# GitHub Advisory malware sweep, 20 October 2026

> GHSA 2026-10-19/20 batch (~150+ advisories). PyPI `asurion` + `vinted-mocked-apis` kam193 dep-confusion pentest probes at `99.0.0`. New npm `@an1mshnpmb9c84920` scope burst (7 attack-framework-shaped stage/pipe/oidc-cross/gat-scope packages). AI-assistant setup lure cluster (8 packages: `codex-setup`, `chatgpt-pro-setup-tool`, `chatgpt-desktop-setup`, `claude-desktop-setup`, `@decoopus/claude-setup`, `@decoopus/chatgpt-setup`, `api-anthropic`, `chatgpt-pro-activator`). Baileys-lure wave 7 (8 slugs). `sc-geeksquad-core`/`sc-font-icons` Best Buy / Geek Squad dep-confusion (hardcoded `75.119.137.232:31337/depconfuse`).

- Published: 2026-10-20
- Severity: medium
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 34 packages, 36 compromised versions
- Tags: dependency-confusion, typosquat, credential-theft, crypto-wallet-drain
- Also known as: 2026-10-20 GHSA sweep, asurion vinted-mocked-apis kam193 PyPI dep-confusion, @an1mshnpmb9c84920 attack-framework burst, AI-assistant setup lure cluster October 2026, @decoopus Claude ChatGPT setup lure operator, sc-geeksquad-core sc-font-icons Best Buy dep-confusion, Baileys-lure wave 7, bs58x64 crypto-wallet encoding typosquats
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, Amazon Inspector, kam193 bad-packages
- Incident ID: multi-2026-10-20-ghsa-malware-sweep

## Affected packages (34)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@an1mshnpmb9c84920/gat-scope-target-125ec19a](https://dependencywatch.io/package/npm/@an1mshnpmb9c84920/gat-scope-target-125ec19a) | npm | * |
| [@an1mshnpmb9c84920/oidc-cross-cafb9d929e](https://dependencywatch.io/package/npm/@an1mshnpmb9c84920/oidc-cross-cafb9d929e) | npm | * |
| [@an1mshnpmb9c84920/pipe-compat-m19r8](https://dependencywatch.io/package/npm/@an1mshnpmb9c84920/pipe-compat-m19r8) | npm | * |
| [@an1mshnpmb9c84920/pipe-dns-m19t2](https://dependencywatch.io/package/npm/@an1mshnpmb9c84920/pipe-dns-m19t2) | npm | * |
| [@an1mshnpmb9c84920/stage-fn-m19p2](https://dependencywatch.io/package/npm/@an1mshnpmb9c84920/stage-fn-m19p2) | npm | * |
| [@an1mshnpmb9c84920/stage-outer-m19s5](https://dependencywatch.io/package/npm/@an1mshnpmb9c84920/stage-outer-m19s5) | npm | * |
| [@an1mshnpmb9c84920/stage-repo-m19g7](https://dependencywatch.io/package/npm/@an1mshnpmb9c84920/stage-repo-m19g7) | npm | * |
| [@decoopus/chatgpt-setup](https://dependencywatch.io/package/npm/@decoopus/chatgpt-setup) | npm | * |
| [@decoopus/claude-setup](https://dependencywatch.io/package/npm/@decoopus/claude-setup) | npm | * |
| [aemath-baileys](https://dependencywatch.io/package/npm/aemath-baileys) | npm | * |
| [aldi02-baileys](https://dependencywatch.io/package/npm/aldi02-baileys) | npm | * |
| [api-anthropic](https://dependencywatch.io/package/npm/api-anthropic) | npm | * |
| [asurion](https://dependencywatch.io/package/pypi/asurion) | PyPI | 99.0.0 |
| [base58x64](https://dependencywatch.io/package/npm/base58x64) | npm | * |
| [bs58x64](https://dependencywatch.io/package/npm/bs58x64) | npm | * |
| [bs58x64.js](https://dependencywatch.io/package/npm/bs58x64.js) | npm | * |
| [chatgpt-desktop-setup](https://dependencywatch.io/package/npm/chatgpt-desktop-setup) | npm | * |
| [chatgpt-pro-activator](https://dependencywatch.io/package/npm/chatgpt-pro-activator) | npm | * |
| [chatgpt-pro-setup-tool](https://dependencywatch.io/package/npm/chatgpt-pro-setup-tool) | npm | * |
| [claude-desktop-setup](https://dependencywatch.io/package/npm/claude-desktop-setup) | npm | * |
| [codex-setup](https://dependencywatch.io/package/npm/codex-setup) | npm | * |
| [ichigo-baileys](https://dependencywatch.io/package/npm/ichigo-baileys) | npm | * |
| [item-validator](https://dependencywatch.io/package/npm/item-validator) | npm | * |
| [items-validator](https://dependencywatch.io/package/npm/items-validator) | npm | * |
| [rubbydev-crash-baileys](https://dependencywatch.io/package/npm/rubbydev-crash-baileys) | npm | * |
| [sc-font-icons](https://dependencywatch.io/package/npm/sc-font-icons) | npm | 9999.0.0, 99.9.1 |
| [sc-geeksquad-core](https://dependencywatch.io/package/npm/sc-geeksquad-core) | npm | 9999.0.0, 99.9.1 |
| [ticketcathayoct12](https://dependencywatch.io/package/npm/ticketcathayoct12) | npm | * |
| [vinted-mocked-apis](https://dependencywatch.io/package/pypi/vinted-mocked-apis) | PyPI | 99.0.0 |
| [xcvrenzcompany](https://dependencywatch.io/package/npm/xcvrenzcompany) | npm | * |
| [xzbails](https://dependencywatch.io/package/npm/xzbails) | npm | * |
| [xzvexpzcbailey](https://dependencywatch.io/package/npm/xzvexpzcbailey) | npm | * |
| [zero-baileys](https://dependencywatch.io/package/npm/zero-baileys) | npm | * |
| [zeroz-baileys](https://dependencywatch.io/package/npm/zeroz-baileys) | npm | * |

## What happened

Between 2026-10-19 06:00 UTC (yesterday`s sweep cutoff) and 2026-10-20 06:00 UTC (today`s ingest-window start), the GitHub Advisory Database published ~150+ fresh malware advisories. The great majority are automated-publication noise (SEO-spam music-download typosquats, 6-char gibberish takedowns, and other low-signal CWE-506 boilerplate) with no vendor runtime analysis published. The clusters below are the day`s notable operator-shaped activity.

## Headlines

**PyPI `asurion` + `vinted-mocked-apis` kam193 dep-confusion probes** (Cluster A, 2 packages at `99.0.0`): `asurion` is the only 2026-10-20 publication in this sweep; both are classic kam193 bug-bounty / red-team install-time host-info exfil, no credential or RCE payload.

**`@an1mshnpmb9c84920` npm scope attack-framework-shaped burst** (Cluster B, 7 packages): `stage-outer`/`stage-repo`/`stage-fn`/`pipe-dns`/`pipe-compat`/`oidc-cross`/`gat-scope-target` module names read like worm staging primitives rather than coincidental slugs. All tombstoned to `0.0.1-security` within ~5 minutes of initial publish; no runtime analysis available because the original versions were taken down before vendor collection.

**AI-assistant setup lure cluster** (Cluster C, 8 packages across OpenAI + Anthropic brand surfaces): `codex-setup`, `chatgpt-pro-setup-tool`, `chatgpt-desktop-setup`, `claude-desktop-setup`, `chatgpt-pro-activator`, `api-anthropic`, `@decoopus/claude-setup`, `@decoopus/chatgpt-setup`. Likely operator-shared with the earlier `anthropic-setup` lure (MAL-2026-12510, Aug 2026) that hijacked `ANTHROPIC_BASE_URL` to `sugarball.vercel.app` - pattern-matched inference, not confirmed from today`s records.

**`sc-geeksquad-core` + `sc-font-icons` Best Buy / Geek Squad dep-confusion** (Cluster D, 2 packages at `9999.0.0` + `99.9.1`): preinstall script HTTP-GETs host/user/cwd/registry/CI-slug reconnaissance to `http://75.119.137.232:31337/depconfuse` - sharp network IOC.

**Baileys-lure wave 7** (Cluster E, 8 new slugs): the largest single-day Baileys-brand-impersonation burst to date, directly extending the week-running campaign.

**`bs58x64` crypto-wallet-encoding typosquats** (Cluster F, 3 packages): shadows the ubiquitous `bs58` base58 encoding library used in every Solana / Bitcoin / Monero wallet SDK; CWE-506 boilerplate, no runtime analysis.

## Classification

`sweep`. Severity `medium` - every cluster today is at the dep-confusion / lure / typosquat / CWE-506-boilerplate tier with no confirmed credential-stealer or RCE payload reaching a legitimate dependency people already use. No cluster independently merits `high` because the only runtime-confirmed payload (Cluster D, hardcoded IP exfil of host-info) is reconnaissance-only. No cluster merits `critical` - no hijack of a legitimate existing upstream and no worm propagation observed today.

## Discovery

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `Amazon Inspector` (Cluster D source hashes), `kam193 bad-packages` (Cluster A source hashes).

## Impact

- **Cluster A - PyPI `asurion` + `vinted-mocked-apis` kam193 dep-confusion pentest probes (dependency-confusion; `GENERIC-standard-pypi-install-pentest` campaign identifier, 99.0.0 sentinel versions; both packages override the install command in `setup.py` to run install-time code; both exfiltrate basic host info only, no further payload)**: `asurion@99.0.0` (GHSA-59m7-pf46-28fr, MAL-2026-18045, source hash `kam193` `05820dd77e1f73d1a01797af6f10c6fa4ae22038be3fcd6a8cbd8c117cf6436c`; **published 2026-10-20**, the only 2026-10-20 publication in this sweep) and `vinted-mocked-apis@99.0.0` (GHSA-jgrw-w3x3-w5cp, MAL-2026-17943, source hash `kam193` `c71ab868e2ac254cfa135aa73c1ed19a3ddb1c82793efa3ff8466c3c5aa44b02` + `ossf-package-analysis` `55332d91b2afbf62923f1d853c6df3a5c8f768797a3176effdecba07b91d4fbf`, OSSF Package Analysis separately flagged for communicating with a domain associated with malicious activity; published 2026-10-19). Both are classic kam193 bad-packages probes: public PyPI squats on names that could plausibly map to internal registries (`asurion` = telecommunications insurance brand, `vinted-mocked-apis` = test-fixture scope for the Vinted marketplace). Severity `medium` for this cluster (dep-confusion probe tier - confirmed install-time code and basic host-info exfil, no credential or RCE payload disclosed; `kam193` is a known bug-bounty / red-team actor who publishes to the `99.0.0` sentinel to catch internal-registry misresolution)
- **Cluster B - npm `@an1mshnpmb9c84920` scope: attack-framework-shaped stage/pipe/oidc-cross/gat-scope burst (malicious-package; 7 packages all tombstoned to `0.0.1-security` within ~5 minutes of initial publish, no vendor runtime analysis published, CWE-506 boilerplate takedowns; scope name shape `an1msh[npm][hex]` + per-package suffix pattern `stage-outer`/`stage-repo`/`stage-fn`/`pipe-dns`/`pipe-compat`/`oidc-cross`/`gat-scope-target` reads like worm or attack-framework module names rather than a legitimate internal scope)**: `@an1mshnpmb9c84920/stage-outer-m19s5` (GHSA-6grm-8w52-497r, MAL-2026-18051, published 2026-10-19T22:19 UTC - the OSSF record is pure `ghsa-malware` boilerplate with no additional analysis), `@an1mshnpmb9c84920/stage-repo-m19g7` (GHSA-42h4-pvwr-r87v), `@an1mshnpmb9c84920/stage-fn-m19p2` (GHSA-h79g-mv9q-7p44), `@an1mshnpmb9c84920/pipe-dns-m19t2` (GHSA-3xpj-mfqg-v52m), `@an1mshnpmb9c84920/pipe-compat-m19r8` (GHSA-hxmq-p768-mjhf), `@an1mshnpmb9c84920/oidc-cross-cafb9d929e` (GHSA-mmr7-9m67-9qh5), `@an1mshnpmb9c84920/gat-scope-target-125ec19a` (GHSA-87gv-mmww-whrr). npm registry metadata confirms each slug now resolves to `0.0.1-security` (npm`s standard holding placeholder) published roughly 5 minutes after a short-lived `0.0.0-stage` stub, matching npm`s own takedown template; the originally-published versions and their payload are not available for inspection and GHSA/OSSF did not retain source hashes. The `m19s5`/`m19g7`/`m19p2`/`m19r8`/`m19t2` suffix pattern consistently includes `m19` (likely `month 10 day 19` tag) + a two-character variant - consistent with an automated-publication framework stamping its artifacts; `oidc-cross` and `gat-scope-target` module names mirror the lexicon of OIDC-token-cross-exchange + GitHub-Actions-scope-target primitives that have appeared in prior Shai-Hulud / Mini-Shai-Hulud exploitation chains. Severity `medium` for this cluster (install-time code execution risk per CWE-506 pattern, no runtime analysis published; the operator profile - automated-framework naming, mass-publish-and-takedown cadence under a single scope - is the primary signal and does not reach `high` without vendor runtime analysis confirming a stealer or RCE payload)
- **Cluster C - npm AI-assistant setup lures (malicious-package / typosquat; 8 packages, two with the `@decoopus` scope; CWE-506 boilerplate takedowns with no runtime analysis published, but naming shape is a direct echo of the earlier `anthropic-setup` lure (MAL-2026-12510, Aug 2026) that overwrote `ANTHROPIC_BASE_URL` to `sugarball.vercel.app` to hijack every Claude CLI prompt and response; today`s cluster covers both Anthropic and OpenAI brand surfaces)**: `codex-setup` (GHSA-h8cg-xwfv-9x77), `chatgpt-pro-setup-tool` (GHSA-xwx3-5h3q-2v8r), `chatgpt-desktop-setup` (GHSA-pgq5-xq28-533m), `claude-desktop-setup` (GHSA-f4mf-vhm8-xxqc), `chatgpt-pro-activator` (GHSA-qp43-mgx6-56x2), `api-anthropic` (GHSA-cj9w-7h22-q93g), `@decoopus/claude-setup` (GHSA-p7p5-jrq5-q47x), `@decoopus/chatgpt-setup` (GHSA-4632-2g34-4r9w). All eight published and taken down 2026-10-19 with the standard CWE-506 `treat as fully compromised` advisory boilerplate. All eight impersonate first-party AI-assistant installer/activator surfaces (official OpenAI distribution is `@openai/codex` on npm; Anthropic ships Claude Code via `@anthropic-ai/claude-code`; neither brand ships `*-setup` / `*-activator` packages). Likely operator-shared infrastructure with the sugarball.vercel.app anthropic-setup wave (the pattern - overwrite `ANTHROPIC_BASE_URL` / `OPENAI_API_BASE` in `~/.claude/settings.json` or `~/.openai/*` to a lookalike base URL - captures the installer`s API key and every subsequent prompt/response), but no runtime analysis is published on today`s GHSA records so this is a pattern-matching inference rather than confirmed. Severity `medium` for this cluster (install-time code execution risk per CWE-506 pattern, no runtime analysis published; the AI-brand-impersonation naming + the `@decoopus` scope`s dual-brand publication strongly suggest the sugarball.vercel.app operator - developers who installed should rotate their Anthropic / OpenAI API keys and audit `~/.claude/settings.json` + `~/.openai/*` for a non-upstream base URL regardless of which specific package was installed)
- **Cluster D - npm `sc-geeksquad-core` + `sc-font-icons` Best Buy / Geek Squad dep-confusion probe (dependency-confusion; confirmed install-time payload with specific IOCs; 2 packages, 9999.0.0 + 99.9.1 sentinel versions; same amazon-inspector + ossf-package-analysis source identifier shape, same hardcoded IP:port)**: `sc-geeksquad-core@9999.0.0, 99.9.1` (GHSA-46pw-5vw5-769w, MAL-2026-12435, amazon-inspector source hash `2fd2458d8a5843f57187868a2c244a376dd3d2daef420d3c564c775ef6a2782a`, ossf-package-analysis source `2094a7f35be1c723c65b36c32884f2f0e99840ef0bc090a1fbcb1f5568b93ef2`) and `sc-font-icons@9999.0.0, 99.9.1` (GHSA-pcqq-p5c7-m382, MAL-2026-12800, amazon-inspector `1b8c91edd839dd00f2e58ad9296742f8c3c5ff126523bbd8ed7561fef7c8516e`, ossf-package-analysis `1b1e3d1dcd8af0ee16e8da5b321d8c532f9707503a36d90a8802b7835305fceb`). The `9999.0.0` versions run a `preinstall` script that collects hostname, OS username, working directory, npm registry setting, and CI repository-slug environment variables and HTTP-GETs them to `http://75.119.137.232:31337/depconfuse`. The `99.9.1` versions are a parallel OSSF-Package-Analysis flag by malicious-domain reputation (the specific C2 for the second-pattern version is not disclosed at the OSSF-record level). Target: Best Buy Geek Squad - `sc-` is a plausible internal scope prefix for Best Buy`s Service Center / Store Compute organisation, and `sc-geeksquad-core` + `sc-font-icons` map to a design-system + font-icons internal utility pair that most retailers maintain. Severity `medium` for this cluster (dep-confusion probe tier - confirmed install-time code + hostname / registry / CI-slug reconnaissance exfil to a specific hardcoded IP, but exfil scope is scoped to install-time metadata, not credentials; the hardcoded IP and port 31337 are now a sharp network IOC and the TWO-version publication pattern - a `9999.0.0` operator and a `99.9.1` operator both landing on the same scope - is unusual and may suggest multiple actors probed the same target name)
- **Cluster E - npm Baileys-lure operator wave 7 (malicious-package / typosquat continuation; this directly extends the week-running Baileys-brand-impersonation campaign that ran through wave 6 under `@fluxionii/baileys` + `@ostyado/baileys` yesterday; 8 new slugs, all unscoped or under new unused scopes; CWE-506 boilerplate takedowns with no published IOCs)**: `zeroz-baileys` (GHSA-fwfc-f4gp-qrcq), `ichigo-baileys` (GHSA-q66v-22v7-2qj9), `zero-baileys` (GHSA-v486-jrrq-rhwx), `aemath-baileys` (GHSA-rc7v-fm82-xp4x), `aldi02-baileys` (GHSA-fm6q-x7qr-xmpw), `rubbydev-crash-baileys` (GHSA-h9p4-38hj-p2gj), `xzbails` (GHSA-6853-2fcq-h2jm), `xzvexpzcbailey` (GHSA-73c8-rgvx-fw82). All published and taken down 2026-10-19 with the standard GHSA CWE-506 "any computer that has this package installed should be considered fully compromised" boilerplate - no OSSF record, no vendor runtime analysis. The naming shape (prefix / suffix of `baileys` under new one-off slugs) continues the operator lineage from waves 1-6 (prior Baileys slugs catalogued across sweeps 2026-10-11 through 2026-10-19); the real WhatsApp automation library is `@whiskeysockets/baileys`. Severity `medium` for this cluster (install-time code execution risk per CWE-506 pattern, no vendor runtime analysis published; the operator`s week-running wave count and consistent naming lineage are the operator continuity signal, now reaching 8 slugs in a single 24-hour window - the largest Baileys-lure burst to date)
- **Cluster F - npm `bs58x64` crypto-wallet encoding typosquats (typosquat; 3 packages shadowing the ubiquitous `bs58` base58 encoding library used across every Solana / Bitcoin / Monero wallet SDK; CWE-506 boilerplate takedowns, no runtime analysis published, but the base58-encoding library is a known Solana/Bitcoin wallet-drainer target)**: `bs58x64` (GHSA-3xp5-jhc7-xcm9), `bs58x64.js` (GHSA-rhf8-vjg2-4vpv), `base58x64` (GHSA-57vp-ppmx-cgc5). All three published and taken down 2026-10-19 with the standard CWE-506 boilerplate. `bs58` is one of the most-depended-on npm packages in the Solana / Bitcoin / Monero wallet-SDK stack (every wallet library uses it for base58 encoding of addresses and private keys); a trojanised `bs58*` typosquat is a high-value infostealer vector because the import appears in every wallet code path. Severity `medium` for this cluster (install-time code execution risk per CWE-506 pattern, no vendor runtime analysis published; the operator`s target shape - the base58 encoding library specifically - strongly suggests crypto-wallet-drainer intent, but confirming requires runtime analysis of the tombstoned original versions)
- **Cluster G - npm miscellaneous dep-confusion / target-named probes (dependency-confusion / malicious-package; 4 packages with specific company or target-brand names; CWE-506 boilerplate takedowns)**: `xcvrenzcompany` (GHSA-5f99-96jc-hg98 - target "cvrenz" is likely a company internal-scope probe), `ticketcathayoct12` (GHSA-g7mg-3h9r-c8h3 - dated with "oct12", likely a time-stamped Cathay Pacific / Cathay-brand ticket-system probe), `items-validator` (GHSA-ff48-h3v7-m43r), `item-validator` (GHSA-rpgc-c7g7-g8fh - these two shadow a common internal-utility slug `item(s)-validator`), plus the obviously-tombstoned noise cluster `prastzyy` (GHSA-qhp3-5q65-76mj) + `prastzy` (GHSA-mwjq-f2w5-934c). Severity `medium` for this cluster
- **Cluster H - npm SEO-spam music/album-download typosquat cluster (malicious-package / typosquat; ~100 packages with very long slugs of the shape `(available|download|now|zip|mp3)-*-(album|song|track|year-number)-(artist)-(hex)`; CWE-506 boilerplate takedowns, no runtime analysis; appears to be a pivot of the SEO-piracy spam cluster whose aim is Google-search-poisoning for "download free album MP3 ..." queries - the npm package is a wrapper to drive clicks; characteristic suffix of `-<alphanumeric>-<alphanumeric>` hex IDs identifies the batch generator)**: Representative sample (not exhaustive - 100+ advisories match this shape across pages 3-5 of today`s GHSA listing): `do-wnload-available-provincial-q7d0i-muzxoj`, `ava-ilable-down-load-mp3-today-75491-life-after-youth-hfdu7-yzwkck`, `a-lbum-do-wnload-avai-lable-file-10635-about-to-choke-pzt0k-onnsvp`, `availab-le-alb-um-zip-music-is-rotted-one-note-7chcp-frcmmy`, `down-load-available-zip-now-8238-bricks-are-heavy-0v3kh-yluceh`, `down-lo-ad-now-zip-mp3-duppy-writer-9bxwq-qpdzyd`, `mp3-do-wnload-file-to-day-d-nu951-cjkdsy`, plus ~90 more unique slugs. Severity `medium` for this cluster (install-time code execution risk per CWE-506 pattern per advisory, but the batch is dominated by SEO-spam shape rather than confirmed credential-stealer or RCE payload)
- **Cluster I - npm noise: random-looking 6-character gibberish takedowns (malicious-package; ~40 packages with random 6-char lowercase alphanumeric names; CWE-506 boilerplate; low-signal)**: `1n9lip`, `aqj3w7`, `4p9kgm`, `ljem3j`, `j5opb7`, `gtjgd4`, `ysqp68`, `rhlozh`, `giu094`, `ju0oud`, `esgbz5`, `3qamjp`, `3gr2dj`, `lstsyw`, `v49yzy`, `waojpf`, `ivzlid`, `zubn7b`, `x294tn`, `g23p4g`, `oo9fja`, `tkacg3`, `rvmbnj`, `g8ez1y`, `noe77e`, `8h66ok`, `8i7pp4`, `5xzkuy`, `f0klcr`, `j019qc`, `3gr841`, `f4iomt`, `5k5t5q`, `nsdhjuiwqxmhsf1`, `mxckjdgweuxpsiohd`, `dsjklweuvhgsdcq`, `mx3dxhgic8xhd6`, `vjkpwjxbvndelta`, `zxhgssiyluwxchn`, `xcvrenzcompany` (also listed in Cluster G), `array-inline`, `array-inline-transform`. All CWE-506 boilerplate - likely automated-publication noise from a generator producing random short identifiers. Severity `medium`
- **Operator continuity**: this sweep extends four week-running operator campaigns observed on prior sweeps - **Baileys-lure operator wave 7** (8 new slugs today, the largest single-day burst), the **sugarball.vercel.app AI-assistant-setup lure operator** (pattern-matched: 8 setup/activator packages today across OpenAI + Anthropic brand surfaces, two under `@decoopus` scope), the **`@flexmr` / `@fmr-ap149494` dep-confusion operator** (NOT re-observed today after yesterday`s wave 3 scope rotation - a wave 4 under a further variant scope was predicted; status QUIET as of this sweep), and the **transfer.archivete.am PyPI RCE family operator** (fabdeploycheck / fabtoolkit, NOT re-observed today). **New campaign-shaped scopes**: `@an1mshnpmb9c84920` (Cluster B, attack-framework-shaped stage/pipe/oidc-cross/gat-scope burst). **New operator infrastructure**: `75.119.137.232:31337/depconfuse` (Cluster D, sc-geeksquad dep-confusion) - IP-level block is sharp. **No new activity** from: yesterday`s `fabdeploycheck`+`fabtoolkit` operator (`transfer.archivete.am` + fab* kill-list prior-generation implants `FABDRV3`/`fabdrv2`/`connection ready` unchanged), `leakdeep` PyPI Windows credential + Discord stealer (quiet), `ukraine69` destructive Telegram payload operator (quiet), `2026-10-emberlytts` cryptominer campaign extending `2026-10-voxeval` (8-package audio TTS/ASR lure wave quiet), `conx3993` (`realwbx.com` unchanged), `@beloved-lenora/opencode-*` AI-coding-tool lure (wave 1 quiet), `agentaix` (`py-worm`/`py-wormgpt`/`py-sock2` quiet), Wix dep-confusion wave 3, `seapy-ops`, `getpubip`, `proxyrubika`, `tailwindcss-form`/`-uniform` typosquat operator, `@pkgship/frpc-linux-arm64` trojanised FRP binary (quiet). [Apex Accelerator REF8801 (2026-10-19 carve-out)](https://dependencywatch.io/incident/npm-2026-10-19-apex-accelerator-malicious-npm-packages), [TensorLake AI maintainer compromise (2026-10-08 carve-out)](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise), and [hridoy FB credential stealer (2026-10-12 carve-out)](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer) all remain confirmed-recovered with no wave-2 malicious republish observed

## What to do

1. **For Cluster A (`asurion` + `vinted-mocked-apis` PyPI kam193 dep-confusion probes)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, and `conda env` for `asurion` at `99.0.0` or `vinted-mocked-apis` at `99.0.0`. If your organisation operates under the `asurion` brand (telecommunications insurance) or publishes to an internal `asurion` package namespace, confirm your internal-registry resolution order prevents public-PyPI shadowing. If your organisation is Vinted or publishes an internal `vinted-mocked-apis` test-fixture, the same applies. Add both package names to your public-registry denylist. Both are kam193 bug-bounty / red-team probes - the install-time exfil scope is limited to basic host info and should NOT include credentials, so no credential-rotation is required BUT confirm nothing in the installer process environment leaked beyond hostname / username / cwd. On any CI job that resolved either package: review the preinstall script output and audit outbound connections during the install window
2. **For Cluster B (`@an1mshnpmb9c84920` scope attack-framework-shaped burst, 7 packages)**: grep every `package.json`, `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `bun.lock`, and internal registry mirrors for the full scope `@an1mshnpmb9c84920/*`. On ANY hit on any host that ran `npm install` or `yarn install` during the exposure window (2026-10-19T22:19 UTC until the npm security holder replaced each package roughly 5 minutes later): treat the host as a candidate `treat as fully compromised` event per the standard CWE-506 boilerplate. The attack-framework-shaped module names (`stage-outer`, `stage-repo`, `stage-fn`, `pipe-dns`, `pipe-compat`, `oidc-cross`, `gat-scope-target`) read like worm staging primitives rather than coincidental slugs, so rotate every credential reachable from the host - GitHub OIDC trust / GitHub Actions tokens / npm publish tokens / cloud credentials / Kubernetes service-account tokens - and image the host for forensic review before clean-rebuild. Add the full `@an1mshnpmb9c84920` scope to your public-registry denylist. Watch for a follow-up burst under a sibling scope (`@an1mshnpm*` + hex suffix) in the 2026-10-20 / 2026-10-21 window - the operator`s mass-publication + fast-tombstone pattern suggests a repeat is possible
3. **For Cluster C (AI-assistant setup lures, 8 packages, likely sugarball.vercel.app operator continuity)**: grep every `package.json`, lockfiles, and internal registry mirrors for `codex-setup`, `chatgpt-pro-setup-tool`, `chatgpt-desktop-setup`, `claude-desktop-setup`, `chatgpt-pro-activator`, `api-anthropic`, `@decoopus/claude-setup`, `@decoopus/chatgpt-setup`. On ANY hit on a developer workstation or CI host: (1) audit `~/.claude/settings.json` for a non-upstream `ANTHROPIC_BASE_URL` (upstream is `https://api.anthropic.com`); (2) audit `~/.openai/*` + any shell-env for a non-upstream `OPENAI_API_BASE` or `OPENAI_BASE_URL` (upstream is `https://api.openai.com/v1`); (3) rotate the installer`s Anthropic API key, OpenAI API key, Claude Code / Codex / Cursor / Windsurf session credentials, and any other AI-assistant tokens; (4) assume every prompt + response + tool-call result the installer ran through Claude or ChatGPT during the exposure window was mirrored to attacker infrastructure. Add the following scopes to your public-registry denylist: `@decoopus`. Treat ANY future `*-setup`, `*-activator`, `*-desktop-setup` package under an AI brand name as suspect by default - official OpenAI distribution is `@openai/codex` only; official Anthropic distribution is `@anthropic-ai/claude-code` only. Watch for follow-up slugs under new scopes (`@anthropic-tools/*`, `@openai-cli/*`, etc.) - the lure operator`s weekly cadence suggests another publication
4. **For Cluster D (`sc-geeksquad-core` + `sc-font-icons` Best Buy / Geek Squad dep-confusion, hardcoded IP IOC)**: grep every `package.json`, lockfiles, Dockerfiles, container-build manifests, and internal registry mirrors for `sc-geeksquad-core@9999.0.0, 99.9.1` and `sc-font-icons@9999.0.0, 99.9.1`. If your organisation operates under the `sc-` prefix for internal packages (Service Center / Store Compute / anything else matching this shape) you are a probe target - audit your internal-registry resolution order to prevent public-npm from shadowing an internal `sc-*` scope. If you are Best Buy / Geek Squad / any Best Buy subsidiary, this is a direct probe against your internal-registry naming convention; audit your lockfiles across all repos. Add `sc-geeksquad-core` and `sc-font-icons` to your public-registry denylist. **Egress block**: `75.119.137.232:31337` across every CI, build, dev-workstation, and production host - the hardcoded IP + port 31337 + `/depconfuse` path is a sharp network IOC and legitimate development workflows will never need it
5. **For Cluster E (Baileys-lure wave 7, 8 new slugs)**: grep every `package.json`, lockfiles, and internal registry mirrors for `zeroz-baileys`, `ichigo-baileys`, `zero-baileys`, `aemath-baileys`, `aldi02-baileys`, `rubbydev-crash-baileys`, `xzbails`, `xzvexpzcbailey` at any version. All are first-publish lures under new scopes/slugs; none corresponds to a legitimate upstream. Treat installation on any host as a `treat as fully compromised` event per the standard CWE-506 boilerplate - rotate every credential reachable from the host and image it before clean-rebuild. Keep the `baileys-brand-impersonation` denylist policy in place: the real WhatsApp automation library is `@whiskeysockets/baileys` on npm - any `*-baileys` / `@*/baileys` / `@*/baileyss` / `*bails` / `*bailey*` package under any other scope is suspect by default. Watch for a wave 8 under additional single-slug scopes - the operator`s weekly cadence suggests another 4-8-slug publication every 24-48 hours
6. **For Cluster F (`bs58x64` + `bs58x64.js` + `base58x64` crypto-wallet encoding typosquats)**: grep every `package.json`, lockfiles, and internal registry mirrors for `bs58x64`, `bs58x64.js`, `base58x64` at any version. If any wallet-related code path (Solana / Bitcoin / Monero wallet SDK, crypto exchange integration, blockchain tooling) resolved any of these: assume every private key / seed phrase / signing key / wallet credential that passed through base58 encoding during the exposure window may have been exfiltrated. Rotate every wallet-signing key, every API key for connected exchanges, every Solana / Ethereum RPC-provider key, and drain affected hot wallets to fresh ones. The real upstream is `bs58` (unscoped) - any `bs58*` package other than `bs58` itself is suspect by default; same policy for `base58*` variants
7. **For Clusters G, H, I (miscellaneous dep-confusion probes, SEO-spam music-download typosquats, 6-char gibberish noise)**: grep every lockfile for the full package-name list in the impact section above. For Cluster G target-named probes (`xcvrenzcompany`, `ticketcathayoct12`, `items-validator`, `item-validator`): if your organisation operates under any matching brand/acronym, audit your internal-registry resolution order and add the slug to your public-registry denylist. For Cluster H SEO-spam (~100 slugs matching the `(download|available|zip|mp3)-*-(album|song)-*-hex-hex` shape): any lockfile hit is itself suspicious - these packages have no plausible legitimate use. For Cluster I noise (`1n9lip`, `aqj3w7`, etc. - 40+ random 6-char slugs): any lockfile hit is almost certainly a resolution error or an attempt to shadow a developer typo; investigate and remove
8. **Standing egress-denylist carry-forward from prior sweeps** (keep in place; today adds only `75.119.137.232:31337` + `/depconfuse` path): `transfer.archivete.am` apex + `/H2Uxm/fabdeploycheck-config.json` path (2026-10-19 Cluster A), `realwbx.com` apex + `/ip.php` + `/ip` paths (2026-10-15 and 2026-10-17), `artifacts.creditslib.com` apex + `/npm/*` paths (2026-10-17), `login.fromthehotel.com` apex + `/muse` + `/api/poems/code` + `/api/art/downloads/*` paths (2026-10-17), `googleforum.pythonanywhere.com` exact subdomain (2026-10-11), `space-z.ai` apex + `preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai` + `b196q82k8891-d.space-z.ai` subdomains (2026-10-14), `dxpoc.gt.tc` apex (2026-10-09), `raw.githubusercontent.com/anonrider404/pypl/*` path (2026-10-16), `api-bsx.pages.dev` apex + `/download` path (2026-10-16), `177.7.60.239:48080` + `oob.recon.dev` (2026-10-16), `uncoder.eu.org` apex + `/cc-checker/api.php` path (2026-10-15), `accenture-npm.azurewebsites.net`, `limbomail.com` apex + `github.com/lunexindonesia/node-net-pool` + `github.com/trktgq0wbre1/node-net-pool`, `github.com/unicodeces/font-atlas`, `collector.oob.s4yhii.com` + `*.oob.s4yhii.com` + `s4yhii.com` apex, `64.181.165.115/dc`, `167.88.172.33:8087` + `jsonspack.com`, `goxtools.shop` apex, `minhdong.site` apex + GitHub user `VangBanLaNhat`, `45.138.12.177:8089`, `185.158.107.175:8787`, `ltidi.storage.googleapis.com/depenconf/`, `oob.s4yhii.com:9999/native`, `*.oast.pro`/`*.oast.me`/`*.oast.fun`/`*.oast.site`/`*.oastify.com`, `frjmzbjbhwvtdnsuodmu.supabase.co`, `api.npoint.io` apex, `tele.metry.orgin.net`, `morroncr0w.io`, `api.telegram.org` on untrusted CI/build hosts, `appsecc.com`, `webhook.site/*`, `nfjbill.ren`, `storage.googleapis.com/depenconf/`, `10.0.19.0/24` + `10.0.49.0/24`, `api.nm-streetwear.space`, Discord webhook URL pattern, `ipify.org` + `ifconfig.me`, `gitflic.ru`, `api.wagmiwallet.org`, `backend-cybersecuritydashboard.onrender.com`, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, `chinazhangsan.ccwu.cc`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `npm-canary.aveliscare.com`, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil patterns, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, `tuamaeaquelaursa.com`, `45.138.0.0/16` RubyGems wgkit CIDRs, `apexaccs.org` apex + subdomains, `arenapex.cloud`, `apexfdn.xyz` apex + subdomains, `fdn4apex.com`, `router-apex.com` apex + subdomains, `ccmihr.com`, `0auth-chromium.com`, `ehegisnightmare.icu`, `cloudmain365duo.top`

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-59m7-pf46-28fr - pypi asurion (Cluster A - kam193 dep-confusion pentest probe, 99.0.0 sentinel, MAL-2026-18045, GENERIC-standard-pypi-install-pentest campaign, published 2026-10-20 the only 2026-10-20 publication in this sweep)](https://github.com/advisories/GHSA-59m7-pf46-28fr) - GitHub
- [GHSA-jgrw-w3x3-w5cp - pypi vinted-mocked-apis (Cluster A - kam193 dep-confusion probe + separate OSSF-Package-Analysis flag for malicious-domain communication, 99.0.0 sentinel, MAL-2026-17943)](https://github.com/advisories/GHSA-jgrw-w3x3-w5cp) - GitHub
- [GHSA-6grm-8w52-497r - npm @an1mshnpmb9c84920/stage-outer-m19s5 (Cluster B - attack-framework-shaped stage/pipe/oidc-cross burst, MAL-2026-18051, published 2026-10-19T22:19 UTC, tombstoned to 0.0.1-security within 5 minutes)](https://github.com/advisories/GHSA-6grm-8w52-497r) - GitHub
- [GHSA-42h4-pvwr-r87v - npm @an1mshnpmb9c84920/stage-repo-m19g7 (Cluster B companion)](https://github.com/advisories/GHSA-42h4-pvwr-r87v) - GitHub
- [GHSA-h79g-mv9q-7p44 - npm @an1mshnpmb9c84920/stage-fn-m19p2 (Cluster B companion)](https://github.com/advisories/GHSA-h79g-mv9q-7p44) - GitHub
- [GHSA-3xpj-mfqg-v52m - npm @an1mshnpmb9c84920/pipe-dns-m19t2 (Cluster B companion)](https://github.com/advisories/GHSA-3xpj-mfqg-v52m) - GitHub
- [GHSA-hxmq-p768-mjhf - npm @an1mshnpmb9c84920/pipe-compat-m19r8 (Cluster B companion)](https://github.com/advisories/GHSA-hxmq-p768-mjhf) - GitHub
- [GHSA-mmr7-9m67-9qh5 - npm @an1mshnpmb9c84920/oidc-cross-cafb9d929e (Cluster B companion - OIDC-related module name)](https://github.com/advisories/GHSA-mmr7-9m67-9qh5) - GitHub
- [GHSA-87gv-mmww-whrr - npm @an1mshnpmb9c84920/gat-scope-target-125ec19a (Cluster B companion - GitHub-Actions-scope-target shaped module name)](https://github.com/advisories/GHSA-87gv-mmww-whrr) - GitHub
- [GHSA-h8cg-xwfv-9x77 - npm codex-setup (Cluster C - OpenAI Codex brand impersonation; official distribution is @openai/codex only)](https://github.com/advisories/GHSA-h8cg-xwfv-9x77) - GitHub
- [GHSA-xwx3-5h3q-2v8r - npm chatgpt-pro-setup-tool (Cluster C - OpenAI ChatGPT brand impersonation)](https://github.com/advisories/GHSA-xwx3-5h3q-2v8r) - GitHub
- [GHSA-pgq5-xq28-533m - npm chatgpt-desktop-setup (Cluster C - OpenAI ChatGPT brand impersonation)](https://github.com/advisories/GHSA-pgq5-xq28-533m) - GitHub
- [GHSA-f4mf-vhm8-xxqc - npm claude-desktop-setup (Cluster C - Anthropic Claude brand impersonation; official distribution is @anthropic-ai/claude-code only)](https://github.com/advisories/GHSA-f4mf-vhm8-xxqc) - GitHub
- [GHSA-qp43-mgx6-56x2 - npm chatgpt-pro-activator (Cluster C - OpenAI ChatGPT brand impersonation)](https://github.com/advisories/GHSA-qp43-mgx6-56x2) - GitHub
- [GHSA-cj9w-7h22-q93g - npm api-anthropic (Cluster C - Anthropic brand impersonation)](https://github.com/advisories/GHSA-cj9w-7h22-q93g) - GitHub
- [GHSA-p7p5-jrq5-q47x - npm @decoopus/claude-setup (Cluster C - @decoopus scope operator; Anthropic brand impersonation)](https://github.com/advisories/GHSA-p7p5-jrq5-q47x) - GitHub
- [GHSA-4632-2g34-4r9w - npm @decoopus/chatgpt-setup (Cluster C - @decoopus scope operator; OpenAI brand impersonation under same scope as Anthropic sibling confirms single-operator dual-brand run)](https://github.com/advisories/GHSA-4632-2g34-4r9w) - GitHub
- [GHSA-46pw-5vw5-769w - npm sc-geeksquad-core (Cluster D - Best Buy / Geek Squad dep-confusion probe, 9999.0.0 + 99.9.1 sentinels, preinstall script HTTP-GETs host/user/cwd/registry/CI-slug to http://75.119.137.232:31337/depconfuse, MAL-2026-12435, Amazon Inspector + OSSF Package Analysis)](https://github.com/advisories/GHSA-46pw-5vw5-769w) - GitHub
- [GHSA-pcqq-p5c7-m382 - npm sc-font-icons (Cluster D companion - same hardcoded IP 75.119.137.232:31337/depconfuse, MAL-2026-12800)](https://github.com/advisories/GHSA-pcqq-p5c7-m382) - GitHub
- [GHSA-fwfc-f4gp-qrcq - npm zeroz-baileys (Cluster E - Baileys-brand-impersonation wave 7)](https://github.com/advisories/GHSA-fwfc-f4gp-qrcq) - GitHub
- [GHSA-q66v-22v7-2qj9 - npm ichigo-baileys (Cluster E - Baileys wave 7)](https://github.com/advisories/GHSA-q66v-22v7-2qj9) - GitHub
- [GHSA-v486-jrrq-rhwx - npm zero-baileys (Cluster E - Baileys wave 7)](https://github.com/advisories/GHSA-v486-jrrq-rhwx) - GitHub
- [GHSA-rc7v-fm82-xp4x - npm aemath-baileys (Cluster E - Baileys wave 7)](https://github.com/advisories/GHSA-rc7v-fm82-xp4x) - GitHub
- [GHSA-fm6q-x7qr-xmpw - npm aldi02-baileys (Cluster E - Baileys wave 7)](https://github.com/advisories/GHSA-fm6q-x7qr-xmpw) - GitHub
- [GHSA-h9p4-38hj-p2gj - npm rubbydev-crash-baileys (Cluster E - Baileys wave 7)](https://github.com/advisories/GHSA-h9p4-38hj-p2gj) - GitHub
- [GHSA-6853-2fcq-h2jm - npm xzbails (Cluster E - Baileys wave 7)](https://github.com/advisories/GHSA-6853-2fcq-h2jm) - GitHub
- [GHSA-73c8-rgvx-fw82 - npm xzvexpzcbailey (Cluster E - Baileys wave 7)](https://github.com/advisories/GHSA-73c8-rgvx-fw82) - GitHub
- [GHSA-3xp5-jhc7-xcm9 - npm bs58x64 (Cluster F - base58 encoding typosquat shadowing bs58, crypto-wallet-drainer-shaped target)](https://github.com/advisories/GHSA-3xp5-jhc7-xcm9) - GitHub
- [GHSA-rhf8-vjg2-4vpv - npm bs58x64.js (Cluster F companion)](https://github.com/advisories/GHSA-rhf8-vjg2-4vpv) - GitHub
- [GHSA-57vp-ppmx-cgc5 - npm base58x64 (Cluster F companion)](https://github.com/advisories/GHSA-57vp-ppmx-cgc5) - GitHub
- [DependencyWatch: multi-2026-10-19-ghsa-malware-sweep (yesterday`s context - Baileys wave 6 @fluxionii/@ostyado direct predecessor to today`s Cluster E wave 7, @flexmr/@fmr-ap149494 FMR dep-confusion wave 3, @pkgship/frpc trojanised FRP binary, fabdeploycheck+fabtoolkit PyPI RCE family, @fcsmc dep-confusion)](https://dependencywatch.io/incident/multi-2026-10-19-ghsa-malware-sweep)
- [DependencyWatch: npm-2026-10-19-apex-accelerator-malicious-npm-packages (yesterday`s Apex Accelerator REF8801 carve-out)](https://dependencywatch.io/incident/npm-2026-10-19-apex-accelerator-malicious-npm-packages)
- [DependencyWatch: pypi-2026-10-18-ghsa-malware-sweep (2026-10-18 context - leakdeep Windows credential + Discord stealer, ukraine69 destructive Telegram payload, 2026-10-emberlytts cryptominer campaign)](https://dependencywatch.io/incident/pypi-2026-10-18-ghsa-malware-sweep)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-20-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-20-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).