GitHub Advisory malware sweep, 20 October 2026

The full picture

34 packages 36 versions

• npm@an1mshnpmb9c84920/gat-scope-target-125ec19a*→
• npm@an1mshnpmb9c84920/oidc-cross-cafb9d929e*→
• npm@an1mshnpmb9c84920/pipe-compat-m19r8*→
• npm@an1mshnpmb9c84920/pipe-dns-m19t2*→
• npm@an1mshnpmb9c84920/stage-fn-m19p2*→
• npm@an1mshnpmb9c84920/stage-outer-m19s5*→
• npm@an1mshnpmb9c84920/stage-repo-m19g7*→
• npm@decoopus/chatgpt-setup*→
• npm@decoopus/claude-setup*→
• npmaemath-baileys*→
• npmaldi02-baileys*→
• npmapi-anthropic*→
• PyPIasurion99.0.0→
• npmbase58x64*→
• npmbs58x64*→
• npmbs58x64.js*→
• npmchatgpt-desktop-setup*→
• npmchatgpt-pro-activator*→
• npmchatgpt-pro-setup-tool*→
• npmclaude-desktop-setup*→
• npmcodex-setup*→
• npmichigo-baileys*→
• npmitem-validator*→
• npmitems-validator*→
• npmrubbydev-crash-baileys*→
• npmsc-font-icons9999.0.099.9.1→
• npmsc-geeksquad-core9999.0.099.9.1→
• npmticketcathayoct12*→
• PyPIvinted-mocked-apis99.0.0→
• npmxcvrenzcompany*→
• npmxzbails*→
• npmxzvexpzcbailey*→
• npmzero-baileys*→
• npmzeroz-baileys*→

What it does if you installed it

• Cluster A - PyPI asurion + vinted-mocked-apis kam193 dep-confusion pentest probes (dependency-confusion; GENERIC-standard-pypi-install-pentest campaign identifier, 99.0.0 sentinel versions; both packages override the install command in setup.py to run install-time code; both exfiltrate basic host info only, no further payload): asurion@99.0.0 (GHSA-59m7-pf46-28fr, MAL-2026-18045, source hash kam193 05820dd77e1f73d1a01797af6f10c6fa4ae22038be3fcd6a8cbd8c117cf6436c; published 2026-10-20, the only 2026-10-20 publication in this sweep) and vinted-mocked-apis@99.0.0 (GHSA-jgrw-w3x3-w5cp, MAL-2026-17943, source hash kam193 c71ab868e2ac254cfa135aa73c1ed19a3ddb1c82793efa3ff8466c3c5aa44b02 + ossf-package-analysis 55332d91b2afbf62923f1d853c6df3a5c8f768797a3176effdecba07b91d4fbf, OSSF Package Analysis separately flagged for communicating with a domain associated with malicious activity; published 2026-10-19). Both are classic kam193 bad-packages probes: public PyPI squats on names that could plausibly map to internal registries (asurion = telecommunications insurance brand, vinted-mocked-apis = test-fixture scope for the Vinted marketplace). Severity medium for this cluster (dep-confusion probe tier - confirmed install-time code and basic host-info exfil, no credential or RCE payload disclosed; kam193 is a known bug-bounty / red-team actor who publishes to the 99.0.0 sentinel to catch internal-registry misresolution)
• Cluster B - npm @an1mshnpmb9c84920 scope: attack-framework-shaped stage/pipe/oidc-cross/gat-scope burst (malicious-package; 7 packages all tombstoned to 0.0.1-security within ~5 minutes of initial publish, no vendor runtime analysis published, CWE-506 boilerplate takedowns; scope name shape an1msh[npm][hex] + per-package suffix pattern stage-outer/stage-repo/stage-fn/pipe-dns/pipe-compat/oidc-cross/gat-scope-target reads like worm or attack-framework module names rather than a legitimate internal scope): @an1mshnpmb9c84920/stage-outer-m19s5 (GHSA-6grm-8w52-497r, MAL-2026-18051, published 2026-10-19T22:19 UTC - the OSSF record is pure ghsa-malware boilerplate with no additional analysis), @an1mshnpmb9c84920/stage-repo-m19g7 (GHSA-42h4-pvwr-r87v), @an1mshnpmb9c84920/stage-fn-m19p2 (GHSA-h79g-mv9q-7p44), @an1mshnpmb9c84920/pipe-dns-m19t2 (GHSA-3xpj-mfqg-v52m), @an1mshnpmb9c84920/pipe-compat-m19r8 (GHSA-hxmq-p768-mjhf), @an1mshnpmb9c84920/oidc-cross-cafb9d929e (GHSA-mmr7-9m67-9qh5), @an1mshnpmb9c84920/gat-scope-target-125ec19a (GHSA-87gv-mmww-whrr). npm registry metadata confirms each slug now resolves to 0.0.1-security (npms standard holding placeholder) published roughly 5 minutes after a short-lived 0.0.0-stage stub, matching npms own takedown template; the originally-published versions and their payload are not available for inspection and GHSA/OSSF did not retain source hashes. The m19s5/m19g7/m19p2/m19r8/m19t2 suffix pattern consistently includes m19 (likely month 10 day 19 tag) + a two-character variant - consistent with an automated-publication framework stamping its artifacts; oidc-cross and gat-scope-target module names mirror the lexicon of OIDC-token-cross-exchange + GitHub-Actions-scope-target primitives that have appeared in prior Shai-Hulud / Mini-Shai-Hulud exploitation chains. Severity medium for this cluster (install-time code execution risk per CWE-506 pattern, no runtime analysis published; the operator profile - automated-framework naming, mass-publish-and-takedown cadence under a single scope - is the primary signal and does not reach high without vendor runtime analysis confirming a stealer or RCE payload)
• Cluster C - npm AI-assistant setup lures (malicious-package / typosquat; 8 packages, two with the @decoopus scope; CWE-506 boilerplate takedowns with no runtime analysis published, but naming shape is a direct echo of the earlier anthropic-setup lure (MAL-2026-12510, Aug 2026) that overwrote ANTHROPIC_BASE_URL to sugarball.vercel.app to hijack every Claude CLI prompt and response; today`s cluster covers both Anthropic and OpenAI brand surfaces): codex-setup (GHSA-h8cg-xwfv-9x77), chatgpt-pro-setup-tool (GHSA-xwx3-5h3q-2v8r), chatgpt-desktop-setup (GHSA-pgq5-xq28-533m), claude-desktop-setup (GHSA-f4mf-vhm8-xxqc), chatgpt-pro-activator (GHSA-qp43-mgx6-56x2), api-anthropic (GHSA-cj9w-7h22-q93g), @decoopus/claude-setup (GHSA-p7p5-jrq5-q47x), @decoopus/chatgpt-setup (GHSA-4632-2g34-4r9w). All eight published and taken down 2026-10-19 with the standard CWE-506 treat as fully compromised advisory boilerplate. All eight impersonate first-party AI-assistant installer/activator surfaces (official OpenAI distribution is @openai/codex on npm; Anthropic ships Claude Code via @anthropic-ai/claude-code; neither brand ships *-setup / *-activator packages). Likely operator-shared infrastructure with the sugarball.vercel.app anthropic-setup wave (the pattern - overwrite ANTHROPIC_BASE_URL / OPENAI_API_BASE in ~/.claude/settings.json or ~/.openai/* to a lookalike base URL - captures the installers API key and every subsequent prompt/response), but no runtime analysis is published on todays GHSA records so this is a pattern-matching inference rather than confirmed. Severity medium for this cluster (install-time code execution risk per CWE-506 pattern, no runtime analysis published; the AI-brand-impersonation naming + the @decoopus scopes dual-brand publication strongly suggest the sugarball.vercel.app operator - developers who installed should rotate their Anthropic / OpenAI API keys and audit ~/.claude/settings.json + ~/.openai/*` for a non-upstream base URL regardless of which specific package was installed)
• Cluster D - npm sc-geeksquad-core + sc-font-icons Best Buy / Geek Squad dep-confusion probe (dependency-confusion; confirmed install-time payload with specific IOCs; 2 packages, 9999.0.0 + 99.9.1 sentinel versions; same amazon-inspector + ossf-package-analysis source identifier shape, same hardcoded IP:port): sc-geeksquad-core@9999.0.0, 99.9.1 (GHSA-46pw-5vw5-769w, MAL-2026-12435, amazon-inspector source hash 2fd2458d8a5843f57187868a2c244a376dd3d2daef420d3c564c775ef6a2782a, ossf-package-analysis source 2094a7f35be1c723c65b36c32884f2f0e99840ef0bc090a1fbcb1f5568b93ef2) and sc-font-icons@9999.0.0, 99.9.1 (GHSA-pcqq-p5c7-m382, MAL-2026-12800, amazon-inspector 1b8c91edd839dd00f2e58ad9296742f8c3c5ff126523bbd8ed7561fef7c8516e, ossf-package-analysis 1b1e3d1dcd8af0ee16e8da5b321d8c532f9707503a36d90a8802b7835305fceb). The 9999.0.0 versions run a preinstall script that collects hostname, OS username, working directory, npm registry setting, and CI repository-slug environment variables and HTTP-GETs them to http://75.119.137.232:31337/depconfuse. The 99.9.1 versions are a parallel OSSF-Package-Analysis flag by malicious-domain reputation (the specific C2 for the second-pattern version is not disclosed at the OSSF-record level). Target: Best Buy Geek Squad - sc- is a plausible internal scope prefix for Best Buys Service Center / Store Compute organisation, and sc-geeksquad-core + sc-font-icons map to a design-system + font-icons internal utility pair that most retailers maintain. Severity medium for this cluster (dep-confusion probe tier - confirmed install-time code + hostname / registry / CI-slug reconnaissance exfil to a specific hardcoded IP, but exfil scope is scoped to install-time metadata, not credentials; the hardcoded IP and port 31337 are now a sharp network IOC and the TWO-version publication pattern - a 9999.0.0 operator and a 99.9.1` operator both landing on the same scope - is unusual and may suggest multiple actors probed the same target name)
• Cluster E - npm Baileys-lure operator wave 7 (malicious-package / typosquat continuation; this directly extends the week-running Baileys-brand-impersonation campaign that ran through wave 6 under @fluxionii/baileys + @ostyado/baileys yesterday; 8 new slugs, all unscoped or under new unused scopes; CWE-506 boilerplate takedowns with no published IOCs): zeroz-baileys (GHSA-fwfc-f4gp-qrcq), ichigo-baileys (GHSA-q66v-22v7-2qj9), zero-baileys (GHSA-v486-jrrq-rhwx), aemath-baileys (GHSA-rc7v-fm82-xp4x), aldi02-baileys (GHSA-fm6q-x7qr-xmpw), rubbydev-crash-baileys (GHSA-h9p4-38hj-p2gj), xzbails (GHSA-6853-2fcq-h2jm), xzvexpzcbailey (GHSA-73c8-rgvx-fw82). All published and taken down 2026-10-19 with the standard GHSA CWE-506 "any computer that has this package installed should be considered fully compromised" boilerplate - no OSSF record, no vendor runtime analysis. The naming shape (prefix / suffix of baileys under new one-off slugs) continues the operator lineage from waves 1-6 (prior Baileys slugs catalogued across sweeps 2026-10-11 through 2026-10-19); the real WhatsApp automation library is @whiskeysockets/baileys. Severity medium for this cluster (install-time code execution risk per CWE-506 pattern, no vendor runtime analysis published; the operator`s week-running wave count and consistent naming lineage are the operator continuity signal, now reaching 8 slugs in a single 24-hour window - the largest Baileys-lure burst to date)
• Cluster F - npm bs58x64 crypto-wallet encoding typosquats (typosquat; 3 packages shadowing the ubiquitous bs58 base58 encoding library used across every Solana / Bitcoin / Monero wallet SDK; CWE-506 boilerplate takedowns, no runtime analysis published, but the base58-encoding library is a known Solana/Bitcoin wallet-drainer target): bs58x64 (GHSA-3xp5-jhc7-xcm9), bs58x64.js (GHSA-rhf8-vjg2-4vpv), base58x64 (GHSA-57vp-ppmx-cgc5). All three published and taken down 2026-10-19 with the standard CWE-506 boilerplate. bs58 is one of the most-depended-on npm packages in the Solana / Bitcoin / Monero wallet-SDK stack (every wallet library uses it for base58 encoding of addresses and private keys); a trojanised bs58* typosquat is a high-value infostealer vector because the import appears in every wallet code path. Severity medium for this cluster (install-time code execution risk per CWE-506 pattern, no vendor runtime analysis published; the operator`s target shape - the base58 encoding library specifically - strongly suggests crypto-wallet-drainer intent, but confirming requires runtime analysis of the tombstoned original versions)
• Cluster G - npm miscellaneous dep-confusion / target-named probes (dependency-confusion / malicious-package; 4 packages with specific company or target-brand names; CWE-506 boilerplate takedowns): xcvrenzcompany (GHSA-5f99-96jc-hg98 - target "cvrenz" is likely a company internal-scope probe), ticketcathayoct12 (GHSA-g7mg-3h9r-c8h3 - dated with "oct12", likely a time-stamped Cathay Pacific / Cathay-brand ticket-system probe), items-validator (GHSA-ff48-h3v7-m43r), item-validator (GHSA-rpgc-c7g7-g8fh - these two shadow a common internal-utility slug item(s)-validator), plus the obviously-tombstoned noise cluster prastzyy (GHSA-qhp3-5q65-76mj) + prastzy (GHSA-mwjq-f2w5-934c). Severity medium for this cluster
• *Cluster H - npm SEO-spam music/album-download typosquat cluster (malicious-package / typosquat; ~100 packages with very long slugs of the shape `(available|download|now|zip|mp3)--(album|song|track|year-number)-(artist)-(hex); CWE-506 boilerplate takedowns, no runtime analysis; appears to be a pivot of the SEO-piracy spam cluster whose aim is Google-search-poisoning for "download free album MP3 ..." queries - the npm package is a wrapper to drive clicks; characteristic suffix of -<alphanumeric>-<alphanumeric> hex IDs identifies the batch generator)**: Representative sample (not exhaustive - 100+ advisories match this shape across pages 3-5 of todays GHSA listing): do-wnload-available-provincial-q7d0i-muzxoj, ava-ilable-down-load-mp3-today-75491-life-after-youth-hfdu7-yzwkck, a-lbum-do-wnload-avai-lable-file-10635-about-to-choke-pzt0k-onnsvp, availab-le-alb-um-zip-music-is-rotted-one-note-7chcp-frcmmy, down-load-available-zip-now-8238-bricks-are-heavy-0v3kh-yluceh, down-lo-ad-now-zip-mp3-duppy-writer-9bxwq-qpdzyd, mp3-do-wnload-file-to-day-d-nu951-cjkdsy, plus ~90 more unique slugs. Severity medium for this cluster (install-time code execution risk per CWE-506 pattern per advisory, but the batch is dominated by SEO-spam shape rather than confirmed credential-stealer or RCE payload)
• Cluster I - npm noise: random-looking 6-character gibberish takedowns (malicious-package; ~40 packages with random 6-char lowercase alphanumeric names; CWE-506 boilerplate; low-signal): 1n9lip, aqj3w7, 4p9kgm, ljem3j, j5opb7, gtjgd4, ysqp68, rhlozh, giu094, ju0oud, esgbz5, 3qamjp, 3gr2dj, lstsyw, v49yzy, waojpf, ivzlid, zubn7b, x294tn, g23p4g, oo9fja, tkacg3, rvmbnj, g8ez1y, noe77e, 8h66ok, 8i7pp4, 5xzkuy, f0klcr, j019qc, 3gr841, f4iomt, 5k5t5q, nsdhjuiwqxmhsf1, mxckjdgweuxpsiohd, dsjklweuvhgsdcq, mx3dxhgic8xhd6, vjkpwjxbvndelta, zxhgssiyluwxchn, xcvrenzcompany (also listed in Cluster G), array-inline, array-inline-transform. All CWE-506 boilerplate - likely automated-publication noise from a generator producing random short identifiers. Severity medium
• Operator continuity: this sweep extends four week-running operator campaigns observed on prior sweeps - Baileys-lure operator wave 7 (8 new slugs today, the largest single-day burst), the sugarball.vercel.app AI-assistant-setup lure operator (pattern-matched: 8 setup/activator packages today across OpenAI + Anthropic brand surfaces, two under @decoopus scope), the @flexmr / @fmr-ap149494 dep-confusion operator (NOT re-observed today after yesterdays wave 3 scope rotation - a wave 4 under a further variant scope was predicted; status QUIET as of this sweep), and the **transfer.archivete.am PyPI RCE family operator** (fabdeploycheck / fabtoolkit, NOT re-observed today). **New campaign-shaped scopes**: @an1mshnpmb9c84920 (Cluster B, attack-framework-shaped stage/pipe/oidc-cross/gat-scope burst). **New operator infrastructure**: 75.119.137.232:31337/depconfuse (Cluster D, sc-geeksquad dep-confusion) - IP-level block is sharp. **No new activity** from: yesterdays fabdeploycheck+fabtoolkit operator (transfer.archivete.am + fab kill-list prior-generation implants FABDRV3/fabdrv2/connection ready unchanged), leakdeep PyPI Windows credential + Discord stealer (quiet), ukraine69 destructive Telegram payload operator (quiet), 2026-10-emberlytts cryptominer campaign extending 2026-10-voxeval (8-package audio TTS/ASR lure wave quiet), conx3993 (realwbx.com unchanged), `@beloved-lenora/opencode- AI-coding-tool lure (wave 1 quiet), agentaix (py-worm/py-wormgpt/py-sock2 quiet), Wix dep-confusion wave 3, seapy-ops, getpubip, proxyrubika, tailwindcss-form/-uniform typosquat operator, @pkgship/frpc-linux-arm64` trojanised FRP binary (quiet). Apex Accelerator REF8801 (2026-10-19 carve-out), TensorLake AI maintainer compromise (2026-10-08 carve-out), and hridoy FB credential stealer (2026-10-12 carve-out) all remain confirmed-recovered with no wave-2 malicious republish observed

Clean-up steps

1. 1For Cluster A (asurion + vinted-mocked-apis PyPI kam193 dep-confusion probes): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, and conda env for asurion at 99.0.0 or vinted-mocked-apis at 99.0.0. If your organisation operates under the asurion brand (telecommunications insurance) or publishes to an internal asurion package namespace, confirm your internal-registry resolution order prevents public-PyPI shadowing. If your organisation is Vinted or publishes an internal vinted-mocked-apis test-fixture, the same applies. Add both package names to your public-registry denylist. Both are kam193 bug-bounty / red-team probes - the install-time exfil scope is limited to basic host info and should NOT include credentials, so no credential-rotation is required BUT confirm nothing in the installer process environment leaked beyond hostname / username / cwd. On any CI job that resolved either package: review the preinstall script output and audit outbound connections during the install window
2. 2For Cluster B (@an1mshnpmb9c84920 scope attack-framework-shaped burst, 7 packages): grep every package.json, package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock, and internal registry mirrors for the full scope @an1mshnpmb9c84920/*. On ANY hit on any host that ran npm install or yarn install during the exposure window (2026-10-19T22:19 UTC until the npm security holder replaced each package roughly 5 minutes later): treat the host as a candidate treat as fully compromised event per the standard CWE-506 boilerplate. The attack-framework-shaped module names (stage-outer, stage-repo, stage-fn, pipe-dns, pipe-compat, oidc-cross, gat-scope-target) read like worm staging primitives rather than coincidental slugs, so rotate every credential reachable from the host - GitHub OIDC trust / GitHub Actions tokens / npm publish tokens / cloud credentials / Kubernetes service-account tokens - and image the host for forensic review before clean-rebuild. Add the full @an1mshnpmb9c84920 scope to your public-registry denylist. Watch for a follow-up burst under a sibling scope (@an1mshnpm* + hex suffix) in the 2026-10-20 / 2026-10-21 window - the operator`s mass-publication + fast-tombstone pattern suggests a repeat is possible
3. 3For Cluster C (AI-assistant setup lures, 8 packages, likely sugarball.vercel.app operator continuity): grep every package.json, lockfiles, and internal registry mirrors for codex-setup, chatgpt-pro-setup-tool, chatgpt-desktop-setup, claude-desktop-setup, chatgpt-pro-activator, api-anthropic, @decoopus/claude-setup, @decoopus/chatgpt-setup. On ANY hit on a developer workstation or CI host: (1) audit ~/.claude/settings.json for a non-upstream ANTHROPIC_BASE_URL (upstream is https://api.anthropic.com); (2) audit ~/.openai/* + any shell-env for a non-upstream OPENAI_API_BASE or OPENAI_BASE_URL (upstream is https://api.openai.com/v1); (3) rotate the installers Anthropic API key, OpenAI API key, Claude Code / Codex / Cursor / Windsurf session credentials, and any other AI-assistant tokens; (4) assume every prompt + response + tool-call result the installer ran through Claude or ChatGPT during the exposure window was mirrored to attacker infrastructure. Add the following scopes to your public-registry denylist: @decoopus. Treat ANY future -setup, -activator, -desktop-setup package under an AI brand name as suspect by default - official OpenAI distribution is @openai/codex only; official Anthropic distribution is @anthropic-ai/claude-code only. Watch for follow-up slugs under new scopes (@anthropic-tools/, @openai-cli/*, etc.) - the lure operators weekly cadence suggests another publication
4. 4For Cluster D (sc-geeksquad-core + sc-font-icons Best Buy / Geek Squad dep-confusion, hardcoded IP IOC): grep every package.json, lockfiles, Dockerfiles, container-build manifests, and internal registry mirrors for sc-geeksquad-core@9999.0.0, 99.9.1 and sc-font-icons@9999.0.0, 99.9.1. If your organisation operates under the sc- prefix for internal packages (Service Center / Store Compute / anything else matching this shape) you are a probe target - audit your internal-registry resolution order to prevent public-npm from shadowing an internal sc-* scope. If you are Best Buy / Geek Squad / any Best Buy subsidiary, this is a direct probe against your internal-registry naming convention; audit your lockfiles across all repos. Add sc-geeksquad-core and sc-font-icons to your public-registry denylist. Egress block: 75.119.137.232:31337 across every CI, build, dev-workstation, and production host - the hardcoded IP + port 31337 + /depconfuse path is a sharp network IOC and legitimate development workflows will never need it
5. 5For Cluster E (Baileys-lure wave 7, 8 new slugs): grep every package.json, lockfiles, and internal registry mirrors for zeroz-baileys, ichigo-baileys, zero-baileys, aemath-baileys, aldi02-baileys, rubbydev-crash-baileys, xzbails, xzvexpzcbailey at any version. All are first-publish lures under new scopes/slugs; none corresponds to a legitimate upstream. Treat installation on any host as a treat as fully compromised event per the standard CWE-506 boilerplate - rotate every credential reachable from the host and image it before clean-rebuild. Keep the baileys-brand-impersonation denylist policy in place: the real WhatsApp automation library is @whiskeysockets/baileys on npm - any *-baileys / @*/baileys / @*/baileyss / *bails / *bailey* package under any other scope is suspect by default. Watch for a wave 8 under additional single-slug scopes - the operator`s weekly cadence suggests another 4-8-slug publication every 24-48 hours
6. 6For Cluster F (bs58x64 + bs58x64.js + base58x64 crypto-wallet encoding typosquats): grep every package.json, lockfiles, and internal registry mirrors for bs58x64, bs58x64.js, base58x64 at any version. If any wallet-related code path (Solana / Bitcoin / Monero wallet SDK, crypto exchange integration, blockchain tooling) resolved any of these: assume every private key / seed phrase / signing key / wallet credential that passed through base58 encoding during the exposure window may have been exfiltrated. Rotate every wallet-signing key, every API key for connected exchanges, every Solana / Ethereum RPC-provider key, and drain affected hot wallets to fresh ones. The real upstream is bs58 (unscoped) - any bs58* package other than bs58 itself is suspect by default; same policy for base58* variants
7. 7For Clusters G, H, I (miscellaneous dep-confusion probes, SEO-spam music-download typosquats, 6-char gibberish noise): grep every lockfile for the full package-name list in the impact section above. For Cluster G target-named probes (xcvrenzcompany, ticketcathayoct12, items-validator, item-validator): if your organisation operates under any matching brand/acronym, audit your internal-registry resolution order and add the slug to your public-registry denylist. For Cluster H SEO-spam (~100 slugs matching the (download|available|zip|mp3)-*-(album|song)-*-hex-hex shape): any lockfile hit is itself suspicious - these packages have no plausible legitimate use. For Cluster I noise (1n9lip, aqj3w7, etc. - 40+ random 6-char slugs): any lockfile hit is almost certainly a resolution error or an attempt to shadow a developer typo; investigate and remove
8. 8Standing egress-denylist carry-forward from prior sweeps (keep in place; today adds only 75.119.137.232:31337 + /depconfuse path): transfer.archivete.am apex + /H2Uxm/fabdeploycheck-config.json path (2026-10-19 Cluster A), realwbx.com apex + /ip.php + /ip paths (2026-10-15 and 2026-10-17), artifacts.creditslib.com apex + /npm/* paths (2026-10-17), login.fromthehotel.com apex + /muse + /api/poems/code + /api/art/downloads/* paths (2026-10-17), googleforum.pythonanywhere.com exact subdomain (2026-10-11), space-z.ai apex + preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai + b196q82k8891-d.space-z.ai subdomains (2026-10-14), dxpoc.gt.tc apex (2026-10-09), raw.githubusercontent.com/anonrider404/pypl/* path (2026-10-16), api-bsx.pages.dev apex + /download path (2026-10-16), 177.7.60.239:48080 + oob.recon.dev (2026-10-16), uncoder.eu.org apex + /cc-checker/api.php path (2026-10-15), accenture-npm.azurewebsites.net, limbomail.com apex + github.com/lunexindonesia/node-net-pool + github.com/trktgq0wbre1/node-net-pool, github.com/unicodeces/font-atlas, collector.oob.s4yhii.com + *.oob.s4yhii.com + s4yhii.com apex, 64.181.165.115/dc, 167.88.172.33:8087 + jsonspack.com, goxtools.shop apex, minhdong.site apex + GitHub user VangBanLaNhat, 45.138.12.177:8089, 185.158.107.175:8787, ltidi.storage.googleapis.com/depenconf/, oob.s4yhii.com:9999/native, *.oast.pro/*.oast.me/*.oast.fun/*.oast.site/*.oastify.com, frjmzbjbhwvtdnsuodmu.supabase.co, api.npoint.io apex, tele.metry.orgin.net, morroncr0w.io, api.telegram.org on untrusted CI/build hosts, appsecc.com, webhook.site/*, nfjbill.ren, storage.googleapis.com/depenconf/, 10.0.19.0/24 + 10.0.49.0/24, api.nm-streetwear.space, Discord webhook URL pattern, ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, chinazhangsan.ccwu.cc, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil patterns, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com, 45.138.0.0/16 RubyGems wgkit CIDRs, apexaccs.org apex + subdomains, arenapex.cloud, apexfdn.xyz apex + subdomains, fdn4apex.com, router-apex.com apex + subdomains, ccmihr.com, 0auth-chromium.com, ehegisnightmare.icu, cloudmain365duo.top

Sources

• GitHub Advisory Database - recent malware advisoriesgithub.comGitHub
• GHSA-59m7-pf46-28fr - pypi asurion (Cluster A - kam193 dep-confusion pentest probe, 99.0.0 sentinel, MAL-2026-18045, GENERIC-standard-pypi-install-pentest campaign, published 2026-10-20 the only 2026-10-20 publication in this sweep)github.comGitHub
• GHSA-jgrw-w3x3-w5cp - pypi vinted-mocked-apis (Cluster A - kam193 dep-confusion probe + separate OSSF-Package-Analysis flag for malicious-domain communication, 99.0.0 sentinel, MAL-2026-17943)github.comGitHub
• GHSA-6grm-8w52-497r - npm @an1mshnpmb9c84920/stage-outer-m19s5 (Cluster B - attack-framework-shaped stage/pipe/oidc-cross burst, MAL-2026-18051, published 2026-10-19T22:19 UTC, tombstoned to 0.0.1-security within 5 minutes)github.comGitHub
• GHSA-42h4-pvwr-r87v - npm @an1mshnpmb9c84920/stage-repo-m19g7 (Cluster B companion)github.comGitHub
• GHSA-h79g-mv9q-7p44 - npm @an1mshnpmb9c84920/stage-fn-m19p2 (Cluster B companion)github.comGitHub
• GHSA-3xpj-mfqg-v52m - npm @an1mshnpmb9c84920/pipe-dns-m19t2 (Cluster B companion)github.comGitHub
• GHSA-hxmq-p768-mjhf - npm @an1mshnpmb9c84920/pipe-compat-m19r8 (Cluster B companion)github.comGitHub
• GHSA-mmr7-9m67-9qh5 - npm @an1mshnpmb9c84920/oidc-cross-cafb9d929e (Cluster B companion - OIDC-related module name)github.comGitHub
• GHSA-87gv-mmww-whrr - npm @an1mshnpmb9c84920/gat-scope-target-125ec19a (Cluster B companion - GitHub-Actions-scope-target shaped module name)github.comGitHub
• GHSA-h8cg-xwfv-9x77 - npm codex-setup (Cluster C - OpenAI Codex brand impersonation; official distribution is @openai/codex only)github.comGitHub
• GHSA-xwx3-5h3q-2v8r - npm chatgpt-pro-setup-tool (Cluster C - OpenAI ChatGPT brand impersonation)github.comGitHub
• GHSA-pgq5-xq28-533m - npm chatgpt-desktop-setup (Cluster C - OpenAI ChatGPT brand impersonation)github.comGitHub
• GHSA-f4mf-vhm8-xxqc - npm claude-desktop-setup (Cluster C - Anthropic Claude brand impersonation; official distribution is @anthropic-ai/claude-code only)github.comGitHub
• GHSA-qp43-mgx6-56x2 - npm chatgpt-pro-activator (Cluster C - OpenAI ChatGPT brand impersonation)github.comGitHub
• GHSA-cj9w-7h22-q93g - npm api-anthropic (Cluster C - Anthropic brand impersonation)github.comGitHub
• GHSA-p7p5-jrq5-q47x - npm @decoopus/claude-setup (Cluster C - @decoopus scope operator; Anthropic brand impersonation)github.comGitHub
• GHSA-4632-2g34-4r9w - npm @decoopus/chatgpt-setup (Cluster C - @decoopus scope operator; OpenAI brand impersonation under same scope as Anthropic sibling confirms single-operator dual-brand run)github.comGitHub
• GHSA-46pw-5vw5-769w - npm sc-geeksquad-core (Cluster D - Best Buy / Geek Squad dep-confusion probe, 9999.0.0 + 99.9.1 sentinels, preinstall script HTTP-GETs host/user/cwd/registry/CI-slug to http://75.119.137.232:31337/depconfuse, MAL-2026-12435, Amazon Inspector + OSSF Package Analysis)github.comGitHub
• GHSA-pcqq-p5c7-m382 - npm sc-font-icons (Cluster D companion - same hardcoded IP 75.119.137.232:31337/depconfuse, MAL-2026-12800)github.comGitHub
• GHSA-fwfc-f4gp-qrcq - npm zeroz-baileys (Cluster E - Baileys-brand-impersonation wave 7)github.comGitHub
• GHSA-q66v-22v7-2qj9 - npm ichigo-baileys (Cluster E - Baileys wave 7)github.comGitHub
• GHSA-v486-jrrq-rhwx - npm zero-baileys (Cluster E - Baileys wave 7)github.comGitHub
• GHSA-rc7v-fm82-xp4x - npm aemath-baileys (Cluster E - Baileys wave 7)github.comGitHub
• GHSA-fm6q-x7qr-xmpw - npm aldi02-baileys (Cluster E - Baileys wave 7)github.comGitHub
• GHSA-h9p4-38hj-p2gj - npm rubbydev-crash-baileys (Cluster E - Baileys wave 7)github.comGitHub
• GHSA-6853-2fcq-h2jm - npm xzbails (Cluster E - Baileys wave 7)github.comGitHub
• GHSA-73c8-rgvx-fw82 - npm xzvexpzcbailey (Cluster E - Baileys wave 7)github.comGitHub
• GHSA-3xp5-jhc7-xcm9 - npm bs58x64 (Cluster F - base58 encoding typosquat shadowing bs58, crypto-wallet-drainer-shaped target)github.comGitHub
• GHSA-rhf8-vjg2-4vpv - npm bs58x64.js (Cluster F companion)github.comGitHub
• GHSA-57vp-ppmx-cgc5 - npm base58x64 (Cluster F companion)github.comGitHub
• DependencyWatch: multi-2026-10-19-ghsa-malware-sweep (yesterdays context - Baileys wave 6 @fluxionii/@ostyado direct predecessor to todays Cluster E wave 7, @flexmr/@fmr-ap149494 FMR dep-confusion wave 3, @pkgship/frpc trojanised FRP binary, fabdeploycheck+fabtoolkit PyPI RCE family, @fcsmc dep-confusion)dependencywatch.io
• DependencyWatch: npm-2026-10-19-apex-accelerator-malicious-npm-packages (yesterday`s Apex Accelerator REF8801 carve-out)dependencywatch.io
• DependencyWatch: pypi-2026-10-18-ghsa-malware-sweep (2026-10-18 context - leakdeep Windows credential + Discord stealer, ukraine69 destructive Telegram payload, 2026-10-emberlytts cryptominer campaign)dependencywatch.io