DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 26 October 2026

HighAdvisory sweepnpmPyPI

GHSA 2026-10-24/25/26 batch (~71 advisories). Headlines: PyPI claudeopus* 2026-09-donutautosellsrc steganography infostealer (3 Anthropic-brand typosquats, Polygon-blockchain C2); npm event-bus-lite-testmetest Bun-runtime binding.gyp loader (same AES-128-GCM + Brotli TTP family as TanStack); npm wiseke operator dep-confusion scope sweep (14 packages across @greenlake/@sxm-web/@drone-js-ext/@ppa-web-components, all beaconing 185.158.107.175:8787/_ah/dc); kam193 PyPI malicious-package singles nebulallm (JScript+DLL loader) and dictmerge-lite (wallet/browser/SSH stealer); plus @s4yhiitestpoc r2/scan pentest POC batch (10 packages) and the usual CWE-506 boilerplate takedown long tail.

Published 26 Oct 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-10-26-ghsa-malware-sweep
82
Packages tracked90 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
26 Oct 2026
Ecosystems
npmPyPI
Threat actor
kam193-tracked operators (campaigns 2026-09-donutautosellsrc, 2026-10-nebulallm, 2026-10-dictmerge-lite, 2026-10-fontus, s4yhii pentest); `wiseke` npm operator (14-pkg dep-confusion scope sweep)
Detected by
GitHub Advisory Database, OpenSSF malicious-packages, kam193 bad-packages, Amazon Inspector
Also known as
2026-10-26 GHSA sweep, 2026-09-donutautosellsrc claudeopus Anthropic brand typosquat cluster, event-bus-lite-testmetest Bun loader TanStack TTP family

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

Between 2026-10-24 06:00 UTC (yesterdays sweep cut-off) and 2026-10-26 06:00 UTC (todays ingest-window start), the GitHub Advisory Database published ~71 fresh malware advisories across npm and PyPI, spanning 2026-10-24 (2 new), 2026-10-25 (~42), and 2026-10-26 (~25). Todays batch is dominated by the resurgence of the kam193 2026-09-donutautosellsrc PyPI campaign under Anthropic-brand typosquats (claudeopuseni, claudeopusenifile, claudeopusfile) with a confirmed steganography-based infostealer that retrieves its C2 address from Polygon blockchain transactions, plus a one-off Bun-runtime loader on npm (event-bus-lite-testmetest) carrying the TanStack / Mini Shai-Hulud TTP signature, plus a 14-package wiseke operator dep-confusion scope sweep across HPE GreenLake / SiriusXM / DJI / public-sector namespaces, plus kam193 PyPI singles (nebulallm with a JScript-to-DLL loader, dictmerge-lite with a crypto-wallet-and-dev-credentials infostealer, fontus and zagents-message-bus as pentest fingerprinting probes), plus a 10-package @s4yhiitestpoc` npm pentest POC batch, plus a ~16-package "social scraper / Appit cordova" npm cluster of plausible-looking hobbyist mobile-app lures, plus a ~12-package miscellaneous dep-confusion cluster targeting named orgs, plus the usual CWE-506 boilerplate long tail of ~15 unanalysed takedowns.

Headlines

*PyPI `claudeopus 2026-09-donutautosellsrc steganography infostealer** (Cluster A): three Anthropic-brand typosquats (claudeopuseni@0.1.0/0.1.1, claudeopusenifile@0.1.3, claudeopusfile@0.1.1/0.1.2) flagged 2026-10-26 under campaign tag 2026-09-donutautosellsrc. OpenSSF rates the campaign MALICIOUS. The install-time behaviour is explicit: obfuscated setup code fetches hidden code from a bundled image via steganography; the decoded Python program loads a native extension module whose only purpose is an obfuscated infostealer; the C2 address is retrieved from Polygon blockchain transactions of operator address 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a (VirusTotal file hash d03c42c275f0dbc617428441508c49ae1adcbbc95af4eeb094bca4e4f8943f3e`). This is the second Anthropic-SDK-adjacent PyPI campaign in the DependencyWatch corpus after the 2026-10-05 anthropic-sdk typosquat, and is a different operator (donutautosellsrc campaign vs 2026-10-anthropic-sdk campaign).

npm event-bus-lite-testmetest Bun-runtime binding.gyp loader (Cluster B): one package at 0.0.6, 2026-10-25. Amazon Inspector and OSSF caught a binding.gyp with no C/C++ sources that runs node index.js during the automatic node-gyp rebuild on npm install. The decoded loader uses AES-128-GCM with hardcoded key/IV/AAD to decrypt a Brotli-compressed, high-entropy lib_native.dat and launches Bun (not Node) to execute the plaintext. This is the exact TTP family of the TanStack / Mini Shai-Hulud / TeamPCP Bun stealer; no operator attribution yet.

npm wiseke operator dep-confusion scope sweep (Cluster C): fourteen packages at 3.0.0 across @greenlake, @sxm-web, @drone-js-ext, @ppa-web-components, posted Oct 23 21:23 UTC through Oct 25 14:28 UTC. The beacon.cjs postinstall script sends hostname + install path + cwd to http://185.158.107.175:8787/_ah/dc (already in our standing egress denylist from prior waves). The index.js is byte-identical to prior-wave ph-common (MAL-2026-1809), confirming operator continuity.

PyPI kam193 malicious-package singles (Cluster D): nebulallm@1.4.3 is a typosquat that downloads a JScript file on install which then downloads a malicious DLL; dictmerge-lite@1.0.0 is a dev-workstation infostealer against crypto wallets, browser data, SSH keys, and development credential files; fontus@0.0.1-0.0.3 and zagents-message-bus@1.0.5/1.0.10/99.99.99/99.99.100 are OSSF-rated PROBABLY_PENTEST fingerprinting probes.

npm @s4yhiitestpoc pentest POC batch (Cluster E): ten @s4yhiitestpoc/r2-* and @s4yhiitestpoc/scan-* packages flagged 2026-10-26 from the known kam193-tracked s4yhii pentest operator; standing-denylisted apex (collector.oob.s4yhii.com, oob.s4yhii.com:9999/native) already blocks the beacon.

npm "social scraper / Appit cordova" cluster (Cluster F): ~16 packages flagged 2026-10-25 with CWE-506 boilerplate advisories only. The naming (insta-reel-search, tiktok-video-scraper, ionic-sound-cloud-loader-api, youtube-search-without-api-key, appit-cordova-plugin-ionic) reads as a single operator building a lure brand around social-media scraper utilities and cordova/ionic plugin impersonators that a hobbyist mobile-app developer could install from a Stack Overflow / AI-assistant snippet.

npm miscellaneous dep-confusion probes (Cluster G): ~12 scoped and sentinel-versioned packages 2026-10-25/26 targeting named orgs - HPE GreenLake, SiriusXM, DJI drone, Fidelity Management & Research, Capital One (@capsense), Telefónica (@jm-telefonica), ING Bank (@generic-means), Postex, Factoryz, Paychex, and the Bright SDK brand. Beacons on install to a webhook, a ngrok tunnel, or a sentinel endpoint.

CWE-506 boilerplate takedowns (Cluster H): ~15 npm packages 2026-10-24/25/26 with no vendor runtime analysis. Several are plainly typosquats (react-dropzone-v4, numbors, ocsp-hashes, p12-pem, tailwindcss-theme-kit); several are plausible-looking lures (monitoring-agent, brass-common); for all of them the install-time behaviour is uncaptured and the only published evidence is the CWE-506 flag.

Classification

sweep. Severity high (upgraded from the sweep baseline medium) because Cluster A ships a confirmed infostealer payload with sandbox detection and blockchain-hidden C2, and Cluster B carries a confirmed Bun-runtime loader matching the TanStack / Mini Shai-Hulud family TTP signature. Cluster C is medium-high (confirmed exfil to an already-known operator endpoint; dependency-confusion, limited reach for orgs that lock the resolution path). Clusters D (nebulallm, dictmerge-lite sub-cluster) step up to high on confirmed payloads; the rest of D plus Clusters E-H are medium. No cluster reaches critical - all are typosquats, dependency-confusion probes, pentest POCs, or one-off loaders against packages with no legitimate established dependents. Anything that would itself be critical (a hijack of an already-dependent-on name, a worm, a maintainer takeover with downstream reach) would get its own named incident file; none of today`s advisories meet that bar.

Discovery

GitHub Advisory Database, OpenSSF malicious-packages (Clusters A, C, D - specifically MAL-2026-18271, 18285, 18288, 18290, 18292, 18296-18301, 18316), Amazon Inspector (Clusters B, C, G - several Oct 25 npm takedowns), kam193 bad-packages (campaign tags 2026-09-donutautosellsrc, 2026-10-nebulallm, 2026-10-dictmerge-lite, 2026-10-fontus, GENERIC-standard-pypi-install-pentest, s4yhii).

typosquatdependency-confusioninfostealercredential-theftobfuscationdns-exfiltrationcrypto-wallet-drain
Affected packages

82 packages 90 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • *Cluster A - PyPI `claudeopus 2026-09-donutautosellsrc steganography infostealer (typosquat; 3 Anthropic-brand lures, 5 total versions, OSSF MALICIOUS category, campaign tag 2026-09-donutautosellsrc, kam193-tracked)**: claudeopuseni@0.1.0, 0.1.1 (GHSA-6m96-8rw5-4rhw, OSSF MAL-2026-18299), claudeopusenifile@0.1.3 (GHSA-8whx-wfhh-6vh5, OSSF MAL-2026-18300), claudeopusfile@0.1.1, 0.1.2 (GHSA-jgm6-7jxr-97gx, OSSF MAL-2026-18298). All three run obfuscated code during installation that fetches a payload from a bundled image via steganography; the decoded payload is a Python application with a native extension module containing an obfuscated infostealer. The C2 server address is retrieved from the Polygon blockchain transaction history of operator address 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a. VirusTotal file hash d03c42c275f0dbc617428441508c49ae1adcbbc95af4eeb094bca4e4f8943f3e applies to the shared image/payload. The names typosquat Anthropics Claude Opus brand (claudeopuseni, claudeopusenifile, claudeopusfile as spellings a developer could land on when typing claude-opus / claude-opus-eni / claude-opus-file from an AI assistants suggestion). Reported behaviours: infostealer; downloads and executes a remote executable; obfuscation; sandbox detection; steganography; native-extension use; C2 hidden in blockchain data. **Severity high`** (confirmed infostealer payload with sandbox detection and blockchain-hidden C2, limited reach because nothing legitimate depends on these typosquats)
  • Cluster B - npm event-bus-lite-testmetest Bun-runtime binding.gyp loader (malicious-package; 1 pkg, 1 version 0.0.6, 2026-10-25, GHSA-7xwf-5j6m-rjff, OSSF MAL-2026-18292, Amazon Inspector source): the package ships a binding.gyp with a target that has no C/C++ sources - its only purpose is to run node index.js during the automatic node-gyp rebuild that fires on npm install. index.js is Caesar-shift-obfuscated and uses eval() to execute a decoded loader that reads the bundled lib_native.dat file (~312 KB, high entropy), decompresses it with Brotli, decrypts it with AES-128-GCM using hardcoded key/IV/AAD, writes the plaintext to a temporary index.js in a .b- directory, and launches the Bun runtime (not Node) to execute the decrypted script - Node-only security tooling misses it. Published payload hash SHA-256 e1ab1e330d3db532d511d4af4386ab2d2c6245ca807410f51c1211ae48814d73. This is the same TTP family as the May 2026 TanStack / Mini Shai-Hulud TeamPCP Bun-runtime stealer; the loader cannot be inspected offline so the ultimate payload is unknown. Severity high (confirmed Bun-runtime loader with the TanStack family TTP signature, limited reach because the slug is a one-off testmetest with no legitimate dependents)
  • Cluster C - npm wiseke operator dep-confusion scope sweep (dependency-confusion; 14 packages across 4 scopes, beacon http://185.158.107.175:8787/_ah/dc, Oct 23 21:23 UTC through Oct 25 14:28 UTC, byte-identical index.js to prior-wave ph-common MAL-2026-1809): @greenlake scope - @greenlake/auth@3.0.0 (GHSA-pfqf-544g-rvp9, MAL-2026-18316), @greenlake/common-context@3.0.0 (GHSA-p5fc-j294-qr5q), @greenlake/session@3.0.0 (GHSA-ph7p-r8mj-5q6r), @greenlake/mfe-login-url@3.0.0 (GHSA-968q-w3j5-w6rq), @greenlake/context-pane@3.0.0 (GHSA-pmfr-35rg-27xm); @sxm-web scope - @sxm-web/client-sdk-core@3.0.0 (GHSA-j5p5-hcm3-6gx9); @drone-js-ext scope - @drone-js-ext/core@3.0.0 (GHSA-68q8-r62c-rwgx), @drone-js-ext/vip-badge@3.0.0 (GHSA-g6h7-w896-4p29); @ppa-web-components scope - @ppa-web-components/ppa-headerfooter@3.0.0 (GHSA-vhvr-f5ww-qh72), @ppa-web-components/ppa-hotel-collection@3.0.0 (GHSA-g7m6-g9fm-57wh), @ppa-web-components/ppa-navigation@3.0.0 (GHSA-38w9-666c-chmr), @ppa-web-components/ppa-banner@3.0.0 (GHSA-2g28-gqgq-ghvf), @ppa-web-components/ppa-builder@3.0.0 (GHSA-gpx7-mx94-wfv3), @ppa-web-components/ppa-searchform@3.0.0 (GHSA-xv6m-ch98-25c4). All 14 use inflated version 3.0.0, run node beacon.cjs as postinstall, and index.js exports a Proxy returning no-op functions so builds that import the package keep running; beacon.cjs sends hostname + install path + cwd to http://185.158.107.175:8787/_ah/dc over plain HTTP. The targeted scopes map to real orgs (@greenlake = HPE GreenLake private namespace; @sxm-web = SiriusXM web team scope; @drone-js-ext = DJI drone SDK extension namespace; @ppa-web-components = PPA / public-sector web components library). Severity medium per cluster (dependency-confusion probes beaconing to an endpoint already in our standing egress denylist; no payload beyond host-fingerprint exfil)
  • Cluster D - PyPI kam193 malicious-package singles (malicious-package / dependency-confusion mix; 4 packages, 2026-10-25): nebulallm@1.4.3 (GHSA-mvgr-2gjf-h99c, OSSF MAL-2026-18297, campaign 2026-10-nebulallm, OSSF MALICIOUS category - typosquats some other LLM-related project; overrides setup.py install command; downloads a JScript file on install which then downloads a malicious DLL; downloads and executes a remote executable and a remote script); dictmerge-lite@1.0.0 (GHSA-825m-m2h7-7cwc, OSSF MAL-2026-18301, campaign 2026-10-dictmerge-lite, OSSF MALICIOUS category - typosquat of dict-merge / dictmerge; overrides setup.py install command; exfiltrates cryptocurrency wallet data, browser data, SSH keys, and development credential files - full infostealer against dev workstations); fontus@0.0.1, 0.0.2, 0.0.3 (GHSA-g5mh-f2v3-6p25, OSSF MAL-2026-18271, campaign 2026-10-fontus, OSSF PROBABLY_PENTEST category - fingerprinting-only, exfiltrates basic info and installed fonts); zagents-message-bus@1.0.5, 1.0.10, 99.99.99, 99.99.100 (GHSA-2hr3-wchh-6g2q, OSSF MAL-2026-18296, OSSF GENERIC-standard-pypi-install-pentest category, pentest sentinel versions 99.99.99/99.99.100 are the dep-confusion halves - overrides setup.py install command, exfiltrates host fingerprint only). Severity high for the nebulallm + dictmerge-lite sub-cluster (confirmed infostealer / loader payloads, OSSF-rated MALICIOUS), medium for fontus + zagents-message-bus (OSSF-rated PROBABLY_PENTEST / standard install pentest)
  • *Cluster E - npm @s4yhiitestpoc r2/scan pentest POC batch (dependency-confusion; 10 packages, 2026-10-26, kam193-tracked s4yhii pentest operator, standing egress-denylist entries collector.oob.s4yhii.com, `.oob.s4yhii.com, s4yhii.com, oob.s4yhii.com:9999/native already in place from 2026-09 and 2026-10 prior sweeps)**: @s4yhiitestpoc/scan-https-d (GHSA-96fg-4mp3-2hj5), @s4yhiitestpoc/scan-dns-c (GHSA-vhw8-ph25-jc87), @s4yhiitestpoc/scan-echo-b (GHSA-2wfm-2q62-f937), @s4yhiitestpoc/r2-control (GHSA-mgmq-xcr7-2945), @s4yhiitestpoc/r2-dns (GHSA-jr92-v3rg-vg3w), @s4yhiitestpoc/scan-https-dualuse-e (GHSA-5957-rhph-hx5p), @s4yhiitestpoc/r2-echo (GHSA-gcfx-vpjf-86m9), @s4yhiitestpoc/r2-https-b (GHSA-h99w-8693-g33v), @s4yhiitestpoc/r2-https-dualuse (GHSA-mv2r-j9qg-322h), @s4yhiitestpoc/scan-control-a (GHSA-m9p6-4pgh-6gqx). All ten are CWE-506 boilerplate advisories with no vendor runtime analysis in the GHSA entry itself; the naming pattern (r2-, scan-, dualuse-) matches the s4yhii scoped POC namespace that previously beaconed to collector.oob.s4yhii.com / oob.s4yhii.com:9999/native`. Severity medium* (pentest POC artefacts; no new C2 beyond the already-denylisted s4yhii apex)
  • Cluster F - npm single-maintainer "social scraper / Appit cordova" cluster (malicious-package; ~16 packages, 2026-10-25, all CWE-506 boilerplate without vendor runtime analysis, naming pattern suggests a single operator building a lure brand around social-media scraper utilities and cordova/ionic plugin impersonators): scrapers - insta-reel-search (GHSA-v2r2-x76j-6fcx), insta-api-wrapper (GHSA-j8vh-32vh-rj39), tiktok-video-scraper (GHSA-5xjv-xr86-9hrv), ionic-tiktok-scraper (GHSA-wwj3-4v8w-w98j), ionic-sound-cloud-loader-api (GHSA-g89m-8c48-9x73), sound-cloud-loader-api (GHSA-5f99-52fc-5rc9), youtube-search-without-api-key (GHSA-f6m2-r9qr-44fx), youtube-info-streams (GHSA-7mfw-r26v-9r9f), ionic-youtube-search (GHSA-7p9r-26fp-m47g), ionic-youtube-streams (GHSA-3cc7-77mx-rmj6), ionic-insta-api-wrapper (GHSA-65qr-q8w8-4q7r), ionic-insta-search (GHSA-4fw4-xm5r-mh69); dev-tool impersonators - redis-dumper (GHSA-8gg8-xq45-8fx5), ocsp-hashes (GHSA-9v69-fx5h-r6p6, likely typosquat of ocsp + node-ocsp), cert-infos (GHSA-8mjx-r4j6-3h6g), p12-pem (GHSA-74xg-w33f-jpv3, likely typosquat of p12-pem-converter / pem); cordova-plugin impersonators - appit-cordova-plugin-ionic (GHSA-fr38-45mf-vcqf), appit-cordova-admob (GHSA-9w8h-674f-4x2j), cordova-plugin-geofence-appit (GHSA-5pw8-3xv5-6cmg). Severity medium (no vendor runtime analysis; the "social scraper" branding (TikTok/Instagram/YouTube/SoundCloud) and the "cordova-plugin-" / "appit-" naming both read as plausible-sounding lures a hobbyist mobile-app developer could install, so some real installs are likely)
  • Cluster G - npm miscellaneous dep-confusion probes with sentinel versions (dependency-confusion; 10 scoped and 2 unscoped packages, 2026-10-25/26): react-native-bright-sdk@9000.0.0 (GHSA-fjcx-639f-h39g, MAL-2026-18290, Amazon Inspector - preinstall canary.js beacons hostname + timestamp to a hardcoded *.ngrok-free.dev/canary tunnel; name impersonates Bright SDK), jshelperdependenceny@99.0.0 (GHSA-249c-6w49-6274, MAL-2026-18288, Amazon Inspector - preinstall beacons host+os+arch via POST to env-overridable DC_CALLBACK_URL defaulting to 127.0.0.1:5656/exfil, inflated 99.0.0 to shadow internal v1.0.0), @postex/common@99.9.1 (GHSA-cxq5-px5q-3gm4, MAL-2026-18285, Amazon Inspector - stub index.js with the only dependency being a bare ltidisafe HTTPS tarball on ltidi.storage.googleapis.com, i.e. install-time arbitrary-code pull from a user-controlled Google Cloud Storage bucket already in our egress denylist), @futurae-public/adaptive-js (GHSA-79qp-32qv-632x), @fmr-ap153177/apex-kit-icons (GHSA-vw9v-ghxv-m2gw, scope @fmr-ap153177 = Fidelity Management & Research team naming), @factoryz/apollo (GHSA-8wg4-rwxf-cv7v), @capsense/core-ui (GHSA-f24f-639h-q46v), @capsense/ccx-welcome-page (GHSA-v7w7-x8q8-wp4r), @jm-telefonica/multibrand-components (GHSA-xrpm-2w69-j2r7), @generic-means/ing-feat-scanner-libs (GHSA-3qv7-4fg6-54gp, @generic-means + ing-feat-* naming matches ING Bank internal-registry pattern), @eforms/forms-api (GHSA-2cfq-pcr7-8572), paychex-pdftron (GHSA-qg7g-2jr4-vjw8, paychex- prefix impersonates Paychex SDK naming). Severity medium (dep-confusion probes targeting named orgs - HPE, Paychex, Fidelity, Capital One, Telefónica, ING, Postex, Factoryz; most beacon on install to a webhook or sentinel endpoint without further payload)
  • Cluster H - npm CWE-506 boilerplate takedowns, no vendor runtime analysis (malicious-package; ~15 packages across 2026-10-24/25/26): tailwindcss-theme-kit (GHSA-v5xr-xjx7-ggwf, 2026-10-24, impersonates tailwindcss theme ecosystem), noelc-css-blender (GHSA-cj2x-975v-jmwf, 2026-10-24), tailwind-base-buttons (GHSA-5j43-343m-gggg, 2026-10-25), w-mousekey (GHSA-gmhr-j769-j6qf, 2026-10-25), sc-hydrate-carousel-price (GHSA-p6gr-jpmq-4hjq, 2026-10-25), monitoring-agent (GHSA-fvjv-j94x-c8wm, 2026-10-26, plausible lure name), numbors@1.6.1 (GHSA-682c-pwqm-7gxv, 2026-10-26, likely typosquat of numbro), dsh-native (GHSA-x94m-hxm5-m298, 2026-10-26), bow-test (GHSA-w53j-w72q-2f32, 2026-10-26), brass-common (GHSA-g6mf-8rwx-xgwh, 2026-10-26), css-overscroll-contain (GHSA-xjrr-fv8j-9hw7, 2026-10-26), css-hnhxwd-polyfill (GHSA-r2cx-wgxm-g93q, 2026-10-26), util-foriepft (GHSA-rc7p-6p9r-rfj9, 2026-10-26), css-flexgap-shim (GHSA-xv83-g4vx-88wf, 2026-10-26), css-grid-snap-util (GHSA-ww37-mhpw-cm3q, 2026-10-26), ap3-foundations-ui (GHSA-g9j6-f655-22p6, 2026-10-26), react-dropzone-v4 (GHSA-cqf2-3c3q-p639, 2026-10-26, likely typosquat of react-dropzone), orderly-plugin-liquidity-heatmap (GHSA-83cj-fp7v-jmfx, 2026-10-26), @regex33-hackerone/tb-compat (GHSA-vwp8-h222-46p8, 2026-10-26, scope name @regex33-hackerone indicates a bug-bounty researcher scope). Severity medium (CWE-506 boilerplate takedowns without published vendor runtime payload analysis; several are plainly typosquats or dep-confusion probes but with no captured C2 or payload the install-time behaviour is uncaptured)
  • Operator continuity: kam193 cadence - the 2026-10-voice-synthesis-profiles PyPI loader campaign that ran a 43-pkg wave 1 on 2026-10-22 and a 21-pkg wave 2 on 2026-10-23 appears idle today (no new matching slugs flagged 2026-10-24/25/26 in the GHSA feed), suggesting a 2-day burst. The 2026-10-sitecard kam193 PyPI SSH-tunnel backdoor flagged yesterday (13 versions of sitecard) is a single-package campaign and no new sibling slugs appeared today. New today from kam193: the 2026-09-donutautosellsrc campaign resurfaced on PyPI with Anthropic-brand typosquats (claudeopuseni, claudeopusenifile, claudeopusfile) and new slugs nebulallm, dictmerge-lite, fontus, zagents-message-bus. New today from wiseke npm operator: 14-pkg dep-confusion scope sweep across HPE GreenLake / SiriusXM / DJI / public-sector scopes, same byte-identical index.js as prior-wave ph-common and the same beacon endpoint 185.158.107.175:8787/_ah/dc already in our standing egress denylist. New today from an unknown Amazon-Inspector-flagged operator: a binding.gyp + Brotli + AES-128-GCM + Bun-runtime loader (event-bus-lite-testmetest) matching the TanStack / Mini Shai-Hulud family TTP signature - no evidence yet linking it to TeamPCP but worth monitoring the slug prefix. The s4yhii npm pentest operator (standing-denylisted collector.oob.s4yhii.com apex) posted a 10-pkg POC batch under @s4yhiitestpoc/r2-* and @s4yhiitestpoc/scan-* naming today. Carve-outs LiteLLM 1.107.0, Tailwind Animate.css fake-interview, Apex Accelerator REF8801, TensorLake AI, hridoy FB credential stealer, anthropic-sdk PyPI typosquat all remain confirmed-recovered with no wave-2 malicious republish observed - PyPI quarantine of litellm 1.107.0 holds, no new anthropic-prefix typosquats beyond todays claudeopus*` cluster
What to do

Clean-up steps

  1. *For Cluster A (`claudeopus 2026-09-donutautosellsrc steganography infostealer, 3 PyPI typosquats)**: grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda env.yml, every internal PyPI mirror, every Dockerfile, and every AI-pipeline / LangChain / Claude-SDK / Cursor-rules repo for the literal strings claudeopuseni, claudeopusenifile, claudeopusfile. The legitimate Anthropic Python SDK is anthropic (import from anthropic import Anthropic); the Claude Opus family of models is addressed through that SDK, there is NO separate claudeopus PyPI package. On any hit: treat the host as fully compromised (steganography payload with sandbox detection and blockchain-hidden C2 = full infostealer with evasion). Rotate: Anthropic API keys, all SSH/GPG keys, cloud credentials (AWS/GCP/Azure), browser-stored passwords and cookies, every .env file on the host, every AI-tool credential store (~/.config/claude, ~/.anthropic, ~/.config/anthropic*, ~/.cursor, ~/.codex, ~/.gemini). Block egress to Polygon blockchain RPC endpoints from CI/build hosts (the C2 address is retrieved from Polygon transaction history, so blocking the retrieval breaks the lookup even if the operator rotates C2); block egress to any domain resolving from Polygon transactions of 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a. Add claudeopuseni, claudeopusenifile, claudeopusfile, claudeopus-sdk, claudeopus, claude-opus-sdk, claude-opus` as adjacent-guess PyPI denylist entries - the operator rotates spellings around the Claude Opus brand
  2. For Cluster B (event-bus-lite-testmetest Bun-runtime binding.gyp loader, 1 npm pkg): grep every package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, Dockerfile, and container image manifest for event-bus-lite-testmetest at version 0.0.6. On any hit: treat the host as a candidate TanStack-family-TTP implant (Bun runtime + binding.gyp install trigger + Brotli-wrapped AES-128-GCM-encrypted native payload). Hunt for .b-*/ temporary directories under node_modules/event-bus-lite-testmetest/, hunt for the Bun runtime binary on hosts that do not normally use Bun, and hunt for the lib_native.dat artefact (SHA-256 e1ab1e330d3db532d511d4af4386ab2d2c6245ca807410f51c1211ae48814d73). Rotate secrets from a clean machine; rebuild the host rather than attempt in-place cleanup. Add event-bus-lite-testmetest and sibling slugs starting event-bus-lite-* to the npm denylist; alert when any package in the dependency tree ships both a binding.gyp and a bundled .dat / .bin file over 100 KB
  3. For Cluster C (wiseke npm dep-confusion scope sweep, 14 packages across @greenlake/@sxm-web/@drone-js-ext/@ppa-web-components): grep every package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, container image manifest, and private-registry mirror config for @greenlake/, @sxm-web/, @drone-js-ext/, @ppa-web-components/, wiseke (the npm maintainer), and specifically for the 14 package names in Cluster A at version 3.0.0. On any hit: treat the host as compromised (postinstall ran node beacon.cjs, exfiltrated host+path+cwd to 185.158.107.175:8787/_ah/dc, which is already in our standing egress denylist); confirm no inbound reach was granted to the C2 (the beacon exfils identity info useful for a targeted follow-up). For organisations that have ANY internal usage of the @greenlake / @sxm-web / @drone-js-ext / @ppa-web-components scopes against an internal registry: audit the internal-registry resolution path and ensure the public npm registry is not the fallback; the operators 3.0.0 version wins against lower-numbered internal versions. Keep 185.158.107.175:8787/_ah/dc` blocked at egress
  4. For Cluster D (kam193 PyPI malicious singles - nebulallm, dictmerge-lite, fontus, zagents-message-bus): grep every PyPI manifest and internal mirror for nebulallm==1.4.3, dictmerge-lite==1.0.0, fontus==0.0.1/0.0.2/0.0.3, zagents-message-bus==1.0.5/1.0.10/99.99.99/99.99.100. On nebulallm or dictmerge-lite hit on any host: treat the host as fully compromised (nebulallm chains JScript-to-DLL loader; dictmerge-lite is a dev-workstation infostealer against crypto wallets, browser profiles, SSH keys, and development credentials). On fontus or zagents-message-bus hit: treat as a confirmed pentest probe - the hosts basic fingerprint (IP, username, platform, arch) has been exfiltrated and the install itself proves resolution worked, so follow-up targeting is possible. Add nebulallm, dictmerge-lite, fontus, zagents-message-bus to the PyPI denylist; the sentinel 99.99.99/99.99.100 versions on zagents-message-bus indicate internal-registry dep-confusion so audit for an internal zagents-message-bus` package first
  5. *For Cluster E (`@s4yhiitestpoc/r2- and @s4yhiitestpoc/scan-` pentest POC batch, 10 npm pkgs): grep every npm manifest for @s4yhiitestpoc/. On hit: this is a known kam193-tracked s4yhii pentest operator namespace with standing-denylisted C2 (collector.oob.s4yhii.com, `.oob.s4yhii.com, oob.s4yhii.com:9999/native); treat the install as a successful bug-bounty / dep-confusion probe and investigate how the public @s4yhiitestpoc` scope reached the resolver. Keep the standing s4yhii egress denylist in place
  6. For Cluster F (npm "social scraper / Appit cordova" cluster, ~16 packages): grep every npm manifest for insta-reel-search, insta-api-wrapper, tiktok-video-scraper, ionic-tiktok-scraper, ionic-sound-cloud-loader-api, sound-cloud-loader-api, youtube-search-without-api-key, youtube-info-streams, ionic-youtube-search, ionic-youtube-streams, ionic-insta-api-wrapper, ionic-insta-search, redis-dumper, ocsp-hashes, cert-infos, p12-pem, appit-cordova-plugin-ionic, appit-cordova-admob, cordova-plugin-geofence-appit. On any hit from a hobbyist mobile-app repo or a cordova/ionic prototype: treat as suspicious-install (CWE-506 boilerplate indicates malicious intent but no vendor payload analysis is published); audit node_modules/<pkg>/ for postinstall scripts and bundled binary files; rebuild from a clean npm registry mirror. For ocsp-hashes and p12-pem specifically: the legitimate packages are ocsp and pem / node-forge / node-pem - treat these as typosquats and alert the developer who introduced them
  7. For Cluster G (npm miscellaneous dep-confusion probes, ~12 scoped and sentinel-versioned packages): grep every npm manifest for the full scope list @greenlake, @sxm-web, @drone-js-ext, @ppa-web-components, @futurae-public, @fmr-ap153177, @factoryz, @capsense, @jm-telefonica, @generic-means, @postex, @eforms, paychex-pdftron, react-native-bright-sdk, jshelperdependenceny. These impersonate HPE GreenLake, SiriusXM, DJI drone, PPA/public-sector, Fidelity Management & Research, Factoryz, Capital One (@capsense), Telefónica (@jm-telefonica), ING Bank (@generic-means + ing-feat), Postex, eForms, Paychex, and the Bright SDK name. On any hit against your organisations internal-registry namespace: this is a confirmed targeted dep-confusion probe, not a drive-by - audit the internal-registry resolution path, confirm the public npm registry is not the fallback, and treat the install host as compromised (fingerprint exfiltrated at minimum). Keep ltidi.storage.googleapis.com/depenconf/ and *.ngrok-free.dev/canary` in the egress denylist
  8. For Cluster H (CWE-506 boilerplate takedown long tail, ~15 npm pkgs): grep every npm manifest for tailwindcss-theme-kit, noelc-css-blender, tailwind-base-buttons, w-mousekey, sc-hydrate-carousel-price, monitoring-agent, numbors, dsh-native, bow-test, brass-common, css-overscroll-contain, css-hnhxwd-polyfill, util-foriepft, css-flexgap-shim, css-grid-snap-util, ap3-foundations-ui, react-dropzone-v4, orderly-plugin-liquidity-heatmap, @regex33-hackerone/tb-compat, @eforms/forms-api. On hit: remove the package, audit any postinstall script that ran, and rebuild from a clean mirror; alert the developer who introduced the dependency so the operators lure name is retired from internal docs/snippets. react-dropzone-v4 specifically appears to typosquat react-dropzone; numbors likely typosquats numbro; ocsp-hashes and p12-pem (listed in Cluster F) typosquat ocsp and pem`
  9. Standing egress-denylist carry-forward from prior sweeps (keep in place; todays batch adds no new sharp network IOCs beyond the Polygon-blockchain-hosted C2 for Cluster A, where the retrieval endpoint is any Polygon RPC gateway rather than a fixed C2 apex): continue to block networkservicesupp.flashhub.net:8443 (2026-10-22 @sudobility XMRig Monero pool), c2-worker.crawlnet-claim.workers.dev apex + /dl/pyupd path, 34.143.131.27:18080 + /x-VA-1/main.js path, webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/ (2026-10-21 rs-lookout-sandbox-poc AWS IMDS exfil), 75.119.137.232:31337 + /depconfuse path (2026-10-20), transfer.archivete.am apex + /H2Uxm/fabdeploycheck-config.json path (2026-10-19), realwbx.com apex + /ip.php + /ip paths, artifacts.creditslib.com apex + /npm/ paths, login.fromthehotel.com apex, googleforum.pythonanywhere.com, space-z.ai apex, dxpoc.gt.tc apex, raw.githubusercontent.com/anonrider404/pypl/, api-bsx.pages.dev + /download, 177.7.60.239:48080 + oob.recon.dev, uncoder.eu.org + /cc-checker/api.php, accenture-npm.azurewebsites.net, limbomail.com, collector.oob.s4yhii.com + .oob.s4yhii.com + s4yhii.com, 64.181.165.115/dc, 167.88.172.33:8087 + jsonspack.com, goxtools.shop, minhdong.site, 45.138.12.177:8089, 185.158.107.175:8787 (todays Cluster C beacon - stays sharp), ltidi.storage.googleapis.com/depenconf/, oob.s4yhii.com:9999/native, `.oast.pro/.oast.me/.oast.fun/.oast.site/.oastify.com, frjmzbjbhwvtdnsuodmu.supabase.co, api.npoint.io, tele.metry.orgin.net, morroncr0w.io, api.telegram.org on untrusted CI/build hosts, appsecc.com, generic webhook.site/ paths other than legitimate dev webhooks, nfjbill.ren, storage.googleapis.com/depenconf/, 10.0.19.0/24 + 10.0.49.0/24, api.nm-streetwear.space, Discord webhook URL patterns, ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints (specifically re-emphasised for todays Cluster A - block Polygon mainnet JSON-RPC from CI/build hosts to break the blockchain-hidden C2 lookup; the operator address of record is 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a whose transaction history returns the current C2 string), chinazhangsan.ccwu.cc, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil patterns, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com, 45.138.0.0/16 RubyGems wgkit CIDRs, apexaccs.org apex + subdomains, arenapex.cloud, apexfdn.xyz apex + subdomains, fdn4apex.com, router-apex.com apex + subdomains, ccmihr.com, 0auth-chromium.com, ehegisnightmare.icu, cloudmain365duo.top, www.litellm.dev/healthcheck, raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt, known SSH relay services srv.us, `.devtunnels.ms, .devtunnels.visualstudio.com on build/CI networks. New today for Cluster G: .ngrok-free.dev/canary subdomain pattern (react-native-bright-sdk@9000.0.0` preinstall beacon)
References

Sources

multi-2026-10-26-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents