# GitHub Advisory malware sweep, 17 October 2026

> GHSA 2026-10-16/17 batch (19 advisories). Legacy `itsa-react-*` maintainer compromise finally indexed. `conx3993` operator wave 2 adds 4 `realwbx.com` beacon packages. `@flexmr` dep-confusion wave 2 pivots to `artifacts.creditslib.com` bare-URL deps. 7-package `@beloved-lenora/opencode-*` AI-coding-tool lure. PyPI `marocolor` Telegram-bot stealer + `fromthehotel-poems` LLM-threat.

- Published: 2026-10-17
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 19 packages, 30 compromised versions
- Tags: dependency-confusion, typosquat, maintainer-takeover, infostealer, credential-theft, prompt-injection
- Also known as: 2026-10-17 GHSA sweep, itsa-react-* legacy maintainer compromise (May 2025 backfill), conx3993 operator wave 2, @flexmr dep-confusion operator wave 2 (artifacts.creditslib.com), @beloved-lenora opencode AI-coding-tool lure wave, Baileys lure operator wave 5, 2026-10-marocolor campaign, 2026-10-fromthehotel-poems campaign
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, kam193/bad-packages, Amazon Inspector, InvisiRisk, npm security, PyPI security
- Incident ID: multi-2026-10-17-ghsa-malware-sweep

## Affected packages (19)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@beloved-lenora/opencode-btw](https://dependencywatch.io/package/npm/@beloved-lenora/opencode-btw) | npm | 0.0.0 |
| [@beloved-lenora/opencode-goal](https://dependencywatch.io/package/npm/@beloved-lenora/opencode-goal) | npm | 0.0.0 |
| [@beloved-lenora/opencode-orchestrator](https://dependencywatch.io/package/npm/@beloved-lenora/opencode-orchestrator) | npm | 0.0.0 |
| [@beloved-lenora/opencode-shared-rpc](https://dependencywatch.io/package/npm/@beloved-lenora/opencode-shared-rpc) | npm | 0.0.0 |
| [@beloved-lenora/opencode-shell-guard](https://dependencywatch.io/package/npm/@beloved-lenora/opencode-shell-guard) | npm | 0.0.0 |
| [@beloved-lenora/opencode-stats](https://dependencywatch.io/package/npm/@beloved-lenora/opencode-stats) | npm | 0.0.0 |
| [@beloved-lenora/opencode-todo](https://dependencywatch.io/package/npm/@beloved-lenora/opencode-todo) | npm | 0.0.0 |
| [@flexmr/survey-client](https://dependencywatch.io/package/npm/@flexmr/survey-client) | npm | 1.0.0, 1.0.12, 2.0.12, 3.0.12, 10.0.12 |
| [@flexmr/survey-conversation](https://dependencywatch.io/package/npm/@flexmr/survey-conversation) | npm | 1.0.0, 1.0.12, 2.0.12, 3.0.12, 10.0.12 |
| [@xatancchii/natabaileys](https://dependencywatch.io/package/npm/@xatancchii/natabaileys) | npm | 0.0.0 |
| [buyerdashboard](https://dependencywatch.io/package/npm/buyerdashboard) | npm | 45.3.4 |
| [fromthehotel-poems](https://dependencywatch.io/package/pypi/fromthehotel-poems) | PyPI | 0.1.0 |
| [idlive-face-capture-web-development](https://dependencywatch.io/package/npm/idlive-face-capture-web-development) | npm | 78.8.1 |
| [itsa-react-focuscontainer](https://dependencywatch.io/package/npm/itsa-react-focuscontainer) | npm | 16.0.10 |
| [itsa-react-maskedinput](https://dependencywatch.io/package/npm/itsa-react-maskedinput) | npm | 16.1.2 |
| [marocolor](https://dependencywatch.io/package/pypi/marocolor) | PyPI | 1.0.0 |
| [parxleys](https://dependencywatch.io/package/npm/parxleys) | npm | 0.0.0 |
| [web-pixels-manager](https://dependencywatch.io/package/npm/web-pixels-manager) | npm | 76.2.4 |
| [xapi-lib](https://dependencywatch.io/package/npm/xapi-lib) | npm | 88.2.3, 88.2.5, 90.2.1, 90.3.1 |

## What happened

Between 2026-10-16 06:00 UTC (yesterday`s sweep cutoff) and 2026-10-17 06:00 UTC (today`s ingest-window start), the GitHub Advisory Database and OpenSSF `malicious-packages` published 19 fresh malware advisories not already in yesterday`s sweep: 17 npm and 2 PyPI. Today`s material continues several week-running operators (`conx3993`, `@flexmr`, Baileys lure) and surfaces one legacy maintainer-compromise backfill (`itsa-react-*`) alongside one new AI-coding-tool-lure operator (`@beloved-lenora/opencode-*`) and two single-package PyPI threats from kam193 (`marocolor` + `fromthehotel-poems`).

## Headlines

**Legacy `itsa-react-*` maintainer compromise, finally indexed** (Cluster A): GHSA ingested two advisories on 2026-10-16 for a May 2025 maintainer-account compromise of the `itsasbreuk` (Marco Asbreuk) npm account - `itsa-react-maskedinput@16.1.2` (malicious, 2025-05-04T21:28 UTC) and `itsa-react-focuscontainer@16.0.10` (malicious, 2025-05-04T21:44 UTC). Both are 8-year-old React component libraries with 100+ releases each, and both show the canonical patch-above-latest fingerprint of a maintainer-account compromise. The maintainer republished clean `16.1.3` and `16.0.11` within 15 hours. Current `latest` on both packages is the clean maintainer release. This is a 2026-10 GHSA backfill of a 2025-05 compromise, not a fresh takeover; current reach is limited to teams whose old lockfiles pin the malicious versions exactly.

**`conx3993` operator wave 2** (Cluster B): 4 new `realwbx.com` preinstall-beacon packages (`buyerdashboard`, `web-pixels-manager@76.2.4` lookalike of the real Shopify package, `xapi-lib`, `idlive-face-capture-web-development@78.8.1`) continue the 2026-10-15 Cluster A 5-package wave. Same npm account, same C2 apex, same per-package Authorization scheme. Operator totals 9 packages across the Sep 30 - Oct 15 2026 window.

**`@flexmr/*` dep-confusion wave 2** (Cluster C): `@flexmr/survey-conversation` + `@flexmr/survey-client` extend yesterday`s Cluster F into a new C2 (`artifacts.creditslib.com`) and a new technique (bare-URL dependency instead of `99.99.99` sentinel beacon). The reused five-version ladder `1.0.0, 1.0.12, 2.0.12, 3.0.12, 10.0.12` is the operator fingerprint.

## Confirmed-payload carve-outs within the sweep

- **Cluster F** `marocolor` (PyPI, 1.0.0) - home-directory file exfiltration via Telegram-bot C2 + resource-exhaustion DoS on import. Reporter `kam193`. The combination of two independent payload classes in a single package is unusual and worth highlighting.
- **Cluster G** `fromthehotel-poems` (PyPI, 0.1.0) - novel LLM-agent-threat: library function hides remote code execution designed to steer an LLM coding agent into fetching and executing a self-hosted wheel from `login.fromthehotel.com`. Current remote content is non-malicious at analysis time but the delivery design is live. This cluster is the significant find of the sweep as a signal that LLM-prompt-injection-via-dependency is a growing operator class.

## Lures and typosquats

**Cluster D** 7-package `@beloved-lenora/opencode-*` AI-coding-tool lure - targets the opencode (sst.dev) plugin ecosystem under a parallel scope. **Cluster E** Baileys-lure wave 5 (`@xatancchii/natabaileys` + residual `parxleys`) - continues the operator lineage from yesterday`s Cluster H wave 4 under a new scope.

## Classification

`sweep`. Severity `high` taken as a whole, driven by Cluster A (confirmed hijack of a legitimate 8-year-old scope, even though the compromise is now 1.5 years dormant and the maintainer-recovery version has been `latest` for the same period). Clusters B through G are `medium` on their own and do not raise overall sweep severity above `high`. No cluster today would independently merit `critical` - Cluster A`s current reach is limited to teams whose old lockfiles pin the exact malicious versions, and the other clusters are first-publish lures or probes without confirmed worm propagation.

## Discovery

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `kam193/bad-packages` (both PyPI records), `Amazon Inspector` (Clusters B and C), `InvisiRisk, Inc.` (Cluster B contributions), `npm security` (Clusters A, D, E takedowns), `PyPI security`.

## Impact

- **Cluster A - npm `itsa-react-*` legacy maintainer-account compromise, GHSA-indexed 2026-10-16 (compromise, confirmed hijacked legitimate scope by `itsasbreuk` / Marco Asbreuk; CWE-506 boilerplate takedowns on both advisories; malicious versions have been dormant on the registry since 2025-05 and maintainer-recovery releases followed within 15 hours - this is a 2026-10-16 GHSA backfill of a May 2025 compromise, not a fresh takeover)**: `itsa-react-maskedinput@16.1.2` (GHSA-hhr5-rjw6-9hr5, published to npm 2025-05-04T21:28:00 UTC; superseded by legitimate `16.1.3` on 2025-05-05T11:13:59 UTC - a ~14-hour exposure window and the current `latest`) and `itsa-react-focuscontainer@16.0.10` (GHSA-8c34-p746-v5rq, published to npm 2025-05-04T21:44:15 UTC; superseded by legitimate `16.0.11` on 2025-05-05T10:59:47 UTC - a ~13-hour exposure window and the current `latest`). The `itsa-react-*` family is an 8-year-old legitimate React component library (`itsa-react-maskedinput` has 100+ releases dating back to 0.0.1 in 2017; `itsa-react-focuscontainer` similarly dates to 2017 under the same npm account `itsasbreuk`, email `marco@itsasbreuk.nl`). The malicious patch-above-latest pattern (`16.1.2` sat between legitimate `16.1.1` 2018 and the recovery `16.1.3` of 2025-05-05; `16.0.10` sat between `16.0.9` 2023 and `16.0.11` 2025-05-05) is the canonical fingerprint of a maintainer-account or publish-credential compromise. The registry `modified` timestamp on both packages jumped to 2026-10-16T23:28-29 UTC - the day GHSA ingested the records. Severity `high` for this cluster (confirmed hijack of a legitimate long-standing scope; CWE-506 means malicious payload is confirmed present on the pulled tarballs but no vendor runtime analysis has been published; the ~14-hour live window and the fact that current `latest` is a clean maintainer republish mean active exposure for anyone pinned to the malicious versions in old lockfiles only - no new reach)
- **Cluster B - npm `conx3993` operator wave 2: 4 `realwbx.com` preinstall-beacon packages (dependency-confusion / typosquat lures, confirmed install-time HTTP beacon with hardcoded Authorization per package, same account as 2026-10-15 Cluster A, operator totals 9 packages across the Sep 30 - Oct 15 2026 window)**: `buyerdashboard@45.3.4` (GHSA-gp7c-v9m4-rx6c, MAL-2026-17893, Authorization `8eb5e8641a5795b022d68e14d8858415`), `web-pixels-manager@76.2.4` (GHSA-g99r-gv24-gqpp, MAL-2026-17895, Authorization `207e4133bd083b9e3e89c5556fc8677e` - shadows the real `web-pixels-manager` Shopify-published npm package), `xapi-lib` (88.2.3, 88.2.5, 90.2.1, 90.3.1; GHSA-q29m-w8xx-cvvg, MAL-2026-17896, Authorization `fa79878bc2cfb48bd5127ae26fb661b1`), `idlive-face-capture-web-development@78.8.1` (GHSA-xvmh-mc7p-r5vj, MAL-2026-17894, Authorization `a3b620ea8719eae2fa9b62726364bcc9`). All four were published 2026-10-15 by npm account `conx3993` and taken down 2026-10-16 after GHSA ingestion. Each ships a `preinstall` hook that runs `node index.js` and POSTs host identity to `https://realwbx.com/ip.php?ip=8.8.8.8` under a per-package hardcoded `Authorization` header (same scheme as the 2026-10-15 Cluster A `@mntv-analysis/*` + `@user-interface-common/*` + `monkey-tags-ip` 5-package wave, same C2 apex `realwbx.com`, same `/ip.php` + `/ip` path family). The yesterday 2026-10-16 sweep marked this operator "quiet"; today`s publish-list proves wave 2 landed before yesterday`s GHSA ingest cutoff but surfaced in the advisory feed after it. Severity `medium` for this cluster (dep-confusion / typosquat probe-tier - confirmed install-time HTTP beacon and host identity leak, but no credential-stealing payload confirmed; the per-package Authorization header suggests the operator is correlating install-telemetry with victim identity for later targeted follow-up)
- **Cluster C - npm `@flexmr/*` dep-confusion operator wave 2: `@flexmr/survey-conversation` + `@flexmr/survey-client` (dependency-confusion, confirmed install-time arbitrary code execution via bare-URL dependency to `artifacts.creditslib.com`; operator pivot from yesterday`s Cluster F `99.99.99` sentinel + `oob.recon.dev` DNS canary to a new `artifacts.creditslib.com` stage-2 host and a bare-URL-dep technique that fully delegates installed code to the attacker server)**: `@flexmr/survey-conversation` (1.0.0, 1.0.12, 2.0.12, 3.0.12, 10.0.12; GHSA-3h5x-5663-jx9x, MAL-2026-17899, bare-URL dep `cache-format-syntax-tracer` served from `https://artifacts.creditslib.com/npm/cache-format-syntax-tracer`) and `@flexmr/survey-client` (1.0.0, 1.0.12, 2.0.12, 3.0.12, 10.0.12; GHSA-w9wx-pxhr-p9g4, MAL-2026-17898, bare-URL dep `marker-index-symbol-schema` served from `https://artifacts.creditslib.com/npm/marker-index-symbol-schema`). Both packages ship a one-line `index.js` that re-exports the bare-URL dependency; `npm install` fetches whatever `artifacts.creditslib.com` is currently serving under that path and runs its lifecycle scripts (same pattern as [2026-10-12 hridoy-ultimate](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer) where `fca-unofficial` was pinned to a bare GitHub repo). Install integrity hashes do not protect against this because the resolver pins to the URL, not the tree. Both show placeholder metadata (`author: "Package Registry"`, `description: "Generated package"`, `repository: github.com/example/`) consistent with a scripted dep-confusion generator. The reused five-version ladder `1.0.0, 1.0.12, 2.0.12, 3.0.12, 10.0.12` is the operator fingerprint - the operator probes which internal `@flexmr/*` version an internal registry resolves at and matches it. Severity `medium` for this cluster (confirmed install-time arbitrary code execution via bare-URL dep but payload is fully under attacker server control at install time - no fixed payload hash can be IOC-matched; dep-confusion probe tier against FlexMR, a UK market-research platform, so dev-fleet exposure outside FlexMR and its vendors is low)
- **Cluster D - npm `@beloved-lenora/opencode-*` 7-package AI-coding-tool lure wave (malicious-package / typosquat targeting the `opencode` AI coding agent ecosystem - sst.dev`s opencode uses the `@opencode-ai/*` scope; `@beloved-lenora/opencode-*` is a parallel-scope impersonation of plausible-sounding plugin names; CWE-506 boilerplate takedowns on all 7 advisories; versions 1.0.0 through 1.0.3 were published and npm security replaced them with `0.0.1-security` holding packages; no runtime analysis published)**: `@beloved-lenora/opencode-todo` (GHSA-9rjq-6mhc-46c5), `@beloved-lenora/opencode-shared-rpc` (GHSA-8c9g-fwgq-rqq5), `@beloved-lenora/opencode-stats` (GHSA-f4h2-68pg-ffhj), `@beloved-lenora/opencode-orchestrator` (GHSA-7wq2-8pc2-wm26), `@beloved-lenora/opencode-shell-guard` (GHSA-pm76-w63j-7j29), `@beloved-lenora/opencode-goal` (GHSA-c78h-wwhq-g6j8), `@beloved-lenora/opencode-btw` (GHSA-xv54-6gmc-3xph). All seven published to the same new scope `@beloved-lenora` in a single coordinated drop and all taken down together. The naming (`todo`, `shared-rpc`, `stats`, `orchestrator`, `shell-guard`, `goal`, `btw`) targets the plausible shape of opencode plugin / helper modules a developer or an LLM agent might reach for. Severity `medium` for this cluster (coordinated 7-package publish under a brand-impersonation scope, CWE-506 means malicious payload is confirmed present on the pulled tarballs but no vendor runtime analysis has been published; AI-coding-tool lures are a growing operator category - the 2026-10-15 agentaix wave (`py-worm`+`py-wormgpt`+`py-sock2`) and today`s Cluster G `fromthehotel-poems` LLM-threat are peers)
- **Cluster E - npm Baileys-lure operator wave 5 continuation + residual CWE-506 (malicious-package; `@xatancchii/natabaileys` directly extends the 7-package wave 4 of yesterday`s Cluster H under a new `@xatancchii` scope; `parxleys` is a residual CWE-506 takedown with no explicit Baileys string but the timing + boilerplate pattern suggest the same operator or a very similar one)**: `@xatancchii/natabaileys` (all versions; GHSA-cgq9-cff6-pf33) and `parxleys` (all versions; GHSA-rg3c-8x72-6pmc). Both CWE-506 boilerplate with no published IOCs. The `@xatancchii` scope is new; the `natabaileys` slug follows the Baileys-brand-impersonation signature (same as yesterday`s `xmd-baileys`, `@developmentyora/baileyss`, `@celestial-community/baileys`, prior waves `@fer2809fl/baileys`, `arsya-baileys`, `my-baileys`). Severity `medium` for this cluster (install-time code execution risk per CWE-506 pattern, no vendor runtime analysis published; the Baileys operator`s week-running wave count and consistent naming lineage are the operator continuity signal)
- **Cluster F - PyPI `marocolor` single-package infostealer + DoS (malicious-package, confirmed `files-exfiltration` + `uses-telegram-bot` + `destructive-actions` OSSF reasons; home-directory scrape of secret-pattern files + resource-exhaustion DoS on import; kam193 reporter)**: `marocolor@1.0.0` (GHSA-m6jr-rmfr-29w4, MAL-2026-17900, campaign `2026-10-marocolor`, reporter `kam193`). On import, the package scans `$HOME` for files matching document / image / secret extensions (`.env`, `.key`, `.sql` and similar) and uploads them to a Telegram-bot endpoint; a second import-time thread spawns threads unbounded to exhaust the host. The combination of file exfiltration + Telegram-bot C2 + destructive-action denial-of-service in a single package is unusual - typical kam193-reported PyPI malware ships one payload class at a time. The package name `marocolor` carries no obvious brand-impersonation shape, suggesting a lure name chosen for a specific victim rather than a mass-reach typosquat. OSSF commit `38b0fa2ee77af46ad9daf78c024a0f599fd0798eef7605cb3eed50d8db65fa22` and reporter-maintained page `https://bad-packages.kam193.eu/pypi/package/marocolor` are the entry points for the specific Telegram-bot token and file-match patterns. Severity `medium` for this cluster (confirmed functional file-exfiltration payload with Telegram-bot C2 + confirmed destructive-action DoS; single package with a specific-target lure name means dev-fleet reach is low but any installer host should be presumed exfiltrated)
- **Cluster G - PyPI `fromthehotel-poems` single-package LLM-agent-threat (malicious-package, confirmed `llm-threat` + `action-hidden-in-lib-usage` OSSF reasons; one function hides remote code execution designed to steer an LLM coding agent into fetching and executing a self-hosted wheel from a freshly registered domain; kam193 reporter notes remote payload non-malicious at analysis time but the design is clearly an LLM-threat prototype)**: `fromthehotel-poems@0.1.0` (GHSA-q5q7-gj32-mwhh, MAL-2026-17897, campaign `2026-10-fromthehotel-poems`, reporter `kam193`). The package provides a function that fetches instructions from `https://login.fromthehotel.com/muse`, which read as prompt-injection targeting an LLM agent (telling the agent to download a self-hosted wheel from `https://login.fromthehotel.com/api/art/downloads/<wheel>` and run it) and separately exposes a `/api/poems/code` endpoint that returns executable Python code hidden inside what reads as poetry. The current remote content is reported as non-malicious at analysis time, but the delivery design (library function that fetches instructions, prompt-injected agent coercion, wheel download URL already live) is a working framework for turning any LLM coding assistant that installs the package into a confused deputy. Source hash `bf72dad3e2f32ee2e66a3a5ee5642b4a20a9fb9458fcd677f6250b1e4b805906`. Severity `medium` for this cluster (confirmed novel LLM-threat primitive and working infrastructure, but current remote payload is non-malicious so no confirmed exploitation yet; the attack class is the significant find - LLM-agent prompt-injection via package-shipped library function is a growing operator category that this record flags for future tracking)
- **Operator continuity**: this sweep extends several week-running operators. **`conx3993` operator** returns from "quiet since 2026-10-15" (yesterday`s sweep marked it so) with wave 2 under 4 new slugs; same npm account, same `realwbx.com` C2 apex, same per-package Authorization scheme. **`@flexmr` dep-confusion operator** continues from yesterday`s Cluster F with a technique pivot: bare-URL deps to a new `artifacts.creditslib.com` host instead of a `99.99.99` sentinel beacon. **Baileys-lure operator** continues from yesterday`s Cluster H with 1 new slug (`@xatancchii/natabaileys`) and possibly `parxleys`. **`kam193` remains top PyPI reporter** - today reports both PyPI advisories (`marocolor`, `fromthehotel-poems`). **New disclosed attacker-controlled hosts today**: `artifacts.creditslib.com` apex + `/npm/cache-format-syntax-tracer` + `/npm/marker-index-symbol-schema` paths (Cluster C), `login.fromthehotel.com` apex + `/muse` + `/api/poems/code` + `/api/art/downloads/*` paths (Cluster G). **New operator lineage**: `@beloved-lenora` AI-coding-tool-lure scope (Cluster D) is a new seven-package operator targeting the opencode ecosystem; watch for a wave 2 under additional `opencode-*` or `claude-code-*` or similar AI-coding-tool-brand-impersonation scopes. **New attacker npm scope** `@xatancchii` (Cluster E) added to the Baileys-operator`s scope rotation. **No new activity** from: yesterday`s `agentaix` operator wave 2 (`py-worm`+`py-wormgpt`+`py-sock2` quiet; `anonrider404/pypl` GitHub repo and `googleforum.pythonanywhere.com` C2 unchanged), Wix dep-confusion wave 3 (`util-foriepft` quiet; `dxpoc.gt.tc` unchanged), `seapy-ops` operator (`space-z.ai` quiet), `getpubip` operator (`api-bsx.pages.dev` quiet), `proxyrubika` operator, `tailwindcss-form`/`-uniform` typosquat operator. [TensorLake AI maintainer compromise (2026-10-08 carve-out)](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise) confirmed-recovered: maintainer`s own clean releases `0.5.145` through `0.5.151` have shipped, no wave-2 malicious republish, record updated today with the recovery timeline

## What to do

1. **For Cluster A (`itsa-react-maskedinput@16.1.2` + `itsa-react-focuscontainer@16.0.10` - legacy maintainer compromise)**: grep every `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `bun.lock` for the exact strings `itsa-react-maskedinput` + `16.1.2` and `itsa-react-focuscontainer` + `16.0.10`. On ANY hit (likely only in old lockfiles that have not been refreshed since May 2025): bump to the clean maintainer republish `itsa-react-maskedinput@16.1.3` and `itsa-react-focuscontainer@16.0.11` or later, with exact-version pins; rebuild lockfiles and run `npm ci` / `pnpm install --frozen-lockfile` to evict the compromised tarballs. The CWE-506 boilerplate advisory means the specific payload is undocumented - treat any installer host that ran the malicious tarball between 2025-05-04 and 2025-05-05 as potentially credential-compromised during that window. Internal registry mirrors (Nexus, Artifactory, Verdaccio) that cached the `16.1.2` / `16.0.10` tarballs between May 2025 and today should flush them. Note: this cluster is low current risk because the maintainer republish has sat at `latest` for 1.5 years and most consumers with floating `^16.1` or `~16.1` constraints resolved past the malicious versions long ago; the entries are indexed primarily to warn teams whose old pinned lockfiles still carry the exact malicious versions. If your org uses the `@itsasbreuk` scope or publishes under similar single-maintainer scopes, this is a reminder to migrate publishing off long-lived npm tokens to npm OIDC trusted publishing and to enable mandatory 2FA on every maintainer account
2. **For Cluster B (`conx3993` operator wave 2 - 4 npm packages with `realwbx.com` beacon)**: grep every `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml` for `buyerdashboard`, `web-pixels-manager@76.2.4` (not the real Shopify-published `web-pixels-manager` - this is the lookalike at version 76.2.4 only), `xapi-lib` (any of 88.2.3, 88.2.5, 90.2.1, 90.3.1), `idlive-face-capture-web-development@78.8.1`. On hit: the `preinstall` hook has run `node index.js` and POSTed host identity to `realwbx.com/ip.php?ip=8.8.8.8`. Treat the installing host as recon-tier compromised; no credential-stealing payload confirmed, but the per-package Authorization token means the operator can correlate the installing host`s outbound beacon with the specific lure package. Rotate any secret that was in the `preinstall` process`s environment. Keep egress blocks on `realwbx.com` apex + `/ip.php` + `/ip` paths (already in the standing denylist from the 2026-10-15 sweep - do not remove). If your org publishes under `@mntv-analysis`, `@user-interface-common`, or any of the plausible internal names the operator shadows, scope-lock the internal registry and hold the public slugs with placeholder packages. Report npm account `conx3993` for the full 9-package publish set across Sep 30 - Oct 15 2026 as the same operator`s complete wave
3. **For Cluster C (`@flexmr/*` dep-confusion wave 2 - `@flexmr/survey-conversation` + `@flexmr/survey-client`)**: grep every `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml` for `@flexmr/survey-conversation` or `@flexmr/survey-client` (any of versions 1.0.0, 1.0.12, 2.0.12, 3.0.12, 10.0.12). On hit: the bare-URL dependency has fetched whatever `artifacts.creditslib.com/npm/cache-format-syntax-tracer` or `/marker-index-symbol-schema` was serving at install time, and lifecycle scripts have run. The payload is attacker-server-controlled so there is no fixed SHA to match - treat the installing host as fully compromised and rotate every credential reachable from the Node runtime (API tokens, SSH / GPG keys, cloud SDK creds, env-exported secrets). Add egress blocks: `artifacts.creditslib.com` apex + `/npm/*` paths (new today). Keep yesterday`s standing blocks on `177.7.60.239:48080` and `oob.recon.dev` (yesterday`s @flexmr Cluster F). CI gates: reject any `package.json` whose dependency spec is a bare URL to an arbitrary host (not just the usual bare-GitHub-repo check); the lockfile integrity field for a URL dep is a URL hash, not a tree hash, so `npm ci --frozen-lockfile` does not protect against the attacker swapping payload. If your org is FlexMR or uses `@flexmr/*` internally, scope-lock the internal registry and hold the public slugs with placeholders at a safe version
4. **For Cluster D (7-package `@beloved-lenora/opencode-*` AI-coding-tool lure wave)**: grep every `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml` for `@beloved-lenora/opencode-todo`, `@beloved-lenora/opencode-shared-rpc`, `@beloved-lenora/opencode-stats`, `@beloved-lenora/opencode-orchestrator`, `@beloved-lenora/opencode-shell-guard`, `@beloved-lenora/opencode-goal`, `@beloved-lenora/opencode-btw` (all all-versions, versions `1.0.0`-`1.0.3` were pulled and npm `0.0.1-security` placeholders remain). CWE-506 boilerplate advisory means the specific payload is undocumented; treat the installing host as credential-compromised until Socket or a vendor publishes a runtime analysis. Teach contributors (and any coding-agent that reads this record) that the real opencode scope is `@opencode-ai`; any `opencode`-named package under a different scope (`@beloved-lenora`, `@claude-code`, `@opencoding`, `@opencode-plugin`) is suspect by default. Watch for a wave 2 under additional `@beloved-lenora/*` or newly-created AI-coding-tool-brand-impersonation scopes
5. **For Cluster E (Baileys lure wave 5 - `@xatancchii/natabaileys` + `parxleys`)**: grep for `@xatancchii/natabaileys` and `parxleys` (both all-versions). CWE-506 boilerplate means the specific payload is undocumented; treat as credential-compromised until a vendor publishes a runtime analysis. The Baileys-operator`s week-running wave count means detection rules should match any npm package containing `baileys`, `bailey`, `xbails`, `libsignal-node`, or `whiskeysockets` substrings outside the real `@whiskeysockets` scope; also match on new scopes `@xatancchii/*` and `@beloved-lenora/*` (today`s AI-coding-tool-lure scope - no overlap confirmed with the Baileys operator but worth watching for scope-reuse)
6. **For Cluster F (`marocolor` PyPI Telegram-bot stealer + DoS)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, `conda env` for `marocolor@1.0.0`. On hit: assume home-directory files matching `.env`, `.key`, `.sql`, document, and image extensions have been scraped and uploaded to a Telegram-bot endpoint; also assume the import-time thread-spawn DoS has fired against the installer host. Rotate every credential in `$HOME` on the installing host (SSH keys, GPG keys, `.env` secrets, `.aws/credentials`, `.config/*/token`, `.ssh/*`, `.netrc`, cloud SDK caches). Preserve the host for forensic review before clean-rebuilding. Add egress blocks: `api.telegram.org` on CI / build hosts (already in the standing denylist from prior Telegram-bot stealer disclosures - keep it). Report the specific Telegram-bot token (listed in OSSF MAL-2026-17900 record) to Telegram abuse
7. **For Cluster G (`fromthehotel-poems` PyPI LLM-agent-threat)**: grep for `fromthehotel-poems@0.1.0`. On hit: assume the library function has been called by whatever LLM coding assistant or notebook the package was imported in, and the function has fetched instructions from `https://login.fromthehotel.com/muse` and possibly executed a wheel from `https://login.fromthehotel.com/api/art/downloads/<wheel>`. Current remote payload is reported non-malicious at analysis time, but the delivery design is live and the operator can swap the hosted content at will. Add egress blocks: `login.fromthehotel.com` apex + `/muse` + `/api/poems/code` + `/api/art/downloads/*` paths. For LLM-agent-threat defence more generally: coding assistants and agents that install Python packages mid-session should treat any package`s hosted-instructions function with the same suspicion as a prompt from an unexpected source - the operator`s goal here is to turn the agent into a confused deputy that executes an attacker-provided wheel without the human seeing the fetch. This cluster is a warning signal for the growing LLM-prompt-injection-via-dependency attack class
8. **NEW outbound denylist entries for CI / build-host egress proxies today**: `artifacts.creditslib.com` apex + `/npm/*` paths (Cluster C `@flexmr` dep-confusion wave 2), `login.fromthehotel.com` apex + `/muse` + `/api/poems/code` + `/api/art/downloads/*` paths (Cluster G `fromthehotel-poems` LLM-threat). Report the Telegram-bot token in MAL-2026-17900 to Telegram abuse (Cluster F `marocolor`). Keep prior egress blocks in place: `realwbx.com` apex + `/ip.php` + `/ip` paths (2026-10-15), `googleforum.pythonanywhere.com` exact subdomain (2026-10-11), `space-z.ai` apex + `preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai` + `b196q82k8891-d.space-z.ai` subdomains (2026-10-14), `dxpoc.gt.tc` apex (2026-10-09), `raw.githubusercontent.com/anonrider404/pypl/*` path (2026-10-16), `api-bsx.pages.dev` apex + `/download` path (2026-10-16), `177.7.60.239:48080` + `oob.recon.dev` (2026-10-16), `uncoder.eu.org` apex + `/cc-checker/api.php` path (2026-10-15), `accenture-npm.azurewebsites.net`, `limbomail.com` apex + `github.com/lunexindonesia/node-net-pool` + `github.com/trktgq0wbre1/node-net-pool`, `github.com/unicodeces/font-atlas`, `collector.oob.s4yhii.com` + `*.oob.s4yhii.com` + `s4yhii.com` apex, `64.181.165.115/dc`, `167.88.172.33:8087` + `jsonspack.com`, `goxtools.shop` apex, `minhdong.site` apex + GitHub user `VangBanLaNhat`, `45.138.12.177:8089`, `185.158.107.175:8787`, `ltidi.storage.googleapis.com/depenconf/`, `oob.s4yhii.com:9999/native`, `*.oast.pro`/`*.oast.me`/`*.oast.fun`/`*.oast.site`/`*.oastify.com`, `frjmzbjbhwvtdnsuodmu.supabase.co`, `api.npoint.io` apex, `tele.metry.orgin.net`, `morroncr0w.io`, `api.telegram.org` on untrusted CI/build hosts, `appsecc.com`, `webhook.site/*`, `nfjbill.ren`, `storage.googleapis.com/depenconf/`, `10.0.19.0/24` + `10.0.49.0/24`, `api.nm-streetwear.space`, Discord webhook URL pattern, `ipify.org` + `ifconfig.me`, `gitflic.ru`, `api.wagmiwallet.org`, `backend-cybersecuritydashboard.onrender.com`, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, `chinazhangsan.ccwu.cc`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `npm-canary.aveliscare.com`, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil patterns, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, `tuamaeaquelaursa.com`, `45.138.0.0/16` RubyGems wgkit CIDRs

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-hhr5-rjw6-9hr5 - npm itsa-react-maskedinput@16.1.2 (Cluster A - legacy itsasbreuk maintainer-account compromise, malicious tarball live 2025-05-04 21:28 UTC until maintainer republish 16.1.3 on 2025-05-05 11:13 UTC, GHSA-indexed 2026-10-16)](https://github.com/advisories/GHSA-hhr5-rjw6-9hr5) - GitHub
- [GHSA-8c34-p746-v5rq - npm itsa-react-focuscontainer@16.0.10 (Cluster A - same itsasbreuk maintainer compromise, malicious tarball live 2025-05-04 21:44 UTC until maintainer republish 16.0.11 on 2025-05-05 10:59 UTC)](https://github.com/advisories/GHSA-8c34-p746-v5rq) - GitHub
- [npm registry page for itsa-react-maskedinput (latest 16.1.3, maintainer itsasbreuk / Marco Asbreuk, 100+ releases dating to 2017)](https://www.npmjs.com/package/itsa-react-maskedinput) - npm
- [npm registry page for itsa-react-focuscontainer (latest 16.0.11, same maintainer itsasbreuk)](https://www.npmjs.com/package/itsa-react-focuscontainer) - npm
- [GHSA-gp7c-v9m4-rx6c - npm buyerdashboard@45.3.4 (Cluster B - conx3993 operator wave 2, realwbx.com preinstall beacon, Authorization 8eb5e864..., MAL-2026-17893)](https://github.com/advisories/GHSA-gp7c-v9m4-rx6c) - GitHub
- [GHSA-g99r-gv24-gqpp - npm web-pixels-manager@76.2.4 (Cluster B - conx3993 wave 2, lookalike of real Shopify-published web-pixels-manager, Authorization 207e4133..., MAL-2026-17895)](https://github.com/advisories/GHSA-g99r-gv24-gqpp) - GitHub
- [GHSA-q29m-w8xx-cvvg - npm xapi-lib (88.2.3, 88.2.5, 90.2.1, 90.3.1) (Cluster B - conx3993 wave 2, Authorization fa79878b..., MAL-2026-17896)](https://github.com/advisories/GHSA-q29m-w8xx-cvvg) - GitHub
- [GHSA-xvmh-mc7p-r5vj - npm idlive-face-capture-web-development@78.8.1 (Cluster B - conx3993 wave 2, Authorization a3b620ea..., MAL-2026-17894)](https://github.com/advisories/GHSA-xvmh-mc7p-r5vj) - GitHub
- [GHSA-3h5x-5663-jx9x - npm @flexmr/survey-conversation (Cluster C - @flexmr dep-confusion wave 2, bare-URL dep cache-format-syntax-tracer served from artifacts.creditslib.com, five-version ladder 1.0.0/1.0.12/2.0.12/3.0.12/10.0.12, MAL-2026-17899)](https://github.com/advisories/GHSA-3h5x-5663-jx9x) - GitHub
- [OSSF malicious-packages MAL-2026-17899 raw record (@flexmr/survey-conversation IOCs: artifacts.creditslib.com, bare-URL dep cache-format-syntax-tracer, Amazon Inspector source hash 20ab57dd...)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/npm/%40flexmr/survey-conversation/MAL-2026-17899.json) - OpenSSF
- [GHSA-w9wx-pxhr-p9g4 - npm @flexmr/survey-client (Cluster C - @flexmr dep-confusion wave 2, bare-URL dep marker-index-symbol-schema served from artifacts.creditslib.com, same five-version ladder, MAL-2026-17898)](https://github.com/advisories/GHSA-w9wx-pxhr-p9g4) - GitHub
- [OSSF malicious-packages MAL-2026-17898 raw record (@flexmr/survey-client IOCs: artifacts.creditslib.com, bare-URL dep marker-index-symbol-schema)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/npm/%40flexmr/survey-client/MAL-2026-17898.json) - OpenSSF
- [GHSA-9rjq-6mhc-46c5 - npm @beloved-lenora/opencode-todo (Cluster D - 7-package AI-coding-tool-lure wave, CWE-506 boilerplate)](https://github.com/advisories/GHSA-9rjq-6mhc-46c5) - GitHub
- [GHSA-8c9g-fwgq-rqq5 - npm @beloved-lenora/opencode-shared-rpc (Cluster D - same wave, CWE-506 boilerplate)](https://github.com/advisories/GHSA-8c9g-fwgq-rqq5) - GitHub
- [GHSA-f4h2-68pg-ffhj - npm @beloved-lenora/opencode-stats (Cluster D - same wave, CWE-506 boilerplate)](https://github.com/advisories/GHSA-f4h2-68pg-ffhj) - GitHub
- [GHSA-7wq2-8pc2-wm26 - npm @beloved-lenora/opencode-orchestrator (Cluster D - same wave, CWE-506 boilerplate)](https://github.com/advisories/GHSA-7wq2-8pc2-wm26) - GitHub
- [GHSA-pm76-w63j-7j29 - npm @beloved-lenora/opencode-shell-guard (Cluster D - same wave, CWE-506 boilerplate)](https://github.com/advisories/GHSA-pm76-w63j-7j29) - GitHub
- [GHSA-c78h-wwhq-g6j8 - npm @beloved-lenora/opencode-goal (Cluster D - same wave, CWE-506 boilerplate)](https://github.com/advisories/GHSA-c78h-wwhq-g6j8) - GitHub
- [GHSA-xv54-6gmc-3xph - npm @beloved-lenora/opencode-btw (Cluster D - same wave, CWE-506 boilerplate)](https://github.com/advisories/GHSA-xv54-6gmc-3xph) - GitHub
- [GHSA-cgq9-cff6-pf33 - npm @xatancchii/natabaileys (Cluster E - Baileys lure wave 5 continuation under new @xatancchii scope, CWE-506 boilerplate)](https://github.com/advisories/GHSA-cgq9-cff6-pf33) - GitHub
- [GHSA-rg3c-8x72-6pmc - npm parxleys (Cluster E - residual CWE-506 takedown, Baileys-wave timing)](https://github.com/advisories/GHSA-rg3c-8x72-6pmc) - GitHub
- [GHSA-m6jr-rmfr-29w4 - pypi marocolor@1.0.0 (Cluster F - Telegram-bot infostealer + resource-exhaustion DoS, campaign 2026-10-marocolor, kam193 reporter, MAL-2026-17900)](https://github.com/advisories/GHSA-m6jr-rmfr-29w4) - GitHub
- [OSSF malicious-packages MAL-2026-17900 raw record (marocolor IOCs: Telegram-bot token, files-exfiltration + uses-telegram-bot + destructive-actions reasons, OSSF commit 38b0fa2e...)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/pypi/marocolor/MAL-2026-17900.json) - OpenSSF
- [kam193 bad-packages entry for marocolor (reporter`s own detail page)](https://bad-packages.kam193.eu/pypi/package/marocolor)
- [GHSA-q5q7-gj32-mwhh - pypi fromthehotel-poems@0.1.0 (Cluster G - novel LLM-agent-threat via hidden-in-lib-usage remote code execution, campaign 2026-10-fromthehotel-poems, kam193 reporter, MAL-2026-17897)](https://github.com/advisories/GHSA-q5q7-gj32-mwhh) - GitHub
- [OSSF malicious-packages MAL-2026-17897 raw record (fromthehotel-poems IOCs: login.fromthehotel.com, /muse + /api/poems/code + /api/art/downloads/* paths, llm-threat + action-hidden-in-lib-usage reasons, source hash bf72dad3...)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/pypi/fromthehotel-poems/MAL-2026-17897.json) - OpenSSF
- [kam193 bad-packages entry for fromthehotel-poems](https://bad-packages.kam193.eu/pypi/package/fromthehotel-poems)
- [DependencyWatch: multi-2026-10-16-ghsa-malware-sweep (yesterday`s context - agentaix wave 2 py-worm/py-wormgpt/py-sock2, Wix dep-confusion wave 3 util-foriepft, seapy-ops, getpubip, proxyrubika, @flexmr wave 1, tailwindcss-form, Baileys wave 4)](https://dependencywatch.io/incident/multi-2026-10-16-ghsa-malware-sweep)
- [DependencyWatch: multi-2026-10-15-ghsa-malware-sweep (prior-day context - conx3993 realwbx.com wave 1 of 5 packages, babel-polyfill-plugin-corejs2 + eth-react-provider typosquats, saeka PyPI credit-card checker)](https://dependencywatch.io/incident/multi-2026-10-15-ghsa-malware-sweep)
- [DependencyWatch: npm-2026-10-08-tensorlake-maintainer-compromise (updated today with maintainer-recovery timeline, 0.5.145 through 0.5.151 all clean, no wave-2 malicious republish)](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise)
- [DependencyWatch: npm-2026-10-12-hridoy-ultimate-fb-credential-stealer (bare-URL dep pattern precedent for today`s Cluster C @flexmr wave 2 technique)](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-17-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-17-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).