# GitHub Advisory malware sweep, 19 October 2026

> GHSA 2026-10-18/19 batch (9 advisories after the Apex Accelerator carve-out). PyPI `fabdeploycheck` + `fabtoolkit` ship a 4-version Amazon-Inspector-flagged reverse-shell/RCE family talking to `transfer.archivete.am`. `@fmr-ap149494` dep-confusion wave 3 extends the FMR scope. New `@fcsmc` scope dep-confusion probe. Baileys-lure wave 6 (`@fluxionii/baileys` + `@ostyado/baileys`). FRP-binary `@pkgship/frpc-linux-arm64` dep-confusion.

- Published: 2026-10-19
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 7 packages, 9 compromised versions
- Tags: dependency-confusion, typosquat, credential-theft
- Also known as: 2026-10-19 GHSA sweep, fabdeploycheck fabtoolkit transfer.archivete.am RCE family, @fmr-ap149494 FMR dep-confusion wave 3, @fcsmc dep-confusion probe, Baileys-lure wave 6, @pkgship/frpc trojanised FRP binary
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, Amazon Inspector
- Incident ID: multi-2026-10-19-ghsa-malware-sweep

## Affected packages (7)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@fcsmc/commercial-analytics](https://dependencywatch.io/package/npm/@fcsmc/commercial-analytics) | npm | 99.9.1 |
| [@fluxionii/baileys](https://dependencywatch.io/package/npm/@fluxionii/baileys) | npm | * |
| [@fmr-ap149494/apex-base-component](https://dependencywatch.io/package/npm/@fmr-ap149494/apex-base-component) | npm | 99.9.1 |
| [@ostyado/baileys](https://dependencywatch.io/package/npm/@ostyado/baileys) | npm | * |
| [@pkgship/frpc-linux-arm64](https://dependencywatch.io/package/npm/@pkgship/frpc-linux-arm64) | npm | 0.71.0 |
| [fabdeploycheck](https://dependencywatch.io/package/pypi/fabdeploycheck) | PyPI | 0.1.1 |
| [fabtoolkit](https://dependencywatch.io/package/pypi/fabtoolkit) | PyPI | 0.1.0, 0.1.1, 0.1.2 |

## What happened

Between 2026-10-18 06:00 UTC (yesterday`s PyPI-only sweep cutoff) and 2026-10-19 06:00 UTC (today`s ingest-window start), the GitHub Advisory Database and OpenSSF `malicious-packages` published 11 fresh malware advisories: 2 are the Apex Accelerator / `@apexacc/*` npm packages carved out to their own [npm-2026-10-19-apex-accelerator-malicious-npm-packages](https://dependencywatch.io/incident/npm-2026-10-19-apex-accelerator-malicious-npm-packages) record; 9 remain for this sweep (7 npm + 2 PyPI, counting `fabtoolkit`+`fabdeploycheck` as a single Cluster A operator and the Baileys pair as Cluster D).

## Headlines

**PyPI `fabdeploycheck` + `fabtoolkit` RCE / reverse-shell family** (Cluster A, 4 versions, Amazon Inspector): same operator (shared `transfer.archivete.am` config URL, shared process-kill strings), five action kinds including `revsh` daemon, targets `~/.aws/credentials` + `~/.ssh/*` + cloud-metadata, kill-list reveals prior-generation implants named `FABDRV3`, `fabdrv2`, `connection ready` already in the wild.

**`@fmr-ap149494` npm scope rotation (dep-confusion wave 3 of the `@flexmr` operator)** (Cluster B): `99.9.1` sentinel version, OSSF Package Analysis flagged by domain reputation but specific C2 undisclosed; third scope in four days from the same actor.

**`@fcsmc/commercial-analytics` new-scope dep-confusion probe** (Cluster C): `99.9.1` sentinel, same OSSF flag reason as Cluster B, published two minutes after Cluster B - consistent with a single operator rapidly rotating scopes.

**Baileys-lure wave 6** (Cluster D): `@fluxionii/baileys` + `@ostyado/baileys` continue the week-running Baileys-brand-impersonation campaign.

**`@pkgship/frpc-linux-arm64` likely-trojanised FRP binary** (Cluster E): version `0.71.0` matches the then-current upstream `fatedier/frp` release, package name follows the FRP binary-release naming shape; CWE-506 boilerplate takedown with no runtime analysis published.

## Classification

`sweep`. Severity `high`, driven by Cluster A (confirmed functional reverse-shell + RCE payload across 4 live versions in two package names). The dep-confusion probe clusters (B, C, E) are individually `medium` because no credential-stealing or RCE payload is confirmed at analysis time, only a "communicates with malicious domain" or CWE-506 boilerplate flag. Cluster D is `medium` on CWE-506 boilerplate. No cluster today would independently merit `critical` on its own (no hijack of a legitimate existing upstream in the sweep itself; the Apex Accelerator find is a `malicious-package` not a `compromise`, so it is `high` severity on its own carve-out and does not raise sweep severity above `high`).

## Discovery

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `Amazon Inspector` (Cluster A source hashes).

## Impact

- **Cluster A - PyPI `fabdeploycheck` + `fabtoolkit` family RCE / reverse-shell (malicious-package, confirmed `remote-code-execution` + `revsh` payload, 4 versions across 2 package names, same `transfer.archivete.am` C2 and identical process-kill strings prove shared operator, Amazon Inspector finder, CWE-506)**: `fabdeploycheck@0.1.1` (GHSA-8g2w-p5px-2pjr, MAL-2026-17926) and `fabtoolkit@0.1.0, 0.1.1, 0.1.2` (GHSA-2j5q-cfcm-6vgm, MAL-2026-17927). Both packages launch an embedded payload via `subprocess.run([sys.executable, "-I", "-c", CHILD])` that downloads a JSON command-config from `https://transfer.archivete.am/H2Uxm/fabdeploycheck-config.json` (fabtoolkit reuses the fabdeploycheck URL, confirming shared operator) with `ssl._create_unverified_context()`. The config enumerates five action kinds: `file` (arbitrary file reads - targets `~/.aws/credentials`, `~/.ssh/*`, cloud-metadata endpoints), `run` (arbitrary subprocess execution), `http` (attacker-chosen HTTP calls with Bearer tokens taken from previously read files), `tcp` (port probing), and `revsh` (daemonised reverse shell piping fetched strings into `/bin/sh -c`). Command polling at `<base>/<ident>-cmd.txt`, output PUT back under `<ident>-out.txt`, results exfil as zipped archives under attacker-chosen names. Persistence/cleanup: scans `/proc/*/cmdline` and SIGKILLs any process matching the strings `FABDRV3`, `fabdrv2`, or `connection ready` - the comment field in the OSSF record describes this as "removing earlier versions of the implant", so the operator has prior-generation implants with those process names in the wild. Trigger paths: `python -m fabtoolkit`, or any import that reaches `selftest()` / `check()`. Evidence hashes: `fabdeploycheck/__init__.py` SHA-256 `96161cb2ff7d91e1b156242ea76bd1ae2dbc02395e7139194c59820f59fd6d9a`, wheel SHA-256 `24cb59b96fdffe19dab2eae7903c2d15f00ef9f9d385507544e3d5b581596609`; `fabtoolkit/__init__.py` SHA-256 `518954224d7879e904b0f7fa669c0f7463e7ea0269ed7f0ed50681178bfce0f5`, `fabtoolkit-0.1.2` wheel SHA-256 `1e527bdf3345ce4e7e24091205ef6c84a06508bf5bf83c7bdec48d26b7522b2b`. Per-version Amazon Inspector hashes recorded in MAL-2026-17926 and MAL-2026-17927. Severity `high` for this cluster (confirmed functional reverse-shell + RCE payload with credential-exfil shape, four live versions across two package names, prior-generation implants named in the kill-list imply operator maturity; reach limited to developers who installed by mistake, no legitimate upstream was hijacked)
- **Cluster B - npm `@fmr-ap149494/apex-base-component` FMR dep-confusion wave 3 (dependency-confusion, confirmed `communicates with a domain associated with malicious activity` reason, extends the `@flexmr` operator`s week-running pivot from `99.99.99` sentinel + `oob.recon.dev` canary (2026-10-16) to bare-URL deps served from `artifacts.creditslib.com` (2026-10-17) by publishing under a new `@fmr-ap149494` ticket-numbered scope - likely the operator reaction to `@flexmr` scope being flagged on the registry)**: `@fmr-ap149494/apex-base-component@99.9.1` (GHSA-8rp9-qj7v-w22c, MAL-2026-17929, source hash SHA-256 `e3505d2eebf31d1938862b6f6744d353fadaf980b9a27860f2a7c36d863828b9`). Published to the npm registry 2026-10-19T03:11 UTC. The `99.9.1` sentinel version follows the operator`s version pattern (`99.99.99` on 2026-10-16, `99.9.1` today). OSSF Package Analysis flagged the package via domain reputation but the specific C2 domain is not disclosed in the public advisory (would need the Package Analysis raw report keyed on the SHA-256 above). Severity `medium` for this cluster (dep-confusion probe tier - confirmed communicates with a known-malicious domain but specific payload and C2 domain are not disclosed at the OSSF-record level; one package, sentinel version, pentest-shaped operator profile - FMR is the UK market-research platform `FlexMR` and this is the third scope rotation in four days, consistent with a bug-bounty / pentest actor who re-publishes after each takedown)
- **Cluster C - npm `@fcsmc/commercial-analytics` new-scope dep-confusion probe (dependency-confusion, confirmed `communicates with a domain associated with malicious activity` reason, new attacker-controlled scope `@fcsmc` first observation)**: `@fcsmc/commercial-analytics@99.9.1` (GHSA-9w66-f3mv-43f7, MAL-2026-17928, source hash SHA-256 `2a6c1e570c16bbf3b94ecc31e622c4d31be7c8575c90eaffc238ca1ef36e659d`). Published 2026-10-19T03:01 UTC. Same `99.9.1` sentinel version as Cluster B, same OSSF Package Analysis flag reason, same two-minute publish window ahead of Cluster B - consistent with a single operator rotating scopes rapidly across targets. `@fcsmc` is unused on the public npm registry; the acronym could plausibly map to several internal-registry targets (Fidelity Commercial, FCS Mortgage, FCS Commercial, etc.) and the operator is probing with a `commercial-analytics` package name. Severity `medium` for this cluster (dep-confusion probe tier - confirmed communicates with a known-malicious domain but specific C2 is not disclosed at the OSSF-record level; one package, sentinel version, operator profile is consistent with the Cluster B actor rotating scopes)
- **Cluster D - npm Baileys-lure operator wave 6 (malicious-package / typosquat continuation; `@fluxionii/baileys` + `@ostyado/baileys` directly extend the week-running Baileys-brand-impersonation campaign that ran through wave 5 under `@xatancchii/natabaileys` yesterday; CWE-506 boilerplate takedowns with no published IOCs)**: `@fluxionii/baileys` (all versions, GHSA-98x4-5hvc-62qx) and `@ostyado/baileys` (all versions, GHSA-v73c-2rgc-m2jx). Both published and taken down 2026-10-19 with the standard GHSA CWE-506 "any computer that has this package installed should be considered fully compromised" boilerplate - no OSSF record, no vendor runtime analysis. Both scopes (`@fluxionii`, `@ostyado`) are new; both follow the operator`s Baileys-brand-impersonation naming shape. Prior waves catalogued in [2026-10-17 Cluster E (`@xatancchii/natabaileys`)](https://dependencywatch.io/incident/multi-2026-10-17-ghsa-malware-sweep), [2026-10-16 Cluster H](https://dependencywatch.io/incident/multi-2026-10-16-ghsa-malware-sweep) (7 Baileys slugs including `xmd-baileys`, `@developmentyora/baileyss`, `@celestial-community/baileys`), and the pre-October `@fer2809fl/baileys` / `arsya-baileys` / `my-baileys` waves. Severity `medium` for this cluster (install-time code execution risk per CWE-506 pattern, no vendor runtime analysis published; the operator`s week-running wave count and consistent naming lineage are the operator continuity signal)
- **Cluster E - npm `@pkgship/frpc-linux-arm64` likely-trojanised FRP binary (dependency-confusion / malicious-package; CWE-506 boilerplate takedown, no IOCs disclosed in advisory, but naming + versioning fingerprint matches a trojanised FRP (Fast Reverse Proxy) release)**: `@pkgship/frpc-linux-arm64@0.71.0` (GHSA-753f-gx8g-q88w, MAL-2026-17922, source hash SHA-256 `39802a26f48be15a64474534e0c7312611a91aa768688944ada0723beb425912`). Published 2026-10-18T21:10 UTC (not in yesterday`s PyPI-only sweep). Version `0.71.0` matches the then-current upstream frp release, so a developer resolving `frpc-linux-arm64` under an internal `@pkgship` scope would receive a plausible-looking FRP binary with a benign version number. FRP is a popular open-source reverse-proxy / NAT-traversal tool; a trojanised FRP binary is a high-value loader because victim developers often whitelist outbound reverse-proxy traffic for legitimate ops reasons. No vendor runtime analysis has been published and the OSSF record carries no IOCs beyond the source hash, so the specific trojan is unverified. Severity `medium` for this cluster (dep-confusion / scope-impersonation probe tier - CWE-506 confirms embedded malicious code in the pulled tarball but specific payload is unverified at analysis time; `@pkgship` is unused on the public npm registry so the operator profile is a scoped-registry probe against an internal `@pkgship` deployment)
- **Operator continuity**: this sweep continues the week-running **`@flexmr` / `@fmr-ap149494` dep-confusion operator** (wave 3 scope rotation) and the **Baileys-lure operator** (wave 6). **Apex Accelerator / Apex Arena** `@apexacc/cli` + `@apexacc/audit` carved out to [npm-2026-10-19-apex-accelerator-malicious-npm-packages](https://dependencywatch.io/incident/npm-2026-10-19-apex-accelerator-malicious-npm-packages) because the operator`s months-long public-presence build, multi-platform Bun-wrapped infostealer binaries, and 18-tool fake MCP server make it a sophistication tier above the sweep`s probe/lure baseline. **New operator infrastructure**: `transfer.archivete.am` (Cluster A, PyPI RCE family) is a shared anonymous file-host - IP-level block is sharp, apex-level block will affect any legitimate use of the host. **New attacker scopes**: `@fmr-ap149494` (Cluster B), `@fcsmc` (Cluster C), `@fluxionii` + `@ostyado` (Cluster D), `@pkgship` (Cluster E). **Prior-generation implants named**: Cluster A`s `FABDRV3`, `fabdrv2`, `connection ready` kill-list strings reveal that the fabdeploycheck/fabtoolkit operator has at least two earlier implant generations in the wild - any FABDRV3 or fabdrv2 process on a Linux host is worth investigating. **No new activity** from: yesterday`s `leakdeep` PyPI Windows credential + Discord stealer (XOR-obfuscated webhook unchanged), `ukraine69` destructive Telegram payload operator (`149.154.175.53`/167.51/175.100/167.91 + `91.108.56.130` DC IPs unchanged), `2026-10-emberlytts` cryptominer campaign extending `2026-10-voxeval` (8-package audio TTS/ASR lure wave quiet), `conx3993` (`realwbx.com` unchanged), `@beloved-lenora/opencode-*` AI-coding-tool lure (yesterday`s 7-package wave quiet), `agentaix` (`py-worm`/`py-wormgpt`/`py-sock2` quiet), Wix dep-confusion wave 3, `seapy-ops`, `getpubip`, `proxyrubika`, `tailwindcss-form`/`-uniform` typosquat operator. [TensorLake AI maintainer compromise (2026-10-08 carve-out)](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise) remains confirmed-recovered; no wave-2 malicious republish

## What to do

1. **For Cluster A (`fabdeploycheck` + `fabtoolkit` PyPI RCE family, 4 versions)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, `conda env` for `fabdeploycheck` at `0.1.1` and `fabtoolkit` at `0.1.0`, `0.1.1`, or `0.1.2`. On ANY hit on any Linux installer host that imported the package or ran `python -m fabtoolkit`: assume `~/.aws/credentials`, `~/.ssh/*`, any file matching the config`s `file` kind patterns, and any cloud-metadata-endpoint response has been exfiltrated under Bearer tokens taken from those same files; assume the host has run an arbitrary attacker-chosen reverse shell via `/bin/sh -c`; assume the host has probed arbitrary TCP targets on the attacker`s behalf. Rotate every AWS credential, every SSH key, every cloud-provider CLI credential, every secret in the installer process environment, and every secret stored in any file the installer could read. Hunt for processes named or containing `FABDRV3`, `fabdrv2`, or `connection ready` in `/proc/*/cmdline` - the operator`s own kill-list reveals these are prior-generation implants that may already be present on the host. Image the host for forensic review before clean-rebuild. **Egress block**: `transfer.archivete.am` apex + the specific `/H2Uxm/fabdeploycheck-config.json` path across every CI, build, dev-workstation, and production host - it is an anonymous file-host that legitimate development workflows do not depend on. Report the specific config URL to the hosting provider abuse channel
2. **For Cluster B (`@fmr-ap149494/apex-base-component` FMR dep-confusion wave 3)**: grep every `package.json`, `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `bun.lock`, and any internal registry mirror for `@fmr-ap149494/apex-base-component@99.9.1`. On hit: check your internal registry for a legitimate `@fmr-ap149494/*` or `@flexmr/*` scope - if your organisation is FlexMR, Fidelity Mutual Research, or any FMR-adjacent business, verify that your internal-registry resolution order prevents public-npm packages from shadowing an internal `@fmr-ap149494/*` or `@flexmr/*` scope on a fresh checkout. Add `@fmr-ap149494` to your public-registry denylist alongside the existing `@flexmr` entry (established 2026-10-16 and 2026-10-17 Cluster F / C). Watch for a wave 4 under a further variant scope (`@fmr-ap0*`, `@fmr-mortgage/*`, `@flexmr-ltd/*`, `@flex-market-research/*`) - the operator`s weekly scope-rotation cadence suggests another publication on the 2026-10-20 / 2026-10-21 window. The specific C2 domain is not disclosed at the OSSF-record level; pull the OpenSSF Package Analysis report for SHA-256 `e3505d2eebf31d1938862b6f6744d353fadaf980b9a27860f2a7c36d863828b9` to recover the egress indicator and feed it to your IOC pipeline
3. **For Cluster C (`@fcsmc/commercial-analytics` new-scope dep-confusion)**: grep every `package.json`, lockfiles, and internal registry mirrors for `@fcsmc/commercial-analytics@99.9.1` and the bare scope name `@fcsmc`. If your organisation operates under an acronym matching `fcsmc` (Fidelity Commercial Services Management Corp, FCS Mortgage Capital, FCS Commercial, or similar) you are the probe target - audit your internal-registry resolution order to prevent public-npm from shadowing an internal `@fcsmc/*` scope. Add `@fcsmc` to your public-registry denylist. Pull the OSSF Package Analysis report for SHA-256 `2a6c1e570c16bbf3b94ecc31e622c4d31be7c8575c90eaffc238ca1ef36e659d` to recover the specific C2 domain. The two-minute publish gap between this cluster and Cluster B suggests they share an operator - watch for additional sentinel-`99.9.1` publications under further new scopes in the same window
4. **For Cluster D (Baileys-lure wave 6: `@fluxionii/baileys` + `@ostyado/baileys`)**: grep every `package.json`, lockfiles, and internal registry mirrors for `@fluxionii/baileys` + `@ostyado/baileys` at any version. Both are first-publish lures under new scopes; neither corresponds to a legitimate upstream. Treat installation on any host as a `treat as fully compromised` event per the standard CWE-506 boilerplate - rotate every credential reachable from the host and image it before clean-rebuild. Keep the `baileys-brand-impersonation` denylist policy in place: the real WhatsApp automation library is `@whiskeysockets/baileys` on npm - any `*-baileys` / `@*/baileys` / `@*/baileyss` package under any other scope is suspect by default. Watch for a wave 7 under additional single-slug scopes - the operator`s weekly cadence suggests another `*-baileys` publication every 24-48 hours
5. **For Cluster E (`@pkgship/frpc-linux-arm64` likely-trojanised FRP binary)**: grep every `package.json`, lockfiles, Dockerfiles, and container-build manifests for `@pkgship/frpc-linux-arm64@0.71.0`. On hit on any Linux ARM64 host (edge devices, CI runners, developer M-series Macs with Linux VMs, Raspberry Pi fleets): image the host for forensic review and compare the installed `frpc` binary against the upstream `fatedier/frp` v0.71.0 Linux ARM64 release SHA-256. Any `frpc` process on the host is a candidate reverse-proxy / NAT-traversal channel the attacker can use for lateral movement - audit `netstat`/`ss` for persistent outbound connections to non-upstream FRP server hosts. Add `@pkgship` scope to your public-registry denylist. Watch for sibling slugs across `frpc-linux-amd64`, `frpc-darwin-arm64`, `frpc-windows-amd64` under the same `@pkgship` scope - the operator chose the ARM64 platform first, so additional architectures may follow
6. **Standing egress-denylist carry-forward from prior sweeps** (keep in place; today adds only `transfer.archivete.am` + the fabdeploycheck-config.json path): `realwbx.com` apex + `/ip.php` + `/ip` paths (2026-10-15 and 2026-10-17), `artifacts.creditslib.com` apex + `/npm/*` paths (2026-10-17), `login.fromthehotel.com` apex + `/muse` + `/api/poems/code` + `/api/art/downloads/*` paths (2026-10-17), `googleforum.pythonanywhere.com` exact subdomain (2026-10-11), `space-z.ai` apex + `preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai` + `b196q82k8891-d.space-z.ai` subdomains (2026-10-14), `dxpoc.gt.tc` apex (2026-10-09), `raw.githubusercontent.com/anonrider404/pypl/*` path (2026-10-16), `api-bsx.pages.dev` apex + `/download` path (2026-10-16), `177.7.60.239:48080` + `oob.recon.dev` (2026-10-16), `uncoder.eu.org` apex + `/cc-checker/api.php` path (2026-10-15), `accenture-npm.azurewebsites.net`, `limbomail.com` apex + `github.com/lunexindonesia/node-net-pool` + `github.com/trktgq0wbre1/node-net-pool`, `github.com/unicodeces/font-atlas`, `collector.oob.s4yhii.com` + `*.oob.s4yhii.com` + `s4yhii.com` apex, `64.181.165.115/dc`, `167.88.172.33:8087` + `jsonspack.com`, `goxtools.shop` apex, `minhdong.site` apex + GitHub user `VangBanLaNhat`, `45.138.12.177:8089`, `185.158.107.175:8787`, `ltidi.storage.googleapis.com/depenconf/`, `oob.s4yhii.com:9999/native`, `*.oast.pro`/`*.oast.me`/`*.oast.fun`/`*.oast.site`/`*.oastify.com`, `frjmzbjbhwvtdnsuodmu.supabase.co`, `api.npoint.io` apex, `tele.metry.orgin.net`, `morroncr0w.io`, `api.telegram.org` on untrusted CI/build hosts, `appsecc.com`, `webhook.site/*`, `nfjbill.ren`, `storage.googleapis.com/depenconf/`, `10.0.19.0/24` + `10.0.49.0/24`, `api.nm-streetwear.space`, Discord webhook URL pattern, `ipify.org` + `ifconfig.me`, `gitflic.ru`, `api.wagmiwallet.org`, `backend-cybersecuritydashboard.onrender.com`, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, `chinazhangsan.ccwu.cc`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `npm-canary.aveliscare.com`, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil patterns, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, `tuamaeaquelaursa.com`, `45.138.0.0/16` RubyGems wgkit CIDRs. **New today (Apex Accelerator carve-out)**: `apexaccs.org` apex + `arena.apexaccs.org` + `token.apexaccs.org` + `vrf.apexaccs.org`, `arenapex.cloud`, `apexfdn.xyz` apex + `arena.apexfdn.xyz` + `verify.apexfdn.xyz`, `fdn4apex.com`, `router-apex.com` apex + `main.router-apex.com` + `update.apex-arena-router.com`, `ccmihr.com`, `0auth-chromium.com`, `ehegisnightmare.icu`, `cloudmain365duo.top`

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-8g2w-p5px-2pjr - pypi fabdeploycheck (Cluster A - single-version 0.1.1 reverse-shell/RCE family, transfer.archivete.am config URL, FABDRV3/fabdrv2/connection-ready kill-list, MAL-2026-17926, Amazon Inspector finder)](https://github.com/advisories/GHSA-8g2w-p5px-2pjr) - GitHub
- [GHSA-2j5q-cfcm-6vgm - pypi fabtoolkit (Cluster A - 3-version 0.1.0/0.1.1/0.1.2 same operator as fabdeploycheck, reuses fabdeploycheck-config.json URL, MAL-2026-17927, Amazon Inspector finder)](https://github.com/advisories/GHSA-2j5q-cfcm-6vgm) - GitHub
- [OSSF malicious-packages MAL-2026-17926 raw record (fabdeploycheck IOCs: transfer.archivete.am + /H2Uxm/fabdeploycheck-config.json config URL, FABDRV3/fabdrv2/connection-ready process-kill strings, 5-action config schema file/run/http/tcp/revsh, Amazon Inspector per-wheel hashes)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/pypi/fabdeploycheck/MAL-2026-17926.json) - OpenSSF
- [OSSF malicious-packages MAL-2026-17927 raw record (fabtoolkit IOCs: shared transfer.archivete.am config URL with fabdeploycheck, identical 5-action schema, per-version Amazon Inspector hashes, IN-MAL-2026-021523/021525/021526 origin IDs)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/pypi/fabtoolkit/MAL-2026-17927.json) - OpenSSF
- [GHSA-8rp9-qj7v-w22c - npm @fmr-ap149494/apex-base-component (Cluster B - FMR dep-confusion wave 3 scope rotation from @flexmr, 99.9.1 sentinel version, MAL-2026-17929, OSSF Package Analysis flag by malicious-domain reputation)](https://github.com/advisories/GHSA-8rp9-qj7v-w22c) - GitHub
- [OSSF malicious-packages MAL-2026-17929 raw record (@fmr-ap149494/apex-base-component source hash e3505d2e..., ossf-package-analysis source, specific C2 domain not disclosed at record level)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/npm/%40fmr-ap149494/apex-base-component/MAL-2026-17929.json) - OpenSSF
- [GHSA-9w66-f3mv-43f7 - npm @fcsmc/commercial-analytics (Cluster C - new-scope dep-confusion probe, 99.9.1 sentinel, 2-minute publish-window with Cluster B, MAL-2026-17928, OSSF Package Analysis flag)](https://github.com/advisories/GHSA-9w66-f3mv-43f7) - GitHub
- [OSSF malicious-packages MAL-2026-17928 raw record (@fcsmc/commercial-analytics source hash 2a6c1e57..., ossf-package-analysis source, specific C2 domain not disclosed at record level)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/npm/%40fcsmc/commercial-analytics/MAL-2026-17928.json) - OpenSSF
- [GHSA-98x4-5hvc-62qx - npm @fluxionii/baileys (Cluster D - Baileys-brand-impersonation wave 6 new scope @fluxionii, all versions, CWE-506 boilerplate)](https://github.com/advisories/GHSA-98x4-5hvc-62qx) - GitHub
- [GHSA-v73c-2rgc-m2jx - npm @ostyado/baileys (Cluster D - Baileys-brand-impersonation wave 6 new scope @ostyado, all versions, CWE-506 boilerplate)](https://github.com/advisories/GHSA-v73c-2rgc-m2jx) - GitHub
- [GHSA-753f-gx8g-q88w - npm @pkgship/frpc-linux-arm64 (Cluster E - likely-trojanised FRP binary at upstream version 0.71.0, scope-impersonation of a plausible internal FRP binary distribution, MAL-2026-17922, published 2026-10-18 but surfaced in GHSA after yesterday`s PyPI-only sweep)](https://github.com/advisories/GHSA-753f-gx8g-q88w) - GitHub
- [DependencyWatch: npm-2026-10-19-apex-accelerator-malicious-npm-packages (today`s carve-out for the @apexacc/cli + @apexacc/audit Elastic REF8801 campaign)](https://dependencywatch.io/incident/npm-2026-10-19-apex-accelerator-malicious-npm-packages)
- [DependencyWatch: pypi-2026-10-18-ghsa-malware-sweep (yesterday`s context - leakdeep Windows credential + Discord stealer, ukraine69 destructive Telegram payload, 2026-10-emberlytts cryptominer campaign)](https://dependencywatch.io/incident/pypi-2026-10-18-ghsa-malware-sweep)
- [DependencyWatch: multi-2026-10-17-ghsa-malware-sweep (itsa-react maintainer compromise backfill, conx3993 wave 2, @flexmr wave 2 - direct predecessor to today`s Cluster B scope rotation to @fmr-ap149494, @beloved-lenora opencode AI-coding-tool lure, Baileys wave 5)](https://dependencywatch.io/incident/multi-2026-10-17-ghsa-malware-sweep)
- [DependencyWatch: multi-2026-10-16-ghsa-malware-sweep (Baileys wave 4 - @celestial-community/baileys, @developmentyora/baileyss, xmd-baileys context for today`s Cluster D wave 6)](https://dependencywatch.io/incident/multi-2026-10-16-ghsa-malware-sweep)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-19-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-19-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).