GitHub Advisory malware sweep, 19 October 2026

HighAdvisory sweepnpmPyPI

GHSA 2026-10-18/19 batch (9 advisories after the Apex Accelerator carve-out). PyPI fabdeploycheck + fabtoolkit ship a 4-version Amazon-Inspector-flagged reverse-shell/RCE family talking to transfer.archivete.am. @fmr-ap149494 dep-confusion wave 3 extends the FMR scope. New @fcsmc scope dep-confusion probe. Baileys-lure wave 6 (@fluxionii/baileys + @ostyado/baileys). FRP-binary @pkgship/frpc-linux-arm64 dep-confusion.

Published 19 Oct 2026

Check your package-lock.json Source advisory

At a glancemulti-2026-10-19-ghsa-malware-sweep

Packages tracked9 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity: High
Type: Advisory sweep
Published: 19 Oct 2026
Ecosystems: npmPyPI
Detected by: GitHub Advisory Database, OpenSSF malicious-packages, Amazon Inspector
Also known as: 2026-10-19 GHSA sweep, fabdeploycheck fabtoolkit transfer.archivete.am RCE family, @fmr-ap149494 FMR dep-confusion wave 3
Source: github.com

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

Between 2026-10-18 06:00 UTC (yesterdays PyPI-only sweep cutoff) and 2026-10-19 06:00 UTC (todays ingest-window start), the GitHub Advisory Database and OpenSSF malicious-packages published 11 fresh malware advisories: 2 are the Apex Accelerator / @apexacc/* npm packages carved out to their own npm-2026-10-19-apex-accelerator-malicious-npm-packages record; 9 remain for this sweep (7 npm + 2 PyPI, counting fabtoolkit+fabdeploycheck as a single Cluster A operator and the Baileys pair as Cluster D).

Headlines

PyPI fabdeploycheck + fabtoolkit RCE / reverse-shell family (Cluster A, 4 versions, Amazon Inspector): same operator (shared transfer.archivete.am config URL, shared process-kill strings), five action kinds including revsh daemon, targets ~/.aws/credentials + ~/.ssh/* + cloud-metadata, kill-list reveals prior-generation implants named FABDRV3, fabdrv2, connection ready already in the wild.

@fmr-ap149494 npm scope rotation (dep-confusion wave 3 of the @flexmr operator) (Cluster B): 99.9.1 sentinel version, OSSF Package Analysis flagged by domain reputation but specific C2 undisclosed; third scope in four days from the same actor.

@fcsmc/commercial-analytics new-scope dep-confusion probe (Cluster C): 99.9.1 sentinel, same OSSF flag reason as Cluster B, published two minutes after Cluster B - consistent with a single operator rapidly rotating scopes.

Baileys-lure wave 6 (Cluster D): @fluxionii/baileys + @ostyado/baileys continue the week-running Baileys-brand-impersonation campaign.

@pkgship/frpc-linux-arm64 likely-trojanised FRP binary (Cluster E): version 0.71.0 matches the then-current upstream fatedier/frp release, package name follows the FRP binary-release naming shape; CWE-506 boilerplate takedown with no runtime analysis published.

Classification

sweep. Severity high, driven by Cluster A (confirmed functional reverse-shell + RCE payload across 4 live versions in two package names). The dep-confusion probe clusters (B, C, E) are individually medium because no credential-stealing or RCE payload is confirmed at analysis time, only a "communicates with malicious domain" or CWE-506 boilerplate flag. Cluster D is medium on CWE-506 boilerplate. No cluster today would independently merit critical on its own (no hijack of a legitimate existing upstream in the sweep itself; the Apex Accelerator find is a malicious-package not a compromise, so it is high severity on its own carve-out and does not raise sweep severity above high).

Discovery

GitHub Advisory Database, OpenSSF malicious-packages, Amazon Inspector (Cluster A source hashes).

dependency-confusiontyposquatcredential-theft

Affected packages

7 packages 9 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →

Impact

What it does if you installed it

Cluster A - PyPI fabdeploycheck + fabtoolkit family RCE / reverse-shell (malicious-package, confirmed remote-code-execution + revsh payload, 4 versions across 2 package names, same transfer.archivete.am C2 and identical process-kill strings prove shared operator, Amazon Inspector finder, CWE-506): fabdeploycheck@0.1.1 (GHSA-8g2w-p5px-2pjr, MAL-2026-17926) and fabtoolkit@0.1.0, 0.1.1, 0.1.2 (GHSA-2j5q-cfcm-6vgm, MAL-2026-17927). Both packages launch an embedded payload via subprocess.run([sys.executable, "-I", "-c", CHILD]) that downloads a JSON command-config from https://transfer.archivete.am/H2Uxm/fabdeploycheck-config.json (fabtoolkit reuses the fabdeploycheck URL, confirming shared operator) with ssl._create_unverified_context(). The config enumerates five action kinds: file (arbitrary file reads - targets ~/.aws/credentials, ~/.ssh/*, cloud-metadata endpoints), run (arbitrary subprocess execution), http (attacker-chosen HTTP calls with Bearer tokens taken from previously read files), tcp (port probing), and revsh (daemonised reverse shell piping fetched strings into /bin/sh -c). Command polling at <base>/<ident>-cmd.txt, output PUT back under <ident>-out.txt, results exfil as zipped archives under attacker-chosen names. Persistence/cleanup: scans /proc/*/cmdline and SIGKILLs any process matching the strings FABDRV3, fabdrv2, or connection ready - the comment field in the OSSF record describes this as "removing earlier versions of the implant", so the operator has prior-generation implants with those process names in the wild. Trigger paths: python -m fabtoolkit, or any import that reaches selftest() / check(). Evidence hashes: fabdeploycheck/__init__.py SHA-256 96161cb2ff7d91e1b156242ea76bd1ae2dbc02395e7139194c59820f59fd6d9a, wheel SHA-256 24cb59b96fdffe19dab2eae7903c2d15f00ef9f9d385507544e3d5b581596609; fabtoolkit/__init__.py SHA-256 518954224d7879e904b0f7fa669c0f7463e7ea0269ed7f0ed50681178bfce0f5, fabtoolkit-0.1.2 wheel SHA-256 1e527bdf3345ce4e7e24091205ef6c84a06508bf5bf83c7bdec48d26b7522b2b. Per-version Amazon Inspector hashes recorded in MAL-2026-17926 and MAL-2026-17927. Severity high for this cluster (confirmed functional reverse-shell + RCE payload with credential-exfil shape, four live versions across two package names, prior-generation implants named in the kill-list imply operator maturity; reach limited to developers who installed by mistake, no legitimate upstream was hijacked)
Cluster B - npm @fmr-ap149494/apex-base-component FMR dep-confusion wave 3 (dependency-confusion, confirmed communicates with a domain associated with malicious activity reason, extends the @flexmr operators week-running pivot from 99.99.99 sentinel + oob.recon.dev canary (2026-10-16) to bare-URL deps served from artifacts.creditslib.com (2026-10-17) by publishing under a new @fmr-ap149494 ticket-numbered scope - likely the operator reaction to @flexmr` scope being flagged on the registry): @fmr-ap149494/apex-base-component@99.9.1 (GHSA-8rp9-qj7v-w22c, MAL-2026-17929, source hash SHA-256 e3505d2eebf31d1938862b6f6744d353fadaf980b9a27860f2a7c36d863828b9). Published to the npm registry 2026-10-19T03:11 UTC. The 99.9.1 sentinel version follows the operators version pattern (99.99.99 on 2026-10-16, 99.9.1 today). OSSF Package Analysis flagged the package via domain reputation but the specific C2 domain is not disclosed in the public advisory (would need the Package Analysis raw report keyed on the SHA-256 above). Severity medium for this cluster (dep-confusion probe tier - confirmed communicates with a known-malicious domain but specific payload and C2 domain are not disclosed at the OSSF-record level; one package, sentinel version, pentest-shaped operator profile - FMR is the UK market-research platform FlexMR` and this is the third scope rotation in four days, consistent with a bug-bounty / pentest actor who re-publishes after each takedown)
Cluster C - npm @fcsmc/commercial-analytics new-scope dep-confusion probe (dependency-confusion, confirmed communicates with a domain associated with malicious activity reason, new attacker-controlled scope @fcsmc first observation): @fcsmc/commercial-analytics@99.9.1 (GHSA-9w66-f3mv-43f7, MAL-2026-17928, source hash SHA-256 2a6c1e570c16bbf3b94ecc31e622c4d31be7c8575c90eaffc238ca1ef36e659d). Published 2026-10-19T03:01 UTC. Same 99.9.1 sentinel version as Cluster B, same OSSF Package Analysis flag reason, same two-minute publish window ahead of Cluster B - consistent with a single operator rotating scopes rapidly across targets. @fcsmc is unused on the public npm registry; the acronym could plausibly map to several internal-registry targets (Fidelity Commercial, FCS Mortgage, FCS Commercial, etc.) and the operator is probing with a commercial-analytics package name. Severity medium for this cluster (dep-confusion probe tier - confirmed communicates with a known-malicious domain but specific C2 is not disclosed at the OSSF-record level; one package, sentinel version, operator profile is consistent with the Cluster B actor rotating scopes)
Cluster D - npm Baileys-lure operator wave 6 (malicious-package / typosquat continuation; @fluxionii/baileys + @ostyado/baileys directly extend the week-running Baileys-brand-impersonation campaign that ran through wave 5 under @xatancchii/natabaileys yesterday; CWE-506 boilerplate takedowns with no published IOCs): @fluxionii/baileys (all versions, GHSA-98x4-5hvc-62qx) and @ostyado/baileys (all versions, GHSA-v73c-2rgc-m2jx). Both published and taken down 2026-10-19 with the standard GHSA CWE-506 "any computer that has this package installed should be considered fully compromised" boilerplate - no OSSF record, no vendor runtime analysis. Both scopes (@fluxionii, @ostyado) are new; both follow the operators Baileys-brand-impersonation naming shape. Prior waves catalogued in [2026-10-17 Cluster E (@xatancchii/natabaileys)](/incident/multi-2026-10-17-ghsa-malware-sweep), [2026-10-16 Cluster H](/incident/multi-2026-10-16-ghsa-malware-sweep) (7 Baileys slugs including xmd-baileys, @developmentyora/baileyss, @celestial-community/baileys), and the pre-October @fer2809fl/baileys / arsya-baileys / my-baileys waves. Severity medium for this cluster (install-time code execution risk per CWE-506 pattern, no vendor runtime analysis published; the operators week-running wave count and consistent naming lineage are the operator continuity signal)
Cluster E - npm @pkgship/frpc-linux-arm64 likely-trojanised FRP binary (dependency-confusion / malicious-package; CWE-506 boilerplate takedown, no IOCs disclosed in advisory, but naming + versioning fingerprint matches a trojanised FRP (Fast Reverse Proxy) release): @pkgship/frpc-linux-arm64@0.71.0 (GHSA-753f-gx8g-q88w, MAL-2026-17922, source hash SHA-256 39802a26f48be15a64474534e0c7312611a91aa768688944ada0723beb425912). Published 2026-10-18T21:10 UTC (not in yesterdays PyPI-only sweep). Version 0.71.0 matches the then-current upstream frp release, so a developer resolving frpc-linux-arm64 under an internal @pkgship scope would receive a plausible-looking FRP binary with a benign version number. FRP is a popular open-source reverse-proxy / NAT-traversal tool; a trojanised FRP binary is a high-value loader because victim developers often whitelist outbound reverse-proxy traffic for legitimate ops reasons. No vendor runtime analysis has been published and the OSSF record carries no IOCs beyond the source hash, so the specific trojan is unverified. Severity medium for this cluster (dep-confusion / scope-impersonation probe tier - CWE-506 confirms embedded malicious code in the pulled tarball but specific payload is unverified at analysis time; @pkgship is unused on the public npm registry so the operator profile is a scoped-registry probe against an internal @pkgship` deployment)
Operator continuity: this sweep continues the week-running @flexmr / @fmr-ap149494 dep-confusion operator (wave 3 scope rotation) and the Baileys-lure operator (wave 6). Apex Accelerator / Apex Arena @apexacc/cli + @apexacc/audit carved out to npm-2026-10-19-apex-accelerator-malicious-npm-packages because the operators months-long public-presence build, multi-platform Bun-wrapped infostealer binaries, and 18-tool fake MCP server make it a sophistication tier above the sweeps probe/lure baseline. New operator infrastructure: transfer.archivete.am (Cluster A, PyPI RCE family) is a shared anonymous file-host - IP-level block is sharp, apex-level block will affect any legitimate use of the host. New attacker scopes: @fmr-ap149494 (Cluster B), @fcsmc (Cluster C), @fluxionii + @ostyado (Cluster D), @pkgship (Cluster E). Prior-generation implants named: Cluster As FABDRV3, fabdrv2, connection ready kill-list strings reveal that the fabdeploycheck/fabtoolkit operator has at least two earlier implant generations in the wild - any FABDRV3 or fabdrv2 process on a Linux host is worth investigating. **No new activity** from: yesterdays leakdeep PyPI Windows credential + Discord stealer (XOR-obfuscated webhook unchanged), ukraine69 destructive Telegram payload operator (149.154.175.53/167.51/175.100/167.91 + 91.108.56.130 DC IPs unchanged), 2026-10-emberlytts cryptominer campaign extending 2026-10-voxeval (8-package audio TTS/ASR lure wave quiet), conx3993 (realwbx.com unchanged), @beloved-lenora/opencode-* AI-coding-tool lure (yesterdays 7-package wave quiet), agentaix (py-worm/py-wormgpt/py-sock2 quiet), Wix dep-confusion wave 3, seapy-ops, getpubip, proxyrubika, tailwindcss-form/-uniform` typosquat operator. TensorLake AI maintainer compromise (2026-10-08 carve-out) remains confirmed-recovered; no wave-2 malicious republish

What to do

Clean-up steps

For Cluster A (fabdeploycheck + fabtoolkit PyPI RCE family, 4 versions): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda env for fabdeploycheck at 0.1.1 and fabtoolkit at 0.1.0, 0.1.1, or 0.1.2. On ANY hit on any Linux installer host that imported the package or ran python -m fabtoolkit: assume ~/.aws/credentials, ~/.ssh/*, any file matching the configs file kind patterns, and any cloud-metadata-endpoint response has been exfiltrated under Bearer tokens taken from those same files; assume the host has run an arbitrary attacker-chosen reverse shell via /bin/sh -c; assume the host has probed arbitrary TCP targets on the attackers behalf. Rotate every AWS credential, every SSH key, every cloud-provider CLI credential, every secret in the installer process environment, and every secret stored in any file the installer could read. Hunt for processes named or containing FABDRV3, fabdrv2, or connection ready in /proc/*/cmdline - the operators own kill-list reveals these are prior-generation implants that may already be present on the host. Image the host for forensic review before clean-rebuild. **Egress block**: transfer.archivete.am apex + the specific /H2Uxm/fabdeploycheck-config.json` path across every CI, build, dev-workstation, and production host - it is an anonymous file-host that legitimate development workflows do not depend on. Report the specific config URL to the hosting provider abuse channel
For Cluster B (@fmr-ap149494/apex-base-component FMR dep-confusion wave 3): grep every package.json, package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock, and any internal registry mirror for @fmr-ap149494/apex-base-component@99.9.1. On hit: check your internal registry for a legitimate @fmr-ap149494/* or @flexmr/* scope - if your organisation is FlexMR, Fidelity Mutual Research, or any FMR-adjacent business, verify that your internal-registry resolution order prevents public-npm packages from shadowing an internal @fmr-ap149494/* or @flexmr/* scope on a fresh checkout. Add @fmr-ap149494 to your public-registry denylist alongside the existing @flexmr entry (established 2026-10-16 and 2026-10-17 Cluster F / C). Watch for a wave 4 under a further variant scope (@fmr-ap0*, @fmr-mortgage/*, @flexmr-ltd/*, @flex-market-research/*) - the operators weekly scope-rotation cadence suggests another publication on the 2026-10-20 / 2026-10-21 window. The specific C2 domain is not disclosed at the OSSF-record level; pull the OpenSSF Package Analysis report for SHA-256 e3505d2eebf31d1938862b6f6744d353fadaf980b9a27860f2a7c36d863828b9` to recover the egress indicator and feed it to your IOC pipeline
For Cluster C (@fcsmc/commercial-analytics new-scope dep-confusion): grep every package.json, lockfiles, and internal registry mirrors for @fcsmc/commercial-analytics@99.9.1 and the bare scope name @fcsmc. If your organisation operates under an acronym matching fcsmc (Fidelity Commercial Services Management Corp, FCS Mortgage Capital, FCS Commercial, or similar) you are the probe target - audit your internal-registry resolution order to prevent public-npm from shadowing an internal @fcsmc/* scope. Add @fcsmc to your public-registry denylist. Pull the OSSF Package Analysis report for SHA-256 2a6c1e570c16bbf3b94ecc31e622c4d31be7c8575c90eaffc238ca1ef36e659d to recover the specific C2 domain. The two-minute publish gap between this cluster and Cluster B suggests they share an operator - watch for additional sentinel-99.9.1 publications under further new scopes in the same window
For Cluster D (Baileys-lure wave 6: @fluxionii/baileys + @ostyado/baileys): grep every package.json, lockfiles, and internal registry mirrors for @fluxionii/baileys + @ostyado/baileys at any version. Both are first-publish lures under new scopes; neither corresponds to a legitimate upstream. Treat installation on any host as a treat as fully compromised event per the standard CWE-506 boilerplate - rotate every credential reachable from the host and image it before clean-rebuild. Keep the baileys-brand-impersonation denylist policy in place: the real WhatsApp automation library is @whiskeysockets/baileys on npm - any *-baileys / @*/baileys / @*/baileyss package under any other scope is suspect by default. Watch for a wave 7 under additional single-slug scopes - the operators weekly cadence suggests another *-baileys` publication every 24-48 hours
For Cluster E (@pkgship/frpc-linux-arm64 likely-trojanised FRP binary): grep every package.json, lockfiles, Dockerfiles, and container-build manifests for @pkgship/frpc-linux-arm64@0.71.0. On hit on any Linux ARM64 host (edge devices, CI runners, developer M-series Macs with Linux VMs, Raspberry Pi fleets): image the host for forensic review and compare the installed frpc binary against the upstream fatedier/frp v0.71.0 Linux ARM64 release SHA-256. Any frpc process on the host is a candidate reverse-proxy / NAT-traversal channel the attacker can use for lateral movement - audit netstat/ss for persistent outbound connections to non-upstream FRP server hosts. Add @pkgship scope to your public-registry denylist. Watch for sibling slugs across frpc-linux-amd64, frpc-darwin-arm64, frpc-windows-amd64 under the same @pkgship scope - the operator chose the ARM64 platform first, so additional architectures may follow
Standing egress-denylist carry-forward from prior sweeps (keep in place; today adds only transfer.archivete.am + the fabdeploycheck-config.json path): realwbx.com apex + /ip.php + /ip paths (2026-10-15 and 2026-10-17), artifacts.creditslib.com apex + /npm/* paths (2026-10-17), login.fromthehotel.com apex + /muse + /api/poems/code + /api/art/downloads/* paths (2026-10-17), googleforum.pythonanywhere.com exact subdomain (2026-10-11), space-z.ai apex + preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai + b196q82k8891-d.space-z.ai subdomains (2026-10-14), dxpoc.gt.tc apex (2026-10-09), raw.githubusercontent.com/anonrider404/pypl/* path (2026-10-16), api-bsx.pages.dev apex + /download path (2026-10-16), 177.7.60.239:48080 + oob.recon.dev (2026-10-16), uncoder.eu.org apex + /cc-checker/api.php path (2026-10-15), accenture-npm.azurewebsites.net, limbomail.com apex + github.com/lunexindonesia/node-net-pool + github.com/trktgq0wbre1/node-net-pool, github.com/unicodeces/font-atlas, collector.oob.s4yhii.com + *.oob.s4yhii.com + s4yhii.com apex, 64.181.165.115/dc, 167.88.172.33:8087 + jsonspack.com, goxtools.shop apex, minhdong.site apex + GitHub user VangBanLaNhat, 45.138.12.177:8089, 185.158.107.175:8787, ltidi.storage.googleapis.com/depenconf/, oob.s4yhii.com:9999/native, *.oast.pro/*.oast.me/*.oast.fun/*.oast.site/*.oastify.com, frjmzbjbhwvtdnsuodmu.supabase.co, api.npoint.io apex, tele.metry.orgin.net, morroncr0w.io, api.telegram.org on untrusted CI/build hosts, appsecc.com, webhook.site/*, nfjbill.ren, storage.googleapis.com/depenconf/, 10.0.19.0/24 + 10.0.49.0/24, api.nm-streetwear.space, Discord webhook URL pattern, ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, chinazhangsan.ccwu.cc, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil patterns, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com, 45.138.0.0/16 RubyGems wgkit CIDRs. New today (Apex Accelerator carve-out): apexaccs.org apex + arena.apexaccs.org + token.apexaccs.org + vrf.apexaccs.org, arenapex.cloud, apexfdn.xyz apex + arena.apexfdn.xyz + verify.apexfdn.xyz, fdn4apex.com, router-apex.com apex + main.router-apex.com + update.apex-arena-router.com, ccmihr.com, 0auth-chromium.com, ehegisnightmare.icu, cloudmain365duo.top

References

Sources

multi-2026-10-19-ghsa-malware-sweepBack to incidents Submit a correction

Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.json All incidents