GitHub Advisory malware sweep, 17 October 2026

The full picture

19 packages 30 versions

• npm@beloved-lenora/opencode-btw0.0.0→
• npm@beloved-lenora/opencode-goal0.0.0→
• npm@beloved-lenora/opencode-orchestrator0.0.0→
• npm@beloved-lenora/opencode-shared-rpc0.0.0→
• npm@beloved-lenora/opencode-shell-guard0.0.0→
• npm@beloved-lenora/opencode-stats0.0.0→
• npm@beloved-lenora/opencode-todo0.0.0→
• npm@flexmr/survey-client1.0.01.0.122.0.123.0.1210.0.12→
• npm@flexmr/survey-conversation1.0.01.0.122.0.123.0.1210.0.12→
• npm@xatancchii/natabaileys0.0.0→
• npmbuyerdashboard45.3.4→
• PyPIfromthehotel-poems0.1.0→
• npmidlive-face-capture-web-development78.8.1→
• npmitsa-react-focuscontainer16.0.10→
• npmitsa-react-maskedinput16.1.2→
• PyPImarocolor1.0.0→
• npmparxleys0.0.0→
• npmweb-pixels-manager76.2.4→
• npmxapi-lib88.2.388.2.590.2.190.3.1→

What it does if you installed it

• *Cluster A - npm `itsa-react- legacy maintainer-account compromise, GHSA-indexed 2026-10-16 (compromise, confirmed hijacked legitimate scope by itsasbreuk / Marco Asbreuk; CWE-506 boilerplate takedowns on both advisories; malicious versions have been dormant on the registry since 2025-05 and maintainer-recovery releases followed within 15 hours - this is a 2026-10-16 GHSA backfill of a May 2025 compromise, not a fresh takeover)**: itsa-react-maskedinput@16.1.2 (GHSA-hhr5-rjw6-9hr5, published to npm 2025-05-04T21:28:00 UTC; superseded by legitimate 16.1.3 on 2025-05-05T11:13:59 UTC - a ~14-hour exposure window and the current latest) and itsa-react-focuscontainer@16.0.10 (GHSA-8c34-p746-v5rq, published to npm 2025-05-04T21:44:15 UTC; superseded by legitimate 16.0.11 on 2025-05-05T10:59:47 UTC - a ~13-hour exposure window and the current latest). The itsa-react-* family is an 8-year-old legitimate React component library (itsa-react-maskedinput has 100+ releases dating back to 0.0.1 in 2017; itsa-react-focuscontainer similarly dates to 2017 under the same npm account itsasbreuk, email marco@itsasbreuk.nl). The malicious patch-above-latest pattern (16.1.2 sat between legitimate 16.1.1 2018 and the recovery 16.1.3 of 2025-05-05; 16.0.10 sat between 16.0.9 2023 and 16.0.11 2025-05-05) is the canonical fingerprint of a maintainer-account or publish-credential compromise. The registry modified timestamp on both packages jumped to 2026-10-16T23:28-29 UTC - the day GHSA ingested the records. Severity high for this cluster (confirmed hijack of a legitimate long-standing scope; CWE-506 means malicious payload is confirmed present on the pulled tarballs but no vendor runtime analysis has been published; the ~14-hour live window and the fact that current latest` is a clean maintainer republish mean active exposure for anyone pinned to the malicious versions in old lockfiles only - no new reach)
• Cluster B - npm conx3993 operator wave 2: 4 realwbx.com preinstall-beacon packages (dependency-confusion / typosquat lures, confirmed install-time HTTP beacon with hardcoded Authorization per package, same account as 2026-10-15 Cluster A, operator totals 9 packages across the Sep 30 - Oct 15 2026 window): buyerdashboard@45.3.4 (GHSA-gp7c-v9m4-rx6c, MAL-2026-17893, Authorization 8eb5e8641a5795b022d68e14d8858415), web-pixels-manager@76.2.4 (GHSA-g99r-gv24-gqpp, MAL-2026-17895, Authorization 207e4133bd083b9e3e89c5556fc8677e - shadows the real web-pixels-manager Shopify-published npm package), xapi-lib (88.2.3, 88.2.5, 90.2.1, 90.3.1; GHSA-q29m-w8xx-cvvg, MAL-2026-17896, Authorization fa79878bc2cfb48bd5127ae26fb661b1), idlive-face-capture-web-development@78.8.1 (GHSA-xvmh-mc7p-r5vj, MAL-2026-17894, Authorization a3b620ea8719eae2fa9b62726364bcc9). All four were published 2026-10-15 by npm account conx3993 and taken down 2026-10-16 after GHSA ingestion. Each ships a preinstall hook that runs node index.js and POSTs host identity to https://realwbx.com/ip.php?ip=8.8.8.8 under a per-package hardcoded Authorization header (same scheme as the 2026-10-15 Cluster A @mntv-analysis/* + @user-interface-common/* + monkey-tags-ip 5-package wave, same C2 apex realwbx.com, same /ip.php + /ip path family). The yesterday 2026-10-16 sweep marked this operator "quiet"; todays publish-list proves wave 2 landed before yesterdays GHSA ingest cutoff but surfaced in the advisory feed after it. Severity medium for this cluster (dep-confusion / typosquat probe-tier - confirmed install-time HTTP beacon and host identity leak, but no credential-stealing payload confirmed; the per-package Authorization header suggests the operator is correlating install-telemetry with victim identity for later targeted follow-up)
• *Cluster C - npm `@flexmr/ dep-confusion operator wave 2: @flexmr/survey-conversation + @flexmr/survey-client (dependency-confusion, confirmed install-time arbitrary code execution via bare-URL dependency to artifacts.creditslib.com; operator pivot from yesterdays Cluster F 99.99.99 sentinel + oob.recon.dev DNS canary to a new artifacts.creditslib.com stage-2 host and a bare-URL-dep technique that fully delegates installed code to the attacker server)*: @flexmr/survey-conversation (1.0.0, 1.0.12, 2.0.12, 3.0.12, 10.0.12; GHSA-3h5x-5663-jx9x, MAL-2026-17899, bare-URL dep cache-format-syntax-tracer served from https://artifacts.creditslib.com/npm/cache-format-syntax-tracer) and @flexmr/survey-client (1.0.0, 1.0.12, 2.0.12, 3.0.12, 10.0.12; GHSA-w9wx-pxhr-p9g4, MAL-2026-17898, bare-URL dep marker-index-symbol-schema served from https://artifacts.creditslib.com/npm/marker-index-symbol-schema). Both packages ship a one-line index.js that re-exports the bare-URL dependency; npm install fetches whatever artifacts.creditslib.com is currently serving under that path and runs its lifecycle scripts (same pattern as 2026-10-12 hridoy-ultimate where fca-unofficial was pinned to a bare GitHub repo). Install integrity hashes do not protect against this because the resolver pins to the URL, not the tree. Both show placeholder metadata (author: "Package Registry", description: "Generated package", repository: github.com/example/) consistent with a scripted dep-confusion generator. The reused five-version ladder 1.0.0, 1.0.12, 2.0.12, 3.0.12, 10.0.12 is the operator fingerprint - the operator probes which internal `@flexmr/ version an internal registry resolves at and matches it. Severity medium` for this cluster (confirmed install-time arbitrary code execution via bare-URL dep but payload is fully under attacker server control at install time - no fixed payload hash can be IOC-matched; dep-confusion probe tier against FlexMR, a UK market-research platform, so dev-fleet exposure outside FlexMR and its vendors is low)
• *Cluster D - npm `@beloved-lenora/opencode- 7-package AI-coding-tool lure wave (malicious-package / typosquat targeting the opencode AI coding agent ecosystem - sst.devs opencode uses the @opencode-ai/* scope; @beloved-lenora/opencode-* is a parallel-scope impersonation of plausible-sounding plugin names; CWE-506 boilerplate takedowns on all 7 advisories; versions 1.0.0 through 1.0.3 were published and npm security replaced them with 0.0.1-security holding packages; no runtime analysis published)**: @beloved-lenora/opencode-todo (GHSA-9rjq-6mhc-46c5), @beloved-lenora/opencode-shared-rpc (GHSA-8c9g-fwgq-rqq5), @beloved-lenora/opencode-stats (GHSA-f4h2-68pg-ffhj), @beloved-lenora/opencode-orchestrator (GHSA-7wq2-8pc2-wm26), @beloved-lenora/opencode-shell-guard (GHSA-pm76-w63j-7j29), @beloved-lenora/opencode-goal (GHSA-c78h-wwhq-g6j8), @beloved-lenora/opencode-btw (GHSA-xv54-6gmc-3xph). All seven published to the same new scope @beloved-lenora in a single coordinated drop and all taken down together. The naming (todo, shared-rpc, stats, orchestrator, shell-guard, goal, btw) targets the plausible shape of opencode plugin / helper modules a developer or an LLM agent might reach for. Severity medium for this cluster (coordinated 7-package publish under a brand-impersonation scope, CWE-506 means malicious payload is confirmed present on the pulled tarballs but no vendor runtime analysis has been published; AI-coding-tool lures are a growing operator category - the 2026-10-15 agentaix wave (py-worm+py-wormgpt+py-sock2) and todays Cluster G fromthehotel-poems` LLM-threat are peers)
• Cluster E - npm Baileys-lure operator wave 5 continuation + residual CWE-506 (malicious-package; @xatancchii/natabaileys directly extends the 7-package wave 4 of yesterdays Cluster H under a new @xatancchii scope; parxleys` is a residual CWE-506 takedown with no explicit Baileys string but the timing + boilerplate pattern suggest the same operator or a very similar one): @xatancchii/natabaileys (all versions; GHSA-cgq9-cff6-pf33) and parxleys (all versions; GHSA-rg3c-8x72-6pmc). Both CWE-506 boilerplate with no published IOCs. The @xatancchii scope is new; the natabaileys slug follows the Baileys-brand-impersonation signature (same as yesterdays xmd-baileys, @developmentyora/baileyss, @celestial-community/baileys, prior waves @fer2809fl/baileys, arsya-baileys, my-baileys). Severity medium for this cluster (install-time code execution risk per CWE-506 pattern, no vendor runtime analysis published; the Baileys operators week-running wave count and consistent naming lineage are the operator continuity signal)
• Cluster F - PyPI marocolor single-package infostealer + DoS (malicious-package, confirmed files-exfiltration + uses-telegram-bot + destructive-actions OSSF reasons; home-directory scrape of secret-pattern files + resource-exhaustion DoS on import; kam193 reporter): marocolor@1.0.0 (GHSA-m6jr-rmfr-29w4, MAL-2026-17900, campaign 2026-10-marocolor, reporter kam193). On import, the package scans $HOME for files matching document / image / secret extensions (.env, .key, .sql and similar) and uploads them to a Telegram-bot endpoint; a second import-time thread spawns threads unbounded to exhaust the host. The combination of file exfiltration + Telegram-bot C2 + destructive-action denial-of-service in a single package is unusual - typical kam193-reported PyPI malware ships one payload class at a time. The package name marocolor carries no obvious brand-impersonation shape, suggesting a lure name chosen for a specific victim rather than a mass-reach typosquat. OSSF commit 38b0fa2ee77af46ad9daf78c024a0f599fd0798eef7605cb3eed50d8db65fa22 and reporter-maintained page https://bad-packages.kam193.eu/pypi/package/marocolor are the entry points for the specific Telegram-bot token and file-match patterns. Severity medium for this cluster (confirmed functional file-exfiltration payload with Telegram-bot C2 + confirmed destructive-action DoS; single package with a specific-target lure name means dev-fleet reach is low but any installer host should be presumed exfiltrated)
• Cluster G - PyPI fromthehotel-poems single-package LLM-agent-threat (malicious-package, confirmed llm-threat + action-hidden-in-lib-usage OSSF reasons; one function hides remote code execution designed to steer an LLM coding agent into fetching and executing a self-hosted wheel from a freshly registered domain; kam193 reporter notes remote payload non-malicious at analysis time but the design is clearly an LLM-threat prototype): fromthehotel-poems@0.1.0 (GHSA-q5q7-gj32-mwhh, MAL-2026-17897, campaign 2026-10-fromthehotel-poems, reporter kam193). The package provides a function that fetches instructions from https://login.fromthehotel.com/muse, which read as prompt-injection targeting an LLM agent (telling the agent to download a self-hosted wheel from https://login.fromthehotel.com/api/art/downloads/<wheel> and run it) and separately exposes a /api/poems/code endpoint that returns executable Python code hidden inside what reads as poetry. The current remote content is reported as non-malicious at analysis time, but the delivery design (library function that fetches instructions, prompt-injected agent coercion, wheel download URL already live) is a working framework for turning any LLM coding assistant that installs the package into a confused deputy. Source hash bf72dad3e2f32ee2e66a3a5ee5642b4a20a9fb9458fcd677f6250b1e4b805906. Severity medium for this cluster (confirmed novel LLM-threat primitive and working infrastructure, but current remote payload is non-malicious so no confirmed exploitation yet; the attack class is the significant find - LLM-agent prompt-injection via package-shipped library function is a growing operator category that this record flags for future tracking)
• Operator continuity: this sweep extends several week-running operators. conx3993 operator returns from "quiet since 2026-10-15" (yesterdays sweep marked it so) with wave 2 under 4 new slugs; same npm account, same realwbx.com C2 apex, same per-package Authorization scheme. **@flexmr dep-confusion operator** continues from yesterdays Cluster F with a technique pivot: bare-URL deps to a new artifacts.creditslib.com host instead of a 99.99.99 sentinel beacon. Baileys-lure operator continues from yesterdays Cluster H with 1 new slug (@xatancchii/natabaileys) and possibly parxleys. **kam193 remains top PyPI reporter** - today reports both PyPI advisories (marocolor, fromthehotel-poems). **New disclosed attacker-controlled hosts today**: artifacts.creditslib.com apex + /npm/cache-format-syntax-tracer + /npm/marker-index-symbol-schema paths (Cluster C), login.fromthehotel.com apex + /muse + /api/poems/code + /api/art/downloads/` paths (Cluster G). New operator lineage: @beloved-lenora AI-coding-tool-lure scope (Cluster D) is a new seven-package operator targeting the opencode ecosystem; watch for a wave 2 under additional `opencode- or claude-code-` or similar AI-coding-tool-brand-impersonation scopes. New attacker npm scope @xatancchii (Cluster E) added to the Baileys-operator`s scope rotation. No new activity* from: yesterdays agentaix operator wave 2 (py-worm+py-wormgpt+py-sock2 quiet; anonrider404/pypl GitHub repo and googleforum.pythonanywhere.com C2 unchanged), Wix dep-confusion wave 3 (util-foriepft quiet; dxpoc.gt.tc unchanged), seapy-ops operator (space-z.ai quiet), getpubip operator (api-bsx.pages.dev quiet), proxyrubika operator, tailwindcss-form/-uniform typosquat operator. [TensorLake AI maintainer compromise (2026-10-08 carve-out)](/incident/npm-2026-10-08-tensorlake-maintainer-compromise) confirmed-recovered: maintainers own clean releases 0.5.145 through 0.5.151 have shipped, no wave-2 malicious republish, record updated today with the recovery timeline

Clean-up steps

1. 1For Cluster A (itsa-react-maskedinput@16.1.2 + itsa-react-focuscontainer@16.0.10 - legacy maintainer compromise): grep every package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock for the exact strings itsa-react-maskedinput + 16.1.2 and itsa-react-focuscontainer + 16.0.10. On ANY hit (likely only in old lockfiles that have not been refreshed since May 2025): bump to the clean maintainer republish itsa-react-maskedinput@16.1.3 and itsa-react-focuscontainer@16.0.11 or later, with exact-version pins; rebuild lockfiles and run npm ci / pnpm install --frozen-lockfile to evict the compromised tarballs. The CWE-506 boilerplate advisory means the specific payload is undocumented - treat any installer host that ran the malicious tarball between 2025-05-04 and 2025-05-05 as potentially credential-compromised during that window. Internal registry mirrors (Nexus, Artifactory, Verdaccio) that cached the 16.1.2 / 16.0.10 tarballs between May 2025 and today should flush them. Note: this cluster is low current risk because the maintainer republish has sat at latest for 1.5 years and most consumers with floating ^16.1 or ~16.1 constraints resolved past the malicious versions long ago; the entries are indexed primarily to warn teams whose old pinned lockfiles still carry the exact malicious versions. If your org uses the @itsasbreuk scope or publishes under similar single-maintainer scopes, this is a reminder to migrate publishing off long-lived npm tokens to npm OIDC trusted publishing and to enable mandatory 2FA on every maintainer account
2. 2For Cluster B (conx3993 operator wave 2 - 4 npm packages with realwbx.com beacon): grep every package.json, package-lock.json, yarn.lock, pnpm-lock.yaml for buyerdashboard, web-pixels-manager@76.2.4 (not the real Shopify-published web-pixels-manager - this is the lookalike at version 76.2.4 only), xapi-lib (any of 88.2.3, 88.2.5, 90.2.1, 90.3.1), idlive-face-capture-web-development@78.8.1. On hit: the preinstall hook has run node index.js and POSTed host identity to realwbx.com/ip.php?ip=8.8.8.8. Treat the installing host as recon-tier compromised; no credential-stealing payload confirmed, but the per-package Authorization token means the operator can correlate the installing hosts outbound beacon with the specific lure package. Rotate any secret that was in the preinstall processs environment. Keep egress blocks on realwbx.com apex + /ip.php + /ip paths (already in the standing denylist from the 2026-10-15 sweep - do not remove). If your org publishes under @mntv-analysis, @user-interface-common, or any of the plausible internal names the operator shadows, scope-lock the internal registry and hold the public slugs with placeholder packages. Report npm account conx3993 for the full 9-package publish set across Sep 30 - Oct 15 2026 as the same operator`s complete wave
3. 3*For Cluster C (`@flexmr/ dep-confusion wave 2 - @flexmr/survey-conversation + @flexmr/survey-client)**: grep every package.json, package-lock.json, yarn.lock, pnpm-lock.yaml for @flexmr/survey-conversation or @flexmr/survey-client (any of versions 1.0.0, 1.0.12, 2.0.12, 3.0.12, 10.0.12). On hit: the bare-URL dependency has fetched whatever artifacts.creditslib.com/npm/cache-format-syntax-tracer or /marker-index-symbol-schema was serving at install time, and lifecycle scripts have run. The payload is attacker-server-controlled so there is no fixed SHA to match - treat the installing host as fully compromised and rotate every credential reachable from the Node runtime (API tokens, SSH / GPG keys, cloud SDK creds, env-exported secrets). Add egress blocks: artifacts.creditslib.com apex + /npm/ paths (new today). Keep yesterdays standing blocks on 177.7.60.239:48080 and oob.recon.dev (yesterdays @flexmr Cluster F). CI gates: reject any package.json whose dependency spec is a bare URL to an arbitrary host (not just the usual bare-GitHub-repo check); the lockfile integrity field for a URL dep is a URL hash, not a tree hash, so npm ci --frozen-lockfile does not protect against the attacker swapping payload. If your org is FlexMR or uses @flexmr/` internally, scope-lock the internal registry and hold the public slugs with placeholders at a safe version
4. 4*For Cluster D (7-package `@beloved-lenora/opencode- AI-coding-tool lure wave)**: grep every package.json, package-lock.json, yarn.lock, pnpm-lock.yaml for @beloved-lenora/opencode-todo, @beloved-lenora/opencode-shared-rpc, @beloved-lenora/opencode-stats, @beloved-lenora/opencode-orchestrator, @beloved-lenora/opencode-shell-guard, @beloved-lenora/opencode-goal, @beloved-lenora/opencode-btw (all all-versions, versions 1.0.0-1.0.3 were pulled and npm 0.0.1-security placeholders remain). CWE-506 boilerplate advisory means the specific payload is undocumented; treat the installing host as credential-compromised until Socket or a vendor publishes a runtime analysis. Teach contributors (and any coding-agent that reads this record) that the real opencode scope is @opencode-ai; any opencode-named package under a different scope (@beloved-lenora, @claude-code, @opencoding, @opencode-plugin) is suspect by default. Watch for a wave 2 under additional @beloved-lenora/*` or newly-created AI-coding-tool-brand-impersonation scopes
5. 5For Cluster E (Baileys lure wave 5 - @xatancchii/natabaileys + parxleys): grep for @xatancchii/natabaileys and parxleys (both all-versions). CWE-506 boilerplate means the specific payload is undocumented; treat as credential-compromised until a vendor publishes a runtime analysis. The Baileys-operators week-running wave count means detection rules should match any npm package containing baileys, bailey, xbails, libsignal-node, or whiskeysockets substrings outside the real @whiskeysockets scope; also match on new scopes @xatancchii/ and @beloved-lenora/ (todays AI-coding-tool-lure scope - no overlap confirmed with the Baileys operator but worth watching for scope-reuse)
6. 6For Cluster F (marocolor PyPI Telegram-bot stealer + DoS): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda env for marocolor@1.0.0. On hit: assume home-directory files matching .env, .key, .sql, document, and image extensions have been scraped and uploaded to a Telegram-bot endpoint; also assume the import-time thread-spawn DoS has fired against the installer host. Rotate every credential in $HOME on the installing host (SSH keys, GPG keys, .env secrets, .aws/credentials, .config/*/token, .ssh/*, .netrc, cloud SDK caches). Preserve the host for forensic review before clean-rebuilding. Add egress blocks: api.telegram.org on CI / build hosts (already in the standing denylist from prior Telegram-bot stealer disclosures - keep it). Report the specific Telegram-bot token (listed in OSSF MAL-2026-17900 record) to Telegram abuse
7. 7For Cluster G (fromthehotel-poems PyPI LLM-agent-threat): grep for fromthehotel-poems@0.1.0. On hit: assume the library function has been called by whatever LLM coding assistant or notebook the package was imported in, and the function has fetched instructions from https://login.fromthehotel.com/muse and possibly executed a wheel from https://login.fromthehotel.com/api/art/downloads/<wheel>. Current remote payload is reported non-malicious at analysis time, but the delivery design is live and the operator can swap the hosted content at will. Add egress blocks: login.fromthehotel.com apex + /muse + /api/poems/code + /api/art/downloads/* paths. For LLM-agent-threat defence more generally: coding assistants and agents that install Python packages mid-session should treat any packages hosted-instructions function with the same suspicion as a prompt from an unexpected source - the operators goal here is to turn the agent into a confused deputy that executes an attacker-provided wheel without the human seeing the fetch. This cluster is a warning signal for the growing LLM-prompt-injection-via-dependency attack class
8. 8NEW outbound denylist entries for CI / build-host egress proxies today: artifacts.creditslib.com apex + /npm/* paths (Cluster C @flexmr dep-confusion wave 2), login.fromthehotel.com apex + /muse + /api/poems/code + /api/art/downloads/* paths (Cluster G fromthehotel-poems LLM-threat). Report the Telegram-bot token in MAL-2026-17900 to Telegram abuse (Cluster F marocolor). Keep prior egress blocks in place: realwbx.com apex + /ip.php + /ip paths (2026-10-15), googleforum.pythonanywhere.com exact subdomain (2026-10-11), space-z.ai apex + preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai + b196q82k8891-d.space-z.ai subdomains (2026-10-14), dxpoc.gt.tc apex (2026-10-09), raw.githubusercontent.com/anonrider404/pypl/* path (2026-10-16), api-bsx.pages.dev apex + /download path (2026-10-16), 177.7.60.239:48080 + oob.recon.dev (2026-10-16), uncoder.eu.org apex + /cc-checker/api.php path (2026-10-15), accenture-npm.azurewebsites.net, limbomail.com apex + github.com/lunexindonesia/node-net-pool + github.com/trktgq0wbre1/node-net-pool, github.com/unicodeces/font-atlas, collector.oob.s4yhii.com + *.oob.s4yhii.com + s4yhii.com apex, 64.181.165.115/dc, 167.88.172.33:8087 + jsonspack.com, goxtools.shop apex, minhdong.site apex + GitHub user VangBanLaNhat, 45.138.12.177:8089, 185.158.107.175:8787, ltidi.storage.googleapis.com/depenconf/, oob.s4yhii.com:9999/native, *.oast.pro/*.oast.me/*.oast.fun/*.oast.site/*.oastify.com, frjmzbjbhwvtdnsuodmu.supabase.co, api.npoint.io apex, tele.metry.orgin.net, morroncr0w.io, api.telegram.org on untrusted CI/build hosts, appsecc.com, webhook.site/*, nfjbill.ren, storage.googleapis.com/depenconf/, 10.0.19.0/24 + 10.0.49.0/24, api.nm-streetwear.space, Discord webhook URL pattern, ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, chinazhangsan.ccwu.cc, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil patterns, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com, 45.138.0.0/16 RubyGems wgkit CIDRs

Sources

• GitHub Advisory Database - recent malware advisoriesgithub.comGitHub
• GHSA-hhr5-rjw6-9hr5 - npm itsa-react-maskedinput@16.1.2 (Cluster A - legacy itsasbreuk maintainer-account compromise, malicious tarball live 2025-05-04 21:28 UTC until maintainer republish 16.1.3 on 2025-05-05 11:13 UTC, GHSA-indexed 2026-10-16)github.comGitHub
• GHSA-8c34-p746-v5rq - npm itsa-react-focuscontainer@16.0.10 (Cluster A - same itsasbreuk maintainer compromise, malicious tarball live 2025-05-04 21:44 UTC until maintainer republish 16.0.11 on 2025-05-05 10:59 UTC)github.comGitHub
• npm registry page for itsa-react-maskedinput (latest 16.1.3, maintainer itsasbreuk / Marco Asbreuk, 100+ releases dating to 2017)npmjs.comnpm
• npm registry page for itsa-react-focuscontainer (latest 16.0.11, same maintainer itsasbreuk)npmjs.comnpm
• GHSA-gp7c-v9m4-rx6c - npm buyerdashboard@45.3.4 (Cluster B - conx3993 operator wave 2, realwbx.com preinstall beacon, Authorization 8eb5e864..., MAL-2026-17893)github.comGitHub
• GHSA-g99r-gv24-gqpp - npm web-pixels-manager@76.2.4 (Cluster B - conx3993 wave 2, lookalike of real Shopify-published web-pixels-manager, Authorization 207e4133..., MAL-2026-17895)github.comGitHub
• GHSA-q29m-w8xx-cvvg - npm xapi-lib (88.2.3, 88.2.5, 90.2.1, 90.3.1) (Cluster B - conx3993 wave 2, Authorization fa79878b..., MAL-2026-17896)github.comGitHub
• GHSA-xvmh-mc7p-r5vj - npm idlive-face-capture-web-development@78.8.1 (Cluster B - conx3993 wave 2, Authorization a3b620ea..., MAL-2026-17894)github.comGitHub
• GHSA-3h5x-5663-jx9x - npm @flexmr/survey-conversation (Cluster C - @flexmr dep-confusion wave 2, bare-URL dep cache-format-syntax-tracer served from artifacts.creditslib.com, five-version ladder 1.0.0/1.0.12/2.0.12/3.0.12/10.0.12, MAL-2026-17899)github.comGitHub
• OSSF malicious-packages MAL-2026-17899 raw record (@flexmr/survey-conversation IOCs: artifacts.creditslib.com, bare-URL dep cache-format-syntax-tracer, Amazon Inspector source hash 20ab57dd...)raw.githubusercontent.comOpenSSF
• GHSA-w9wx-pxhr-p9g4 - npm @flexmr/survey-client (Cluster C - @flexmr dep-confusion wave 2, bare-URL dep marker-index-symbol-schema served from artifacts.creditslib.com, same five-version ladder, MAL-2026-17898)github.comGitHub
• OSSF malicious-packages MAL-2026-17898 raw record (@flexmr/survey-client IOCs: artifacts.creditslib.com, bare-URL dep marker-index-symbol-schema)raw.githubusercontent.comOpenSSF
• GHSA-9rjq-6mhc-46c5 - npm @beloved-lenora/opencode-todo (Cluster D - 7-package AI-coding-tool-lure wave, CWE-506 boilerplate)github.comGitHub
• GHSA-8c9g-fwgq-rqq5 - npm @beloved-lenora/opencode-shared-rpc (Cluster D - same wave, CWE-506 boilerplate)github.comGitHub
• GHSA-f4h2-68pg-ffhj - npm @beloved-lenora/opencode-stats (Cluster D - same wave, CWE-506 boilerplate)github.comGitHub
• GHSA-7wq2-8pc2-wm26 - npm @beloved-lenora/opencode-orchestrator (Cluster D - same wave, CWE-506 boilerplate)github.comGitHub
• GHSA-pm76-w63j-7j29 - npm @beloved-lenora/opencode-shell-guard (Cluster D - same wave, CWE-506 boilerplate)github.comGitHub
• GHSA-c78h-wwhq-g6j8 - npm @beloved-lenora/opencode-goal (Cluster D - same wave, CWE-506 boilerplate)github.comGitHub
• GHSA-xv54-6gmc-3xph - npm @beloved-lenora/opencode-btw (Cluster D - same wave, CWE-506 boilerplate)github.comGitHub
• GHSA-cgq9-cff6-pf33 - npm @xatancchii/natabaileys (Cluster E - Baileys lure wave 5 continuation under new @xatancchii scope, CWE-506 boilerplate)github.comGitHub
• GHSA-rg3c-8x72-6pmc - npm parxleys (Cluster E - residual CWE-506 takedown, Baileys-wave timing)github.comGitHub
• GHSA-m6jr-rmfr-29w4 - pypi marocolor@1.0.0 (Cluster F - Telegram-bot infostealer + resource-exhaustion DoS, campaign 2026-10-marocolor, kam193 reporter, MAL-2026-17900)github.comGitHub
• OSSF malicious-packages MAL-2026-17900 raw record (marocolor IOCs: Telegram-bot token, files-exfiltration + uses-telegram-bot + destructive-actions reasons, OSSF commit 38b0fa2e...)raw.githubusercontent.comOpenSSF
• kam193 bad-packages entry for marocolor (reporter`s own detail page)bad-packages.kam193.eu
• GHSA-q5q7-gj32-mwhh - pypi fromthehotel-poems@0.1.0 (Cluster G - novel LLM-agent-threat via hidden-in-lib-usage remote code execution, campaign 2026-10-fromthehotel-poems, kam193 reporter, MAL-2026-17897)github.comGitHub
• OSSF malicious-packages MAL-2026-17897 raw record (fromthehotel-poems IOCs: login.fromthehotel.com, /muse + /api/poems/code + /api/art/downloads/* paths, llm-threat + action-hidden-in-lib-usage reasons, source hash bf72dad3...)raw.githubusercontent.comOpenSSF
• kam193 bad-packages entry for fromthehotel-poemsbad-packages.kam193.eu
• DependencyWatch: multi-2026-10-16-ghsa-malware-sweep (yesterday`s context - agentaix wave 2 py-worm/py-wormgpt/py-sock2, Wix dep-confusion wave 3 util-foriepft, seapy-ops, getpubip, proxyrubika, @flexmr wave 1, tailwindcss-form, Baileys wave 4)dependencywatch.io
• DependencyWatch: multi-2026-10-15-ghsa-malware-sweep (prior-day context - conx3993 realwbx.com wave 1 of 5 packages, babel-polyfill-plugin-corejs2 + eth-react-provider typosquats, saeka PyPI credit-card checker)dependencywatch.io
• DependencyWatch: npm-2026-10-08-tensorlake-maintainer-compromise (updated today with maintainer-recovery timeline, 0.5.145 through 0.5.151 all clean, no wave-2 malicious republish)dependencywatch.io
• DependencyWatch: npm-2026-10-12-hridoy-ultimate-fb-credential-stealer (bare-URL dep pattern precedent for today`s Cluster C @flexmr wave 2 technique)dependencywatch.io