# GitHub Advisory malware sweep, 16 October 2026

> GHSA 2026-10-15/16 batch (20 advisories). PyPI `agentaix` wave 2 adds `py-worm`+`py-wormgpt`+`py-sock2` with GitHub-raw stage-2 and `googleforum.pythonanywhere.com` C2. npm Wix dep-confusion wave 3 ships `util-foriepft` reusing the K8s-SA-token-theft `thunderboltRegistry.js` family. `seapy-ops` adds concealed-upload + in-memory exec; `getpubip` infostealer.

- Published: 2026-10-16
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 20 packages, 32 compromised versions
- Tags: dependency-confusion, typosquat, infostealer, credential-theft, obfuscation
- Also known as: 2026-10-16 GHSA sweep, agentaix operator wave 2 (py-worm, py-wormgpt, py-sock2), 2026-10-agentaix campaign wave 2, Wix dep-confusion operator wave 3 (util-foriepft), seapy-ops PyPI concealed-upload tool, getpubip PyPI infostealer, 2026-10-getpubip campaign, 2026-10-proxyrubika campaign, @flexmr dep-confusion probe, Baileys lure operator wave 4
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, kam193/bad-packages, InvisiRisk, OpenSSF Package Analysis, smiling-hyena, npm security, PyPI security
- Incident ID: multi-2026-10-16-ghsa-malware-sweep

## Affected packages (20)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@celestial-community/baileys](https://dependencywatch.io/package/npm/@celestial-community/baileys) | npm | 0.0.0 |
| [@developmentyora/baileyss](https://dependencywatch.io/package/npm/@developmentyora/baileyss) | npm | 0.0.0 |
| [@developmentyora/yorakids](https://dependencywatch.io/package/npm/@developmentyora/yorakids) | npm | 0.0.0 |
| [@flexmr/ui](https://dependencywatch.io/package/npm/@flexmr/ui) | npm | 99.99.99 |
| [@flexmr/utils](https://dependencywatch.io/package/npm/@flexmr/utils) | npm | 1.0.0, 3.0.12 |
| [asistenyorstore](https://dependencywatch.io/package/npm/asistenyorstore) | npm | 0.0.0 |
| [bungoma](https://dependencywatch.io/package/npm/bungoma) | npm | 0.0.0 |
| [getpubip](https://dependencywatch.io/package/pypi/getpubip) | PyPI | 0.1.0, 0.1.1, 0.1.2 |
| [kiyoramarkets](https://dependencywatch.io/package/npm/kiyoramarkets) | npm | 0.0.0 |
| [proxy-rubikis](https://dependencywatch.io/package/pypi/proxy-rubikis) | PyPI | 0.1.0 |
| [proxyrobika](https://dependencywatch.io/package/pypi/proxyrobika) | PyPI | 0.1.0 |
| [proxyrubika](https://dependencywatch.io/package/pypi/proxyrubika) | PyPI | 0.1.0 |
| [py-sock2](https://dependencywatch.io/package/pypi/py-sock2) | PyPI | 0.1.0 |
| [py-worm](https://dependencywatch.io/package/pypi/py-worm) | PyPI | 0.1.0, 2.0.0, 2.0.1 |
| [py-wormgpt](https://dependencywatch.io/package/pypi/py-wormgpt) | PyPI | 1.0.0 |
| [seapy-ops](https://dependencywatch.io/package/pypi/seapy-ops) | PyPI | 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.1, 1.2.2 |
| [tailwindcss-form](https://dependencywatch.io/package/npm/tailwindcss-form) | npm | 0.0.0 |
| [tailwindcss-uniform](https://dependencywatch.io/package/npm/tailwindcss-uniform) | npm | 0.0.0 |
| [util-foriepft](https://dependencywatch.io/package/npm/util-foriepft) | npm | 1.0.0 |
| [xmd-baileys](https://dependencywatch.io/package/npm/xmd-baileys) | npm | 0.0.0 |

## What happened

Between 2026-10-15 06:00 UTC (yesterday`s sweep cutoff) and 2026-10-16 06:00 UTC (today`s ingest-window start), the GitHub Advisory Database and OpenSSF `malicious-packages` published 20 fresh malware advisories across npm and PyPI, split roughly evenly: 11 npm (7 of them from the Baileys lure wave 4) and 9 PyPI. Today`s material is largely a continuation of week-running operators rather than a new wave; four of eight clusters are explicit continuations of operators tracked across this week`s sweeps.

## Headlines

**PyPI `agentaix` operator wave 2** (Cluster A): three new first-publish RAT packages `py-worm`+`py-wormgpt`+`py-sock2` extend the 2026-10-11 `agentaix`+`agent-vx`+`media-manager5` cluster to 6 total packages / 8 versions, sharing the campaign tag `2026-10-agentaix` and the `googleforum.pythonanywhere.com` C2 - and now with a disclosed GitHub-attacker-account IOC. On import of `py-worm`'s `agentaix` module, the package downloads a mutable Python file from `raw.githubusercontent.com/anonrider404/pypl/9395c5802b11bc088925d7adf6e2f66b8b0709fd/readme.txt` (also fetched via the `refs/heads/main/readme.txt` branch form) and runs it hidden on Windows. The remote file is a remote file-management client with Windows-registry persistence and C2-style polling. Versions 0.1.0 and 2.0.0 run the download during import; 2.0.1 moves it to a background thread (anti-sandbox refinement over 2 versions). Because `anonrider404/pypl` is a live GitHub repo under attacker control, the stage-2 payload is mutable - the operator can swap it between the time GHSA ingested the record and the time a victim actually runs the package.

**npm Wix dep-confusion operator wave 3** (Cluster B): `util-foriepft@1.0.0` carries a `thunderboltRegistry.js` payload the OSSF record explicitly calls "nearly identical to the payload of `css-overscroll-contain@1.0.1`" (that 2026-10-09 Cluster B package read `/var/run/secrets/kubernetes.io/serviceaccount/token`, scraped env vars matching secret-like patterns, and attempted `unshare --user --mount` + `devtmpfs/cgroup/release_agent` container-escape). Same `dxpoc.gt.tc` collector. Same operator (`regex33-hackerone` on npm). This is the third Wix-targeting slug in two weeks and the second to carry the K8s SA-token-stealing payload family.

## Confirmed-payload carve-outs within the sweep

- **Cluster C** `seapy-ops` (PyPI, 8 versions `1.0.0`-`1.2.2`) - concealed-upload tool with symlink-target exfiltration and server-side path-traversal writes in 1.0.0-1.1.2, pivoted to REPL-impersonation + in-memory Base64/gzip code execution in 1.2.1-1.2.2. C2 at `*.space-z.ai` (same apex as the 2026-10-14 `pyyi` REPL C2). SHA-256 payloads disclosed for `seapy/cli.py` on each version.
- **Cluster D** `getpubip` (PyPI, 3 versions `0.1.0`-`0.1.2`) - obfuscated import-time infostealer downloading from `api-bsx.pages.dev/download` with "similarities to campaign `2026-10-fontcase`" (yesterday`s Cluster B carve-out). Behavioural reasons: remote-executable download, infostealer, browser-data exfiltration, obfuscation.
- **Cluster E** 3-package `proxyrubika` operator (PyPI) - Android-targeted file exfiltration against the Rubika messaging-service user base. Dev-fleet exposure low (not a typical developer dependency), but the installer`s files are exfiltrated.

## Probes and typosquats

**Cluster F** `@flexmr/ui@99.99.99` + `@flexmr/utils` - dep-confusion probe against FlexMR (UK market research). HTTP beacon to `177.7.60.239:48080` + DNS canary under `oob.recon.dev`. **Cluster G** `tailwindcss-form` + `tailwindcss-uniform` - Tailwind-form typosquat operator`s continued `-form`/`-uniform` sibling-pair signature. **Cluster H** 7-package Baileys lure wave 4 - CWE-506 boilerplate takedowns under new scopes `@developmentyora/*` and `@celestial-community/*` plus Indonesian/Kenyan-themed standalone slugs.

## Classification

`sweep`. Severity `high` taken as a whole, driven by Cluster A (confirmed RAT with mutable GitHub-raw stage-2 + Windows registry persistence; 6-package operator continuity), Cluster B (confirmed shared payload with K8s-SA-token-stealing `css-overscroll-contain` family), Cluster C (functional file exfiltration + in-memory code execution + 8-version iteration), and Cluster D (confirmed functional infostealer with browser-data target + stage-2 URL + fontcase-campaign kinship). Clusters E through H are `medium` on their own and do not reduce overall sweep severity.

## Discovery

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `kam193/bad-packages` (7 of 11 PyPI records), `InvisiRisk, Inc.` (Cluster F `@flexmr/ui` finder), `ossf-package-analysis` (Cluster F `@flexmr/utils`), `smiling-hyena` (Cluster C `seapy-ops` finder), `npm security`, `PyPI security`.

## Impact

- **Cluster A - PyPI `agentaix` operator wave 2: 3-package first-publish RAT cluster `py-worm`+`py-wormgpt`+`py-sock2` (malicious-package, confirmed persistent RAT + remote code execution + autorun persistence + GitHub-raw second-stage download; same `googleforum.pythonanywhere.com` C2 as 2026-10-11 cluster)**: `py-worm` (0.1.0, 2.0.0, 2.0.1; GHSA-483q-j87r-c97c, OSV MAL-2026-17883), `py-wormgpt` (1.0.0; GHSA-q9mx-j265-447m, OSV MAL-2026-17886), `py-sock2` (0.1.0; GHSA-mrm7-9jxf-vx65, OSV MAL-2026-17881). All three carry the campaign tag `2026-10-agentaix` and share the IOC domain `googleforum.pythonanywhere.com` with the 2026-10-11 cluster (`agentaix`, `agent-vx`, `media-manager5`), bringing the operator to 6 packages / 8 versions total since 2026-10-10. `py-worm` adds a disclosed second-stage: on import of the `agentaix` module (yes, the same module name - the operator reused the lure name internally), the package downloads a mutable Python file from `https://raw.githubusercontent.com/anonrider404/pypl/9395c5802b11bc088925d7adf6e2f66b8b0709fd/readme.txt` (also fetched via the `refs/heads/main/readme.txt` branch form) and runs it hidden on Windows. Versions 0.1.0 and 2.0.0 do this during import; version 2.0.1 does it in a background thread (anti-sandbox refinement over 2 versions). The remote file reportedly includes a remote file-management client with registry-based persistence, C2-style polling of the `googleforum.pythonanywhere.com` domain, and capabilities for file transfer, deletion, and command execution. The record notes that the remote file`s contents at the time of victim execution have not been established (`anonrider404/pypl` is a live GitHub repo under attacker control - the operator can change what `readme.txt` serves at any time). Reporter `kam193` (Kamil Mańkowski) credits ESTsecurity-adjacent and OpenSSF for the finders. Severity `high` for this cluster (persistent RAT with mutable GitHub-raw stage-2 server + Windows registry persistence + explicit RAT behaviour; the 6-package operator continuity across 2 waves and a disclosed GitHub-attacker-account IOC makes this one of the stronger PyPI RAT campaigns of October)
- **Cluster B - npm Wix dep-confusion operator wave 3: `util-foriepft@1.0.0` (dependency-confusion, confirmed install-time host-command exfiltration via `thunderboltRegistry.js` payload nearly identical to 2026-10-09 `css-overscroll-contain@1.0.1` family, same `dxpoc.gt.tc` collector, SHA-256 payload hash disclosed)**: `util-foriepft` (1.0.0; GHSA-jc4x-j69j-jf5c, OSV MAL-2026-17878, published 2026-10-08 17:34 UTC by npm user `regex33-hackerone`, still available 2026-10-11, GHSA-ingested 2026-10-15). Shadows Wix-internal registry module names via `registry-manifest.min.json` (SHA-256 `c8e3101a375550ae7559c94b2720f81dc63cac44c4c8aace17211e5eed71751d`) that calls out Wix-internal modules. On module load, `thunderboltRegistry.js` (SHA-256 `0bebf66b8f89240b99cbe6dadc92023156e6155740e272d3e7a43aa138b8b675`) runs host commands via `child_process` and POSTs their output to `dxpoc[.]gt[.]tc`. The OSSF record explicitly says this payload is **nearly identical to the payload of `css-overscroll-contain@1.0.1` published from the same account** - that package (MAL-2026-17705, 2026-10-09 Cluster B) read `/var/run/secrets/kubernetes.io/serviceaccount/token`, scraped env vars matching secret-like patterns, and attempted `unshare --user --mount` + `devtmpfs/cgroup/release_agent` container-escape. Operator continuity makes this slug a direct wave-3 extension (wave 1: `css-jptvix-polyfill` + `appsecc.com/js` on 2026-10-07; wave 2: `wix-reg-poc-bypass` + `css-overscroll-contain` on 2026-10-09; wave 3: `util-foriepft` surfaced today). Severity `high` for this package (confirmed shared payload with the K8s-SA-token-stealing `css-overscroll-contain` family; any installing pod must assume the same tokens and env-vars were scraped and the same container-escape attempted)
- **Cluster C - PyPI `seapy-ops` 8-version concealed-upload tool with in-memory Base64/gzip code execution + REPL impersonation (malicious-package, confirmed file exfiltration + remote-code execution, 2-stage version-split payload design, `*.space-z.ai` C2)**: `seapy-ops` (1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.1, 1.2.2; GHSA-5j6r-jv3q-c93f, OSV MAL-2026-17880, finder `smiling-hyena`). Advertised as a "local file analyzer". Versions 1.0.0 through 1.1.2 hide folder-collection and upload behind an unlock gate: once unlocked, the tool recursively uploads eligible files from the working directory to a configured remote server. A hidden prompt command also uploads the folder before the first prompt. Symlinks can expose content outside the directory, and server-supplied result paths can write files outside the working directory (path traversal on writes). Versions 1.2.1 and 1.2.2 shift the payload: the tool shows a Python REPL that silently sends eligible single-token input to a server as an unlock password, then fetches Base64-encoded, gzip-compressed code, runs it in memory, and calls its main function. Loader errors are disguised as file-not-found errors (failure-concealment). Confirmed C2 domains: `preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai` and `b196q82k8891-d.space-z.ai`. The `space-z.ai` apex was previously named in the 2026-10-14 sweep (Cluster D `pyyi` REPL C2 - same operator profile across REPL-impersonation campaigns). SHA-256 payloads for `seapy/cli.py` on each affected version are listed in the OSV record. Severity `high` for this package (functional file exfiltration + working in-memory Base64/gzip code loader + 8-version iteration; REPL-impersonation is a sophisticated anti-analysis primitive beyond CWE-506 boilerplate)
- **Cluster D - PyPI `getpubip` 3-version infostealer with "api-bsx.pages.dev" second-stage URL and campaign-link to yesterday`s fontcase (malicious-package, confirmed infostealer + browser-data exfiltration + obfuscation + remote-executable download)**: `getpubip` (0.1.0, 0.1.1, 0.1.2; GHSA-7j9m-mhr6-9jj6, OSV MAL-2026-17884, campaign `2026-10-getpubip`, reporter `kam193`). On import, obfuscated code downloads and executes an infostealer. Record notes "some similarities with the campaign `2026-10-fontcase`" - fontcase was yesterday`s Cluster B carve-out from the 2026-10-14 sweep (3-package `fontcase`/`sysdiagd`/`pyyi` cluster, also kam193-reported). IOCs: domain `api-bsx.pages.dev`, URL `https://api-bsx.pages.dev/download` (a Cloudflare Pages deployment under attacker control - throwaway edge hosting). Behavioural reasons: downloads and executes a remote executable, infostealer, browser-data exfiltration, obfuscation. Also linked via Triage analysis `tria.ge/261015-hppmhsgx51`. Severity `high` for this package (confirmed functional infostealer with browser-data target + disclosed stage-2 URL + fontcase-campaign kinship)
- **Cluster E - PyPI 3-package `proxyrubika` operator cluster with Android-targeted file exfiltration (malicious-package, confirmed `files-exfiltration` + `target:android` behaviour; shared campaign tag `2026-10-proxyrubika`, no C2 disclosed in record)**: `proxyrobika` (0.1.0; GHSA-ch77-7g6p-3v7x, OSV MAL-2026-17889), `proxy-rubikis` (0.1.0; GHSA-j493-92mg-8qj9, OSV MAL-2026-17887), `proxyrubika` (0.1.0; GHSA-rmvf-4vh2-pv34, OSV MAL-2026-17885). All three share the campaign tag `2026-10-proxyrubika` and the OSSF reasons `files-exfiltration` + `target:android`. All reported by `kam193`; package names are slight variations of each other, consistent with a single-operator spray against the "Rubika" messaging-service user base (Rubika is a popular Iranian/Persian messaging and social app, so the Android focus and Persian-looking naming suggests the targets are Android-side Rubika accounts, not developers directly). Record body is terse: "The package contains code for automated files exfiltration." No HTTP endpoint, IP, or specific hash published beyond each tarball`s source identifier. Severity `medium` for this cluster (confirmed file exfiltration behaviour but no disclosed C2 or payload details; the attack vector is unusual - the installer is likely a hobbyist Rubika-automation user who runs the package on their phone or workstation, not a typical dev-tooling consumer, so dev-fleet exposure is low)
- **Cluster F - npm `@flexmr/*` 2-package dep-confusion probe: `@flexmr/ui` + `@flexmr/utils` (dependency-confusion, confirmed install-time HTTP beacon + DNS OAST canary + `99.99.99` sentinel version; InvisiRisk-flagged on `@flexmr/ui` and ossf-package-analysis-flagged on `@flexmr/utils`)**: `@flexmr/ui@99.99.99` (GHSA-ccxj-49h8-hp3q, OSV MAL-2026-17879, finder InvisiRisk, Inc.) and `@flexmr/utils` (1.0.0, 3.0.12; GHSA-f8pr-fqvq-vvxv, OSV MAL-2026-17888, finder ossf-package-analysis). `@flexmr/ui@99.99.99` is the canonical dep-confusion sentinel (`99.99.99` was the version pattern of the FlexMR dep-confusion probe operator - the package was published to npm 2026-10-13 and GHSA-registered 2026-10-15). Its `beacon.js` (SHA-256 `bdee8d65c1c5b40df70e851eda298aa0729f0a618e11d702a6e9a35285c4e2c3`) runs during `preinstall`, `install`, and `postinstall` lifecycle events, sends the package name, lifecycle event, a fixed token, and host identity details to `http://177.7.60.239:48080`, and encodes the hostname in a DNS query under `oob.recon.dev` ("recon.dev" is a known bug-bounty / recon OAST brand - this is a bug-bounty-adjacent probe against FlexMR, a UK market-research platform). `@flexmr/utils@1.0.0`/`3.0.12` is a second scope slug flagged by OpenSSF Package Analysis for "executes commands associated with malicious behavior" (specific IOCs not disclosed on `/utils`; the 3.0.12 non-sentinel version is noteworthy - it`s a plausibly-realistic version jump rather than a `99.x` sentinel, so the operator may be probing both the canonical dep-confusion fingerprint and a plausible-looking version to beat an internal `3.0.11`). Severity `medium` for the cluster (dep-confusion probe tier, confirmed HTTPS beacon on `/ui` but no credential-stealing payload yet)
- **Cluster G - npm `tailwindcss-form` + `tailwindcss-uniform` 2-package typosquat continuation of the 2026-10-10 Tailwind-form operator (typosquat, CWE-506 boilerplate takedowns with no runtime analysis published; naming pattern directly extends 2026-10-10 `tailwind-animatecss-uniform`/`-form` wave)**: `tailwindcss-form` (all versions; GHSA-c8m9-qwg6-5cv9) and `tailwindcss-uniform` (all versions; GHSA-r7f7-6833-rxh9). Both typosquat the real `@tailwindcss/forms` npm package (the scoped form the Tailwind team maintains). The 2026-10-10 sweep (Cluster D in that write-up) noted the same operator published `tailwind-animatecss-uniform` and `tailwind-animatecss-form` as a continuation of the 2026-10-09 `tailwindcss-ui-extensions`+`tailwindcss-effects-kit` cluster - today`s pair drops the "animatecss" infix and goes with the simpler `tailwindcss-*` form, closer to the real `@tailwindcss/forms` slug. The pattern of two sibling slugs (`-form` and `-uniform`) in each wave is the operator`s signature. GHSA bodies are CWE-506 "fully compromised" boilerplate with no IOCs. Severity `medium` for this cluster (install-time code execution risk per CWE-506 pattern, no vendor runtime analysis published)
- **Cluster H - npm Baileys lure operator wave 4: 7 new scoped and standalone packages (malicious-package, CWE-506 boilerplate takedowns, no runtime analysis published; naming lineage continues the 2026-10-09 `@bellaxchuu/*`+`@xayz/libsignal-node`+`my-baileys`+`@kxafunc/xbails` 16-package Cluster D and the 2026-10-13 60+ package wave 3)**: `xmd-baileys` (all versions; GHSA-m3qf-j9rf-pqrh), `@developmentyora/baileyss` (all versions; GHSA-v8xh-mr86-2fpq), `@developmentyora/yorakids` (all versions; GHSA-xgr5-84p3-qqmf), `@celestial-community/baileys` (all versions; GHSA-5ghv-64gv-gv29), `bungoma` (all versions; GHSA-jj55-mvw9-496r), `kiyoramarkets` (all versions; GHSA-23wg-cgvp-f8w7), `asistenyorstore` (all versions; GHSA-qgh5-36wr-3vvw). Three slugs are explicit Baileys-brand-impersonations (`xmd-baileys`, `@developmentyora/baileyss`, `@celestial-community/baileys`); `@developmentyora/yorakids` is the sibling slug under the same new `@developmentyora` scope and ties the fourth non-`baileys`-named slug into the cluster. `bungoma`, `kiyoramarkets`, `asistenyorstore` are the three standalone-slug entries whose GHSA bodies are identical boilerplate - the naming has an Indonesian/Yoruba/Swahili theme (Bungoma is a town in Kenya, Kiyora is an Indonesian retailer, "asisten yor store" reads as Indonesian for "assistant yor store") consistent with earlier Baileys-operator "lunexindonesia" and `@fer2809fl/baileys`/`arsya-baileys` Indonesian-naming fingerprints from the 2026-10-10 wave. All 7 CWE-506 boilerplate advisories with no published IOCs. Severity `medium` for this cluster (coordinated wave-4 co-publication confirmed by naming + scope pattern, runtime payload family consistent with prior Baileys-lure waves but today`s specific payload not yet documented in the GHSA bodies)
- **Operator continuity**: this sweep extends several week-running operators rather than introducing new ones. **`agentaix` operator** is confirmed-continuing from the 2026-10-11 cluster (same campaign tag, same `googleforum.pythonanywhere.com` C2; today`s wave now has a disclosed GitHub-attacker-account IOC `anonrider404/pypl` with mutable second-stage via `readme.txt`). **Wix dep-confusion operator** continues from the 2026-10-07/09 clusters (same `thunderboltRegistry.js` payload family + `dxpoc.gt.tc` exfil - with the OSSF record explicitly saying `util-foriepft`'s payload is nearly identical to `css-overscroll-contain@1.0.1`). **Tailwind-form typosquat operator** continues from 2026-10-09/10 waves (same `-form`/`-uniform` sibling-pair signature). **Baileys lure operator** continues from the 2026-10-09 16-package cluster through the 2026-10-13 60+ package wave 3 (today`s wave 4 adds 7 packages; the Indonesian/Kenyan naming lineage is the operator continuity signal). **`kam193` continues as top PyPI reporter** - today reports `py-worm`, `py-wormgpt`, `py-sock2`, `getpubip`, and the 3 `proxyrubika` variants (7 of 11 PyPI advisories). **No new activity** from: `priyashareek` Accenture+@newspage dep-confusion operator (quiet since 2026-10-14), `dumtban` orderly-plugin GitHub Actions CI-token-abuse operator (quiet since 2026-10-14), `kingsize`+`limbomail.com`+`lunexindonesia/node-net-pool` discord-mfa Windows-RAT campaign, `conx3993` operator (yesterday`s 5-package `realwbx.com` dep-confusion cluster quiet), `saeka` fraud-tool campaign (yesterday`s PyPI credit-card checker quiet), `185.158.107.175` operator, `64.181.165.115` operator, `hardhat-option` operator, `wgkit` RubyGems operator, `xwise8887`, `sharpnes` crates.io, `@tunstock/remact-dom`, `nfjbill`, `@bitwardne/*`, `reaperhackbot256f`, `ig-gox`, `s4yhii` operator. **New disclosed attacker-controlled hosts today**: `anonrider404/pypl` GitHub repo (Cluster A `py-worm` second-stage), `api-bsx.pages.dev` apex + `/download` path (Cluster D `getpubip` second-stage), `177.7.60.239:48080` (Cluster F `@flexmr/ui` HTTP beacon), `oob.recon.dev` apex (Cluster F `@flexmr/ui` DNS OAST canary). TensorLake AI maintainer compromise ([2026-10-08 carve-out](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise)) remains quiet at `tensorlake@0.5.145` with no wave-2 republish

## What to do

1. **For Cluster A (`agentaix` PyPI operator wave 2 - `py-worm`+`py-wormgpt`+`py-sock2`)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, `conda env` for `py-worm` (`0.1.0`, `2.0.0`, `2.0.1`), `py-wormgpt` (`1.0.0`), and `py-sock2` (`0.1.0`). On ANY hit: treat the installing host as having run a persistent RAT with GitHub-raw stage-2 download. Rotate every credential reachable from the host`s Python runtime (API tokens, SSH/GPG keys unlocked during the install window, cloud SDK credentials, env-exported secrets). On Windows hosts, check for registry persistence under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and Scheduled Tasks (the record notes "registry-based persistence"); the `py-worm@2.0.1` background-thread variant means the hidden Python process may still be running after the install call returned. Add egress blocks: `googleforum.pythonanywhere.com` exact subdomain (do NOT blanket-block `pythonanywhere.com` apex - it is a legitimate PaaS), `raw.githubusercontent.com/anonrider404/pypl/*` path (block the specific attacker-controlled repo path at egress proxies), and `github.com/anonrider404/pypl` repo access on build hosts. Report the `anonrider404` GitHub account to GitHub for abuse takedown. Also audit for leftover autorun entries that match the operator signature from the 2026-10-11 Cluster B (same `agentaix` campaign tag): `~/.config/autostart/` on Linux, `~/Library/LaunchAgents/` on macOS, user-level cron / `systemd --user`. The 6-package operator continuity means a host that installed one may have been retargeted with another; grep for the full set `agentaix`, `agent-vx`, `media-manager5`, `py-worm`, `py-wormgpt`, `py-sock2` together
2. **For Cluster B (`util-foriepft` npm Wix dep-confusion operator wave 3)**: grep every `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml` for `util-foriepft` (version `1.0.0`). On hit: assume **the same K8s SA-token theft + env-variable scraping + container-escape attempt as `css-overscroll-contain@1.0.1`** (the OSSF record explicitly says the payload is nearly identical). On any pod/node that resolved the package, rotate the Kubernetes service-account token, rotate every env-exported credential the pod could reach, audit `/proc/self/mountinfo` for lingering attacker mounts, and treat the pod image as compromised and rebuild from known-good. Add egress blocks on `dxpoc.gt.tc` apex (already in the standing denylist from 2026-10-09 - do not remove) and add detection rules for the IOC files `thunderboltRegistry.js` (SHA-256 `0bebf66b8f89240b99cbe6dadc92023156e6155740e272d3e7a43aa138b8b675`) and `registry-manifest.min.json` (SHA-256 `c8e3101a375550ae7559c94b2720f81dc63cac44c4c8aace17211e5eed71751d`) under any npm package name. If your org publishes under Wix-internal `*Registry*` names (`thunderboltRegistry`, `corvidRegistry`, `editorRegistry`, `siteAssetsRegistry`), scope-lock the internal registry (`npm config set @your-wix-scope:registry https://internal-registry`) and hold the public slugs with placeholder packages at a safe version. Report npm user `regex33-hackerone` for the published name `util-foriepft@1.0.0` as the same operator who shipped `css-overscroll-contain`
3. **For Cluster C (`seapy-ops` PyPI 8-version concealed-upload tool)**: grep for `seapy-ops` (any of 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.1, 1.2.2). On hit: preserve the host for forensic review. For versions 1.0.0-1.1.2, assume the recursive upload has fired against the directory where `seapy` was run (and against any symlink targets outside that directory); treat all files in those directories as having left the host. For versions 1.2.1-1.2.2, assume the single-token REPL input was captured as a password AND the in-memory Base64/gzip code loader fired - the actual payload is undocumented, so treat the host as compromised and rotate every credential reachable from it. Add egress blocks: `space-z.ai` apex (already in the standing denylist from 2026-10-14 - keep it), `preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai` and `b196q82k8891-d.space-z.ai` exact subdomains. Add detection rules for `seapy/cli.py` with any of the 8 published SHA-256 hashes (listed in the OSV record). The REPL-impersonation primitive (a prompt that looks like Python`s built-in REPL but silently exfils typed tokens) is novel enough to call out in security awareness: contributors should treat any Python prompt from an unexpected source with the same suspicion as a sudo prompt from an unexpected source
4. **For Cluster D (`getpubip` PyPI infostealer)**: grep for `getpubip` (any of 0.1.0, 0.1.1, 0.1.2). On hit, assume the obfuscated import-time payload fired - the browser-data target means Chrome/Firefox/Edge profile credentials, cookies, and saved sessions are presumed exfiltrated. Rotate every login on the host and clear browser profiles. Add egress blocks: `api-bsx.pages.dev` apex + `/download` path. `pages.dev` is Cloudflare Pages (legitimate edge hosting) - block the specific `api-bsx` subdomain, do NOT blanket-block `pages.dev` apex. Reference Triage report `tria.ge/261015-hppmhsgx51` for dynamic-analysis IOCs. The campaign kinship with yesterday`s `fontcase` (2026-10-14 Cluster B carve-out) means hosts that installed `fontcase` or `sysdiagd` or `pyyi` should also be audited for `getpubip` by the same operator profile
5. **For Cluster E (3-package `proxyrubika` PyPI Android file-exfiltration cluster)**: grep for `proxyrobika` (0.1.0), `proxy-rubikis` (0.1.0), `proxyrubika` (0.1.0). On hit: file exfiltration from the installer`s working directory is the confirmed behaviour; the Android target (`target:android` OSSF reason) suggests this is more likely a Rubika-messaging-user tool than a dev-tooling library, so a corporate dev-host hit is unusual and the host should be preserved for forensic review (fraud/account-theft side rather than dev-credential compromise). No specific C2 endpoint disclosed in the record, so apply standard removal + credential-rotation hygiene until a vendor publishes a runtime analysis. The three variations of the same name (one correct spelling `proxyrubika`, one transposed `proxyrobika`, one pluralised `proxy-rubikis`) are the operator`s signature - watch for a wave 2 under further Rubika-themed slugs
6. **For Cluster F (`@flexmr/ui` + `@flexmr/utils` npm dep-confusion probe)**: grep for `@flexmr/ui@99.99.99` and `@flexmr/utils` (1.0.0, 3.0.12). On hit, the `@flexmr/ui@99.99.99` beacon fired during `preinstall`/`install`/`postinstall` and sent host identity plus a fixed token to `http://177.7.60.239:48080` (plus a DNS canary to `oob.recon.dev`). Treat as recon-tier - no credential-stealing payload confirmed yet - but the `@flexmr/*` scope is the signal that FlexMR (a UK market-research platform) is being probed. If your org is FlexMR or uses `@flexmr/*` internally, scope-lock the internal registry and hold the public slugs with placeholders. Add egress blocks: `177.7.60.239:48080` exact IP+port and `oob.recon.dev` apex (recon.dev is a known bug-bounty / OAST brand, so this may be a legitimate bug-bounty probe - but still block from CI/build hosts). Detection rule for `beacon.js` SHA-256 `bdee8d65c1c5b40df70e851eda298aa0729f0a618e11d702a6e9a35285c4e2c3` under any npm package name. The `@flexmr/utils` 1.0.0 + 3.0.12 non-sentinel pair is unusual for dep-confusion (operator probing both the canonical `99.x` fingerprint and a plausible-looking version to beat an internal `3.0.11`) - teach contributors that a `3.0.12` with no prior history and a jump from `1.0.0` to `3.0.12` is also a suspect dep-confusion signature
7. **For Cluster G (`tailwindcss-form` + `tailwindcss-uniform` npm typosquats)**: grep for `tailwindcss-form` and `tailwindcss-uniform` (both all versions). On hit, remove and treat as CWE-506 install-time compromise until a vendor publishes a runtime analysis. The real packages a developer wants are `@tailwindcss/forms` (the scoped form the Tailwind team maintains) - a wide suspicion of any non-scoped `tailwindcss-*` package is reasonable given this operator`s continued wave count. Teach contributors that unscoped `tailwindcss-form`/`-uniform`/`-animatecss-*` are suspect by default; the scoped forms (`@tailwindcss/forms`, `@tailwindcss/typography`, `@tailwindcss/aspect-ratio`, `@tailwindcss/container-queries`) are the real artefacts
8. **For Cluster H (Baileys lure operator wave 4 - 7 npm packages)**: grep every `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml` for `xmd-baileys`, `@developmentyora/baileyss`, `@developmentyora/yorakids`, `@celestial-community/baileys`, `bungoma`, `kiyoramarkets`, `asistenyorstore` (all all-versions). CWE-506 boilerplate advisory means the specific payload is undocumented in these GHSAs; treat the install as credential-compromised until Socket or a vendor publishes a runtime analysis. Watch for a wave-5 under new scopes `@developmentyora/*` and `@celestial-community/*` and under additional Indonesian/Kenyan/Swahili-named standalone slugs (the operator`s naming lineage from the 2026-10-10 `@fer2809fl/baileys`+`arsya-baileys` wave through the 2026-10-13 60+ package wave 3). Add detection rules for any npm package containing `baileys`, `bailey`, `xbails`, `libsignal-node`, or `whiskeysockets` substrings outside the real `@whiskeysockets` scope - this is the Baileys lure operator`s primary brand-impersonation surface
9. **NEW outbound denylist entries for CI/build-host egress proxies today**: `raw.githubusercontent.com/anonrider404/pypl/*` path (Cluster A `py-worm` second-stage; block the specific attacker-controlled repo path at egress proxies, do NOT blanket-block `raw.githubusercontent.com` apex), `api-bsx.pages.dev` apex + `/download` path (Cluster D `getpubip` second-stage; `pages.dev` apex is Cloudflare Pages legit, block the specific subdomain), `177.7.60.239:48080` exact IP+port (Cluster F `@flexmr/ui` HTTP beacon), `oob.recon.dev` apex (Cluster F `@flexmr/ui` DNS OAST canary). Also block the specific `anonrider404` GitHub account at build-host egress and report for abuse takedown. Keep prior egress blocks in place: `googleforum.pythonanywhere.com` exact subdomain (2026-10-11), `space-z.ai` apex + `preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai` + `b196q82k8891-d.space-z.ai` subdomains (2026-10-14), `dxpoc.gt.tc` apex (2026-10-09 Wix cluster), `realwbx.com` apex + `/ip.php` + `/ip` paths (2026-10-15), `uncoder.eu.org` apex + `/cc-checker/api.php` path (2026-10-15), `accenture-npm.azurewebsites.net` + `/test` + `/async` + `/mfe`, `limbomail.com` apex + `github.com/lunexindonesia/node-net-pool` + `github.com/trktgq0wbre1/node-net-pool`, `github.com/unicodeces/font-atlas`, `collector.oob.s4yhii.com` + `*.oob.s4yhii.com` + `s4yhii.com` apex, `64.181.165.115/dc`, `167.88.172.33:8087` + `jsonspack.com`, `goxtools.shop` apex, `minhdong.site` apex + GitHub user `VangBanLaNhat`, `45.138.12.177:8089`, `185.158.107.175:8787`, `ltidi.storage.googleapis.com/depenconf/`, `oob.s4yhii.com:9999/native`, `*.oast.pro`/`*.oast.me`/`*.oast.fun`/`*.oast.site`/`*.oastify.com`, `frjmzbjbhwvtdnsuodmu.supabase.co`, `api.npoint.io` apex, `tele.metry.orgin.net`, `morroncr0w.io`, `api.telegram.org` on untrusted CI/build hosts, `appsecc.com`, `webhook.site/*`, `nfjbill.ren`, `storage.googleapis.com/depenconf/`, `10.0.19.0/24` + `10.0.49.0/24`, `api.nm-streetwear.space`, Discord webhook URL pattern, `ipify.org` + `ifconfig.me`, `gitflic.ru`, `api.wagmiwallet.org`, `backend-cybersecuritydashboard.onrender.com`, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, `chinazhangsan.ccwu.cc`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `npm-canary.aveliscare.com`, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil patterns, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, `tuamaeaquelaursa.com`, `45.138.0.0/16` RubyGems wgkit CIDRs

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-483q-j87r-c97c - pypi py-worm (Cluster A - agentaix operator wave 2, campaign 2026-10-agentaix, anonrider404/pypl GitHub-raw stage-2, Windows registry persistence, MAL-2026-17883)](https://github.com/advisories/GHSA-483q-j87r-c97c) - GitHub
- [OSSF malicious-packages MAL-2026-17883 raw record (py-worm IOCs: googleforum.pythonanywhere.com, raw.githubusercontent.com/anonrider404/pypl paths, finder kam193)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/pypi/py-worm/MAL-2026-17883.json) - OpenSSF
- [GHSA-q9mx-j265-447m - pypi py-wormgpt (Cluster A - agentaix operator wave 2, MAL-2026-17886)](https://github.com/advisories/GHSA-q9mx-j265-447m) - GitHub
- [GHSA-mrm7-9jxf-vx65 - pypi py-sock2 (Cluster A - agentaix operator wave 2, MAL-2026-17881)](https://github.com/advisories/GHSA-mrm7-9jxf-vx65) - GitHub
- [kam193 bad-packages entry for py-worm (reporter`s own detail page for the PyPI advisory)](https://bad-packages.kam193.eu/pypi/package/py-worm)
- [GHSA-jc4x-j69j-jf5c - npm util-foriepft (Cluster B - Wix dep-confusion wave 3, thunderboltRegistry.js SHA-256 0bebf66b..., dxpoc.gt.tc exfil, nearly identical to css-overscroll-contain@1.0.1 MAL-2026-17705 payload, MAL-2026-17878)](https://github.com/advisories/GHSA-jc4x-j69j-jf5c) - GitHub
- [OSSF malicious-packages MAL-2026-17878 raw record (util-foriepft IOCs: dxpoc.gt.tc, thunderboltRegistry.js SHA-256 hashes)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/npm/util-foriepft/MAL-2026-17878.json) - OpenSSF
- [GHSA-5j6r-jv3q-c93f - pypi seapy-ops (Cluster C - 8-version concealed-upload + REPL impersonation + in-memory Base64/gzip code exec, space-z.ai C2, MAL-2026-17880)](https://github.com/advisories/GHSA-5j6r-jv3q-c93f) - GitHub
- [OSSF malicious-packages MAL-2026-17880 raw record (seapy-ops IOCs: preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai, b196q82k8891-d.space-z.ai, finder smiling-hyena, 8 SHA-256 hashes for seapy/cli.py)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/pypi/seapy-ops/MAL-2026-17880.json) - OpenSSF
- [GHSA-7j9m-mhr6-9jj6 - pypi getpubip (Cluster D - obfuscated infostealer, api-bsx.pages.dev/download stage-2, similarities to campaign 2026-10-fontcase, MAL-2026-17884)](https://github.com/advisories/GHSA-7j9m-mhr6-9jj6) - GitHub
- [OSSF malicious-packages MAL-2026-17884 raw record (getpubip IOCs: api-bsx.pages.dev, /download URL, finder kam193)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/pypi/getpubip/MAL-2026-17884.json) - OpenSSF
- [Triage dynamic-analysis report tria.ge/261015-hppmhsgx51 (getpubip)](https://tria.ge/261015-hppmhsgx51)
- [GHSA-ch77-7g6p-3v7x - pypi proxyrobika (Cluster E - Android file-exfil cluster, campaign 2026-10-proxyrubika, MAL-2026-17889)](https://github.com/advisories/GHSA-ch77-7g6p-3v7x) - GitHub
- [GHSA-j493-92mg-8qj9 - pypi proxy-rubikis (Cluster E - Android file-exfil cluster, MAL-2026-17887)](https://github.com/advisories/GHSA-j493-92mg-8qj9) - GitHub
- [GHSA-rmvf-4vh2-pv34 - pypi proxyrubika (Cluster E - Android file-exfil cluster, MAL-2026-17885)](https://github.com/advisories/GHSA-rmvf-4vh2-pv34) - GitHub
- [GHSA-ccxj-49h8-hp3q - npm @flexmr/ui (Cluster F - 99.99.99 sentinel dep-confusion, 177.7.60.239:48080 + oob.recon.dev beacon, InvisiRisk finder, MAL-2026-17879)](https://github.com/advisories/GHSA-ccxj-49h8-hp3q) - GitHub
- [OSSF malicious-packages MAL-2026-17879 raw record (@flexmr/ui IOCs: 177.7.60.239:48080, oob.recon.dev, beacon.js SHA-256 bdee8d65...)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/npm/%40flexmr/ui/MAL-2026-17879.json) - OpenSSF
- [GHSA-f8pr-fqvq-vvxv - npm @flexmr/utils (Cluster F - 1.0.0 + 3.0.12 non-sentinel dep-confusion, ossf-package-analysis flag, MAL-2026-17888)](https://github.com/advisories/GHSA-f8pr-fqvq-vvxv) - GitHub
- [GHSA-c8m9-qwg6-5cv9 - npm tailwindcss-form (Cluster G - Tailwind-form typosquat continuation, CWE-506 boilerplate)](https://github.com/advisories/GHSA-c8m9-qwg6-5cv9) - GitHub
- [GHSA-r7f7-6833-rxh9 - npm tailwindcss-uniform (Cluster G - Tailwind-uniform typosquat continuation, CWE-506 boilerplate)](https://github.com/advisories/GHSA-r7f7-6833-rxh9) - GitHub
- [GHSA-m3qf-j9rf-pqrh - npm xmd-baileys (Cluster H - Baileys lure wave 4, CWE-506 boilerplate)](https://github.com/advisories/GHSA-m3qf-j9rf-pqrh) - GitHub
- [GHSA-v8xh-mr86-2fpq - npm @developmentyora/baileyss (Cluster H - Baileys lure wave 4, CWE-506 boilerplate)](https://github.com/advisories/GHSA-v8xh-mr86-2fpq) - GitHub
- [GHSA-xgr5-84p3-qqmf - npm @developmentyora/yorakids (Cluster H - Baileys lure wave 4, same scope as /baileyss, CWE-506 boilerplate)](https://github.com/advisories/GHSA-xgr5-84p3-qqmf) - GitHub
- [GHSA-5ghv-64gv-gv29 - npm @celestial-community/baileys (Cluster H - Baileys lure wave 4, CWE-506 boilerplate)](https://github.com/advisories/GHSA-5ghv-64gv-gv29) - GitHub
- [GHSA-jj55-mvw9-496r - npm bungoma (Cluster H - Baileys lure wave 4 Indonesian/Kenyan-themed slug, CWE-506 boilerplate)](https://github.com/advisories/GHSA-jj55-mvw9-496r) - GitHub
- [GHSA-23wg-cgvp-f8w7 - npm kiyoramarkets (Cluster H - Baileys lure wave 4 Indonesian-themed slug, CWE-506 boilerplate)](https://github.com/advisories/GHSA-23wg-cgvp-f8w7) - GitHub
- [GHSA-qgh5-36wr-3vvw - npm asistenyorstore (Cluster H - Baileys lure wave 4 Indonesian-themed slug, CWE-506 boilerplate)](https://github.com/advisories/GHSA-qgh5-36wr-3vvw) - GitHub
- [DependencyWatch: multi-2026-10-15-ghsa-malware-sweep (prior-day context: conx3993 realwbx.com dep-confusion, saeka PyPI credit-card checker, babel-polyfill-plugin-corejs2 + eth-react-provider Amazon Inspector backfill)](https://dependencywatch.io/incident/multi-2026-10-15-ghsa-malware-sweep)
- [DependencyWatch: multi-2026-10-14-ghsa-malware-sweep (fontcase/sysdiagd/pyyi carve-outs - Cluster D getpubip is the next kam193 campaign in the same lineage)](https://dependencywatch.io/incident/multi-2026-10-14-ghsa-malware-sweep)
- [DependencyWatch: multi-2026-10-11-ghsa-malware-sweep (agentaix wave 1 - 3 packages agentaix/agent-vx/media-manager5, same campaign tag and C2 as today`s wave 2)](https://dependencywatch.io/incident/multi-2026-10-11-ghsa-malware-sweep)
- [DependencyWatch: multi-2026-10-09-ghsa-malware-sweep (Wix dep-confusion wave 2 - css-overscroll-contain K8s SA-token theft, same payload family as today`s util-foriepft)](https://dependencywatch.io/incident/multi-2026-10-09-ghsa-malware-sweep)
- [DependencyWatch: multi-2026-10-13-ghsa-malware-sweep (Baileys lure wave 3 60+ packages, same operator lineage as today`s Cluster H wave 4)](https://dependencywatch.io/incident/multi-2026-10-13-ghsa-malware-sweep)
- [DependencyWatch: npm-2026-10-08-tensorlake-maintainer-compromise (standing watch, no wave 2)](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-16-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-16-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).