# GitHub Advisory malware sweep, 23 October 2026

> GHSA 2026-10-22/23 batch (~25 advisories). Headlines: PyPI `2026-10-journey-test-helloshell` wave 2 (new `journey-teste-shellhello@0.2.0` continuing yesterday`s kam193 reverse-shell + install-time env-var exfil family); npm `@ecg-internal/*` dependency-confusion probe cluster (6 packages against eBay Classifieds Group-style internal scope); npm `@grabcad/*` dependency-confusion probe cluster (4 packages against GrabCAD-style internal scope); npm `@pkgship/frp[c|s]-linux-amd64@0.71.1` bundled reverse-proxy binary droppers; npm `darknode-cli@2.46.0-2.46.2` Republic Protocol tool impersonator.

- Published: 2026-10-23
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 25 packages, 31 compromised versions
- Tags: typosquat, dependency-confusion, credential-theft, obfuscation
- Also known as: 2026-10-23 GHSA sweep, 2026-10-journey-test-helloshell wave 2, @ecg-internal dep-confusion probe cluster, @grabcad dep-confusion probe cluster, @pkgship frp reverse-proxy binary droppers, darknode-cli Ren Protocol impersonator
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, kam193 bad-packages
- Incident ID: multi-2026-10-23-ghsa-malware-sweep

## Affected packages (25)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@blueskydataplatform/shared-ui](https://dependencywatch.io/package/npm/@blueskydataplatform/shared-ui) | npm | * |
| [@cecm-web-sdk/core](https://dependencywatch.io/package/npm/@cecm-web-sdk/core) | npm | * |
| [@ecg-internal/adobe-dmp-js](https://dependencywatch.io/package/npm/@ecg-internal/adobe-dmp-js) | npm | * |
| [@ecg-internal/aurora-js-formatters](https://dependencywatch.io/package/npm/@ecg-internal/aurora-js-formatters) | npm | * |
| [@ecg-internal/favourites-ui](https://dependencywatch.io/package/npm/@ecg-internal/favourites-ui) | npm | * |
| [@ecg-internal/js-react-i18n](https://dependencywatch.io/package/npm/@ecg-internal/js-react-i18n) | npm | * |
| [@ecg-internal/media-util-js-lib](https://dependencywatch.io/package/npm/@ecg-internal/media-util-js-lib) | npm | * |
| [@ecg-internal/reviews-dialog-ui](https://dependencywatch.io/package/npm/@ecg-internal/reviews-dialog-ui) | npm | * |
| [@factiii/runner](https://dependencywatch.io/package/npm/@factiii/runner) | npm | 0.28.0 |
| [@grabcad/company-server-shared](https://dependencywatch.io/package/npm/@grabcad/company-server-shared) | npm | * |
| [@grabcad/grabcad-shop-shared](https://dependencywatch.io/package/npm/@grabcad/grabcad-shop-shared) | npm | * |
| [@grabcad/preferences-client](https://dependencywatch.io/package/npm/@grabcad/preferences-client) | npm | * |
| [@grabcad/user-license](https://dependencywatch.io/package/npm/@grabcad/user-license) | npm | * |
| [@kibt/www-nuxt-i18n](https://dependencywatch.io/package/npm/@kibt/www-nuxt-i18n) | npm | * |
| [@lumen-labs-dev/whisper-node](https://dependencywatch.io/package/npm/@lumen-labs-dev/whisper-node) | npm | 0.5.1 |
| [@pkgship/frpc-linux-amd64](https://dependencywatch.io/package/npm/@pkgship/frpc-linux-amd64) | npm | 0.71.1 |
| [@pkgship/frps-linux-amd64](https://dependencywatch.io/package/npm/@pkgship/frps-linux-amd64) | npm | 0.71.1 |
| [@seggy116/next-diff](https://dependencywatch.io/package/npm/@seggy116/next-diff) | npm | 0.3.0 |
| [@tekmidian/pai](https://dependencywatch.io/package/npm/@tekmidian/pai) | npm | 1.0.8, 1.0.9, 1.0.10 |
| [darknode-cli](https://dependencywatch.io/package/npm/darknode-cli) | npm | 2.46.0, 2.46.1, 2.46.2 |
| [imgdecode](https://dependencywatch.io/package/npm/imgdecode) | npm | 1.0.0, 1.0.1, 1.0.2 |
| [journey-teste-shellhello](https://dependencywatch.io/package/pypi/journey-teste-shellhello) | PyPI | 0.2.0 |
| [kvarzo8f3atestmetest](https://dependencywatch.io/package/npm/kvarzo8f3atestmetest) | npm | * |
| [sdk-utils-testmetest](https://dependencywatch.io/package/npm/sdk-utils-testmetest) | npm | * |
| [x402-prompt-injection-scan](https://dependencywatch.io/package/npm/x402-prompt-injection-scan) | npm | 0.1.4 |

## What happened

Between 2026-10-22 06:00 UTC (yesterday`s sweep cut-off) and 2026-10-23 06:00 UTC (today`s ingest-window start), the GitHub Advisory Database published ~25 fresh malware advisories across npm and PyPI. The only confirmed-payload item today is `journey-teste-shellhello@0.2.0`, a Portuguese "teste"-spelling wave 2 of yesterday`s kam193 `2026-10-journey-test-helloshell` reverse-shell family. Everything else in the batch is a CWE-506 boilerplate takedown without published runtime analysis, split across two sizeable dep-confusion probe clusters (`@ecg-internal/*` and `@grabcad/*`) and a scattering of single-slug impersonators / lures / test artefacts.

## Headlines

**PyPI `2026-10-journey-test-helloshell` wave 2** (Cluster A, 1 package): `journey-teste-shellhello@0.2.0` extends the kam193-tracked family that opened yesterday. The slug swaps the English "test" for Portuguese "teste" - a stealth variant intended to defeat exact-match denylists on the three earlier siblings. Same OSSF-flagged `MALICIOUS` + `targeted-attack` behaviour: `setup.py` overrides install, reverse shell runs during `pip install`, environment variables exfiltrated at install time.

**npm `@ecg-internal/*` dep-confusion probe cluster** (Cluster B, 6 packages): six slugs under a scope that mimics the `ecg-internal` naming pattern used by eBay Classifieds Group-style organisations for their internal shared libraries. All six are CWE-506 boilerplate takedowns with no published payload analysis. Organisations whose public-registry resolution shadows an internal `@ecg-internal/*` scope are the realistic exposure path.

**npm `@grabcad/*` dep-confusion probe cluster** (Cluster C, 4 packages): same pattern as Cluster B but against the `@grabcad` scope, which maps to GrabCAD / Stratasys internal naming.

**npm `@pkgship/frp[c|s]-linux-amd64@0.71.1`** (Cluster F): two packages that appear to bundle the real `fatedier/frp` Linux amd64 reverse-proxy client and server binaries at upstream version 0.71.1 under a dual-use "pkgship" scope. The frp tool is a legitimate OSS NAT-traversal utility and a widely abused C2 reverse-tunnel primitive; shipped as an unexpected npm transitive dependency it is a persistence-staging red flag.

**npm `darknode-cli@2.46.0-2.46.2`** (Cluster E): impersonates the legitimate Republic Protocol / Ren Darknode Go CLI, which is distributed via `curl | sh` and has no npm counterpart - a first-publish impersonator under a brand name.

## Classification

`sweep`. Severity `high` (upgraded from the sweep baseline `medium`) because Cluster A carries a confirmed reverse-shell + env-var-exfil payload (same kam193 campaign as yesterday) and Cluster F carries bundled reverse-proxy binaries. The rest of the batch is CWE-506 boilerplate at `medium`. No cluster reaches `critical` - all are impersonators, first-publish lures, or dep-confusion probes with no legitimate upstream hijacked.

## Discovery

`GitHub Advisory Database`, `OpenSSF malicious-packages` (Cluster A representative source), `kam193 bad-packages` (Cluster A campaign tag).

## Impact

- **Cluster A - PyPI `2026-10-journey-test-helloshell` wave 2 (malicious-package; CONFIRMED same OSSF-flagged `MALICIOUS` + `targeted-attack` family as yesterday`s `journey-test-helloshell@0.2.0` and `journey-test-hellospy@0.1.1`; `setup.py` overrides install so code runs during `pip install`; reverse shell AND install-time env-var exfiltration - any `.env`-sourced secret, CI credential, or private key present in the install environment is in scope)**: `journey-teste-shellhello@0.2.0` (GHSA-r42r-j8h5-x7r3, MAL-2026-18203, kam193 source hash `b0297ac29ad3587325dc37510f2af62bef8b7d92f76e7f123739fc6f49cead0c`, published 2026-10-23). The slug swaps the "test" segment for Portuguese "teste" - a stealth variant intended to defeat exact-match denylists on the three sibling slugs; the `journey-` prefix continues to target organisations running `journey-*` namespaced internal pipelines. Severity `high` for this cluster (confirmed reverse-shell + env-var exfil at install time, limited reach because nothing legitimate depends on `journey-teste-*`)
- **Cluster B - npm `@ecg-internal/*` dependency-confusion probe cluster (dependency-confusion; all 6 packages published 2026-10-23 with CWE-506 boilerplate takedowns and no vendor runtime analysis; the `ecg-internal` scope deliberately mimics the internal-registry scope naming pattern eBay Classifieds Group-style organisations use for their shared libraries, so the only hosts that can resolve these packages are ones whose public-registry resolution shadows their internal registry; typical dep-confusion probe behaviour is a lightweight beacon posting the hostname/IP/`whoami` to an operator endpoint at install time)**: `@ecg-internal/adobe-dmp-js` all versions (GHSA-vcj4-3hxm-4rf3), `@ecg-internal/favourites-ui` all versions (GHSA-g8hh-8pxg-jr3x), `@ecg-internal/aurora-js-formatters` all versions (GHSA-9976-3w38-mrmj), `@ecg-internal/reviews-dialog-ui` all versions (GHSA-r47j-grcr-p9h9), `@ecg-internal/media-util-js-lib` all versions (GHSA-hcw5-m6mm-qg3q), `@ecg-internal/js-react-i18n` all versions (GHSA-5x9g-7rj9-4xc8). Severity `medium` for this cluster (CWE-506 boilerplate, no published payload analysis, no IOCs; organisations using any `@ecg-internal/*` scope on an internal mirror should audit resolution precedence)
- **Cluster C - npm `@grabcad/*` dependency-confusion probe cluster (dependency-confusion; all 4 packages published 2026-10-23 with CWE-506 boilerplate; the `grabcad` scope deliberately mimics GrabCAD / Stratasys internal-package naming; same resolution-precedence risk as Cluster B)**: `@grabcad/company-server-shared` all versions (GHSA-fpfw-7wv8-x4mh), `@grabcad/grabcad-shop-shared` all versions (GHSA-cc6r-jh8f-6c76), `@grabcad/user-license` all versions (GHSA-6w2v-744r-g5j5), `@grabcad/preferences-client` all versions (GHSA-mfh5-wvcp-2v6v). Severity `medium` for this cluster
- **Cluster D - npm other scoped CWE-506 probes (dependency-confusion / malicious-package; all 2026-10-23, CWE-506 boilerplate, no published payload analysis)**: `@cecm-web-sdk/core` all versions (GHSA-88qx-q5v7-q7x5 - "cecm" scope reads as an internal-SDK name), `@blueskydataplatform/shared-ui` all versions (GHSA-6x9m-j5h8-w3vg - "bluesky data platform" style internal-scope naming), `@kibt/www-nuxt-i18n` all versions (GHSA-2c7v-rmgw-3xrp - the `www-nuxt-i18n` slug reads as an internal-pipeline helper for a Nuxt-based site), `@tekmidian/pai@1.0.8, 1.0.9, 1.0.10` (GHSA-xvgg-qjjh-gq34 - specific versions published rather than sentinel/all-versions, so this one is likelier a lure than a dep-confusion probe). Severity `medium` for this cluster
- **Cluster E - npm backfill from 2026-10-22 single-slug takedowns (mixed kinds; all 2026-10-22, CWE-506 boilerplate, no published payload analysis beyond the full-compromise notice)**: `@factiii/runner@0.28.0` (GHSA-9j83-qj34-g5vc), `@seggy116/next-diff@0.3.0` (GHSA-fv2r-964m-pc2m), `@lumen-labs-dev/whisper-node@0.5.1` (GHSA-8mqm-233x-2g2j - "whisper-node" slug reads as an OpenAI Whisper wrapper lure under a fake "lumen-labs-dev" vendor scope - likely `malicious-package`), `darknode-cli@2.46.0, 2.46.1, 2.46.2` (GHSA-6m47-rc2c-6xpg - the legitimate `darknode-cli` is a Republic Protocol Go CLI distributed via `curl | sh`, NOT via npm, so this npm slug is a first-publish impersonator of the Ren Protocol darknode tooling - `typosquat` / brand-impersonation), `x402-prompt-injection-scan@0.1.4` (GHSA-w84w-rhx7-2f7g - "x402-prompt-injection-scan" reads as a Coinbase x402-payment-protocol prompt-injection-scanner lure - `malicious-package`), `imgdecode@1.0.0, 1.0.1, 1.0.2` (GHSA-hw69-vrvf-87h5 - generic image-decoding utility slug - `typosquat`/`malicious-package` depending on whether a legitimate `imgdecode` is being impersonated). Severity `medium` for this cluster
- **Cluster F - npm `@pkgship/frp*-linux-amd64` bundled reverse-proxy binary droppers (malicious-package; both packages 0.71.1, both 2026-10-22; the `frp` upstream (fastreverseproxy / fatedier/frp) is a legitimate open-source TCP/UDP/HTTP tunneling tool widely used both legitimately for NAT traversal AND abusively as a C2 reverse-tunnel implant; the `0.71.1` version string matches the upstream `fatedier/frp` v0.71.1 release so these appear to be the real frp Linux amd64 binaries wrapped as npm packages - a dual-use artefact that becomes a persistence/reverse-tunnel staging payload when installed on a victim host under the guise of a transitive npm dependency)**: `@pkgship/frps-linux-amd64@0.71.1` (GHSA-x55v-jc52-q424 - frp **server** component), `@pkgship/frpc-linux-amd64@0.71.1` (GHSA-9pc4-vxvx-5676 - frp **client** component). Severity `high` for this cluster (bundled reverse-proxy binaries + unknown install hooks + plausible `pkgship` scope reads as a legitimate "package shipping" helper, but the `fastreverseproxy` installer behaviour makes any environment that resolved these during the exposure window a persistent-tunnel candidate)
- **Cluster G - npm `*testmetest` research / canary slugs (malicious-package or noise; 2026-10-22; CWE-506 boilerplate, operator-identified by the `testmetest` suffix as self-labelled test artefacts)**: `sdk-utils-testmetest` all versions (GHSA-m6qq-33mj-mv9w), `kvarzo8f3atestmetest` all versions (GHSA-8vpc-rm6r-5m6c). Severity `medium` for this cluster
- **Operator continuity**: `kam193` continues the `2026-10-journey-test-helloshell` family into a second day (yesterday added `journey-test-helloshell@0.2.0` + `journey-test-hellospy@0.1.1`; today adds the Portuguese "teste" variant `journey-teste-shellhello@0.2.0`), suggesting the operator is iterating on the slug to evade exact-match blocklists while keeping the reverse-shell + env-var exfil payload intact. No new activity today from yesterday`s larger `2026-10-voice-synthesis-profiles` 43-pkg loader campaign (operator pattern: large campaigns typically fire in a single day). The `@sudobility` XMRig scope from yesterday`s [2026-10-22 sweep](https://dependencywatch.io/incident/multi-2026-10-22-ghsa-malware-sweep) stays dormant today - no new sibling slugs under that scope. No new activity from the 2026-10-21 sharp IOCs: `c2-worker.crawlnet-claim.workers.dev` apex (`pyupd` payload), `34.143.131.27:18080` + `/x-VA-1/main.js` path (`@securihackbot` operator), `webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/` (`rs-lookout-sandbox-poc` AWS IMDS exfil) - keep in standing-egress denylist. No new Baileys-lure wave 9 slugs today (operator cadence suggests another wave in 24-48 hours). Carve-outs [LiteLLM 1.107.0](https://dependencywatch.io/incident/pypi-2026-10-21-litellm-infostealer-rat), [Tailwind Animate.css fake-interview](https://dependencywatch.io/incident/npm-2026-10-20-tailwind-animatecss-fake-interview-campaign), [Apex Accelerator REF8801](https://dependencywatch.io/incident/npm-2026-10-19-apex-accelerator-malicious-npm-packages), [TensorLake AI](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise), [hridoy FB credential stealer](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer) remain confirmed-recovered with no wave-2 malicious republish observed

## What to do

1. **For Cluster A (`journey-teste-shellhello@0.2.0`, CONFIRMED kam193 reverse shell + env-var exfil)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, `conda env` and every internal PyPI mirror for `journey-teste-shellhello==0.2.0`, alongside yesterday`s `journey-test-helloshell==0.2.0` and `journey-test-hellospy==0.1.1`. On any hit on any Python environment on any host that ran `pip install` since 2026-10-23: treat the host as compromised AND assume every environment variable visible to the install process was exfiltrated at install time - rotate every `.env`-sourced secret, every CI-provisioned token, every cloud credential visible as an env var, and every private-key path visible in the env. The reverse shell code runs during `setup.py` install - any resource reachable from the install user`s network context is in scope; audit outbound TCP connections from the install window. Block the full `journey-test-*` and `journey-teste-*` prefix family on your public-PyPI denylist and extend the slug-family watchlist for the next 30 days (operator is iterating on orthography to evade exact-match blocklists)
2. **For Clusters B+C (`@ecg-internal/*` + `@grabcad/*` dep-confusion probe clusters, 10 packages total)**: for every build host, CI runner, developer workstation, and internal registry mirror in your organisation, audit the public-vs-internal resolution precedence for the `@ecg-internal/*` and `@grabcad/*` scopes. If your internal registry serves ANY package under either scope, make sure your `.npmrc` / `pnpm` config / `yarn` config / `bun` config pin that scope to the internal registry explicitly (`@ecg-internal:registry=https://your-internal-registry/`), so the public-registry fallback cannot shadow a legitimate internal name. Grep every `package.json` and lockfile for the specific slugs: `@ecg-internal/adobe-dmp-js`, `@ecg-internal/favourites-ui`, `@ecg-internal/aurora-js-formatters`, `@ecg-internal/reviews-dialog-ui`, `@ecg-internal/media-util-js-lib`, `@ecg-internal/js-react-i18n`, `@grabcad/company-server-shared`, `@grabcad/grabcad-shop-shared`, `@grabcad/user-license`, `@grabcad/preferences-client`. On any hit from a public-registry resolution: treat the host as a candidate dep-confusion-probe target - audit outbound DNS/HTTP from the install window for beacon traffic to unfamiliar endpoints, and apply the standard CWE-506 full-compromise response (secrets rotation from a different machine, environment rebuild)
3. **For Cluster D (other scoped CWE-506 probes)**: grep every `package.json` and lockfiles for `@cecm-web-sdk/core`, `@blueskydataplatform/shared-ui`, `@kibt/www-nuxt-i18n`, and `@tekmidian/pai@1.0.8`/`1.0.9`/`1.0.10`. Same resolution-precedence audit as Clusters B/C where the scope matches an internal pattern you use. Standard CWE-506 full-compromise response on hits
4. **For Cluster E (`darknode-cli`, `x402-prompt-injection-scan`, `imgdecode`, `@lumen-labs-dev/whisper-node`, `@factiii/runner`, `@seggy116/next-diff` single-slug impersonator / lure takedowns)**: grep every `package.json` and lockfile for the specific slug + version combinations. **Specifically for `darknode-cli@2.46.0`/`2.46.1`/`2.46.2`**: this npm slug impersonates the legitimate Republic Protocol / Ren Darknode Go CLI, which is NOT distributed via npm. If you deployed Republic Protocol / Ren Darknode nodes using an npm-based installer rather than the official `curl | sh` installer, treat the host as compromised. **For `x402-prompt-injection-scan@0.1.4`**: the slug impersonates Coinbase`s x402 payment-protocol tooling - audit any x402 integration path. Standard CWE-506 full-compromise response on all hits
5. **For Cluster F (`@pkgship/frp[c|s]-linux-amd64@0.71.1` bundled reverse-proxy binaries)**: grep every `package.json`, lockfile, and container image manifest for `@pkgship/frpc-linux-amd64@0.71.1` and `@pkgship/frps-linux-amd64@0.71.1`. On any hit on any Linux amd64 host that ran `npm install` since 2026-10-22: treat the host as a candidate reverse-tunnel implant - the `frp` client/server pair is a legitimate OSS tool but a textbook C2 reverse-tunnel primitive. **Hunt for frp runtime artefacts**: any process named `frpc`/`frps` or any renamed binary matching the frp signature; any `frpc.ini`/`frpc.toml` or `frps.ini`/`frps.toml` config file under non-admin paths (`/tmp/`, `/var/tmp/`, `$HOME/.config/`, `/dev/shm/`); any outbound TCP connection to an unknown host on a non-standard port with persistent reconnection behaviour. Egress-block the fatedier/frp upstream dashboard port patterns at your egress boundary; add the two slugs to your public-npm denylist
6. **For Cluster G (`*testmetest` research slugs)**: standard CWE-506 full-compromise response on hits. The `testmetest` suffix identifies these as self-labelled test / canary artefacts - likely low real-world reach, but any environment that resolved them should still be rebuilt
7. **Standing egress-denylist carry-forward from prior sweeps** (keep in place; today adds no new sharp IOCs - all 2026-10-23 CWE-506 boilerplate advisories lack vendor runtime analysis): `networkservicesupp.flashhub.net:8443` (2026-10-22 `@sudobility` XMRig Monero pool); `c2-worker.crawlnet-claim.workers.dev` apex + `/dl/pyupd` path, `34.143.131.27:18080` + `/x-VA-1/main.js` path, `webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/` (2026-10-21); `75.119.137.232:31337` + `/depconfuse` path (2026-10-20); `transfer.archivete.am` apex + `/H2Uxm/fabdeploycheck-config.json` path (2026-10-19); `realwbx.com` apex + `/ip.php` + `/ip` paths; `artifacts.creditslib.com` apex + `/npm/*` paths; `login.fromthehotel.com` apex; `googleforum.pythonanywhere.com`; `space-z.ai` apex; `dxpoc.gt.tc` apex; `raw.githubusercontent.com/anonrider404/pypl/*`; `api-bsx.pages.dev` + `/download`; `177.7.60.239:48080` + `oob.recon.dev`; `uncoder.eu.org` + `/cc-checker/api.php`; `accenture-npm.azurewebsites.net`; `limbomail.com`; `collector.oob.s4yhii.com` + `*.oob.s4yhii.com` + `s4yhii.com`; `64.181.165.115/dc`; `167.88.172.33:8087` + `jsonspack.com`; `goxtools.shop`; `minhdong.site`; `45.138.12.177:8089`; `185.158.107.175:8787`; `ltidi.storage.googleapis.com/depenconf/`; `oob.s4yhii.com:9999/native`; `*.oast.pro`/`*.oast.me`/`*.oast.fun`/`*.oast.site`/`*.oastify.com`; `frjmzbjbhwvtdnsuodmu.supabase.co`; `api.npoint.io`; `tele.metry.orgin.net`; `morroncr0w.io`; `api.telegram.org` on untrusted CI/build hosts; `appsecc.com`; generic `webhook.site/*` paths other than legitimate dev webhooks; `nfjbill.ren`; `storage.googleapis.com/depenconf/`; `10.0.19.0/24` + `10.0.49.0/24`; `api.nm-streetwear.space`; Discord webhook URL pattern; `ipify.org` + `ifconfig.me`; `gitflic.ru`; `api.wagmiwallet.org`; `backend-cybersecuritydashboard.onrender.com`; Monero mining pools; Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints; `chinazhangsan.ccwu.cc`; `fabric-npm.gm-service.xyz`; `jsonkeeper.com`; `npm-canary.aveliscare.com`; `meta.brs.cx`; `s3://pkusinski-external/`; AWS account `631484165566`; Slack bot-token exfil patterns; `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`; `tuamaeaquelaursa.com`; `45.138.0.0/16` RubyGems wgkit CIDRs; `apexaccs.org` apex + subdomains; `arenapex.cloud`; `apexfdn.xyz` apex + subdomains; `fdn4apex.com`; `router-apex.com` apex + subdomains; `ccmihr.com`; `0auth-chromium.com`; `ehegisnightmare.icu`; `cloudmain365duo.top`; LiteLLM 1.107.0 - `www.litellm.dev/healthcheck` apex + the GitHub dead-drop `raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt`

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-r42r-j8h5-x7r3 - pypi journey-teste-shellhello@0.2.0 (Cluster A - CONFIRMED kam193 2026-10-journey-test-helloshell wave 2, reverse shell + install-time env-var exfil, source hash b0297ac29ad3587325dc37510f2af62bef8b7d92f76e7f123739fc6f49cead0c, MAL-2026-18203)](https://github.com/advisories/GHSA-r42r-j8h5-x7r3) - GitHub
- [GHSA-vcj4-3hxm-4rf3 - npm @ecg-internal/adobe-dmp-js (Cluster B - ecg-internal dep-confusion probe cluster, CWE-506)](https://github.com/advisories/GHSA-vcj4-3hxm-4rf3) - GitHub
- [GHSA-g8hh-8pxg-jr3x - npm @ecg-internal/favourites-ui (Cluster B)](https://github.com/advisories/GHSA-g8hh-8pxg-jr3x) - GitHub
- [GHSA-9976-3w38-mrmj - npm @ecg-internal/aurora-js-formatters (Cluster B)](https://github.com/advisories/GHSA-9976-3w38-mrmj) - GitHub
- [GHSA-r47j-grcr-p9h9 - npm @ecg-internal/reviews-dialog-ui (Cluster B)](https://github.com/advisories/GHSA-r47j-grcr-p9h9) - GitHub
- [GHSA-hcw5-m6mm-qg3q - npm @ecg-internal/media-util-js-lib (Cluster B)](https://github.com/advisories/GHSA-hcw5-m6mm-qg3q) - GitHub
- [GHSA-5x9g-7rj9-4xc8 - npm @ecg-internal/js-react-i18n (Cluster B)](https://github.com/advisories/GHSA-5x9g-7rj9-4xc8) - GitHub
- [GHSA-fpfw-7wv8-x4mh - npm @grabcad/company-server-shared (Cluster C - grabcad dep-confusion probe cluster, CWE-506)](https://github.com/advisories/GHSA-fpfw-7wv8-x4mh) - GitHub
- [GHSA-cc6r-jh8f-6c76 - npm @grabcad/grabcad-shop-shared (Cluster C)](https://github.com/advisories/GHSA-cc6r-jh8f-6c76) - GitHub
- [GHSA-6w2v-744r-g5j5 - npm @grabcad/user-license (Cluster C)](https://github.com/advisories/GHSA-6w2v-744r-g5j5) - GitHub
- [GHSA-mfh5-wvcp-2v6v - npm @grabcad/preferences-client (Cluster C)](https://github.com/advisories/GHSA-mfh5-wvcp-2v6v) - GitHub
- [GHSA-88qx-q5v7-q7x5 - npm @cecm-web-sdk/core (Cluster D - CWE-506 boilerplate)](https://github.com/advisories/GHSA-88qx-q5v7-q7x5) - GitHub
- [GHSA-6x9m-j5h8-w3vg - npm @blueskydataplatform/shared-ui (Cluster D)](https://github.com/advisories/GHSA-6x9m-j5h8-w3vg) - GitHub
- [GHSA-2c7v-rmgw-3xrp - npm @kibt/www-nuxt-i18n (Cluster D)](https://github.com/advisories/GHSA-2c7v-rmgw-3xrp) - GitHub
- [GHSA-xvgg-qjjh-gq34 - npm @tekmidian/pai@1.0.8..1.0.10 (Cluster D - specific versions, lure vs probe)](https://github.com/advisories/GHSA-xvgg-qjjh-gq34) - GitHub
- [GHSA-9j83-qj34-g5vc - npm @factiii/runner@0.28.0 (Cluster E - 2026-10-22 single-slug CWE-506)](https://github.com/advisories/GHSA-9j83-qj34-g5vc) - GitHub
- [GHSA-fv2r-964m-pc2m - npm @seggy116/next-diff@0.3.0 (Cluster E)](https://github.com/advisories/GHSA-fv2r-964m-pc2m) - GitHub
- [GHSA-8mqm-233x-2g2j - npm @lumen-labs-dev/whisper-node@0.5.1 (Cluster E - fake OpenAI Whisper vendor-scope lure)](https://github.com/advisories/GHSA-8mqm-233x-2g2j) - GitHub
- [GHSA-6m47-rc2c-6xpg - npm darknode-cli@2.46.0..2.46.2 (Cluster E - Republic Protocol / Ren Darknode Go CLI impersonator - the real tool is not on npm)](https://github.com/advisories/GHSA-6m47-rc2c-6xpg) - GitHub
- [GHSA-w84w-rhx7-2f7g - npm x402-prompt-injection-scan@0.1.4 (Cluster E - Coinbase x402-payment-protocol scanner lure)](https://github.com/advisories/GHSA-w84w-rhx7-2f7g) - GitHub
- [GHSA-hw69-vrvf-87h5 - npm imgdecode@1.0.0..1.0.2 (Cluster E - generic image-decoding utility typosquat)](https://github.com/advisories/GHSA-hw69-vrvf-87h5) - GitHub
- [GHSA-x55v-jc52-q424 - npm @pkgship/frps-linux-amd64@0.71.1 (Cluster F - bundled fatedier/frp server reverse-proxy binary)](https://github.com/advisories/GHSA-x55v-jc52-q424) - GitHub
- [GHSA-9pc4-vxvx-5676 - npm @pkgship/frpc-linux-amd64@0.71.1 (Cluster F - bundled fatedier/frp client reverse-proxy binary)](https://github.com/advisories/GHSA-9pc4-vxvx-5676) - GitHub
- [GHSA-m6qq-33mj-mv9w - npm sdk-utils-testmetest (Cluster G - self-labelled test/canary slug)](https://github.com/advisories/GHSA-m6qq-33mj-mv9w) - GitHub
- [GHSA-8vpc-rm6r-5m6c - npm kvarzo8f3atestmetest (Cluster G)](https://github.com/advisories/GHSA-8vpc-rm6r-5m6c) - GitHub
- [DependencyWatch: multi-2026-10-22-ghsa-malware-sweep (yesterday`s sweep - @sudobility XMRig miner cluster, 2026-10-voice-synthesis-profiles 43-pkg kam193 loader campaign, journey-test-helloshell wave 1, iterquarry split-payload family)](https://dependencywatch.io/incident/multi-2026-10-22-ghsa-malware-sweep)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-23-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-23-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).