# GitHub Advisory malware sweep, 22 October 2026

> GHSA 2026-10-21/22 batch (~55 advisories). Headlines: new npm `@sudobility/*` XMRig cryptominer cluster (4 packages, confirmed `scripts/miner.sh` postinstall dropping XMRig via a presigned S3 URL and mining to `networkservicesupp.flashhub.net:8443`, with root-escalation branch via `sudo`); new PyPI `2026-10-voice-synthesis-profiles` kam193 loader campaign (43 packages, all `0.1.0`, OSSF-flagged `MALICIOUS` remote-script loaders with unknown second-stage); new PyPI `2026-10-iterquarry` split-payload family (`iterquarry` + `libseal` co-publishing cipher and ciphertext); new PyPI `2026-10-journey-test-helloshell` reverse-shell family (2 packages with env-var exfil at install time).

- Published: 2026-10-22
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 54 packages, 62 compromised versions
- Tags: typosquat, credential-theft, dependency-confusion, obfuscation, dormant-domain
- Also known as: 2026-10-22 GHSA sweep, @sudobility XMRig miner cluster, networkservicesupp.flashhub.net Monero pool operator, 2026-10-voice-synthesis-profiles kam193 loader campaign, 2026-10-iterquarry libseal split-payload family, 2026-10-journey-test-helloshell reverse shell family
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, Amazon Inspector, kam193 bad-packages
- Incident ID: multi-2026-10-22-ghsa-malware-sweep

## Affected packages (54)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@sudobility/indexer_client](https://dependencywatch.io/package/npm/@sudobility/indexer_client) | npm | 0.0.146 |
| [@sudobility/shaperouter_client](https://dependencywatch.io/package/npm/@sudobility/shaperouter_client) | npm | 0.0.14 |
| [@sudobility/testomniac_client](https://dependencywatch.io/package/npm/@sudobility/testomniac_client) | npm | 0.0.131 |
| [@sudobility/wildduck_client](https://dependencywatch.io/package/npm/@sudobility/wildduck_client) | npm | 2.3.102 |
| [@worrisome/aaaa](https://dependencywatch.io/package/npm/@worrisome/aaaa) | npm | * |
| [@worrisome/reutil](https://dependencywatch.io/package/npm/@worrisome/reutil) | npm | * |
| [acoustichub](https://dependencywatch.io/package/pypi/acoustichub) | PyPI | 0.1.0 |
| [acousticpack](https://dependencywatch.io/package/pypi/acousticpack) | PyPI | 0.1.0 |
| [asrdock](https://dependencywatch.io/package/pypi/asrdock) | PyPI | 0.1.0 |
| [asrloom](https://dependencywatch.io/package/pypi/asrloom) | PyPI | 0.1.0 |
| [audiokit](https://dependencywatch.io/package/pypi/audiokit) | PyPI | 0.1.0 |
| [aurenatts](https://dependencywatch.io/package/pypi/aurenatts) | PyPI | 0.1.0 |
| [batchspar](https://dependencywatch.io/package/pypi/batchspar) | PyPI | 0.1.0 |
| [benchbridge](https://dependencywatch.io/package/pypi/benchbridge) | PyPI | 0.1.0 |
| [benchworks](https://dependencywatch.io/package/pypi/benchworks) | PyPI | 0.1.0 |
| [brummatts](https://dependencywatch.io/package/pypi/brummatts) | PyPI | 0.1.0 |
| [codecraze](https://dependencywatch.io/package/pypi/codecraze) | PyPI | 0.1.0 |
| [crenelatts](https://dependencywatch.io/package/pypi/crenelatts) | PyPI | 0.1.0 |
| [dictanovaasr](https://dependencywatch.io/package/pypi/dictanovaasr) | PyPI | 0.1.0 |
| [evalstream](https://dependencywatch.io/package/pypi/evalstream) | PyPI | 0.1.0 |
| [grommatts](https://dependencywatch.io/package/pypi/grommatts) | PyPI | 0.1.0 |
| [hookgantry](https://dependencywatch.io/package/pypi/hookgantry) | PyPI | 0.1.0 |
| [iterquarry](https://dependencywatch.io/package/pypi/iterquarry) | PyPI | 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.2.0, 2.2.1 |
| [journey-test-helloshell](https://dependencywatch.io/package/pypi/journey-test-helloshell) | PyPI | 0.2.0 |
| [journey-test-hellospy](https://dependencywatch.io/package/pypi/journey-test-hellospy) | PyPI | 0.1.1 |
| [libseal](https://dependencywatch.io/package/pypi/libseal) | PyPI | 1.1.0, 1.1.1, 1.1.2, 1.1.3 |
| [melcuratts](https://dependencywatch.io/package/pypi/melcuratts) | PyPI | 0.1.0 |
| [modelworks](https://dependencywatch.io/package/pypi/modelworks) | PyPI | 0.1.0 |
| [orchestril](https://dependencywatch.io/package/pypi/orchestril) | PyPI | 0.1.0 |
| [peptide-modify](https://dependencywatch.io/package/npm/peptide-modify) | npm | * |
| [phonemeforge](https://dependencywatch.io/package/pypi/phonemeforge) | PyPI | 0.1.0 |
| [phonemeprobe](https://dependencywatch.io/package/pypi/phonemeprobe) | PyPI | 0.1.0 |
| [phonoviatts](https://dependencywatch.io/package/pypi/phonoviatts) | PyPI | 0.1.0 |
| [pipegrip](https://dependencywatch.io/package/pypi/pipegrip) | PyPI | 0.1.0 |
| [prosodinetts](https://dependencywatch.io/package/pypi/prosodinetts) | PyPI | 0.1.0 |
| [quillonatts](https://dependencywatch.io/package/pypi/quillonatts) | PyPI | 0.1.0 |
| [shellgrip](https://dependencywatch.io/package/pypi/shellgrip) | PyPI | 0.1.0 |
| [solivoxtts](https://dependencywatch.io/package/pypi/solivoxtts) | PyPI | 0.1.0 |
| [soundsocket](https://dependencywatch.io/package/pypi/soundsocket) | PyPI | 0.1.0 |
| [speakbench](https://dependencywatch.io/package/pypi/speakbench) | PyPI | 0.1.0 |
| [speaksocket](https://dependencywatch.io/package/pypi/speaksocket) | PyPI | 0.1.0 |
| [speechprobe](https://dependencywatch.io/package/pypi/speechprobe) | PyPI | 0.1.0 |
| [tessivatts](https://dependencywatch.io/package/pypi/tessivatts) | PyPI | 0.1.0 |
| [ttsdock](https://dependencywatch.io/package/pypi/ttsdock) | PyPI | 0.1.0 |
| [ttsflow](https://dependencywatch.io/package/pypi/ttsflow) | PyPI | 0.1.0 |
| [ttsprobe](https://dependencywatch.io/package/pypi/ttsprobe) | PyPI | 0.1.0 |
| [ttsweaver](https://dependencywatch.io/package/pypi/ttsweaver) | PyPI | 0.1.0 |
| [vellutts](https://dependencywatch.io/package/pypi/vellutts) | PyPI | 0.1.0 |
| [vocabbench](https://dependencywatch.io/package/pypi/vocabbench) | PyPI | 0.1.0 |
| [vocabblend](https://dependencywatch.io/package/pypi/vocabblend) | PyPI | 0.1.0 |
| [voicekit](https://dependencywatch.io/package/pypi/voicekit) | PyPI | 0.1.0 |
| [voxilaratts](https://dependencywatch.io/package/pypi/voxilaratts) | PyPI | 0.1.0 |
| [voxweaver](https://dependencywatch.io/package/pypi/voxweaver) | PyPI | 0.1.0 |
| [zennittts](https://dependencywatch.io/package/pypi/zennittts) | PyPI | 0.1.0 |

## What happened

Between 2026-10-21 06:00 UTC (yesterday`s sweep cut-off) and 2026-10-22 06:00 UTC (today`s ingest-window start), the GitHub Advisory Database published ~55 fresh malware advisories across npm and PyPI. Three clusters today carry fully-analyzed malicious payloads (the npm `@sudobility/*` XMRig miner cluster, the PyPI `2026-10-journey-test-helloshell` reverse-shell family, and the PyPI `2026-10-iterquarry` split-payload family). The headline campaign by raw volume is the PyPI `2026-10-voice-synthesis-profiles` kam193 loader batch (43 packages in a single day).

## Headlines

**npm `@sudobility/*` XMRig miner** (Cluster A, 4 packages): first-publish lure cluster under a fake vendor scope `@sudobility`. `scripts/miner.sh` postinstall hook fetches a presigned Amazon S3 URL (embedded AWS access key), decompresses to `/tmp/.smi`, and runs. Unprivileged branch installs XMRig under disguised names; privileged branch (root or passwordless sudo) runs `/tmp/.smi agent` for Tor-relay + cron persistence. Mining pool: `networkservicesupp.flashhub.net:8443`.

**PyPI `2026-10-voice-synthesis-profiles` loader campaign** (Cluster B, 43 packages, all `0.1.0`): kam193-tracked, OSSF-flagged `MALICIOUS` loader stubs. Published tarballs contain only a loader - the final payload is fetched from a runtime-supplied URL and has not been reconstructed publicly. Naming theme is TTS / voice synthesis / ASR / audio - the operator is seeding typosquats of the growing TTS / voice-cloning tool ecosystem.

**PyPI `2026-10-iterquarry` split-payload family** (Cluster C): `iterquarry` carries an encrypted payload, `libseal` carries the decryption algorithm. Historical versions embedded the key and used a Discord bot C2. Current versions have the key removed.

**PyPI `2026-10-journey-test-helloshell` reverse-shell family** (Cluster D, 2 packages): `setup.py` overrides install, exfils env vars at install time, and includes a reverse shell. OSSF-flagged `MALICIOUS` with `targeted-attack` tag.

**Backfill** (Cluster E): three npm CWE-506 boilerplate advisories ingested after yesterday`s cut-off (`@worrisome/reutil`, `@worrisome/aaaa`, unscoped `peptide-modify`).

## Classification

`sweep`. Severity `high` (upgraded from the sweep baseline `medium`) because Clusters A, C and D carry confirmed malicious payloads (XMRig miner with root escalation, split-payload cipher pair, reverse shell with env-var exfil). None of the clusters reaches `critical` - all are impersonators or first-publish lures with no legitimate upstream hijacked, so the reach is limited to whoever installs by mistake.

## Discovery

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `Amazon Inspector` (Cluster A representative sources), `kam193 bad-packages` (Clusters B, C, D source hashes and campaign tags).

## Impact

- **Cluster A - npm `@sudobility/*` XMRig cryptominer cluster (malicious-package; CONFIRMED install-time XMRig drop + root-escalation branch; all 4 published 2026-10-22; same payload shape across all 4 - a `scripts/miner.sh` postinstall hook fetches a gzipped stage from an attacker-controlled Amazon S3 bucket via a presigned URL that embeds an AWS access key, decompresses it to `/tmp/.smi`, and runs it; **unprivileged branch** extracts an XMRig cryptominer (binary written to `$HOME/.local/lib/` under disguised system-service names like `edid-mon`, `smmon`, `irqstatsd`, `kmod-cache`), drops a Monero pool config at `$HOME/.sysmond.json` targeting `networkservicesupp.flashhub.net:8443`, and launches the miner under `nohup`; **privileged branch** (root OR passwordless sudo) runs `/tmp/.smi agent` to install a persistent agent, with the script`s own comments referencing stealth renaming, cron persistence, and a Tor relay)**: `@sudobility/indexer_client@0.0.146` (GHSA-2gvv-vgvw-559c, MAL-2026-18127, Amazon Inspector source `b374713629b9be645f22b21fab5376e57a55d3001c72a1e55e1e8dfb6e40a27b`), `@sudobility/shaperouter_client@0.0.14` (GHSA-mj95-29f2-vxg2, MAL-2026-18128, source `bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503`), `@sudobility/testomniac_client@0.0.131` (GHSA-58jf-66x8-7q28, MAL-2026-18129, source `42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3` - advertised as a TanStack Query client), `@sudobility/wildduck_client@2.3.102` (GHSA-vhv8-cmrm-5fpr, MAL-2026-18130, source `a4524dc6ef26909f4ddfaf83eae1ec13495a5b2aef57375c0a8d8ad4c0609637` - advertised as a WildDuck email-server client). The `@sudobility` scope is operator-controlled and the four slugs reuse plausible open-source library names - this is a first-publish lure cluster under a fake vendor scope, not a hijack. Severity `high` for this cluster (confirmed install-time XMRig + root-escalation attempt, limited reach because nothing legitimate depends on `@sudobility/*`)
- **Cluster B - PyPI kam193 `2026-10-voice-synthesis-profiles` loader campaign (malicious-package; OSSF-flagged `MALICIOUS` with reason "Downloads and executes a remote malicious script"; the published tarballs do NOT contain the malicious payload - they are loader stubs that fetch and execute code from a URL supplied at runtime; the second-stage URL and payload have not been published; 43 packages, all `0.1.0`, all 2026-10-22, all with the same kam193 loader shape; the naming theme (TTS / voice synthesis / ASR / audio) suggests the operator is seeding typosquats of the growing TTS / voice-cloning tool ecosystem)**: 12 TTS/voice slugs - `ttsdock` (GHSA-hxqp-f9h5-2vc7, MAL-2026-18169), `voicekit` (GHSA-pjwv-3r6v-rg4g), `voxweaver` (GHSA-cfc4-q58x-wcw2), `ttsprobe` (GHSA-mc55-9j2g-mq57), `vocabbench` (GHSA-wm6p-h4p6-jvwf), `vocabblend` (GHSA-mxx3-4m2r-m6x4), `ttsflow` (GHSA-6vj3-fvf7-2xw8), `ttsweaver` (GHSA-56xh-hrpc-q43f), `soundsocket` (GHSA-c6pp-w9mm-gmm2), `speechprobe` (GHSA-628w-95w3-p743), `speakbench` (GHSA-hfcr-gc92-xhqh), `speaksocket` (GHSA-m465-2c74-q5mr); 14 `*tts` suffix slugs - `phonoviatts` (GHSA-59g8-p4vg-hxmp), `vellutts` (GHSA-r648-hxrj-427m), `voxilaratts` (GHSA-2mv3-pcfq-c2wx), `prosodinetts` (GHSA-79r9-xhg8-fwh2), `tessivatts` (GHSA-53mw-w6xh-cphh), `quillonatts` (GHSA-2q7p-4pqj-r5g8), `solivoxtts` (GHSA-q9gf-mr6c-mcvv), `zennittts` (GHSA-h83c-2v4j-cmqg), `aurenatts` (GHSA-g7rh-4hgc-gg46), `brummatts` (GHSA-xmpf-26vw-3r44), `crenelatts` (GHSA-jqjw-jf8x-rqhx), `melcuratts` (GHSA-fxp8-9rp8-6c29), `grommatts` (GHSA-rjcv-pfv7-h9qx), `dictanovaasr` (GHSA-fx4q-4x54-9xcp); 5 ASR / audio slugs - `asrdock` (GHSA-pfmv-2f8f-956x), `acoustichub` (GHSA-r79r-f84p-h448), `acousticpack` (GHSA-pjv8-qmhr-3cj5), `audiokit` (GHSA-gvgp-r29f-8j66, MAL-2026-18158), `asrloom` (GHSA-5286-9g82-mpg2, MAL-2026-18157); 8 ML / eval misc slugs - `modelworks` (GHSA-cppv-x8vc-pgq6, MAL-2026-18162), `hookgantry` (GHSA-3368-f3gh-9vgp), `phonemeprobe` (GHSA-g278-p8f6-4gq2), `pipegrip` (GHSA-g6cv-p5vx-78jw), `phonemeforge` (GHSA-7w3g-7853-hfwg), `benchworks` (GHSA-cxwf-mm53-g7xh), `benchbridge` (GHSA-jqh2-q92v-g3m9), `evalstream` (GHSA-93qq-p7mf-hxr5); 4 misc - `orchestril` (GHSA-rrj6-3qm9-67cr, MAL-2026-18142), `shellgrip` (GHSA-8jxf-7hjv-2f3h, MAL-2026-18146), `codecraze` (GHSA-ph85-49q2-52ph, MAL-2026-18137), `batchspar` (GHSA-85jh-m5mm-cxm2, MAL-2026-18135). Severity `medium` for this cluster (loader stubs with no second-stage URL published; the kam193-tracked campaign is marked `MALICIOUS` and the operator shape - 43 one-shot `0.1.0` loaders under one campaign tag in a single day - is unusually heavy, so treat an environment that resolved any of these during the exposure window as a candidate compromise and quarantine for forensic review)
- **Cluster C - PyPI kam193 `2026-10-iterquarry` split-payload family (malicious-package; OSSF-flagged `MALICIOUS` with reasons "Obfuscation", "Malicious code intentionally included in a dependency of the package" and "Action hidden in library usage"; the campaign splits the attack across two co-published packages - `iterquarry` carries the encrypted payload while `libseal` carries the decryption algorithm; earlier `iterquarry` versions embedded the decryption key and contacted a Discord bot C2; `iterquarry >= 2.2.0` moved the key out of the package, so the second-stage behaviour on current versions is not reconstructed in public analysis)**: `iterquarry@2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.2.0, 2.2.1` (GHSA-jx5r-qjfm-5v26, MAL-2026-18131, source `229de224c9319ae50283d0c8fb0f76e351d82327ac204193b7dd2d62026ee41d`), `libseal@1.1.0, 1.1.1, 1.1.2, 1.1.3` (GHSA-8pwv-jgmv-fcm8, MAL-2026-18132, source `7e6d706d49a7fce89545d12c5bd5a0cab0a4919a95ff89150b28cb838967bb09`). Severity `medium` (confirmed obfuscated payload split across two packages with a historical Discord C2, but current-version second-stage is not publicly reconstructed and reach is limited to whoever installs the pair by mistake)
- **Cluster D - PyPI kam193 `2026-10-journey-test-helloshell` reverse-shell family (malicious-package; OSSF-flagged `MALICIOUS` + `targeted-attack`; `setup.py` overrides the install command so code runs during `pip install`; confirmed reverse-shell code AND install-time environment-variable exfiltration - any `.env`-sourced secret, CI credential, or private key present in the install environment is in scope)**: `journey-test-helloshell@0.2.0` (GHSA-g885-3jpg-94hg, MAL-2026-18124, source `bdf4549e34df1c1c7dfd704454011cf0a26ea5807948e917d7bc65f130182fc9`, published 2026-10-21 but ingested overnight), `journey-test-hellospy@0.1.1` (GHSA-v8q8-jrm2-52jp, MAL-2026-18133, source `418fea1fe789e9a44c77c08c9135b3da66b773882c9fb2757094c3f55b04321b`). The `journey-test-` prefix suggests a staging / test / QA-flavoured internal-slug naming that targets organisations running `journey-*` namespaced internal pipelines. Severity `high` for this cluster (confirmed reverse-shell + env-var exfil at install time)
- **Cluster E - npm backfill from 2026-10-21 batch (CWE-506 boilerplate takedowns ingested after yesterday`s sweep cut-off; no vendor runtime analysis published; all 3 published 2026-10-21)**: `@worrisome/reutil` all versions (GHSA-4f5p-mp5p-863f), `@worrisome/aaaa` all versions (GHSA-fxf3-w84v-3v6g - the `aaaa` slug self-identifies as a test / canary artefact), `peptide-modify` all versions (GHSA-h643-5mcg-c726 - this is the UNSCOPED republish; the prior scoped `@peptide-unit/peptide-modify` and `@peptide-packets/peptide-modify` slugs were catalogued in the [2026-07-30](https://dependencywatch.io/incident/npm-2026-07-30-ghsa-malware-sweep) and [2026-07-31](https://dependencywatch.io/incident/npm-2026-07-31-ghsa-malware-sweep) sweeps - the operator has graduated the slug off its original biotech-impersonation scope). Severity `medium` for this cluster
- **Operator continuity**: `kam193` publishes three distinct campaigns in a single day (`2026-10-voice-synthesis-profiles` loaders, `2026-10-iterquarry` split-payload cipher pair, `2026-10-journey-test-helloshell` reverse-shell family), continuing the pattern that drove yesterday`s [2026-10-21 sweep](https://dependencywatch.io/incident/multi-2026-10-21-ghsa-malware-sweep) `2026-10-semvver` PyPI typosquat family and `2026-10-vacsdk` dep-confusion probes. The `@sudobility` scope is a NEW operator with a sharper real-world payload (XMRig + root-escalation) than any PyPI loader in the batch - treat the scope as an active probe pattern worth watching for wave 2. **No new activity** from the 2026-10-21 batch`s sharp IOCs: `c2-worker.crawlnet-claim.workers.dev` apex (`pyupd` payload), `34.143.131.27:18080` + `/x-VA-1/main.js` path (`@securihackbot` operator), `webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/` (`rs-lookout-sandbox-poc` AWS IMDS exfil) - keep in standing-egress denylist from yesterday`s sweep. No new Baileys-lure wave 9 slugs today (operator cadence suggests another wave in 24-48 hours). No new `sc-*` Best Buy dep-confusion slugs today beyond yesterday`s `sc-announcer`/`sc-wizard`. Carve-outs [LiteLLM 1.107.0](https://dependencywatch.io/incident/pypi-2026-10-21-litellm-infostealer-rat), [Tailwind Animate.css fake-interview](https://dependencywatch.io/incident/npm-2026-10-20-tailwind-animatecss-fake-interview-campaign), [Apex Accelerator REF8801](https://dependencywatch.io/incident/npm-2026-10-19-apex-accelerator-malicious-npm-packages), [TensorLake AI](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise), [hridoy FB credential stealer](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer) remain confirmed-recovered with no wave-2 malicious republish observed

## What to do

1. **For Cluster A (`@sudobility/*` XMRig miner, CONFIRMED payload)**: grep every `package.json`, `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `bun.lock` and internal registry mirrors for `@sudobility/indexer_client@0.0.146`, `@sudobility/shaperouter_client@0.0.14`, `@sudobility/testomniac_client@0.0.131`, `@sudobility/wildduck_client@2.3.102`. On any hit on a Linux host that ran `npm install`: treat the host as compromised. **Hunt for the drop and persistence artefacts**: `/tmp/.smi`, `$HOME/.sysmond.json`, `$HOME/.local/lib/` entries under disguised system-service names (`edid-mon`, `smmon`, `irqstatsd`, `kmod-cache`), any `nohup` child under those names, unexpected cron entries, and - on root-sudo hosts - any new Tor relay process or `systemd` unit. **Egress block**: `networkservicesupp.flashhub.net:8443` on every host (Monero pool, sharp IOC). Also block egress to the `s3.amazonaws.com` presigned URL path the installer uses (specific bucket not published at advisory level - audit CI / dev-workstation egress logs for S3 presigned GETs during the exposure window). Any `@sudobility/*` slug under any version is suspect by default - the scope is operator-controlled
2. **For Cluster B (PyPI `2026-10-voice-synthesis-profiles` loader campaign, 43 packages)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, `conda env` and every internal PyPI mirror for the full slug list (all 43 at `0.1.0`). On any hit on any Python environment on any host that ran `pip install` since 2026-10-22: treat the environment as a candidate compromise. The published tarballs do not carry the final payload but DO contain a loader stub that will fetch and `exec()` a remote URL under operator control - so the install-time behaviour on any environment that still has the package resident is to re-fetch and re-execute from that URL whenever the loader is imported. Uninstall the slug AND rebuild the environment rather than relying on `pip uninstall` alone. Rotate every secret the install environment could reach (CI tokens, cloud CLI credentials, `.env` entries, package registry credentials). **Grep rules**: block the full slug list on your public-PyPI denylist; add `tts*`, `*tts`, `voice*`, `voc*`, `speak*`, `speech*`, `phonem*`, `acoustic*`, `asr*`, `audio*` prefix / suffix patterns to your heightened-scrutiny list for the next 30 days
3. **For Cluster C (`iterquarry` + `libseal` split-payload family)**: grep every PyPI manifest for `iterquarry` at `2.1.1`, `2.1.2`, `2.1.3`, `2.1.4`, `2.2.0`, `2.2.1`, and `libseal` at `1.1.0`, `1.1.1`, `1.1.2`, `1.1.3`. **If BOTH packages are present together on the same host**, the pair has had the opportunity to decrypt and execute the embedded ciphertext - treat the host as a `treat as fully compromised` event per the CWE-506 boilerplate. If only one of the two is present, the payload cannot execute without its sibling, but the slug is still an active-malicious artefact and the environment should be quarantined. Historical versions used a Discord bot C2 - audit outbound Discord webhook / API traffic from the install window
4. **For Cluster D (`journey-test-helloshell` + `journey-test-hellospy` reverse-shell + env-var exfil family)**: grep every PyPI manifest for `journey-test-helloshell@0.2.0` and `journey-test-hellospy@0.1.1`. On any hit: treat the host as compromised AND assume every environment variable visible to the install process was exfiltrated at install time - rotate every `.env`-sourced secret, every CI-provisioned token, every cloud credential visible as an env var, and every private-key path visible in the env. The reverse shell code is bundled in `setup.py` - any resource reachable from the install user`s network context is in scope; audit outbound TCP connections from the install window and quarantine the host for forensic review. If your organisation runs `journey-*` namespaced internal pipelines, review the internal-registry resolution order to prevent public-PyPI shadowing
5. **For Cluster E (npm `@worrisome/*` + unscoped `peptide-modify` backfill)**: grep every `package.json` and lockfiles for `@worrisome/reutil`, `@worrisome/aaaa`, `peptide-modify` (unscoped, distinct from the earlier `@peptide-unit/peptide-modify` and `@peptide-packets/peptide-modify` entries). On any hit: treat as the standard CWE-506 boilerplate (rotate secrets from a different machine, remove the package, assume host compromise). The unscoped `peptide-modify` re-publish signals that the operator behind the earlier scoped biotech-impersonation attempts has escalated to an unscoped slug - watch for further unscoped single-word biotech / chemistry / peptide slugs
6. **Standing egress-denylist carry-forward from prior sweeps** (keep in place; today adds `networkservicesupp.flashhub.net:8443` apex): `c2-worker.crawlnet-claim.workers.dev` apex + `/dl/pyupd` path, `34.143.131.27:18080` + `/x-VA-1/main.js` path, `webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/` (2026-10-21); `75.119.137.232:31337` + `/depconfuse` path (2026-10-20); `transfer.archivete.am` apex + `/H2Uxm/fabdeploycheck-config.json` path (2026-10-19); `realwbx.com` apex + `/ip.php` + `/ip` paths; `artifacts.creditslib.com` apex + `/npm/*` paths; `login.fromthehotel.com` apex; `googleforum.pythonanywhere.com`; `space-z.ai` apex; `dxpoc.gt.tc` apex; `raw.githubusercontent.com/anonrider404/pypl/*`; `api-bsx.pages.dev` + `/download`; `177.7.60.239:48080` + `oob.recon.dev`; `uncoder.eu.org` + `/cc-checker/api.php`; `accenture-npm.azurewebsites.net`; `limbomail.com`; `collector.oob.s4yhii.com` + `*.oob.s4yhii.com` + `s4yhii.com`; `64.181.165.115/dc`; `167.88.172.33:8087` + `jsonspack.com`; `goxtools.shop`; `minhdong.site`; `45.138.12.177:8089`; `185.158.107.175:8787`; `ltidi.storage.googleapis.com/depenconf/`; `oob.s4yhii.com:9999/native`; `*.oast.pro`/`*.oast.me`/`*.oast.fun`/`*.oast.site`/`*.oastify.com`; `frjmzbjbhwvtdnsuodmu.supabase.co`; `api.npoint.io`; `tele.metry.orgin.net`; `morroncr0w.io`; `api.telegram.org` on untrusted CI/build hosts; `appsecc.com`; generic `webhook.site/*` paths other than legitimate dev webhooks; `nfjbill.ren`; `storage.googleapis.com/depenconf/`; `10.0.19.0/24` + `10.0.49.0/24`; `api.nm-streetwear.space`; Discord webhook URL pattern; `ipify.org` + `ifconfig.me`; `gitflic.ru`; `api.wagmiwallet.org`; `backend-cybersecuritydashboard.onrender.com`; Monero mining pools (now including `networkservicesupp.flashhub.net:8443`); Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints; `chinazhangsan.ccwu.cc`; `fabric-npm.gm-service.xyz`; `jsonkeeper.com`; `npm-canary.aveliscare.com`; `meta.brs.cx`; `s3://pkusinski-external/`; AWS account `631484165566`; Slack bot-token exfil patterns; `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`; `tuamaeaquelaursa.com`; `45.138.0.0/16` RubyGems wgkit CIDRs; `apexaccs.org` apex + subdomains; `arenapex.cloud`; `apexfdn.xyz` apex + subdomains; `fdn4apex.com`; `router-apex.com` apex + subdomains; `ccmihr.com`; `0auth-chromium.com`; `ehegisnightmare.icu`; `cloudmain365duo.top`; LiteLLM 1.107.0 - `www.litellm.dev/healthcheck` apex + the GitHub dead-drop `raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt`

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-2gvv-vgvw-559c - npm @sudobility/indexer_client@0.0.146 (Cluster A - CONFIRMED XMRig miner postinstall + root-escalation branch to Tor relay persistence, miner pool networkservicesupp.flashhub.net:8443, MAL-2026-18127, Amazon Inspector)](https://github.com/advisories/GHSA-2gvv-vgvw-559c) - GitHub
- [GHSA-mj95-29f2-vxg2 - npm @sudobility/shaperouter_client@0.0.14 (Cluster A - same miner payload, MAL-2026-18128)](https://github.com/advisories/GHSA-mj95-29f2-vxg2) - GitHub
- [GHSA-58jf-66x8-7q28 - npm @sudobility/testomniac_client@0.0.131 (Cluster A - advertised as TanStack Query client, same miner payload, MAL-2026-18129)](https://github.com/advisories/GHSA-58jf-66x8-7q28) - GitHub
- [GHSA-vhv8-cmrm-5fpr - npm @sudobility/wildduck_client@2.3.102 (Cluster A - advertised as WildDuck email-server client, same miner payload, MAL-2026-18130)](https://github.com/advisories/GHSA-vhv8-cmrm-5fpr) - GitHub
- [GHSA-hxqp-f9h5-2vc7 - pypi ttsdock@0.1.0 (Cluster B - 2026-10-voice-synthesis-profiles loader campaign representative sample, MAL-2026-18169)](https://github.com/advisories/GHSA-hxqp-f9h5-2vc7) - GitHub
- [GHSA-gvgp-r29f-8j66 - pypi audiokit@0.1.0 (Cluster B - 2026-10-voice-synthesis-profiles, MAL-2026-18158)](https://github.com/advisories/GHSA-gvgp-r29f-8j66) - GitHub
- [GHSA-5286-9g82-mpg2 - pypi asrloom@0.1.0 (Cluster B - 2026-10-voice-synthesis-profiles, MAL-2026-18157)](https://github.com/advisories/GHSA-5286-9g82-mpg2) - GitHub
- [GHSA-cppv-x8vc-pgq6 - pypi modelworks@0.1.0 (Cluster B - 2026-10-voice-synthesis-profiles, MAL-2026-18162)](https://github.com/advisories/GHSA-cppv-x8vc-pgq6) - GitHub
- [GHSA-rrj6-3qm9-67cr - pypi orchestril@0.1.0 (Cluster B - 2026-10-voice-synthesis-profiles, MAL-2026-18142)](https://github.com/advisories/GHSA-rrj6-3qm9-67cr) - GitHub
- [GHSA-8jxf-7hjv-2f3h - pypi shellgrip@0.1.0 (Cluster B - 2026-10-voice-synthesis-profiles, MAL-2026-18146)](https://github.com/advisories/GHSA-8jxf-7hjv-2f3h) - GitHub
- [GHSA-ph85-49q2-52ph - pypi codecraze@0.1.0 (Cluster B - 2026-10-voice-synthesis-profiles, MAL-2026-18137)](https://github.com/advisories/GHSA-ph85-49q2-52ph) - GitHub
- [GHSA-85jh-m5mm-cxm2 - pypi batchspar@0.1.0 (Cluster B - 2026-10-voice-synthesis-profiles, MAL-2026-18135)](https://github.com/advisories/GHSA-85jh-m5mm-cxm2) - GitHub
- [GHSA-jx5r-qjfm-5v26 - pypi iterquarry@2.1.1..2.2.1 (Cluster C - 2026-10-iterquarry split-payload, Discord C2 in earlier versions, MAL-2026-18131)](https://github.com/advisories/GHSA-jx5r-qjfm-5v26) - GitHub
- [GHSA-8pwv-jgmv-fcm8 - pypi libseal@1.1.0..1.1.3 (Cluster C - decryption-algorithm sibling to iterquarry, MAL-2026-18132)](https://github.com/advisories/GHSA-8pwv-jgmv-fcm8) - GitHub
- [GHSA-g885-3jpg-94hg - pypi journey-test-helloshell@0.2.0 (Cluster D - CONFIRMED reverse shell + install-time env-var exfil, OSSF targeted-attack tag, MAL-2026-18124)](https://github.com/advisories/GHSA-g885-3jpg-94hg) - GitHub
- [GHSA-v8q8-jrm2-52jp - pypi journey-test-hellospy@0.1.1 (Cluster D - same campaign, MAL-2026-18133)](https://github.com/advisories/GHSA-v8q8-jrm2-52jp) - GitHub
- [GHSA-4f5p-mp5p-863f - npm @worrisome/reutil (Cluster E - CWE-506 boilerplate, published 2026-10-21)](https://github.com/advisories/GHSA-4f5p-mp5p-863f) - GitHub
- [GHSA-fxf3-w84v-3v6g - npm @worrisome/aaaa (Cluster E - CWE-506 boilerplate, published 2026-10-21)](https://github.com/advisories/GHSA-fxf3-w84v-3v6g) - GitHub
- [GHSA-h643-5mcg-c726 - npm peptide-modify (Cluster E - unscoped republish, distinct from the earlier @peptide-unit/@peptide-packets scoped slugs catalogued in the 2026-07-30 and 2026-07-31 sweeps, published 2026-10-21)](https://github.com/advisories/GHSA-h643-5mcg-c726) - GitHub
- [DependencyWatch: multi-2026-10-21-ghsa-malware-sweep (yesterday`s sweep - 2026-10-semvver PyPI typosquat family with sharp c2-worker.crawlnet-claim.workers.dev IOC, Baileys wave 8, sc-* Best Buy wave 2, @securihackbot depconf-stage)](https://dependencywatch.io/incident/multi-2026-10-21-ghsa-malware-sweep)
- [DependencyWatch: pypi-2026-10-21-litellm-infostealer-rat (co-dated LiteLLM 1.107.0 compromise carve-out)](https://dependencywatch.io/incident/pypi-2026-10-21-litellm-infostealer-rat)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-22-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-22-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).