DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 22 October 2026

HighAdvisory sweepnpmPyPI

GHSA 2026-10-21/22 batch (~55 advisories). Headlines: new npm @sudobility/* XMRig cryptominer cluster (4 packages, confirmed scripts/miner.sh postinstall dropping XMRig via a presigned S3 URL and mining to networkservicesupp.flashhub.net:8443, with root-escalation branch via sudo); new PyPI 2026-10-voice-synthesis-profiles kam193 loader campaign (43 packages, all 0.1.0, OSSF-flagged MALICIOUS remote-script loaders with unknown second-stage); new PyPI 2026-10-iterquarry split-payload family (iterquarry + libseal co-publishing cipher and ciphertext); new PyPI 2026-10-journey-test-helloshell reverse-shell family (2 packages with env-var exfil at install time).

Published 22 Oct 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-10-22-ghsa-malware-sweep
54
Packages tracked62 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
22 Oct 2026
Ecosystems
npmPyPI
Detected by
GitHub Advisory Database, OpenSSF malicious-packages, Amazon Inspector, kam193 bad-packages
Also known as
2026-10-22 GHSA sweep, @sudobility XMRig miner cluster, networkservicesupp.flashhub.net Monero pool operator

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

Between 2026-10-21 06:00 UTC (yesterdays sweep cut-off) and 2026-10-22 06:00 UTC (todays ingest-window start), the GitHub Advisory Database published ~55 fresh malware advisories across npm and PyPI. Three clusters today carry fully-analyzed malicious payloads (the npm @sudobility/* XMRig miner cluster, the PyPI 2026-10-journey-test-helloshell reverse-shell family, and the PyPI 2026-10-iterquarry split-payload family). The headline campaign by raw volume is the PyPI 2026-10-voice-synthesis-profiles kam193 loader batch (43 packages in a single day).

Headlines

*npm `@sudobility/ XMRig miner** (Cluster A, 4 packages): first-publish lure cluster under a fake vendor scope @sudobility. scripts/miner.sh postinstall hook fetches a presigned Amazon S3 URL (embedded AWS access key), decompresses to /tmp/.smi, and runs. Unprivileged branch installs XMRig under disguised names; privileged branch (root or passwordless sudo) runs /tmp/.smi agent for Tor-relay + cron persistence. Mining pool: networkservicesupp.flashhub.net:8443`.

PyPI 2026-10-voice-synthesis-profiles loader campaign (Cluster B, 43 packages, all 0.1.0): kam193-tracked, OSSF-flagged MALICIOUS loader stubs. Published tarballs contain only a loader - the final payload is fetched from a runtime-supplied URL and has not been reconstructed publicly. Naming theme is TTS / voice synthesis / ASR / audio - the operator is seeding typosquats of the growing TTS / voice-cloning tool ecosystem.

PyPI 2026-10-iterquarry split-payload family (Cluster C): iterquarry carries an encrypted payload, libseal carries the decryption algorithm. Historical versions embedded the key and used a Discord bot C2. Current versions have the key removed.

PyPI 2026-10-journey-test-helloshell reverse-shell family (Cluster D, 2 packages): setup.py overrides install, exfils env vars at install time, and includes a reverse shell. OSSF-flagged MALICIOUS with targeted-attack tag.

Backfill (Cluster E): three npm CWE-506 boilerplate advisories ingested after yesterdays cut-off (@worrisome/reutil, @worrisome/aaaa, unscoped peptide-modify`).

Classification

sweep. Severity high (upgraded from the sweep baseline medium) because Clusters A, C and D carry confirmed malicious payloads (XMRig miner with root escalation, split-payload cipher pair, reverse shell with env-var exfil). None of the clusters reaches critical - all are impersonators or first-publish lures with no legitimate upstream hijacked, so the reach is limited to whoever installs by mistake.

Discovery

GitHub Advisory Database, OpenSSF malicious-packages, Amazon Inspector (Cluster A representative sources), kam193 bad-packages (Clusters B, C, D source hashes and campaign tags).

typosquatcredential-theftdependency-confusionobfuscationdormant-domain
Affected packages

54 packages 62 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • *Cluster A - npm `@sudobility/ XMRig cryptominer cluster (malicious-package; CONFIRMED install-time XMRig drop + root-escalation branch; all 4 published 2026-10-22; same payload shape across all 4 - a scripts/miner.sh postinstall hook fetches a gzipped stage from an attacker-controlled Amazon S3 bucket via a presigned URL that embeds an AWS access key, decompresses it to /tmp/.smi, and runs it; **unprivileged branch** extracts an XMRig cryptominer (binary written to $HOME/.local/lib/ under disguised system-service names like edid-mon, smmon, irqstatsd, kmod-cache), drops a Monero pool config at $HOME/.sysmond.json targeting networkservicesupp.flashhub.net:8443, and launches the miner under nohup; **privileged branch** (root OR passwordless sudo) runs /tmp/.smi agent to install a persistent agent, with the scripts own comments referencing stealth renaming, cron persistence, and a Tor relay)*: @sudobility/indexer_client@0.0.146 (GHSA-2gvv-vgvw-559c, MAL-2026-18127, Amazon Inspector source b374713629b9be645f22b21fab5376e57a55d3001c72a1e55e1e8dfb6e40a27b), @sudobility/shaperouter_client@0.0.14 (GHSA-mj95-29f2-vxg2, MAL-2026-18128, source bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503), @sudobility/testomniac_client@0.0.131 (GHSA-58jf-66x8-7q28, MAL-2026-18129, source 42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3 - advertised as a TanStack Query client), @sudobility/wildduck_client@2.3.102 (GHSA-vhv8-cmrm-5fpr, MAL-2026-18130, source a4524dc6ef26909f4ddfaf83eae1ec13495a5b2aef57375c0a8d8ad4c0609637 - advertised as a WildDuck email-server client). The @sudobility scope is operator-controlled and the four slugs reuse plausible open-source library names - this is a first-publish lure cluster under a fake vendor scope, not a hijack. Severity high for this cluster (confirmed install-time XMRig + root-escalation attempt, limited reach because nothing legitimate depends on `@sudobility/`)
  • Cluster B - PyPI kam193 2026-10-voice-synthesis-profiles loader campaign (malicious-package; OSSF-flagged MALICIOUS with reason "Downloads and executes a remote malicious script"; the published tarballs do NOT contain the malicious payload - they are loader stubs that fetch and execute code from a URL supplied at runtime; the second-stage URL and payload have not been published; 43 packages, all 0.1.0, all 2026-10-22, all with the same kam193 loader shape; the naming theme (TTS / voice synthesis / ASR / audio) suggests the operator is seeding typosquats of the growing TTS / voice-cloning tool ecosystem): 12 TTS/voice slugs - ttsdock (GHSA-hxqp-f9h5-2vc7, MAL-2026-18169), voicekit (GHSA-pjwv-3r6v-rg4g), voxweaver (GHSA-cfc4-q58x-wcw2), ttsprobe (GHSA-mc55-9j2g-mq57), vocabbench (GHSA-wm6p-h4p6-jvwf), vocabblend (GHSA-mxx3-4m2r-m6x4), ttsflow (GHSA-6vj3-fvf7-2xw8), ttsweaver (GHSA-56xh-hrpc-q43f), soundsocket (GHSA-c6pp-w9mm-gmm2), speechprobe (GHSA-628w-95w3-p743), speakbench (GHSA-hfcr-gc92-xhqh), speaksocket (GHSA-m465-2c74-q5mr); 14 *tts suffix slugs - phonoviatts (GHSA-59g8-p4vg-hxmp), vellutts (GHSA-r648-hxrj-427m), voxilaratts (GHSA-2mv3-pcfq-c2wx), prosodinetts (GHSA-79r9-xhg8-fwh2), tessivatts (GHSA-53mw-w6xh-cphh), quillonatts (GHSA-2q7p-4pqj-r5g8), solivoxtts (GHSA-q9gf-mr6c-mcvv), zennittts (GHSA-h83c-2v4j-cmqg), aurenatts (GHSA-g7rh-4hgc-gg46), brummatts (GHSA-xmpf-26vw-3r44), crenelatts (GHSA-jqjw-jf8x-rqhx), melcuratts (GHSA-fxp8-9rp8-6c29), grommatts (GHSA-rjcv-pfv7-h9qx), dictanovaasr (GHSA-fx4q-4x54-9xcp); 5 ASR / audio slugs - asrdock (GHSA-pfmv-2f8f-956x), acoustichub (GHSA-r79r-f84p-h448), acousticpack (GHSA-pjv8-qmhr-3cj5), audiokit (GHSA-gvgp-r29f-8j66, MAL-2026-18158), asrloom (GHSA-5286-9g82-mpg2, MAL-2026-18157); 8 ML / eval misc slugs - modelworks (GHSA-cppv-x8vc-pgq6, MAL-2026-18162), hookgantry (GHSA-3368-f3gh-9vgp), phonemeprobe (GHSA-g278-p8f6-4gq2), pipegrip (GHSA-g6cv-p5vx-78jw), phonemeforge (GHSA-7w3g-7853-hfwg), benchworks (GHSA-cxwf-mm53-g7xh), benchbridge (GHSA-jqh2-q92v-g3m9), evalstream (GHSA-93qq-p7mf-hxr5); 4 misc - orchestril (GHSA-rrj6-3qm9-67cr, MAL-2026-18142), shellgrip (GHSA-8jxf-7hjv-2f3h, MAL-2026-18146), codecraze (GHSA-ph85-49q2-52ph, MAL-2026-18137), batchspar (GHSA-85jh-m5mm-cxm2, MAL-2026-18135). Severity medium for this cluster (loader stubs with no second-stage URL published; the kam193-tracked campaign is marked MALICIOUS and the operator shape - 43 one-shot 0.1.0 loaders under one campaign tag in a single day - is unusually heavy, so treat an environment that resolved any of these during the exposure window as a candidate compromise and quarantine for forensic review)
  • Cluster C - PyPI kam193 2026-10-iterquarry split-payload family (malicious-package; OSSF-flagged MALICIOUS with reasons "Obfuscation", "Malicious code intentionally included in a dependency of the package" and "Action hidden in library usage"; the campaign splits the attack across two co-published packages - iterquarry carries the encrypted payload while libseal carries the decryption algorithm; earlier iterquarry versions embedded the decryption key and contacted a Discord bot C2; iterquarry >= 2.2.0 moved the key out of the package, so the second-stage behaviour on current versions is not reconstructed in public analysis): iterquarry@2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.2.0, 2.2.1 (GHSA-jx5r-qjfm-5v26, MAL-2026-18131, source 229de224c9319ae50283d0c8fb0f76e351d82327ac204193b7dd2d62026ee41d), libseal@1.1.0, 1.1.1, 1.1.2, 1.1.3 (GHSA-8pwv-jgmv-fcm8, MAL-2026-18132, source 7e6d706d49a7fce89545d12c5bd5a0cab0a4919a95ff89150b28cb838967bb09). Severity medium (confirmed obfuscated payload split across two packages with a historical Discord C2, but current-version second-stage is not publicly reconstructed and reach is limited to whoever installs the pair by mistake)
  • Cluster D - PyPI kam193 2026-10-journey-test-helloshell reverse-shell family (malicious-package; OSSF-flagged MALICIOUS + targeted-attack; setup.py overrides the install command so code runs during pip install; confirmed reverse-shell code AND install-time environment-variable exfiltration - any .env-sourced secret, CI credential, or private key present in the install environment is in scope): journey-test-helloshell@0.2.0 (GHSA-g885-3jpg-94hg, MAL-2026-18124, source bdf4549e34df1c1c7dfd704454011cf0a26ea5807948e917d7bc65f130182fc9, published 2026-10-21 but ingested overnight), journey-test-hellospy@0.1.1 (GHSA-v8q8-jrm2-52jp, MAL-2026-18133, source 418fea1fe789e9a44c77c08c9135b3da66b773882c9fb2757094c3f55b04321b). The journey-test- prefix suggests a staging / test / QA-flavoured internal-slug naming that targets organisations running journey-* namespaced internal pipelines. Severity high for this cluster (confirmed reverse-shell + env-var exfil at install time)
  • Cluster E - npm backfill from 2026-10-21 batch (CWE-506 boilerplate takedowns ingested after yesterday`s sweep cut-off; no vendor runtime analysis published; all 3 published 2026-10-21): @worrisome/reutil all versions (GHSA-4f5p-mp5p-863f), @worrisome/aaaa all versions (GHSA-fxf3-w84v-3v6g - the aaaa slug self-identifies as a test / canary artefact), peptide-modify all versions (GHSA-h643-5mcg-c726 - this is the UNSCOPED republish; the prior scoped @peptide-unit/peptide-modify and @peptide-packets/peptide-modify slugs were catalogued in the 2026-07-30 and 2026-07-31 sweeps - the operator has graduated the slug off its original biotech-impersonation scope). Severity medium for this cluster
  • Operator continuity: kam193 publishes three distinct campaigns in a single day (2026-10-voice-synthesis-profiles loaders, 2026-10-iterquarry split-payload cipher pair, 2026-10-journey-test-helloshell reverse-shell family), continuing the pattern that drove yesterdays [2026-10-21 sweep](/incident/multi-2026-10-21-ghsa-malware-sweep) 2026-10-semvver PyPI typosquat family and 2026-10-vacsdk dep-confusion probes. The @sudobility scope is a NEW operator with a sharper real-world payload (XMRig + root-escalation) than any PyPI loader in the batch - treat the scope as an active probe pattern worth watching for wave 2. **No new activity** from the 2026-10-21 batchs sharp IOCs: c2-worker.crawlnet-claim.workers.dev apex (pyupd payload), 34.143.131.27:18080 + /x-VA-1/main.js path (@securihackbot operator), webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/ (rs-lookout-sandbox-poc AWS IMDS exfil) - keep in standing-egress denylist from yesterdays sweep. No new Baileys-lure wave 9 slugs today (operator cadence suggests another wave in 24-48 hours). No new sc-* Best Buy dep-confusion slugs today beyond yesterdays sc-announcer/sc-wizard. Carve-outs LiteLLM 1.107.0, Tailwind Animate.css fake-interview, Apex Accelerator REF8801, TensorLake AI, hridoy FB credential stealer remain confirmed-recovered with no wave-2 malicious republish observed
What to do

Clean-up steps

  1. *For Cluster A (`@sudobility/ XMRig miner, CONFIRMED payload)**: grep every package.json, package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock and internal registry mirrors for @sudobility/indexer_client@0.0.146, @sudobility/shaperouter_client@0.0.14, @sudobility/testomniac_client@0.0.131, @sudobility/wildduck_client@2.3.102. On any hit on a Linux host that ran npm install: treat the host as compromised. **Hunt for the drop and persistence artefacts**: /tmp/.smi, $HOME/.sysmond.json, $HOME/.local/lib/ entries under disguised system-service names (edid-mon, smmon, irqstatsd, kmod-cache), any nohup child under those names, unexpected cron entries, and - on root-sudo hosts - any new Tor relay process or systemd unit. **Egress block**: networkservicesupp.flashhub.net:8443 on every host (Monero pool, sharp IOC). Also block egress to the s3.amazonaws.com presigned URL path the installer uses (specific bucket not published at advisory level - audit CI / dev-workstation egress logs for S3 presigned GETs during the exposure window). Any @sudobility/*` slug under any version is suspect by default - the scope is operator-controlled
  2. For Cluster B (PyPI 2026-10-voice-synthesis-profiles loader campaign, 43 packages): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda env and every internal PyPI mirror for the full slug list (all 43 at 0.1.0). On any hit on any Python environment on any host that ran pip install since 2026-10-22: treat the environment as a candidate compromise. The published tarballs do not carry the final payload but DO contain a loader stub that will fetch and exec() a remote URL under operator control - so the install-time behaviour on any environment that still has the package resident is to re-fetch and re-execute from that URL whenever the loader is imported. Uninstall the slug AND rebuild the environment rather than relying on pip uninstall alone. Rotate every secret the install environment could reach (CI tokens, cloud CLI credentials, .env entries, package registry credentials). Grep rules: block the full slug list on your public-PyPI denylist; add tts*, *tts, voice*, voc*, speak*, speech*, phonem*, acoustic*, asr*, audio* prefix / suffix patterns to your heightened-scrutiny list for the next 30 days
  3. For Cluster C (iterquarry + libseal split-payload family): grep every PyPI manifest for iterquarry at 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.2.0, 2.2.1, and libseal at 1.1.0, 1.1.1, 1.1.2, 1.1.3. If BOTH packages are present together on the same host, the pair has had the opportunity to decrypt and execute the embedded ciphertext - treat the host as a treat as fully compromised event per the CWE-506 boilerplate. If only one of the two is present, the payload cannot execute without its sibling, but the slug is still an active-malicious artefact and the environment should be quarantined. Historical versions used a Discord bot C2 - audit outbound Discord webhook / API traffic from the install window
  4. For Cluster D (journey-test-helloshell + journey-test-hellospy reverse-shell + env-var exfil family): grep every PyPI manifest for journey-test-helloshell@0.2.0 and journey-test-hellospy@0.1.1. On any hit: treat the host as compromised AND assume every environment variable visible to the install process was exfiltrated at install time - rotate every .env-sourced secret, every CI-provisioned token, every cloud credential visible as an env var, and every private-key path visible in the env. The reverse shell code is bundled in setup.py - any resource reachable from the install users network context is in scope; audit outbound TCP connections from the install window and quarantine the host for forensic review. If your organisation runs journey-*` namespaced internal pipelines, review the internal-registry resolution order to prevent public-PyPI shadowing
  5. *For Cluster E (npm `@worrisome/ + unscoped peptide-modify backfill)**: grep every package.json and lockfiles for @worrisome/reutil, @worrisome/aaaa, peptide-modify (unscoped, distinct from the earlier @peptide-unit/peptide-modify and @peptide-packets/peptide-modify entries). On any hit: treat as the standard CWE-506 boilerplate (rotate secrets from a different machine, remove the package, assume host compromise). The unscoped peptide-modify` re-publish signals that the operator behind the earlier scoped biotech-impersonation attempts has escalated to an unscoped slug - watch for further unscoped single-word biotech / chemistry / peptide slugs
  6. Standing egress-denylist carry-forward from prior sweeps (keep in place; today adds networkservicesupp.flashhub.net:8443 apex): c2-worker.crawlnet-claim.workers.dev apex + /dl/pyupd path, 34.143.131.27:18080 + /x-VA-1/main.js path, webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/ (2026-10-21); 75.119.137.232:31337 + /depconfuse path (2026-10-20); transfer.archivete.am apex + /H2Uxm/fabdeploycheck-config.json path (2026-10-19); realwbx.com apex + /ip.php + /ip paths; artifacts.creditslib.com apex + /npm/* paths; login.fromthehotel.com apex; googleforum.pythonanywhere.com; space-z.ai apex; dxpoc.gt.tc apex; raw.githubusercontent.com/anonrider404/pypl/*; api-bsx.pages.dev + /download; 177.7.60.239:48080 + oob.recon.dev; uncoder.eu.org + /cc-checker/api.php; accenture-npm.azurewebsites.net; limbomail.com; collector.oob.s4yhii.com + *.oob.s4yhii.com + s4yhii.com; 64.181.165.115/dc; 167.88.172.33:8087 + jsonspack.com; goxtools.shop; minhdong.site; 45.138.12.177:8089; 185.158.107.175:8787; ltidi.storage.googleapis.com/depenconf/; oob.s4yhii.com:9999/native; *.oast.pro/*.oast.me/*.oast.fun/*.oast.site/*.oastify.com; frjmzbjbhwvtdnsuodmu.supabase.co; api.npoint.io; tele.metry.orgin.net; morroncr0w.io; api.telegram.org on untrusted CI/build hosts; appsecc.com; generic webhook.site/* paths other than legitimate dev webhooks; nfjbill.ren; storage.googleapis.com/depenconf/; 10.0.19.0/24 + 10.0.49.0/24; api.nm-streetwear.space; Discord webhook URL pattern; ipify.org + ifconfig.me; gitflic.ru; api.wagmiwallet.org; backend-cybersecuritydashboard.onrender.com; Monero mining pools (now including networkservicesupp.flashhub.net:8443); Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints; chinazhangsan.ccwu.cc; fabric-npm.gm-service.xyz; jsonkeeper.com; npm-canary.aveliscare.com; meta.brs.cx; s3://pkusinski-external/; AWS account 631484165566; Slack bot-token exfil patterns; s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook; tuamaeaquelaursa.com; 45.138.0.0/16 RubyGems wgkit CIDRs; apexaccs.org apex + subdomains; arenapex.cloud; apexfdn.xyz apex + subdomains; fdn4apex.com; router-apex.com apex + subdomains; ccmihr.com; 0auth-chromium.com; ehegisnightmare.icu; cloudmain365duo.top; LiteLLM 1.107.0 - www.litellm.dev/healthcheck apex + the GitHub dead-drop raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt
References

Sources

multi-2026-10-22-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents