (0.1.0). On hit: file exfiltration from the installers working directory is the confirmed behaviour; the Android target (target:android OSSF reason) suggests this is more likely a Rubika-messaging-user tool than a dev-tooling library, so a corporate dev-host hit is unusual and the host should be preserved for forensic review (fraud/account-theft side rather than dev-credential compromise). No specific C2 endpoint disclosed in the record, so apply standard removal + credential-rotation hygiene until a vendor publishes a runtime analysis. The three variations of the same name (one correct spelling proxyrubika, one transposed proxyrobika, one pluralised proxy-rubikis) are the operators signature - watch for a wave 2 under further Rubika-themed slugs
  6. For Cluster F (@flexmr/ui + @flexmr/utils npm dep-confusion probe): grep for @flexmr/ui@99.99.99 and @flexmr/utils (1.0.0, 3.0.12). On hit, the @flexmr/ui@99.99.99 beacon fired during preinstall/install/postinstall and sent host identity plus a fixed token to http://177.7.60.239:48080 (plus a DNS canary to oob.recon.dev). Treat as recon-tier - no credential-stealing payload confirmed yet - but the @flexmr/* scope is the signal that FlexMR (a UK market-research platform) is being probed. If your org is FlexMR or uses @flexmr/* internally, scope-lock the internal registry and hold the public slugs with placeholders. Add egress blocks: 177.7.60.239:48080 exact IP+port and oob.recon.dev apex (recon.dev is a known bug-bounty / OAST brand, so this may be a legitimate bug-bounty probe - but still block from CI/build hosts). Detection rule for beacon.js SHA-256 bdee8d65c1c5b40df70e851eda298aa0729f0a618e11d702a6e9a35285c4e2c3 under any npm package name. The @flexmr/utils 1.0.0 + 3.0.12 non-sentinel pair is unusual for dep-confusion (operator probing both the canonical 99.x fingerprint and a plausible-looking version to beat an internal 3.0.11) - teach contributors that a 3.0.12 with no prior history and a jump from 1.0.0 to 3.0.12 is also a suspect dep-confusion signature
  7. For Cluster G (tailwindcss-form + tailwindcss-uniform npm typosquats): grep for tailwindcss-form and tailwindcss-uniform (both all versions). On hit, remove and treat as CWE-506 install-time compromise until a vendor publishes a runtime analysis. The real packages a developer wants are @tailwindcss/forms (the scoped form the Tailwind team maintains) - a wide suspicion of any non-scoped tailwindcss-* package is reasonable given this operators continued wave count. Teach contributors that unscoped tailwindcss-form/-uniform/-animatecss-* are suspect by default; the scoped forms (@tailwindcss/forms, @tailwindcss/typography, @tailwindcss/aspect-ratio, @tailwindcss/container-queries`) are the real artefacts
  8. For Cluster H (Baileys lure operator wave 4 - 7 npm packages): grep every package.json, package-lock.json, yarn.lock, pnpm-lock.yaml for xmd-baileys, @developmentyora/baileyss, @developmentyora/yorakids, @celestial-community/baileys, bungoma, kiyoramarkets, asistenyorstore (all all-versions). CWE-506 boilerplate advisory means the specific payload is undocumented in these GHSAs; treat the install as credential-compromised until Socket or a vendor publishes a runtime analysis. Watch for a wave-5 under new scopes @developmentyora/* and @celestial-community/* and under additional Indonesian/Kenyan/Swahili-named standalone slugs (the operators naming lineage from the 2026-10-10 @fer2809fl/baileys+arsya-baileys wave through the 2026-10-13 60+ package wave 3). Add detection rules for any npm package containing baileys, bailey, xbails, libsignal-node, or whiskeysockets substrings outside the real @whiskeysockets scope - this is the Baileys lure operators primary brand-impersonation surface
  9. NEW outbound denylist entries for CI/build-host egress proxies today: raw.githubusercontent.com/anonrider404/pypl/* path (Cluster A py-worm second-stage; block the specific attacker-controlled repo path at egress proxies, do NOT blanket-block raw.githubusercontent.com apex), api-bsx.pages.dev apex + /download path (Cluster D getpubip second-stage; pages.dev apex is Cloudflare Pages legit, block the specific subdomain), 177.7.60.239:48080 exact IP+port (Cluster F @flexmr/ui HTTP beacon), oob.recon.dev apex (Cluster F @flexmr/ui DNS OAST canary). Also block the specific anonrider404 GitHub account at build-host egress and report for abuse takedown. Keep prior egress blocks in place: googleforum.pythonanywhere.com exact subdomain (2026-10-11), space-z.ai apex + preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai + b196q82k8891-d.space-z.ai subdomains (2026-10-14), dxpoc.gt.tc apex (2026-10-09 Wix cluster), realwbx.com apex + /ip.php + /ip paths (2026-10-15), uncoder.eu.org apex + /cc-checker/api.php path (2026-10-15), accenture-npm.azurewebsites.net + /test + /async + /mfe, limbomail.com apex + github.com/lunexindonesia/node-net-pool + github.com/trktgq0wbre1/node-net-pool, github.com/unicodeces/font-atlas, collector.oob.s4yhii.com + *.oob.s4yhii.com + s4yhii.com apex, 64.181.165.115/dc, 167.88.172.33:8087 + jsonspack.com, goxtools.shop apex, minhdong.site apex + GitHub user VangBanLaNhat, 45.138.12.177:8089, 185.158.107.175:8787, ltidi.storage.googleapis.com/depenconf/, oob.s4yhii.com:9999/native, *.oast.pro/*.oast.me/*.oast.fun/*.oast.site/*.oastify.com, frjmzbjbhwvtdnsuodmu.supabase.co, api.npoint.io apex, tele.metry.orgin.net, morroncr0w.io, api.telegram.org on untrusted CI/build hosts, appsecc.com, webhook.site/*, nfjbill.ren, storage.googleapis.com/depenconf/, 10.0.19.0/24 + 10.0.49.0/24, api.nm-streetwear.space, Discord webhook URL pattern, ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, chinazhangsan.ccwu.cc, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil patterns, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com, 45.138.0.0/16 RubyGems wgkit CIDRs
References

Sources

multi-2026-10-16-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents