DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 23 October 2026

HighAdvisory sweepnpmPyPI

GHSA 2026-10-22/23 batch (~25 advisories). Headlines: PyPI 2026-10-journey-test-helloshell wave 2 (new journey-teste-shellhello@0.2.0 continuing yesterdays kam193 reverse-shell + install-time env-var exfil family); npm @ecg-internal/ dependency-confusion probe cluster (6 packages against eBay Classifieds Group-style internal scope); npm @grabcad/ dependency-confusion probe cluster (4 packages against GrabCAD-style internal scope); npm @pkgship/frp[c|s]-linux-amd64@0.71.1 bundled reverse-proxy binary droppers; npm darknode-cli@2.46.0-2.46.2` Republic Protocol tool impersonator.

Published 23 Oct 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-10-23-ghsa-malware-sweep
25
Packages tracked31 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
23 Oct 2026
Ecosystems
npmPyPI
Detected by
GitHub Advisory Database, OpenSSF malicious-packages, kam193 bad-packages
Also known as
2026-10-23 GHSA sweep, 2026-10-journey-test-helloshell wave 2, @ecg-internal dep-confusion probe cluster

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

Between 2026-10-22 06:00 UTC (yesterdays sweep cut-off) and 2026-10-23 06:00 UTC (todays ingest-window start), the GitHub Advisory Database published ~25 fresh malware advisories across npm and PyPI. The only confirmed-payload item today is journey-teste-shellhello@0.2.0, a Portuguese "teste"-spelling wave 2 of yesterdays kam193 2026-10-journey-test-helloshell reverse-shell family. Everything else in the batch is a CWE-506 boilerplate takedown without published runtime analysis, split across two sizeable dep-confusion probe clusters (@ecg-internal/ and @grabcad/`) and a scattering of single-slug impersonators / lures / test artefacts.

Headlines

PyPI 2026-10-journey-test-helloshell wave 2 (Cluster A, 1 package): journey-teste-shellhello@0.2.0 extends the kam193-tracked family that opened yesterday. The slug swaps the English "test" for Portuguese "teste" - a stealth variant intended to defeat exact-match denylists on the three earlier siblings. Same OSSF-flagged MALICIOUS + targeted-attack behaviour: setup.py overrides install, reverse shell runs during pip install, environment variables exfiltrated at install time.

*npm `@ecg-internal/ dep-confusion probe cluster** (Cluster B, 6 packages): six slugs under a scope that mimics the ecg-internal naming pattern used by eBay Classifieds Group-style organisations for their internal shared libraries. All six are CWE-506 boilerplate takedowns with no published payload analysis. Organisations whose public-registry resolution shadows an internal @ecg-internal/*` scope are the realistic exposure path.

*npm `@grabcad/ dep-confusion probe cluster** (Cluster C, 4 packages): same pattern as Cluster B but against the @grabcad` scope, which maps to GrabCAD / Stratasys internal naming.

npm @pkgship/frp[c|s]-linux-amd64@0.71.1 (Cluster F): two packages that appear to bundle the real fatedier/frp Linux amd64 reverse-proxy client and server binaries at upstream version 0.71.1 under a dual-use "pkgship" scope. The frp tool is a legitimate OSS NAT-traversal utility and a widely abused C2 reverse-tunnel primitive; shipped as an unexpected npm transitive dependency it is a persistence-staging red flag.

npm darknode-cli@2.46.0-2.46.2 (Cluster E): impersonates the legitimate Republic Protocol / Ren Darknode Go CLI, which is distributed via curl | sh and has no npm counterpart - a first-publish impersonator under a brand name.

Classification

sweep. Severity high (upgraded from the sweep baseline medium) because Cluster A carries a confirmed reverse-shell + env-var-exfil payload (same kam193 campaign as yesterday) and Cluster F carries bundled reverse-proxy binaries. The rest of the batch is CWE-506 boilerplate at medium. No cluster reaches critical - all are impersonators, first-publish lures, or dep-confusion probes with no legitimate upstream hijacked.

Discovery

GitHub Advisory Database, OpenSSF malicious-packages (Cluster A representative source), kam193 bad-packages (Cluster A campaign tag).

typosquatdependency-confusioncredential-theftobfuscation
Affected packages

25 packages 31 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • Cluster A - PyPI 2026-10-journey-test-helloshell wave 2 (malicious-package; CONFIRMED same OSSF-flagged MALICIOUS + targeted-attack family as yesterdays journey-test-helloshell@0.2.0 and journey-test-hellospy@0.1.1; setup.py overrides install so code runs during pip install; reverse shell AND install-time env-var exfiltration - any .env`-sourced secret, CI credential, or private key present in the install environment is in scope): journey-teste-shellhello@0.2.0 (GHSA-r42r-j8h5-x7r3, MAL-2026-18203, kam193 source hash b0297ac29ad3587325dc37510f2af62bef8b7d92f76e7f123739fc6f49cead0c, published 2026-10-23). The slug swaps the "test" segment for Portuguese "teste" - a stealth variant intended to defeat exact-match denylists on the three sibling slugs; the journey- prefix continues to target organisations running journey-* namespaced internal pipelines. Severity high for this cluster (confirmed reverse-shell + env-var exfil at install time, limited reach because nothing legitimate depends on journey-teste-*)
  • *Cluster B - npm `@ecg-internal/ dependency-confusion probe cluster (dependency-confusion; all 6 packages published 2026-10-23 with CWE-506 boilerplate takedowns and no vendor runtime analysis; the ecg-internal scope deliberately mimics the internal-registry scope naming pattern eBay Classifieds Group-style organisations use for their shared libraries, so the only hosts that can resolve these packages are ones whose public-registry resolution shadows their internal registry; typical dep-confusion probe behaviour is a lightweight beacon posting the hostname/IP/whoami to an operator endpoint at install time)**: @ecg-internal/adobe-dmp-js all versions (GHSA-vcj4-3hxm-4rf3), @ecg-internal/favourites-ui all versions (GHSA-g8hh-8pxg-jr3x), @ecg-internal/aurora-js-formatters all versions (GHSA-9976-3w38-mrmj), @ecg-internal/reviews-dialog-ui all versions (GHSA-r47j-grcr-p9h9), @ecg-internal/media-util-js-lib all versions (GHSA-hcw5-m6mm-qg3q), @ecg-internal/js-react-i18n all versions (GHSA-5x9g-7rj9-4xc8). Severity medium for this cluster (CWE-506 boilerplate, no published payload analysis, no IOCs; organisations using any @ecg-internal/*` scope on an internal mirror should audit resolution precedence)
  • *Cluster C - npm `@grabcad/ dependency-confusion probe cluster (dependency-confusion; all 4 packages published 2026-10-23 with CWE-506 boilerplate; the grabcad scope deliberately mimics GrabCAD / Stratasys internal-package naming; same resolution-precedence risk as Cluster B)**: @grabcad/company-server-shared all versions (GHSA-fpfw-7wv8-x4mh), @grabcad/grabcad-shop-shared all versions (GHSA-cc6r-jh8f-6c76), @grabcad/user-license all versions (GHSA-6w2v-744r-g5j5), @grabcad/preferences-client all versions (GHSA-mfh5-wvcp-2v6v). Severity medium` for this cluster
  • Cluster D - npm other scoped CWE-506 probes (dependency-confusion / malicious-package; all 2026-10-23, CWE-506 boilerplate, no published payload analysis): @cecm-web-sdk/core all versions (GHSA-88qx-q5v7-q7x5 - "cecm" scope reads as an internal-SDK name), @blueskydataplatform/shared-ui all versions (GHSA-6x9m-j5h8-w3vg - "bluesky data platform" style internal-scope naming), @kibt/www-nuxt-i18n all versions (GHSA-2c7v-rmgw-3xrp - the www-nuxt-i18n slug reads as an internal-pipeline helper for a Nuxt-based site), @tekmidian/pai@1.0.8, 1.0.9, 1.0.10 (GHSA-xvgg-qjjh-gq34 - specific versions published rather than sentinel/all-versions, so this one is likelier a lure than a dep-confusion probe). Severity medium for this cluster
  • Cluster E - npm backfill from 2026-10-22 single-slug takedowns (mixed kinds; all 2026-10-22, CWE-506 boilerplate, no published payload analysis beyond the full-compromise notice): @factiii/runner@0.28.0 (GHSA-9j83-qj34-g5vc), @seggy116/next-diff@0.3.0 (GHSA-fv2r-964m-pc2m), @lumen-labs-dev/whisper-node@0.5.1 (GHSA-8mqm-233x-2g2j - "whisper-node" slug reads as an OpenAI Whisper wrapper lure under a fake "lumen-labs-dev" vendor scope - likely malicious-package), darknode-cli@2.46.0, 2.46.1, 2.46.2 (GHSA-6m47-rc2c-6xpg - the legitimate darknode-cli is a Republic Protocol Go CLI distributed via curl | sh, NOT via npm, so this npm slug is a first-publish impersonator of the Ren Protocol darknode tooling - typosquat / brand-impersonation), x402-prompt-injection-scan@0.1.4 (GHSA-w84w-rhx7-2f7g - "x402-prompt-injection-scan" reads as a Coinbase x402-payment-protocol prompt-injection-scanner lure - malicious-package), imgdecode@1.0.0, 1.0.1, 1.0.2 (GHSA-hw69-vrvf-87h5 - generic image-decoding utility slug - typosquat/malicious-package depending on whether a legitimate imgdecode is being impersonated). Severity medium for this cluster
  • *Cluster F - npm `@pkgship/frp-linux-amd64 bundled reverse-proxy binary droppers (malicious-package; both packages 0.71.1, both 2026-10-22; the frp upstream (fastreverseproxy / fatedier/frp) is a legitimate open-source TCP/UDP/HTTP tunneling tool widely used both legitimately for NAT traversal AND abusively as a C2 reverse-tunnel implant; the 0.71.1 version string matches the upstream fatedier/frp v0.71.1 release so these appear to be the real frp Linux amd64 binaries wrapped as npm packages - a dual-use artefact that becomes a persistence/reverse-tunnel staging payload when installed on a victim host under the guise of a transitive npm dependency)**: @pkgship/frps-linux-amd64@0.71.1 (GHSA-x55v-jc52-q424 - frp **server** component), @pkgship/frpc-linux-amd64@0.71.1 (GHSA-9pc4-vxvx-5676 - frp **client** component). Severity high for this cluster (bundled reverse-proxy binaries + unknown install hooks + plausible pkgship scope reads as a legitimate "package shipping" helper, but the fastreverseproxy` installer behaviour makes any environment that resolved these during the exposure window a persistent-tunnel candidate)
  • *Cluster G - npm `testmetest research / canary slugs (malicious-package or noise; 2026-10-22; CWE-506 boilerplate, operator-identified by the testmetest suffix as self-labelled test artefacts)**: sdk-utils-testmetest all versions (GHSA-m6qq-33mj-mv9w), kvarzo8f3atestmetest all versions (GHSA-8vpc-rm6r-5m6c). Severity medium` for this cluster
  • Operator continuity: kam193 continues the 2026-10-journey-test-helloshell family into a second day (yesterday added journey-test-helloshell@0.2.0 + journey-test-hellospy@0.1.1; today adds the Portuguese "teste" variant journey-teste-shellhello@0.2.0), suggesting the operator is iterating on the slug to evade exact-match blocklists while keeping the reverse-shell + env-var exfil payload intact. No new activity today from yesterdays larger 2026-10-voice-synthesis-profiles 43-pkg loader campaign (operator pattern: large campaigns typically fire in a single day). The @sudobility XMRig scope from yesterdays 2026-10-22 sweep stays dormant today - no new sibling slugs under that scope. No new activity from the 2026-10-21 sharp IOCs: c2-worker.crawlnet-claim.workers.dev apex (pyupd payload), 34.143.131.27:18080 + /x-VA-1/main.js path (@securihackbot operator), webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/ (rs-lookout-sandbox-poc AWS IMDS exfil) - keep in standing-egress denylist. No new Baileys-lure wave 9 slugs today (operator cadence suggests another wave in 24-48 hours). Carve-outs LiteLLM 1.107.0, Tailwind Animate.css fake-interview, Apex Accelerator REF8801, TensorLake AI, hridoy FB credential stealer remain confirmed-recovered with no wave-2 malicious republish observed
What to do

Clean-up steps

  1. For Cluster A (journey-teste-shellhello@0.2.0, CONFIRMED kam193 reverse shell + env-var exfil): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda env and every internal PyPI mirror for journey-teste-shellhello==0.2.0, alongside yesterdays journey-test-helloshell==0.2.0 and journey-test-hellospy==0.1.1. On any hit on any Python environment on any host that ran pip install since 2026-10-23: treat the host as compromised AND assume every environment variable visible to the install process was exfiltrated at install time - rotate every .env-sourced secret, every CI-provisioned token, every cloud credential visible as an env var, and every private-key path visible in the env. The reverse shell code runs during setup.py install - any resource reachable from the install users network context is in scope; audit outbound TCP connections from the install window. Block the full journey-test-* and journey-teste-* prefix family on your public-PyPI denylist and extend the slug-family watchlist for the next 30 days (operator is iterating on orthography to evade exact-match blocklists)
  2. *For Clusters B+C (`@ecg-internal/ + @grabcad/` dep-confusion probe clusters, 10 packages total): for every build host, CI runner, developer workstation, and internal registry mirror in your organisation, audit the public-vs-internal resolution precedence for the `@ecg-internal/ and @grabcad/* scopes. If your internal registry serves ANY package under either scope, make sure your .npmrc / pnpm config / yarn config / bun config pin that scope to the internal registry explicitly (@ecg-internal:registry=https://your-internal-registry/), so the public-registry fallback cannot shadow a legitimate internal name. Grep every package.json and lockfile for the specific slugs: @ecg-internal/adobe-dmp-js, @ecg-internal/favourites-ui, @ecg-internal/aurora-js-formatters, @ecg-internal/reviews-dialog-ui, @ecg-internal/media-util-js-lib, @ecg-internal/js-react-i18n, @grabcad/company-server-shared, @grabcad/grabcad-shop-shared, @grabcad/user-license, @grabcad/preferences-client`. On any hit from a public-registry resolution: treat the host as a candidate dep-confusion-probe target - audit outbound DNS/HTTP from the install window for beacon traffic to unfamiliar endpoints, and apply the standard CWE-506 full-compromise response (secrets rotation from a different machine, environment rebuild)
  3. For Cluster D (other scoped CWE-506 probes): grep every package.json and lockfiles for @cecm-web-sdk/core, @blueskydataplatform/shared-ui, @kibt/www-nuxt-i18n, and @tekmidian/pai@1.0.8/1.0.9/1.0.10. Same resolution-precedence audit as Clusters B/C where the scope matches an internal pattern you use. Standard CWE-506 full-compromise response on hits
  4. For Cluster E (darknode-cli, x402-prompt-injection-scan, imgdecode, @lumen-labs-dev/whisper-node, @factiii/runner, @seggy116/next-diff single-slug impersonator / lure takedowns): grep every package.json and lockfile for the specific slug + version combinations. Specifically for darknode-cli@2.46.0/2.46.1/2.46.2: this npm slug impersonates the legitimate Republic Protocol / Ren Darknode Go CLI, which is NOT distributed via npm. If you deployed Republic Protocol / Ren Darknode nodes using an npm-based installer rather than the official curl | sh installer, treat the host as compromised. For x402-prompt-injection-scan@0.1.4: the slug impersonates Coinbase`s x402 payment-protocol tooling - audit any x402 integration path. Standard CWE-506 full-compromise response on all hits
  5. For Cluster F (@pkgship/frp[c|s]-linux-amd64@0.71.1 bundled reverse-proxy binaries): grep every package.json, lockfile, and container image manifest for @pkgship/frpc-linux-amd64@0.71.1 and @pkgship/frps-linux-amd64@0.71.1. On any hit on any Linux amd64 host that ran npm install since 2026-10-22: treat the host as a candidate reverse-tunnel implant - the frp client/server pair is a legitimate OSS tool but a textbook C2 reverse-tunnel primitive. Hunt for frp runtime artefacts: any process named frpc/frps or any renamed binary matching the frp signature; any frpc.ini/frpc.toml or frps.ini/frps.toml config file under non-admin paths (/tmp/, /var/tmp/, $HOME/.config/, /dev/shm/); any outbound TCP connection to an unknown host on a non-standard port with persistent reconnection behaviour. Egress-block the fatedier/frp upstream dashboard port patterns at your egress boundary; add the two slugs to your public-npm denylist
  6. *For Cluster G (`testmetest research slugs)**: standard CWE-506 full-compromise response on hits. The testmetest` suffix identifies these as self-labelled test / canary artefacts - likely low real-world reach, but any environment that resolved them should still be rebuilt
  7. Standing egress-denylist carry-forward from prior sweeps (keep in place; today adds no new sharp IOCs - all 2026-10-23 CWE-506 boilerplate advisories lack vendor runtime analysis): networkservicesupp.flashhub.net:8443 (2026-10-22 @sudobility XMRig Monero pool); c2-worker.crawlnet-claim.workers.dev apex + /dl/pyupd path, 34.143.131.27:18080 + /x-VA-1/main.js path, webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/ (2026-10-21); 75.119.137.232:31337 + /depconfuse path (2026-10-20); transfer.archivete.am apex + /H2Uxm/fabdeploycheck-config.json path (2026-10-19); realwbx.com apex + /ip.php + /ip paths; artifacts.creditslib.com apex + /npm/* paths; login.fromthehotel.com apex; googleforum.pythonanywhere.com; space-z.ai apex; dxpoc.gt.tc apex; raw.githubusercontent.com/anonrider404/pypl/*; api-bsx.pages.dev + /download; 177.7.60.239:48080 + oob.recon.dev; uncoder.eu.org + /cc-checker/api.php; accenture-npm.azurewebsites.net; limbomail.com; collector.oob.s4yhii.com + *.oob.s4yhii.com + s4yhii.com; 64.181.165.115/dc; 167.88.172.33:8087 + jsonspack.com; goxtools.shop; minhdong.site; 45.138.12.177:8089; 185.158.107.175:8787; ltidi.storage.googleapis.com/depenconf/; oob.s4yhii.com:9999/native; *.oast.pro/*.oast.me/*.oast.fun/*.oast.site/*.oastify.com; frjmzbjbhwvtdnsuodmu.supabase.co; api.npoint.io; tele.metry.orgin.net; morroncr0w.io; api.telegram.org on untrusted CI/build hosts; appsecc.com; generic webhook.site/* paths other than legitimate dev webhooks; nfjbill.ren; storage.googleapis.com/depenconf/; 10.0.19.0/24 + 10.0.49.0/24; api.nm-streetwear.space; Discord webhook URL pattern; ipify.org + ifconfig.me; gitflic.ru; api.wagmiwallet.org; backend-cybersecuritydashboard.onrender.com; Monero mining pools; Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints; chinazhangsan.ccwu.cc; fabric-npm.gm-service.xyz; jsonkeeper.com; npm-canary.aveliscare.com; meta.brs.cx; s3://pkusinski-external/; AWS account 631484165566; Slack bot-token exfil patterns; s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook; tuamaeaquelaursa.com; 45.138.0.0/16 RubyGems wgkit CIDRs; apexaccs.org apex + subdomains; arenapex.cloud; apexfdn.xyz apex + subdomains; fdn4apex.com; router-apex.com apex + subdomains; ccmihr.com; 0auth-chromium.com; ehegisnightmare.icu; cloudmain365duo.top; LiteLLM 1.107.0 - www.litellm.dev/healthcheck apex + the GitHub dead-drop raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt
References

Sources

multi-2026-10-23-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents