# GitHub Advisory malware sweep, 21 October 2026

> GHSA 2026-10-20/21 batch (~90 advisories). Headline: new kam193 PyPI `2026-10-semvver` typosquat family (`semvver`/`semverr`/`semveer`/`semmver`/`semer`/`ssemver`/`deebug`/`debbug`) with CONFIRMED `pyupd` binary download from `c2-worker.crawlnet-claim.workers.dev` and detached-process execution (sharp IOC). Baileys-lure wave 8 (`@alannxd/baileys` 27 versions, `@dreamguyxeon/baileyx`, `@dreamguyxeon/libsignal-node`). New `@securihackbot/depconf-stage-*` dep-confusion probe with hardcoded `34.143.131.27:18080/x-VA-1/main.js` payload. sc-* Best Buy continuation (`sc-announcer`, `sc-wizard`).

- Published: 2026-10-21
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 44 packages, 72 compromised versions
- Tags: dependency-confusion, typosquat, credential-theft, account-takeover
- Also known as: 2026-10-21 GHSA sweep, kam193 2026-10-semvver PyPI family, c2-worker.crawlnet-claim.workers.dev pyupd operator, @alannxd/baileys 27-version typosquat, @dreamguyxeon Baileys libsignal dual-package operator, @securihackbot depconf-stage 34.143.131.27 operator, sc-announcer sc-wizard Best Buy dep-confusion wave 2, rs-lookout-sandbox-poc AWS IMDS exfil
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, Amazon Inspector, kam193 bad-packages, OSSF Package Analysis
- Incident ID: multi-2026-10-21-ghsa-malware-sweep

## Affected packages (44)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@alannxd/baileys](https://dependencywatch.io/package/npm/@alannxd/baileys) | npm | 2.1.2, 2.1.3, 2.1.4, 3.0.0, 3.0.3, 4.0.3, 4.0.4, 4.0.5, 5.0.5, 5.0.6, 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.9, 6.1.0, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.6, 6.1.7, 6.2.7, 6.2.8 |
| [@dreamguyxeon/baileyx](https://dependencywatch.io/package/npm/@dreamguyxeon/baileyx) | npm | * |
| [@dreamguyxeon/libsignal-node](https://dependencywatch.io/package/npm/@dreamguyxeon/libsignal-node) | npm | * |
| [@platform-services/hrm-mfe-core](https://dependencywatch.io/package/npm/@platform-services/hrm-mfe-core) | npm | 99.9.1 |
| [@securihackbot/depconf-stage-1792484738](https://dependencywatch.io/package/npm/@securihackbot/depconf-stage-1792484738) | npm | 1.0.0 |
| [@ziedzzz/demo-canary](https://dependencywatch.io/package/npm/@ziedzzz/demo-canary) | npm | 0.0.0-stage, 1.0.0 |
| [abbishal-poc-as-dependency](https://dependencywatch.io/package/npm/abbishal-poc-as-dependency) | npm | * |
| [ccl-global-shopping](https://dependencywatch.io/package/npm/ccl-global-shopping) | npm | 99.9.1 |
| [debbug](https://dependencywatch.io/package/pypi/debbug) | PyPI | 1.0.0 |
| [deebug](https://dependencywatch.io/package/pypi/deebug) | PyPI | 1.0.0 |
| [eacq-payform-core](https://dependencywatch.io/package/npm/eacq-payform-core) | npm | * |
| [facewareretargeter](https://dependencywatch.io/package/pypi/facewareretargeter) | PyPI | 9.9.9 |
| [fanarena-common](https://dependencywatch.io/package/npm/fanarena-common) | npm | * |
| [fnd-stores](https://dependencywatch.io/package/npm/fnd-stores) | npm | * |
| [formatting-subtitles-for-claude](https://dependencywatch.io/package/npm/formatting-subtitles-for-claude) | npm | * |
| [hijiko-pilaka](https://dependencywatch.io/package/pypi/hijiko-pilaka) | PyPI | 1.0.0 |
| [hijok-lampam](https://dependencywatch.io/package/pypi/hijok-lampam) | PyPI | 1.0.0 |
| [jiklpo-tsunari-kay](https://dependencywatch.io/package/pypi/jiklpo-tsunari-kay) | PyPI | 1.0.0 |
| [memories-core-web](https://dependencywatch.io/package/npm/memories-core-web) | npm | * |
| [my-auto-follow](https://dependencywatch.io/package/npm/my-auto-follow) | npm | * |
| [my-auto-follow-eltio](https://dependencywatch.io/package/npm/my-auto-follow-eltio) | npm | * |
| [nwfp-build-config](https://dependencywatch.io/package/npm/nwfp-build-config) | npm | 0.0.0-stage, 1.0.0 |
| [pafex](https://dependencywatch.io/package/pypi/pafex) | PyPI | 1.0.0 |
| [research-probe-6150c1c915](https://dependencywatch.io/package/pypi/research-probe-6150c1c915) | PyPI | 1.0.0 |
| [resion](https://dependencywatch.io/package/pypi/resion) | PyPI | 1.0.0 |
| [rootaccessxvv-bbmarker](https://dependencywatch.io/package/npm/rootaccessxvv-bbmarker) | npm | * |
| [rs-lookout-sandbox-poc](https://dependencywatch.io/package/npm/rs-lookout-sandbox-poc) | npm | 1.0.1 |
| [sc-announcer](https://dependencywatch.io/package/npm/sc-announcer) | npm | 99.9.1 |
| [sc-wizard](https://dependencywatch.io/package/npm/sc-wizard) | npm | 99.9.1 |
| [security-research-startup-snapshot-810764b303](https://dependencywatch.io/package/pypi/security-research-startup-snapshot-810764b303) | PyPI | 1.0.0 |
| [semer](https://dependencywatch.io/package/pypi/semer) | PyPI | 1.0.0 |
| [semmver](https://dependencywatch.io/package/pypi/semmver) | PyPI | 1.0.0 |
| [semveer](https://dependencywatch.io/package/pypi/semveer) | PyPI | 1.0.0 |
| [semverr](https://dependencywatch.io/package/pypi/semverr) | PyPI | 1.0.0 |
| [semvver](https://dependencywatch.io/package/pypi/semvver) | PyPI | 1.0.0 |
| [ssemver](https://dependencywatch.io/package/pypi/ssemver) | PyPI | 1.0.0 |
| [tellyo-colours](https://dependencywatch.io/package/npm/tellyo-colours) | npm | * |
| [test-workalendar-internal](https://dependencywatch.io/package/pypi/test-workalendar-internal) | PyPI | 17.1.0.dev0 |
| [tinkoff-cache-path](https://dependencywatch.io/package/npm/tinkoff-cache-path) | npm | * |
| [tostpro](https://dependencywatch.io/package/npm/tostpro) | npm | * |
| [trijigo-kalip](https://dependencywatch.io/package/pypi/trijigo-kalip) | PyPI | 1.0.0 |
| [unicode-title-normalizer](https://dependencywatch.io/package/npm/unicode-title-normalizer) | npm | * |
| [workalender](https://dependencywatch.io/package/pypi/workalender) | PyPI | 17.1.0.dev0 |
| [workcalender](https://dependencywatch.io/package/pypi/workcalender) | PyPI | 17.1.0.dev0 |

## What happened

Between 2026-10-20 06:00 UTC (yesterday`s sweep cutoff) and 2026-10-21 06:00 UTC (today`s ingest-window start), the GitHub Advisory Database published ~90 fresh malware advisories. Two clusters today carry a fully-analyzed malicious payload with sharp network IOCs (the kam193 `2026-10-semvver` PyPI family and the `@securihackbot/depconf-stage-*` npm dep-confusion probe). One cluster carries a confirmed AWS IAM-role enumeration + exfil capability (`rs-lookout-sandbox-poc`). The rest is dep-confusion probe tier and CWE-506 boilerplate takedowns.

## Headlines

**PyPI kam193 `2026-10-semvver` family** (Cluster A, 8 packages): `semvver`/`semverr`/`semveer`/`semmver`/`semer`/`ssemver`/`deebug`/`debbug`, all at `1.0.0`, all shadowing `semver` and `debug`. `setup.py` fetches `pyupd` from `c2-worker.crawlnet-claim.workers.dev/dl/pyupd` and runs it as a detached background process. VirusTotal hash `e6d96b5500b232bea67f6f9046cfbc22d29a515c42d2af9523a15ebe8a7c4ab7` is shared across all variants.

**Baileys-lure wave 8** (Cluster E, 3 new slugs): `@alannxd/baileys` publishes a 27-version range (2.1.2-6.2.8) deliberately shaped to resolve under common `^2.0.0`/`^3.0.0`/`^4.0.0`/`^5.0.0`/`^6.0.0` version specifiers. New `@dreamguyxeon` scope publishes both a Baileys-shaped slug and a libsignal-shaped slug, building an "ecosystem" illusion under one scope.

**`@securihackbot/depconf-stage-*`** (Cluster G sub-entry): confirmed `postinstall` HTTP-GET to `34.143.131.27:18080/x-VA-1/main.js` with base64-encoded `d=` query parameter carrying host reconnaissance.

**sc-* Best Buy continuation** (Cluster F): 2 more `sc-*` slugs added to yesterday`s `sc-geeksquad-core`+`sc-font-icons` wave, same `99.9.1` sentinel version, same operator shape.

**AI-brand lure continuation + AWS IMDS exfil** (Cluster H): `formatting-subtitles-for-claude` extends the sugarball.vercel.app anthropic-setup lure family. `rs-lookout-sandbox-poc` queries AWS IMDSv2 and exfils the IAM role name to webhook.site.

## Classification

`sweep`. Severity `high` (upgraded from the sweep baseline `medium`) because Cluster A is a confirmed malicious payload with remote-binary-execution capability, limited reach because they are typosquats that only harm whoever installs them by mistake. The 26-package coordinated supply-chain campaign that drove the 2026-10-20 batch GHSA ingest is NOT included in this sweep count - it was carved out to [its own named incident](https://dependencywatch.io/incident/npm-2026-10-20-tailwind-animatecss-fake-interview-campaign).

## Discovery

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `Amazon Inspector` (Cluster A representative sample and Cluster G `@securihackbot` + Cluster H `rs-lookout`), `kam193 bad-packages` (Clusters A, B, C, D source hashes), `OSSF Package Analysis` (Cluster F `sc-announcer`+`sc-wizard` and Cluster G `@platform-services`+`ccl-global-shopping`).

## Impact

- **Cluster A - PyPI kam193 `2026-10-semvver` semver typosquat family (typosquat; CONFIRMED malicious payload; `setup.py` fetches `https://c2-worker.crawlnet-claim.workers.dev/dl/pyupd` with `urllib.request.urlretrieve` then runs it as a detached background process via `subprocess.Popen(..., start_new_session=True)`; exceptions suppressed; no hash or signature check; `__init__.py` is empty so there is nothing in the imported module itself - the entire payload is in the install hook; all variants share VirusTotal SHA-256 `e6d96b5500b232bea67f6f9046cfbc22d29a515c42d2af9523a15ebe8a7c4ab7`)**: `semvver@1.0.0` (GHSA-9mgr-73fh-p55h, MAL-2026-18104, Amazon Inspector + bad-packages.kam193.eu, published 2026-10-20 - the fully-analyzed representative sample), `semverr@1.0.0` (GHSA-j4xr-hh3p-8vmm), `semveer@1.0.0` (GHSA-xh78-qp67-j6mg), `semmver@1.0.0` (GHSA-qv44-3q38-xvr3), `semer@1.0.0` (GHSA-2jc4-7fx8-385m, MAL-2026-18118, source hash `7479f42de6f963e39b7aa1409b586e605dca69978763ab35236d20c9126aa4f1`, published 2026-10-21), `ssemver@1.0.0` (GHSA-hf2v-wrj5-w7gc, MAL-2026-18119, source hash `6aacc4af4fb66d334fa0153d79a707cf0c3decfe3d3b7ed41c67697f21d8b16b`), `deebug@1.0.0` (GHSA-7xwg-mx2r-4mpp, MAL-2026-18117, source hash `db7aff856cffe15877311c77e380d51572713e5eaf35aab77ae51453025a352d`), `debbug@1.0.0` (GHSA-xr5f-j3c6-m785, MAL-2026-18116, source hash `082b90f5908b0452f00e213182ddaec147cb8f9c49b25fcb4ec4e1533eafd9ab`). All eight shadow `semver` (one of the most-depended-on Python packages, 70M+ monthly downloads) and `debug` (same shape). Severity `high` for this cluster (confirmed install-time code + remote-binary-execution of a Cloudflare-Workers-hosted `pyupd` payload, limited reach because they are typosquats that only harm whoever installs them by mistake)
- **Cluster B - PyPI kam193 `2026-10-vacsdk` + `GENERIC-standard-pypi-install-pentest` dependency-confusion probes (dependency-confusion; PROBABLY_PENTEST per the OSSF record field; "fake http-downloaded dependencies to track downloads, and has no other purpose"; no credential or RCE payload disclosed)**: `facewareretargeter@9.9.9` (GHSA-729h-8p7j-mwj4, MAL-2026-18110, `2026-10-vacsdk` campaign), `jiklpo-tsunari-kay@1.0.0` (GHSA-v2ww-gvf4-g796, MAL-2026-18113, `2026-10-vacsdk`), `hijok-lampam@1.0.0` (GHSA-2x8w-jgwq-x69p, MAL-2026-18112, `2026-10-vacsdk`), `trijigo-kalip@1.0.0` (GHSA-7hjg-qchp-46pj, MAL-2026-18114, `GENERIC-standard-pypi-install-pentest`), `hijiko-pilaka@1.0.0` (GHSA-fcjc-2jwg-j4pj, MAL-2026-18111, `2026-10-vacsdk`). All five published 2026-10-21 by `kam193`, the known bug-bounty / red-team author. Severity `medium` for this cluster (dep-confusion probe tier - download-tracking only)
- **Cluster C - PyPI kam193 `2026-10-test-workalendar-internal` dependency-confusion probes (dependency-confusion; "stub build-time helper" with `setup.py` overriding install command; the companion PyPI package by the same uploader was already a backdoor so OSSF marks the sibling packages as MALICIOUS intent)**: `workcalender@17.1.0.dev0` (GHSA-rwx2-hxr7-qgg5, MAL-2026-18093, published 2026-10-20), `workalender@17.1.0.dev0` (GHSA-w7r8-xc7m-3j8g), `test-workalendar-internal@17.1.0.dev0` (GHSA-hv2c-g7m7-m956). The campaign target is the `workalendar` Python package (business-day / holiday calculator used across HR, payroll and scheduling platforms). Severity `medium` for this cluster (dep-confusion probe - the sibling-backdoor history earns the MALICIOUS classification but no runtime payload is published for the three listed sibling packages themselves)
- **Cluster D - PyPI misc kam193 research-flow pentest probes (dependency-confusion, PROBABLY_PENTEST)**: `research-probe-6150c1c915@1.0.0` (GHSA-8pfm-r4v5-2f2g - the slug and version pattern self-identifies as a pentest research artefact), `security-research-startup-snapshot-810764b303@1.0.0` (GHSA-9qvj-cj8j-4c9v - same self-identifying pattern), `pafex@1.0.0` (GHSA-pqqp-5w2f-783q), `resion@1.0.0` (GHSA-m3vr-hc83-fvc8). Severity `medium` for this cluster
- **Cluster E - npm Baileys-lure operator wave 8 (malicious-package / typosquat continuation; this directly extends wave 7 under 8 new slugs catalogued in [the 2026-10-20 sweep](https://dependencywatch.io/incident/multi-2026-10-20-ghsa-malware-sweep); today adds 3 slugs, two under a new scope `@dreamguyxeon` that impersonates both the Baileys package AND the Signal protocol library `libsignal-node` which the real `baileys` depends on; **`@alannxd/baileys` has an unusually large version range (27 versions from 2.1.2 to 6.2.8)** mirroring the real `@whiskeysockets/baileys` version history - a deliberate shape to make the typosquat resolve under range specifiers like `^2.0.0`, `^3.0.0`, `^4.0.0`, `^5.0.0`, `^6.0.0`)**: `@alannxd/baileys@2.1.2, 2.1.3, 2.1.4, 3.0.0, 3.0.3, 4.0.3, 4.0.4, 4.0.5, 5.0.5, 5.0.6, 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.9, 6.1.0, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.6, 6.1.7, 6.2.7, 6.2.8` (GHSA-7345-fjw8-x55w, published 2026-10-21), `@dreamguyxeon/baileyx` all versions (GHSA-94fw-5xp7-q2xq), `@dreamguyxeon/libsignal-node` all versions (GHSA-x3rc-jwjw-pwv6 - impersonates the official `libsignal-node` upstream used by the real `@whiskeysockets/baileys`; a project that installs the real `baileys` will not pull `@dreamguyxeon/libsignal-node`, but a project that installs `@dreamguyxeon/baileyx` almost certainly will via its package.json). All three CWE-506 boilerplate takedowns with no vendor runtime analysis published. The `@dreamguyxeon` scope`s dual-package publication (baileys-shaped slug + libsignal-shaped slug) is a new operator pattern worth tagging - it builds the illusion of a working Baileys ecosystem under one scope. Severity `medium` for this cluster (install-time code execution risk per CWE-506 pattern, no vendor runtime analysis published; the 27-version shape of `@alannxd/baileys` is the primary novelty)
- **Cluster F - npm sc-* Best Buy / Geek Squad continuation wave 2 (dependency-confusion continuation; this directly extends the 2026-10-20 Cluster D `sc-geeksquad-core`+`sc-font-icons` dep-confusion catalogued in [yesterday`s sweep](https://dependencywatch.io/incident/multi-2026-10-20-ghsa-malware-sweep) with the hardcoded `75.119.137.232:31337/depconfuse` IOC; today adds 2 more slugs under the same `sc-` prefix, same `99.9.1` sentinel version, OSSF-Package-Analysis flagged for communicating with a domain associated with malicious activity but the domain is not published at the OSSF-record level - likely the same operator and the same `75.119.137.232:31337` C2)**: `sc-announcer@99.9.1` (GHSA-r7h6-xjpc-v4w4, MAL-2026-18064, OSSF source `38abcbba47f18b6d76a06a770258c620fc322472d0db0d38b67f04805b916d43`), `sc-wizard@99.9.1` (GHSA-j5gf-73fv-7357, MAL-2026-18062, OSSF source `54691cc130e614ee031186f7e646c3e6076efad6105a6e9cad68f62aa736516b`). Severity `medium` for this cluster (dep-confusion probe tier - the operator`s week-running `sc-*` publication cadence under the Best Buy / Service Center / Store Compute internal-scope shape is now 4 slugs across 2 days)
- **Cluster G - npm new dep-confusion operators (dependency-confusion; mostly OSSF-Package-Analysis flagged for communicating with a malicious domain, specific domains not published at advisory level; one carries a sharp hardcoded network IOC)**: `@securihackbot/depconf-stage-1792484738@1.0.0` (GHSA-3phv-wc7c-mr2f, MAL-2026-18105, Amazon Inspector source `d8d8706d2a75c053047537a4f57f754a572a1ca4cec4cde80d00e453878013e1`; `postinstall` hook collects hostname, local username, platform/arch, Node version, package name and a nonce, base64-encodes into `d=` query parameter, HTTP-GETs to **`http://34.143.131.27:18080/x-VA-1/main.js`** - sharp network IOC - and issues a DNS beacon fallback; also honours an override env var `DEPCONF_CALLBACK_URL`; bundled `configure.sh` suggests the operator planned to republish under internal scope names), `@ziedzzz/demo-canary@0.0.0-stage, 1.0.0` (GHSA-p7gq-mvm4-4cw4), `@platform-services/hrm-mfe-core@99.9.1` (GHSA-7c67-r266-7883, MAL-2026-18091, OSSF-Package-Analysis flag - likely HRM microfrontend internal-scope target), `tinkoff-cache-path` all versions (GHSA-phw8-h49c-9v2q - Tinkoff Bank Russia internal-scope target), `eacq-payform-core` all versions (GHSA-gpp6-qxfg-2m7x - likely EACQ payment-form internal), `nwfp-build-config@0.0.0-stage, 1.0.0` (GHSA-fj85-27r8-hgfg), `memories-core-web` all versions (GHSA-wj9j-hp45-x3gp), `fanarena-common` all versions (GHSA-pq7r-cr8h-g6c8), `ccl-global-shopping@99.9.1` (GHSA-2xv5-9mfv-2368, MAL-2026-18061, OSSF-Package-Analysis flag), `tellyo-colours` all versions (GHSA-4q6x-w65x-677r). Severity `high` for the `@securihackbot` sub-entry only (hardcoded IP IOC, confirmed install-time payload); `medium` for the rest
- **Cluster H - npm AI-brand lure continuation (malicious-package / typosquat; this directly extends the 2026-10-20 Cluster C "AI-assistant setup lure cluster" catalogued in [yesterday`s sweep](https://dependencywatch.io/incident/multi-2026-10-20-ghsa-malware-sweep); today adds 2 more slugs under the Claude / AWS-tooling impersonation shape)**: `formatting-subtitles-for-claude` all versions (GHSA-xxr7-33gg-pcg6 - Claude-brand impersonation extending the sugarball.vercel.app anthropic-setup lure family; the `formatting-subtitles-for-claude` naming is a plausible-sounding Claude developer utility that an engineer might `npm install` after seeing it recommended on social media or in a lazy LLM prompt), `rs-lookout-sandbox-poc@1.0.1` (GHSA-8f2f-h2mc-9gh2, MAL-2026-18109, Amazon Inspector source `4f28ed1c404dad5afc7b70b345eeef6f81e04dcee77be3a7553956c7a43f8e7c`; `index.js` runs on module load - no CLI invocation needed - reads local username and sends to **`https://webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/`**, then queries AWS IMDS **`169.254.169.254`** via IMDSv2 `PUT /latest/api/token` + `GET /latest/meta-data/iam/security-credentials/` to enumerate attached IAM role; self-labelled "poc" but exfil surface is real on any AWS EC2 host). Severity `high` for `rs-lookout-sandbox-poc` (confirmed AWS IAM-role enumeration + exfil IOCs); `medium` for `formatting-subtitles-for-claude`
- **Cluster I - npm social-media automation lures (malicious-package; CWE-506 boilerplate takedowns with no runtime analysis; naming shape matches the "auto-follow Instagram / TikTok / Facebook / X bot" lure cluster that has recurred across 2026 sweeps)**: `my-auto-follow` all versions (GHSA-3vq8-fp27-44xm), `my-auto-follow-eltio` all versions (GHSA-xw7m-xxch-j3hp), `fnd-stores` all versions (GHSA-wx9h-pmqq-rcgg). All three published 2026-10-21. Severity `medium` for this cluster
- **Cluster J - npm miscellaneous CWE-506 boilerplate takedowns (malicious-package; low-signal, no vendor runtime analysis)**: `tostpro` all versions (GHSA-x5qq-j2hm-34m3), `unicode-title-normalizer` all versions (GHSA-66rv-6q99-h89g - plausible-sounding internationalisation utility slug), `rootaccessxvv-bbmarker` all versions (GHSA-qhhh-x4xj-h3j3 - the `rootaccess` prefix is unusual), `abbishal-poc-as-dependency` all versions (GHSA-pj66-3vwh-cgm2 - self-labelled POC). Severity `medium`
- **Operator continuity + carve-out note**: the 2026-10-20 GHSA batch also included a 26-package coordinated supply-chain campaign tracked as MAL-2026-17665/17666/17667, now catalogued separately as [the Tailwind Animate.css fake-interview campaign](https://dependencywatch.io/incident/npm-2026-10-20-tailwind-animatecss-fake-interview-campaign) - every GHSA record whose MAL-ID falls in the 18065-18090 range (26 consecutive records: `tailwindcss-animatemotion`, `tailwindcss-keyframe-kit`, `signalledger-bridge`, `signalledger-diagnostics`, `tailwind-kinetic`, `tailwind-animate-kit`, `animate-tailwind-kit`, `tailwind-fabric`, `tailwindcss-animate-catalog`, `tailwindcss-visual-kit`, `tailwindcss-effect-lab`, `tailwindcss-motionanimate`, `tailwind-keyframes`, `tailwind-animationlab`, `tailwind-css-keyframes`, `tailwind-animaflow-kit`, `tailwind-animatecss-kit`, `tailwind-animatecss-uniform`, `animatecss-tailwind-helper`, `animatecss-tailwind-plugin`, `animatecss-tailwind-luminary`, `animatecss-tailwind-vectrix`, `animatecss-tailwind-presets`, `animatecss-tailwind-graphic`, `animatecss-tailwind-binary`, `animate-twcss-bridge`, `animate-twcss-pack`, `animatecss-tailwind-bridge`) belongs to that carve-out and should be looked up by its package name there. Other prior-operator extensions observed today: **Baileys-lure wave 8** (3 new slugs, now reaching 11 slugs over 48 hours including yesterday`s 8), **sugarball.vercel.app AI-assistant-setup lure continuation** (2 more slugs today), **sc-* Best Buy dep-confusion continuation** (2 more slugs today). **No new activity** from: yesterday`s `@an1mshnpmb9c84920` attack-framework-shaped burst (quiet; the `0.0.1-security` tombstones remain in place), `@flexmr`/`@fmr-ap149494` FMR dep-confusion operator (still quiet since 2026-10-19), `fabdeploycheck`/`fabtoolkit` PyPI RCE family (quiet), `conx3993` (`realwbx.com` unchanged), `agentaix` py-worm/py-wormgpt (quiet), `@beloved-lenora/opencode-*` AI-coding-tool lure (quiet), Wix dep-confusion wave 3, `getpubip`, `proxyrubika`, `@pkgship/frpc-linux-arm64` trojanised FRP binary (quiet), `tailwindcss-form`/`-uniform` prior typosquat operator (quiet). [Apex Accelerator REF8801 2026-10-19 carve-out](https://dependencywatch.io/incident/npm-2026-10-19-apex-accelerator-malicious-npm-packages), [TensorLake AI 2026-10-08 carve-out](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise), [hridoy FB credential stealer 2026-10-12 carve-out](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer) all remain confirmed-recovered with no wave-2 malicious republish observed

## What to do

1. **For Cluster A (kam193 `2026-10-semvver` PyPI family, CONFIRMED malicious payload)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, `conda env`, every `Pipfile` and every internal PyPI mirror for `semvver`, `semverr`, `semveer`, `semmver`, `semer`, `ssemver`, `deebug`, `debbug` - all at `1.0.0`. On any hit on any Python environment on any host that ran `pip install` or `poetry install` during the exposure window (2026-10-20 onward): treat the host as compromised and quarantine the `pyupd` binary that may have been dropped. **Hunt for the `pyupd` process name running under `start_new_session=True`** (daemonised detached process without a controlling terminal) on every Python developer workstation and CI host - this is the detached-background execution signature. **Egress block**: `c2-worker.crawlnet-claim.workers.dev` apex and specifically `/dl/pyupd` path on every CI, build, dev workstation, and production host - the Cloudflare Workers subdomain + path is a sharp network IOC and legitimate development workflows will never need it. **VirusTotal hash to search for**: `e6d96b5500b232bea67f6f9046cfbc22d29a515c42d2af9523a15ebe8a7c4ab7` (the `pyupd` payload, shared across all 8 variants). Keep `semver` and `debug` grep-rules on your public-registry denylist for suspicious close-slug typos going forward
2. **For Cluster B (kam193 `2026-10-vacsdk` dep-confusion probes)**: grep every PyPI-adjacent manifest for `facewareretargeter@9.9.9`, `jiklpo-tsunari-kay@1.0.0`, `hijok-lampam@1.0.0`, `trijigo-kalip@1.0.0`, `hijiko-pilaka@1.0.0`. The `jiklpo-tsunari-kay`, `hijok-lampam`, `trijigo-kalip` and `hijiko-pilaka` slugs appear to be deliberately obscure strings - any lockfile hit is suspicious. `facewareretargeter@9.9.9` is a plausible-sounding Faceware motion-capture retargeting internal utility - if your organisation is a game studio / mocap pipeline / Unreal plugin shop, confirm your internal-registry resolution order prevents public-PyPI shadowing. No credential rotation required for this cluster (basic host-info exfil only per kam193`s known shape), but confirm install-time environment leakage was limited to hostname / username / cwd
3. **For Cluster C (`workcalender`/`workalender`/`test-workalendar-internal` dep-confusion)**: grep every PyPI manifest for `workcalender`, `workalender`, `test-workalendar-internal` at `17.1.0.dev0`. The `workalendar` Python package is a widely-used business-day / holiday calculator (HR, payroll, scheduling). If your organisation operates an internal `workalendar` fork or an adjacent `test-workalendar-*` test fixture, audit your internal-registry resolution order to prevent public-PyPI shadowing. kam193`s sibling-package backdoor history warrants treating any environment that resolved these packages during the exposure window as a candidate compromise
4. **For Cluster E (Baileys-lure wave 8, 3 new slugs including the 27-version `@alannxd/baileys`)**: grep every `package.json`, lockfiles, and internal registry mirrors for `@alannxd/baileys` at ANY version (the 27-version range 2.1.2-6.2.8 means a range specifier `^2.0.0` through `^6.0.0` would resolve this slug), `@dreamguyxeon/baileyx` any version, and `@dreamguyxeon/libsignal-node` any version. On any hit: treat installation on the host as a `treat as fully compromised` event per the standard CWE-506 boilerplate. The real WhatsApp automation library is `@whiskeysockets/baileys`; the real Signal protocol library is `libsignal-node` (unscoped on npm) - any `*-baileys` / `@*/baileys` / `@*/baileyx` / `@*/libsignal-node` / `*bailey*` / `*bailex*` under any other scope is suspect by default. Keep the `baileys-brand-impersonation` denylist policy from the 2026-10-20 sweep in place (operator cadence suggests another 4-8-slug publication every 24-48 hours; `@dreamguyxeon` scope`s dual-package publication pattern is a new signal to also watch for)
5. **For Cluster F (sc-* Best Buy / Geek Squad continuation)**: keep the 2026-10-20 egress block on `75.119.137.232:31337/depconfuse` in place; add grep rules for `sc-announcer@99.9.1` and `sc-wizard@99.9.1`. The `sc-*` scope prefix remains an active probe target for the operator. If your organisation operates under the `sc-` prefix for internal packages, your internal-registry resolution order must prevent public-npm from shadowing an internal `sc-*` scope. For Best Buy / Geek Squad / any Best Buy subsidiary, this is now wave 2 of a direct probe against your internal-registry naming convention
6. **For Cluster G (new dep-confusion operators, including the `@securihackbot/depconf-stage-*` hardcoded-IP operator)**: grep every lockfile for the full slug list in the impact section above. **Egress block**: `34.143.131.27:18080` across every CI, build, dev workstation, and production host - the hardcoded IP + port 18080 + `/x-VA-1/main.js` path is a sharp network IOC. Also audit shell / CI environments for the `DEPCONF_CALLBACK_URL` env var (the operator`s override channel) and search for a bundled `configure.sh` file suggesting the staged `@securihackbot/depconf-stage-*` publication is part of a multi-phase operation. For `tinkoff-cache-path`: if your organisation is Tinkoff Bank, Tinkoff Business, or any Yandex / Russia Tinkoff-ecosystem subsidiary with a `tinkoff-*` internal scope, this is a direct probe; audit your internal-registry resolution order. For `@platform-services/hrm-mfe-core`: if your organisation runs an HR Management microfrontend under the `@platform-services` scope, same guidance. For `eacq-payform-core`, `memories-core-web`, `fanarena-common`, `nwfp-build-config`, `ccl-global-shopping`, `tellyo-colours`: add to your public-registry denylist and audit your internal-registry scope if any of those prefix shapes match your organisation. **For the `@ziedzzz/demo-canary` sub-entry**: this is a self-identifying canary probe; the operator`s intent appears to be to measure whether the slug resolves against an internal-registry mirror - any resolution-success telemetry you have on it is itself useful threat intel
7. **For Cluster H (AI-brand lure + rs-lookout-sandbox-poc)**: grep every `package.json` and lockfiles for `formatting-subtitles-for-claude` any version, and `rs-lookout-sandbox-poc@1.0.1`. On any hit for `rs-lookout-sandbox-poc` on an AWS EC2 host: **rotate the attached IAM role** (the module queries IMDSv2 and exfils the role name to webhook.site), review CloudTrail for AssumeRole / IAM activity by that role in the exposure window, and image the host for forensic review. **Egress block**: `webhook.site` apex on CI / build / production hosts (standard exfil endpoint; developer workstations may need an exception for legitimate webhook development, but EC2 and CI hosts should NEVER need it). For `formatting-subtitles-for-claude`: assume any Claude API key or `~/.claude/settings.json` on the installer host was mirrored to attacker infrastructure consistent with yesterday`s sugarball.vercel.app operator pattern - rotate every Claude / Anthropic / Codex / Cursor / Windsurf token
8. **For Cluster I (social-media automation lures)**: grep every lockfile for `my-auto-follow`, `my-auto-follow-eltio`, `fnd-stores`. Any lockfile hit on these is a credential-rotation event (standard "auto-follow bot" lures aim to collect Instagram / TikTok / Facebook / X session cookies and 2FA tokens from the host browser store). For developer workstations: rotate every social-media platform credential that was ever on the host; for CI hosts: unusual, treat as a staging-area contamination event
9. **For Cluster J (miscellaneous CWE-506 boilerplate)**: grep every lockfile for `tostpro`, `unicode-title-normalizer`, `rootaccessxvv-bbmarker`, `abbishal-poc-as-dependency`. Any hit is itself suspicious - these packages have no plausible legitimate use. The `rootaccessxvv-bbmarker` and `abbishal-poc-as-dependency` self-labelling as "root access" / "poc as dependency" is a strong signal they are automated-publication noise or research probes
10. **For the Tailwind Animate.css fake-interview campaign carve-out (26 packages)**: see [the carve-out incident](https://dependencywatch.io/incident/npm-2026-10-20-tailwind-animatecss-fake-interview-campaign) for the full package list, affected versions, publisher accounts, and the committed-npm-token lure-repo detection method. The campaign targets individual developers through fake backend-engineer-assessment postings on Torre.ai - the guidance there is to never run a candidate-assessment repo on a daily-driver machine
11. **Standing egress-denylist carry-forward from prior sweeps** (keep in place; today adds `c2-worker.crawlnet-claim.workers.dev` apex + `/dl/pyupd` path, `34.143.131.27:18080` + `/x-VA-1/main.js` path, `webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/`): `75.119.137.232:31337` + `/depconfuse` path (2026-10-20), `transfer.archivete.am` apex + `/H2Uxm/fabdeploycheck-config.json` path (2026-10-19), `realwbx.com` apex + `/ip.php` + `/ip` paths (2026-10-15 and 2026-10-17), `artifacts.creditslib.com` apex + `/npm/*` paths (2026-10-17), `login.fromthehotel.com` apex + `/muse` + `/api/poems/code` + `/api/art/downloads/*` paths (2026-10-17), `googleforum.pythonanywhere.com` exact subdomain (2026-10-11), `space-z.ai` apex + `preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai` + `b196q82k8891-d.space-z.ai` subdomains (2026-10-14), `dxpoc.gt.tc` apex (2026-10-09), `raw.githubusercontent.com/anonrider404/pypl/*` path (2026-10-16), `api-bsx.pages.dev` apex + `/download` path (2026-10-16), `177.7.60.239:48080` + `oob.recon.dev` (2026-10-16), `uncoder.eu.org` apex + `/cc-checker/api.php` path (2026-10-15), `accenture-npm.azurewebsites.net`, `limbomail.com` apex + `github.com/lunexindonesia/node-net-pool` + `github.com/trktgq0wbre1/node-net-pool`, `github.com/unicodeces/font-atlas`, `collector.oob.s4yhii.com` + `*.oob.s4yhii.com` + `s4yhii.com` apex, `64.181.165.115/dc`, `167.88.172.33:8087` + `jsonspack.com`, `goxtools.shop` apex, `minhdong.site` apex + GitHub user `VangBanLaNhat`, `45.138.12.177:8089`, `185.158.107.175:8787`, `ltidi.storage.googleapis.com/depenconf/`, `oob.s4yhii.com:9999/native`, `*.oast.pro`/`*.oast.me`/`*.oast.fun`/`*.oast.site`/`*.oastify.com`, `frjmzbjbhwvtdnsuodmu.supabase.co`, `api.npoint.io` apex, `tele.metry.orgin.net`, `morroncr0w.io`, `api.telegram.org` on untrusted CI/build hosts, `appsecc.com`, generic `webhook.site/*` paths other than legitimate dev webhooks, `nfjbill.ren`, `storage.googleapis.com/depenconf/`, `10.0.19.0/24` + `10.0.49.0/24`, `api.nm-streetwear.space`, Discord webhook URL pattern, `ipify.org` + `ifconfig.me`, `gitflic.ru`, `api.wagmiwallet.org`, `backend-cybersecuritydashboard.onrender.com`, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, `chinazhangsan.ccwu.cc`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `npm-canary.aveliscare.com`, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil patterns, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, `tuamaeaquelaursa.com`, `45.138.0.0/16` RubyGems wgkit CIDRs, `apexaccs.org` apex + subdomains, `arenapex.cloud`, `apexfdn.xyz` apex + subdomains, `fdn4apex.com`, `router-apex.com` apex + subdomains, `ccmihr.com`, `0auth-chromium.com`, `ehegisnightmare.icu`, `cloudmain365duo.top`

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-9mgr-73fh-p55h - pypi semvver@1.0.0 (Cluster A representative sample - setup.py fetches c2-worker.crawlnet-claim.workers.dev/dl/pyupd and runs it as detached background process, VirusTotal SHA-256 e6d96b5500b232bea67f6f9046cfbc22d29a515c42d2af9523a15ebe8a7c4ab7, Amazon Inspector + bad-packages.kam193.eu, MAL-2026-18104)](https://github.com/advisories/GHSA-9mgr-73fh-p55h) - GitHub
- [GHSA-j4xr-hh3p-8vmm - pypi semverr@1.0.0 (Cluster A - 2026-10-semvver campaign variant)](https://github.com/advisories/GHSA-j4xr-hh3p-8vmm) - GitHub
- [GHSA-xh78-qp67-j6mg - pypi semveer@1.0.0 (Cluster A variant)](https://github.com/advisories/GHSA-xh78-qp67-j6mg) - GitHub
- [GHSA-qv44-3q38-xvr3 - pypi semmver@1.0.0 (Cluster A variant)](https://github.com/advisories/GHSA-qv44-3q38-xvr3) - GitHub
- [GHSA-2jc4-7fx8-385m - pypi semer@1.0.0 (Cluster A - published 2026-10-21, MAL-2026-18118)](https://github.com/advisories/GHSA-2jc4-7fx8-385m) - GitHub
- [GHSA-hf2v-wrj5-w7gc - pypi ssemver@1.0.0 (Cluster A - MAL-2026-18119)](https://github.com/advisories/GHSA-hf2v-wrj5-w7gc) - GitHub
- [GHSA-7xwg-mx2r-4mpp - pypi deebug@1.0.0 (Cluster A - debug typosquat shape, MAL-2026-18117)](https://github.com/advisories/GHSA-7xwg-mx2r-4mpp) - GitHub
- [GHSA-xr5f-j3c6-m785 - pypi debbug@1.0.0 (Cluster A variant, MAL-2026-18116)](https://github.com/advisories/GHSA-xr5f-j3c6-m785) - GitHub
- [GHSA-729h-8p7j-mwj4 - pypi facewareretargeter@9.9.9 (Cluster B - 2026-10-vacsdk, PROBABLY_PENTEST, MAL-2026-18110)](https://github.com/advisories/GHSA-729h-8p7j-mwj4) - GitHub
- [GHSA-v2ww-gvf4-g796 - pypi jiklpo-tsunari-kay@1.0.0 (Cluster B - 2026-10-vacsdk)](https://github.com/advisories/GHSA-v2ww-gvf4-g796) - GitHub
- [GHSA-2x8w-jgwq-x69p - pypi hijok-lampam@1.0.0 (Cluster B - 2026-10-vacsdk)](https://github.com/advisories/GHSA-2x8w-jgwq-x69p) - GitHub
- [GHSA-7hjg-qchp-46pj - pypi trijigo-kalip@1.0.0 (Cluster B - GENERIC-standard-pypi-install-pentest)](https://github.com/advisories/GHSA-7hjg-qchp-46pj) - GitHub
- [GHSA-fcjc-2jwg-j4pj - pypi hijiko-pilaka@1.0.0 (Cluster B - 2026-10-vacsdk)](https://github.com/advisories/GHSA-fcjc-2jwg-j4pj) - GitHub
- [GHSA-rwx2-hxr7-qgg5 - pypi workcalender@17.1.0.dev0 (Cluster C - 2026-10-test-workalendar-internal, MAL-2026-18093, sibling-package backdoor history)](https://github.com/advisories/GHSA-rwx2-hxr7-qgg5) - GitHub
- [GHSA-w7r8-xc7m-3j8g - pypi workalender (Cluster C variant)](https://github.com/advisories/GHSA-w7r8-xc7m-3j8g) - GitHub
- [GHSA-hv2c-g7m7-m956 - pypi test-workalendar-internal (Cluster C variant)](https://github.com/advisories/GHSA-hv2c-g7m7-m956) - GitHub
- [GHSA-7345-fjw8-x55w - npm @alannxd/baileys 27 versions 2.1.2-6.2.8 (Cluster E - Baileys-brand-impersonation wave 8, deliberately wide-version-range shape to resolve under ^2/^3/^4/^5/^6 range specifiers)](https://github.com/advisories/GHSA-7345-fjw8-x55w) - GitHub
- [GHSA-94fw-5xp7-q2xq - npm @dreamguyxeon/baileyx (Cluster E - new @dreamguyxeon scope, dual-package Baileys-ecosystem illusion)](https://github.com/advisories/GHSA-94fw-5xp7-q2xq) - GitHub
- [GHSA-x3rc-jwjw-pwv6 - npm @dreamguyxeon/libsignal-node (Cluster E - impersonates upstream libsignal-node that real @whiskeysockets/baileys depends on)](https://github.com/advisories/GHSA-x3rc-jwjw-pwv6) - GitHub
- [GHSA-r7h6-xjpc-v4w4 - npm sc-announcer@99.9.1 (Cluster F - sc-* Best Buy / Geek Squad dep-confusion wave 2, MAL-2026-18064, OSSF-Package-Analysis flag)](https://github.com/advisories/GHSA-r7h6-xjpc-v4w4) - GitHub
- [GHSA-j5gf-73fv-7357 - npm sc-wizard@99.9.1 (Cluster F companion, MAL-2026-18062)](https://github.com/advisories/GHSA-j5gf-73fv-7357) - GitHub
- [GHSA-3phv-wc7c-mr2f - npm @securihackbot/depconf-stage-1792484738@1.0.0 (Cluster G - CONFIRMED postinstall HTTP-GET to http://34.143.131.27:18080/x-VA-1/main.js with base64 d= query parameter, MAL-2026-18105, Amazon Inspector)](https://github.com/advisories/GHSA-3phv-wc7c-mr2f) - GitHub
- [GHSA-p7gq-mvm4-4cw4 - npm @ziedzzz/demo-canary@0.0.0-stage,1.0.0 (Cluster G - self-identifying canary probe)](https://github.com/advisories/GHSA-p7gq-mvm4-4cw4) - GitHub
- [GHSA-7c67-r266-7883 - npm @platform-services/hrm-mfe-core@99.9.1 (Cluster G - HRM microfrontend dep-confusion, MAL-2026-18091, OSSF-Package-Analysis flag)](https://github.com/advisories/GHSA-7c67-r266-7883) - GitHub
- [GHSA-phw8-h49c-9v2q - npm tinkoff-cache-path (Cluster G - Tinkoff Bank Russia internal-scope target)](https://github.com/advisories/GHSA-phw8-h49c-9v2q) - GitHub
- [GHSA-gpp6-qxfg-2m7x - npm eacq-payform-core (Cluster G - EACQ payment-form internal-scope target)](https://github.com/advisories/GHSA-gpp6-qxfg-2m7x) - GitHub
- [GHSA-fj85-27r8-hgfg - npm nwfp-build-config@0.0.0-stage,1.0.0 (Cluster G)](https://github.com/advisories/GHSA-fj85-27r8-hgfg) - GitHub
- [GHSA-wj9j-hp45-x3gp - npm memories-core-web (Cluster G)](https://github.com/advisories/GHSA-wj9j-hp45-x3gp) - GitHub
- [GHSA-pq7r-cr8h-g6c8 - npm fanarena-common (Cluster G)](https://github.com/advisories/GHSA-pq7r-cr8h-g6c8) - GitHub
- [GHSA-2xv5-9mfv-2368 - npm ccl-global-shopping@99.9.1 (Cluster G - MAL-2026-18061, OSSF-Package-Analysis flag)](https://github.com/advisories/GHSA-2xv5-9mfv-2368) - GitHub
- [GHSA-4q6x-w65x-677r - npm tellyo-colours (Cluster G)](https://github.com/advisories/GHSA-4q6x-w65x-677r) - GitHub
- [GHSA-xxr7-33gg-pcg6 - npm formatting-subtitles-for-claude (Cluster H - sugarball.vercel.app anthropic-setup lure continuation)](https://github.com/advisories/GHSA-xxr7-33gg-pcg6) - GitHub
- [GHSA-8f2f-h2mc-9gh2 - npm rs-lookout-sandbox-poc@1.0.1 (Cluster H - CONFIRMED on-module-load AWS IMDSv2 query to 169.254.169.254/latest/meta-data/iam/security-credentials/ with exfil to https://webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/, MAL-2026-18109, Amazon Inspector)](https://github.com/advisories/GHSA-8f2f-h2mc-9gh2) - GitHub
- [GHSA-3vq8-fp27-44xm - npm my-auto-follow (Cluster I)](https://github.com/advisories/GHSA-3vq8-fp27-44xm) - GitHub
- [GHSA-xw7m-xxch-j3hp - npm my-auto-follow-eltio (Cluster I)](https://github.com/advisories/GHSA-xw7m-xxch-j3hp) - GitHub
- [GHSA-wx9h-pmqq-rcgg - npm fnd-stores (Cluster I)](https://github.com/advisories/GHSA-wx9h-pmqq-rcgg) - GitHub
- [DependencyWatch: npm-2026-10-20-tailwind-animatecss-fake-interview-campaign (today`s carve-out from the 2026-10-20 GHSA batch - 26-package coordinated Tailwind Animate.css fake-job-interview supply-chain campaign, MAL-2026-17665/17666/17667, OSSF MAL IDs 18065-18090)](https://dependencywatch.io/incident/npm-2026-10-20-tailwind-animatecss-fake-interview-campaign)
- [DependencyWatch: multi-2026-10-20-ghsa-malware-sweep (yesterday`s context - Baileys wave 7 @fluxionii/@ostyado direct predecessor to today`s @alannxd/@dreamguyxeon wave 8, sc-geeksquad-core/sc-font-icons direct predecessor to today`s sc-announcer/sc-wizard, @an1mshnpmb9c84920 attack-framework burst, @decoopus Claude/ChatGPT lure predecessor to today`s formatting-subtitles-for-claude)](https://dependencywatch.io/incident/multi-2026-10-20-ghsa-malware-sweep)
- [DependencyWatch: npm-2026-10-19-apex-accelerator-malicious-npm-packages (prior Apex Accelerator REF8801 carve-out)](https://dependencywatch.io/incident/npm-2026-10-19-apex-accelerator-malicious-npm-packages)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-21-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-21-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).