DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 21 October 2026

HighAdvisory sweepnpmPyPI

GHSA 2026-10-20/21 batch (~90 advisories). Headline: new kam193 PyPI 2026-10-semvver typosquat family (semvver/semverr/semveer/semmver/semer/ssemver/deebug/debbug) with CONFIRMED pyupd binary download from c2-worker.crawlnet-claim.workers.dev and detached-process execution (sharp IOC). Baileys-lure wave 8 (@alannxd/baileys 27 versions, @dreamguyxeon/baileyx, @dreamguyxeon/libsignal-node). New @securihackbot/depconf-stage-* dep-confusion probe with hardcoded 34.143.131.27:18080/x-VA-1/main.js payload. sc-* Best Buy continuation (sc-announcer, sc-wizard).

Published 21 Oct 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-10-21-ghsa-malware-sweep
44
Packages tracked72 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
21 Oct 2026
Ecosystems
npmPyPI
Detected by
GitHub Advisory Database, OpenSSF malicious-packages, Amazon Inspector, kam193 bad-packages, OSSF Package Analysis
Also known as
2026-10-21 GHSA sweep, kam193 2026-10-semvver PyPI family, c2-worker.crawlnet-claim.workers.dev pyupd operator

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

Between 2026-10-20 06:00 UTC (yesterdays sweep cutoff) and 2026-10-21 06:00 UTC (todays ingest-window start), the GitHub Advisory Database published ~90 fresh malware advisories. Two clusters today carry a fully-analyzed malicious payload with sharp network IOCs (the kam193 2026-10-semvver PyPI family and the @securihackbot/depconf-stage-* npm dep-confusion probe). One cluster carries a confirmed AWS IAM-role enumeration + exfil capability (rs-lookout-sandbox-poc). The rest is dep-confusion probe tier and CWE-506 boilerplate takedowns.

Headlines

PyPI kam193 2026-10-semvver family (Cluster A, 8 packages): semvver/semverr/semveer/semmver/semer/ssemver/deebug/debbug, all at 1.0.0, all shadowing semver and debug. setup.py fetches pyupd from c2-worker.crawlnet-claim.workers.dev/dl/pyupd and runs it as a detached background process. VirusTotal hash e6d96b5500b232bea67f6f9046cfbc22d29a515c42d2af9523a15ebe8a7c4ab7 is shared across all variants.

Baileys-lure wave 8 (Cluster E, 3 new slugs): @alannxd/baileys publishes a 27-version range (2.1.2-6.2.8) deliberately shaped to resolve under common ^2.0.0/^3.0.0/^4.0.0/^5.0.0/^6.0.0 version specifiers. New @dreamguyxeon scope publishes both a Baileys-shaped slug and a libsignal-shaped slug, building an "ecosystem" illusion under one scope.

*`@securihackbot/depconf-stage-** (Cluster G sub-entry): confirmed postinstall HTTP-GET to 34.143.131.27:18080/x-VA-1/main.js with base64-encoded d=` query parameter carrying host reconnaissance.

*sc- Best Buy continuation* (Cluster F): 2 more `sc- slugs added to yesterdays sc-geeksquad-core+sc-font-icons wave, same 99.9.1 sentinel version, same operator shape.

AI-brand lure continuation + AWS IMDS exfil (Cluster H): formatting-subtitles-for-claude extends the sugarball.vercel.app anthropic-setup lure family. rs-lookout-sandbox-poc queries AWS IMDSv2 and exfils the IAM role name to webhook.site.

Classification

sweep. Severity high (upgraded from the sweep baseline medium) because Cluster A is a confirmed malicious payload with remote-binary-execution capability, limited reach because they are typosquats that only harm whoever installs them by mistake. The 26-package coordinated supply-chain campaign that drove the 2026-10-20 batch GHSA ingest is NOT included in this sweep count - it was carved out to its own named incident.

Discovery

GitHub Advisory Database, OpenSSF malicious-packages, Amazon Inspector (Cluster A representative sample and Cluster G @securihackbot + Cluster H rs-lookout), kam193 bad-packages (Clusters A, B, C, D source hashes), OSSF Package Analysis (Cluster F sc-announcer+sc-wizard and Cluster G @platform-services+ccl-global-shopping).

dependency-confusiontyposquatcredential-theftaccount-takeover
Affected packages

44 packages 72 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • Cluster A - PyPI kam193 2026-10-semvver semver typosquat family (typosquat; CONFIRMED malicious payload; setup.py fetches https://c2-worker.crawlnet-claim.workers.dev/dl/pyupd with urllib.request.urlretrieve then runs it as a detached background process via subprocess.Popen(..., start_new_session=True); exceptions suppressed; no hash or signature check; __init__.py is empty so there is nothing in the imported module itself - the entire payload is in the install hook; all variants share VirusTotal SHA-256 e6d96b5500b232bea67f6f9046cfbc22d29a515c42d2af9523a15ebe8a7c4ab7): semvver@1.0.0 (GHSA-9mgr-73fh-p55h, MAL-2026-18104, Amazon Inspector + bad-packages.kam193.eu, published 2026-10-20 - the fully-analyzed representative sample), semverr@1.0.0 (GHSA-j4xr-hh3p-8vmm), semveer@1.0.0 (GHSA-xh78-qp67-j6mg), semmver@1.0.0 (GHSA-qv44-3q38-xvr3), semer@1.0.0 (GHSA-2jc4-7fx8-385m, MAL-2026-18118, source hash 7479f42de6f963e39b7aa1409b586e605dca69978763ab35236d20c9126aa4f1, published 2026-10-21), ssemver@1.0.0 (GHSA-hf2v-wrj5-w7gc, MAL-2026-18119, source hash 6aacc4af4fb66d334fa0153d79a707cf0c3decfe3d3b7ed41c67697f21d8b16b), deebug@1.0.0 (GHSA-7xwg-mx2r-4mpp, MAL-2026-18117, source hash db7aff856cffe15877311c77e380d51572713e5eaf35aab77ae51453025a352d), debbug@1.0.0 (GHSA-xr5f-j3c6-m785, MAL-2026-18116, source hash 082b90f5908b0452f00e213182ddaec147cb8f9c49b25fcb4ec4e1533eafd9ab). All eight shadow semver (one of the most-depended-on Python packages, 70M+ monthly downloads) and debug (same shape). Severity high for this cluster (confirmed install-time code + remote-binary-execution of a Cloudflare-Workers-hosted pyupd payload, limited reach because they are typosquats that only harm whoever installs them by mistake)
  • Cluster B - PyPI kam193 2026-10-vacsdk + GENERIC-standard-pypi-install-pentest dependency-confusion probes (dependency-confusion; PROBABLY_PENTEST per the OSSF record field; "fake http-downloaded dependencies to track downloads, and has no other purpose"; no credential or RCE payload disclosed): facewareretargeter@9.9.9 (GHSA-729h-8p7j-mwj4, MAL-2026-18110, 2026-10-vacsdk campaign), jiklpo-tsunari-kay@1.0.0 (GHSA-v2ww-gvf4-g796, MAL-2026-18113, 2026-10-vacsdk), hijok-lampam@1.0.0 (GHSA-2x8w-jgwq-x69p, MAL-2026-18112, 2026-10-vacsdk), trijigo-kalip@1.0.0 (GHSA-7hjg-qchp-46pj, MAL-2026-18114, GENERIC-standard-pypi-install-pentest), hijiko-pilaka@1.0.0 (GHSA-fcjc-2jwg-j4pj, MAL-2026-18111, 2026-10-vacsdk). All five published 2026-10-21 by kam193, the known bug-bounty / red-team author. Severity medium for this cluster (dep-confusion probe tier - download-tracking only)
  • Cluster C - PyPI kam193 2026-10-test-workalendar-internal dependency-confusion probes (dependency-confusion; "stub build-time helper" with setup.py overriding install command; the companion PyPI package by the same uploader was already a backdoor so OSSF marks the sibling packages as MALICIOUS intent): workcalender@17.1.0.dev0 (GHSA-rwx2-hxr7-qgg5, MAL-2026-18093, published 2026-10-20), workalender@17.1.0.dev0 (GHSA-w7r8-xc7m-3j8g), test-workalendar-internal@17.1.0.dev0 (GHSA-hv2c-g7m7-m956). The campaign target is the workalendar Python package (business-day / holiday calculator used across HR, payroll and scheduling platforms). Severity medium for this cluster (dep-confusion probe - the sibling-backdoor history earns the MALICIOUS classification but no runtime payload is published for the three listed sibling packages themselves)
  • Cluster D - PyPI misc kam193 research-flow pentest probes (dependency-confusion, PROBABLY_PENTEST): research-probe-6150c1c915@1.0.0 (GHSA-8pfm-r4v5-2f2g - the slug and version pattern self-identifies as a pentest research artefact), security-research-startup-snapshot-810764b303@1.0.0 (GHSA-9qvj-cj8j-4c9v - same self-identifying pattern), pafex@1.0.0 (GHSA-pqqp-5w2f-783q), resion@1.0.0 (GHSA-m3vr-hc83-fvc8). Severity medium for this cluster
  • Cluster E - npm Baileys-lure operator wave 8 (malicious-package / typosquat continuation; this directly extends wave 7 under 8 new slugs catalogued in the 2026-10-20 sweep; today adds 3 slugs, two under a new scope @dreamguyxeon that impersonates both the Baileys package AND the Signal protocol library libsignal-node which the real baileys depends on; @alannxd/baileys has an unusually large version range (27 versions from 2.1.2 to 6.2.8) mirroring the real @whiskeysockets/baileys version history - a deliberate shape to make the typosquat resolve under range specifiers like ^2.0.0, ^3.0.0, ^4.0.0, ^5.0.0, ^6.0.0): @alannxd/baileys@2.1.2, 2.1.3, 2.1.4, 3.0.0, 3.0.3, 4.0.3, 4.0.4, 4.0.5, 5.0.5, 5.0.6, 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.9, 6.1.0, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.6, 6.1.7, 6.2.7, 6.2.8 (GHSA-7345-fjw8-x55w, published 2026-10-21), @dreamguyxeon/baileyx all versions (GHSA-94fw-5xp7-q2xq), @dreamguyxeon/libsignal-node all versions (GHSA-x3rc-jwjw-pwv6 - impersonates the official libsignal-node upstream used by the real @whiskeysockets/baileys; a project that installs the real baileys will not pull @dreamguyxeon/libsignal-node, but a project that installs @dreamguyxeon/baileyx almost certainly will via its package.json). All three CWE-506 boilerplate takedowns with no vendor runtime analysis published. The @dreamguyxeon scopes dual-package publication (baileys-shaped slug + libsignal-shaped slug) is a new operator pattern worth tagging - it builds the illusion of a working Baileys ecosystem under one scope. Severity medium for this cluster (install-time code execution risk per CWE-506 pattern, no vendor runtime analysis published; the 27-version shape of @alannxd/baileys` is the primary novelty)
  • *Cluster F - npm sc- Best Buy / Geek Squad continuation wave 2 (dependency-confusion continuation; this directly extends the 2026-10-20 Cluster D sc-geeksquad-core+sc-font-icons dep-confusion catalogued in yesterday`s sweep with the hardcoded 75.119.137.232:31337/depconfuse IOC; today adds 2 more slugs under the same sc- prefix, same 99.9.1 sentinel version, OSSF-Package-Analysis flagged for communicating with a domain associated with malicious activity but the domain is not published at the OSSF-record level - likely the same operator and the same 75.119.137.232:31337 C2)*: sc-announcer@99.9.1 (GHSA-r7h6-xjpc-v4w4, MAL-2026-18064, OSSF source 38abcbba47f18b6d76a06a770258c620fc322472d0db0d38b67f04805b916d43), sc-wizard@99.9.1 (GHSA-j5gf-73fv-7357, MAL-2026-18062, OSSF source 54691cc130e614ee031186f7e646c3e6076efad6105a6e9cad68f62aa736516b). Severity medium for this cluster (dep-confusion probe tier - the operators week-running sc-` publication cadence under the Best Buy / Service Center / Store Compute internal-scope shape is now 4 slugs across 2 days)
  • Cluster G - npm new dep-confusion operators (dependency-confusion; mostly OSSF-Package-Analysis flagged for communicating with a malicious domain, specific domains not published at advisory level; one carries a sharp hardcoded network IOC): @securihackbot/depconf-stage-1792484738@1.0.0 (GHSA-3phv-wc7c-mr2f, MAL-2026-18105, Amazon Inspector source d8d8706d2a75c053047537a4f57f754a572a1ca4cec4cde80d00e453878013e1; postinstall hook collects hostname, local username, platform/arch, Node version, package name and a nonce, base64-encodes into d= query parameter, HTTP-GETs to http://34.143.131.27:18080/x-VA-1/main.js - sharp network IOC - and issues a DNS beacon fallback; also honours an override env var DEPCONF_CALLBACK_URL; bundled configure.sh suggests the operator planned to republish under internal scope names), @ziedzzz/demo-canary@0.0.0-stage, 1.0.0 (GHSA-p7gq-mvm4-4cw4), @platform-services/hrm-mfe-core@99.9.1 (GHSA-7c67-r266-7883, MAL-2026-18091, OSSF-Package-Analysis flag - likely HRM microfrontend internal-scope target), tinkoff-cache-path all versions (GHSA-phw8-h49c-9v2q - Tinkoff Bank Russia internal-scope target), eacq-payform-core all versions (GHSA-gpp6-qxfg-2m7x - likely EACQ payment-form internal), nwfp-build-config@0.0.0-stage, 1.0.0 (GHSA-fj85-27r8-hgfg), memories-core-web all versions (GHSA-wj9j-hp45-x3gp), fanarena-common all versions (GHSA-pq7r-cr8h-g6c8), ccl-global-shopping@99.9.1 (GHSA-2xv5-9mfv-2368, MAL-2026-18061, OSSF-Package-Analysis flag), tellyo-colours all versions (GHSA-4q6x-w65x-677r). Severity high for the @securihackbot sub-entry only (hardcoded IP IOC, confirmed install-time payload); medium for the rest
  • Cluster H - npm AI-brand lure continuation (malicious-package / typosquat; this directly extends the 2026-10-20 Cluster C "AI-assistant setup lure cluster" catalogued in yesterday`s sweep; today adds 2 more slugs under the Claude / AWS-tooling impersonation shape): formatting-subtitles-for-claude all versions (GHSA-xxr7-33gg-pcg6 - Claude-brand impersonation extending the sugarball.vercel.app anthropic-setup lure family; the formatting-subtitles-for-claude naming is a plausible-sounding Claude developer utility that an engineer might npm install after seeing it recommended on social media or in a lazy LLM prompt), rs-lookout-sandbox-poc@1.0.1 (GHSA-8f2f-h2mc-9gh2, MAL-2026-18109, Amazon Inspector source 4f28ed1c404dad5afc7b70b345eeef6f81e04dcee77be3a7553956c7a43f8e7c; index.js runs on module load - no CLI invocation needed - reads local username and sends to https://webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/, then queries AWS IMDS 169.254.169.254 via IMDSv2 PUT /latest/api/token + GET /latest/meta-data/iam/security-credentials/ to enumerate attached IAM role; self-labelled "poc" but exfil surface is real on any AWS EC2 host). Severity high for rs-lookout-sandbox-poc (confirmed AWS IAM-role enumeration + exfil IOCs); medium for formatting-subtitles-for-claude
  • Cluster I - npm social-media automation lures (malicious-package; CWE-506 boilerplate takedowns with no runtime analysis; naming shape matches the "auto-follow Instagram / TikTok / Facebook / X bot" lure cluster that has recurred across 2026 sweeps): my-auto-follow all versions (GHSA-3vq8-fp27-44xm), my-auto-follow-eltio all versions (GHSA-xw7m-xxch-j3hp), fnd-stores all versions (GHSA-wx9h-pmqq-rcgg). All three published 2026-10-21. Severity medium for this cluster
  • Cluster J - npm miscellaneous CWE-506 boilerplate takedowns (malicious-package; low-signal, no vendor runtime analysis): tostpro all versions (GHSA-x5qq-j2hm-34m3), unicode-title-normalizer all versions (GHSA-66rv-6q99-h89g - plausible-sounding internationalisation utility slug), rootaccessxvv-bbmarker all versions (GHSA-qhhh-x4xj-h3j3 - the rootaccess prefix is unusual), abbishal-poc-as-dependency all versions (GHSA-pj66-3vwh-cgm2 - self-labelled POC). Severity medium
  • Operator continuity + carve-out note: the 2026-10-20 GHSA batch also included a 26-package coordinated supply-chain campaign tracked as MAL-2026-17665/17666/17667, now catalogued separately as the Tailwind Animate.css fake-interview campaign - every GHSA record whose MAL-ID falls in the 18065-18090 range (26 consecutive records: tailwindcss-animatemotion, tailwindcss-keyframe-kit, signalledger-bridge, signalledger-diagnostics, tailwind-kinetic, tailwind-animate-kit, animate-tailwind-kit, tailwind-fabric, tailwindcss-animate-catalog, tailwindcss-visual-kit, tailwindcss-effect-lab, tailwindcss-motionanimate, tailwind-keyframes, tailwind-animationlab, tailwind-css-keyframes, tailwind-animaflow-kit, tailwind-animatecss-kit, tailwind-animatecss-uniform, animatecss-tailwind-helper, animatecss-tailwind-plugin, animatecss-tailwind-luminary, animatecss-tailwind-vectrix, animatecss-tailwind-presets, animatecss-tailwind-graphic, animatecss-tailwind-binary, animate-twcss-bridge, animate-twcss-pack, animatecss-tailwind-bridge) belongs to that carve-out and should be looked up by its package name there. Other prior-operator extensions observed today: Baileys-lure wave 8 (3 new slugs, now reaching 11 slugs over 48 hours including yesterdays 8), **sugarball.vercel.app AI-assistant-setup lure continuation** (2 more slugs today), **sc-* Best Buy dep-confusion continuation** (2 more slugs today). **No new activity** from: yesterdays @an1mshnpmb9c84920 attack-framework-shaped burst (quiet; the 0.0.1-security tombstones remain in place), @flexmr/@fmr-ap149494 FMR dep-confusion operator (still quiet since 2026-10-19), fabdeploycheck/fabtoolkit PyPI RCE family (quiet), conx3993 (realwbx.com unchanged), agentaix py-worm/py-wormgpt (quiet), @beloved-lenora/opencode-* AI-coding-tool lure (quiet), Wix dep-confusion wave 3, getpubip, proxyrubika, @pkgship/frpc-linux-arm64 trojanised FRP binary (quiet), tailwindcss-form/-uniform prior typosquat operator (quiet). Apex Accelerator REF8801 2026-10-19 carve-out, TensorLake AI 2026-10-08 carve-out, hridoy FB credential stealer 2026-10-12 carve-out all remain confirmed-recovered with no wave-2 malicious republish observed
What to do

Clean-up steps

  1. For Cluster A (kam193 2026-10-semvver PyPI family, CONFIRMED malicious payload): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda env, every Pipfile and every internal PyPI mirror for semvver, semverr, semveer, semmver, semer, ssemver, deebug, debbug - all at 1.0.0. On any hit on any Python environment on any host that ran pip install or poetry install during the exposure window (2026-10-20 onward): treat the host as compromised and quarantine the pyupd binary that may have been dropped. Hunt for the pyupd process name running under start_new_session=True (daemonised detached process without a controlling terminal) on every Python developer workstation and CI host - this is the detached-background execution signature. Egress block: c2-worker.crawlnet-claim.workers.dev apex and specifically /dl/pyupd path on every CI, build, dev workstation, and production host - the Cloudflare Workers subdomain + path is a sharp network IOC and legitimate development workflows will never need it. VirusTotal hash to search for: e6d96b5500b232bea67f6f9046cfbc22d29a515c42d2af9523a15ebe8a7c4ab7 (the pyupd payload, shared across all 8 variants). Keep semver and debug grep-rules on your public-registry denylist for suspicious close-slug typos going forward
  2. For Cluster B (kam193 2026-10-vacsdk dep-confusion probes): grep every PyPI-adjacent manifest for facewareretargeter@9.9.9, jiklpo-tsunari-kay@1.0.0, hijok-lampam@1.0.0, trijigo-kalip@1.0.0, hijiko-pilaka@1.0.0. The jiklpo-tsunari-kay, hijok-lampam, trijigo-kalip and hijiko-pilaka slugs appear to be deliberately obscure strings - any lockfile hit is suspicious. facewareretargeter@9.9.9 is a plausible-sounding Faceware motion-capture retargeting internal utility - if your organisation is a game studio / mocap pipeline / Unreal plugin shop, confirm your internal-registry resolution order prevents public-PyPI shadowing. No credential rotation required for this cluster (basic host-info exfil only per kam193`s known shape), but confirm install-time environment leakage was limited to hostname / username / cwd
  3. For Cluster C (workcalender/workalender/test-workalendar-internal dep-confusion): grep every PyPI manifest for workcalender, workalender, test-workalendar-internal at 17.1.0.dev0. The workalendar Python package is a widely-used business-day / holiday calculator (HR, payroll, scheduling). If your organisation operates an internal workalendar fork or an adjacent test-workalendar-* test fixture, audit your internal-registry resolution order to prevent public-PyPI shadowing. kam193`s sibling-package backdoor history warrants treating any environment that resolved these packages during the exposure window as a candidate compromise
  4. For Cluster E (Baileys-lure wave 8, 3 new slugs including the 27-version @alannxd/baileys): grep every package.json, lockfiles, and internal registry mirrors for @alannxd/baileys at ANY version (the 27-version range 2.1.2-6.2.8 means a range specifier ^2.0.0 through ^6.0.0 would resolve this slug), @dreamguyxeon/baileyx any version, and @dreamguyxeon/libsignal-node any version. On any hit: treat installation on the host as a treat as fully compromised event per the standard CWE-506 boilerplate. The real WhatsApp automation library is @whiskeysockets/baileys; the real Signal protocol library is libsignal-node (unscoped on npm) - any *-baileys / @*/baileys / @*/baileyx / @*/libsignal-node / *bailey* / *bailex* under any other scope is suspect by default. Keep the baileys-brand-impersonation denylist policy from the 2026-10-20 sweep in place (operator cadence suggests another 4-8-slug publication every 24-48 hours; @dreamguyxeon scope`s dual-package publication pattern is a new signal to also watch for)
  5. *For Cluster F (sc- Best Buy / Geek Squad continuation)*: keep the 2026-10-20 egress block on 75.119.137.232:31337/depconfuse in place; add grep rules for sc-announcer@99.9.1 and sc-wizard@99.9.1. The `sc- scope prefix remains an active probe target for the operator. If your organisation operates under the sc- prefix for internal packages, your internal-registry resolution order must prevent public-npm from shadowing an internal sc-*` scope. For Best Buy / Geek Squad / any Best Buy subsidiary, this is now wave 2 of a direct probe against your internal-registry naming convention
  6. *For Cluster G (new dep-confusion operators, including the `@securihackbot/depconf-stage- hardcoded-IP operator)**: grep every lockfile for the full slug list in the impact section above. **Egress block**: 34.143.131.27:18080 across every CI, build, dev workstation, and production host - the hardcoded IP + port 18080 + /x-VA-1/main.js path is a sharp network IOC. Also audit shell / CI environments for the DEPCONF_CALLBACK_URL env var (the operators override channel) and search for a bundled configure.sh file suggesting the staged @securihackbot/depconf-stage-* publication is part of a multi-phase operation. For tinkoff-cache-path: if your organisation is Tinkoff Bank, Tinkoff Business, or any Yandex / Russia Tinkoff-ecosystem subsidiary with a tinkoff-* internal scope, this is a direct probe; audit your internal-registry resolution order. For @platform-services/hrm-mfe-core: if your organisation runs an HR Management microfrontend under the @platform-services scope, same guidance. For eacq-payform-core, memories-core-web, fanarena-common, nwfp-build-config, ccl-global-shopping, tellyo-colours: add to your public-registry denylist and audit your internal-registry scope if any of those prefix shapes match your organisation. For the @ziedzzz/demo-canary sub-entry: this is a self-identifying canary probe; the operator`s intent appears to be to measure whether the slug resolves against an internal-registry mirror - any resolution-success telemetry you have on it is itself useful threat intel
  7. For Cluster H (AI-brand lure + rs-lookout-sandbox-poc): grep every package.json and lockfiles for formatting-subtitles-for-claude any version, and rs-lookout-sandbox-poc@1.0.1. On any hit for rs-lookout-sandbox-poc on an AWS EC2 host: rotate the attached IAM role (the module queries IMDSv2 and exfils the role name to webhook.site), review CloudTrail for AssumeRole / IAM activity by that role in the exposure window, and image the host for forensic review. Egress block: webhook.site apex on CI / build / production hosts (standard exfil endpoint; developer workstations may need an exception for legitimate webhook development, but EC2 and CI hosts should NEVER need it). For formatting-subtitles-for-claude: assume any Claude API key or ~/.claude/settings.json on the installer host was mirrored to attacker infrastructure consistent with yesterday`s sugarball.vercel.app operator pattern - rotate every Claude / Anthropic / Codex / Cursor / Windsurf token
  8. For Cluster I (social-media automation lures): grep every lockfile for my-auto-follow, my-auto-follow-eltio, fnd-stores. Any lockfile hit on these is a credential-rotation event (standard "auto-follow bot" lures aim to collect Instagram / TikTok / Facebook / X session cookies and 2FA tokens from the host browser store). For developer workstations: rotate every social-media platform credential that was ever on the host; for CI hosts: unusual, treat as a staging-area contamination event
  9. For Cluster J (miscellaneous CWE-506 boilerplate): grep every lockfile for tostpro, unicode-title-normalizer, rootaccessxvv-bbmarker, abbishal-poc-as-dependency. Any hit is itself suspicious - these packages have no plausible legitimate use. The rootaccessxvv-bbmarker and abbishal-poc-as-dependency self-labelling as "root access" / "poc as dependency" is a strong signal they are automated-publication noise or research probes
  10. For the Tailwind Animate.css fake-interview campaign carve-out (26 packages): see the carve-out incident for the full package list, affected versions, publisher accounts, and the committed-npm-token lure-repo detection method. The campaign targets individual developers through fake backend-engineer-assessment postings on Torre.ai - the guidance there is to never run a candidate-assessment repo on a daily-driver machine
  11. Standing egress-denylist carry-forward from prior sweeps (keep in place; today adds c2-worker.crawlnet-claim.workers.dev apex + /dl/pyupd path, 34.143.131.27:18080 + /x-VA-1/main.js path, webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/): 75.119.137.232:31337 + /depconfuse path (2026-10-20), transfer.archivete.am apex + /H2Uxm/fabdeploycheck-config.json path (2026-10-19), realwbx.com apex + /ip.php + /ip paths (2026-10-15 and 2026-10-17), artifacts.creditslib.com apex + /npm/* paths (2026-10-17), login.fromthehotel.com apex + /muse + /api/poems/code + /api/art/downloads/* paths (2026-10-17), googleforum.pythonanywhere.com exact subdomain (2026-10-11), space-z.ai apex + preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai + b196q82k8891-d.space-z.ai subdomains (2026-10-14), dxpoc.gt.tc apex (2026-10-09), raw.githubusercontent.com/anonrider404/pypl/* path (2026-10-16), api-bsx.pages.dev apex + /download path (2026-10-16), 177.7.60.239:48080 + oob.recon.dev (2026-10-16), uncoder.eu.org apex + /cc-checker/api.php path (2026-10-15), accenture-npm.azurewebsites.net, limbomail.com apex + github.com/lunexindonesia/node-net-pool + github.com/trktgq0wbre1/node-net-pool, github.com/unicodeces/font-atlas, collector.oob.s4yhii.com + *.oob.s4yhii.com + s4yhii.com apex, 64.181.165.115/dc, 167.88.172.33:8087 + jsonspack.com, goxtools.shop apex, minhdong.site apex + GitHub user VangBanLaNhat, 45.138.12.177:8089, 185.158.107.175:8787, ltidi.storage.googleapis.com/depenconf/, oob.s4yhii.com:9999/native, *.oast.pro/*.oast.me/*.oast.fun/*.oast.site/*.oastify.com, frjmzbjbhwvtdnsuodmu.supabase.co, api.npoint.io apex, tele.metry.orgin.net, morroncr0w.io, api.telegram.org on untrusted CI/build hosts, appsecc.com, generic webhook.site/* paths other than legitimate dev webhooks, nfjbill.ren, storage.googleapis.com/depenconf/, 10.0.19.0/24 + 10.0.49.0/24, api.nm-streetwear.space, Discord webhook URL pattern, ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, chinazhangsan.ccwu.cc, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil patterns, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com, 45.138.0.0/16 RubyGems wgkit CIDRs, apexaccs.org apex + subdomains, arenapex.cloud, apexfdn.xyz apex + subdomains, fdn4apex.com, router-apex.com apex + subdomains, ccmihr.com, 0auth-chromium.com, ehegisnightmare.icu, cloudmain365duo.top
References

Sources

multi-2026-10-21-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents