# GitHub Advisory malware sweep, 26 October 2026

> GHSA 2026-10-24/25/26 batch (~71 advisories). Headlines: PyPI `claudeopus*` 2026-09-donutautosellsrc steganography infostealer (3 Anthropic-brand typosquats, Polygon-blockchain C2); npm `event-bus-lite-testmetest` Bun-runtime binding.gyp loader (same AES-128-GCM + Brotli TTP family as TanStack); npm `wiseke` operator dep-confusion scope sweep (14 packages across @greenlake/@sxm-web/@drone-js-ext/@ppa-web-components, all beaconing `185.158.107.175:8787/_ah/dc`); kam193 PyPI malicious-package singles `nebulallm` (JScript+DLL loader) and `dictmerge-lite` (wallet/browser/SSH stealer); plus @s4yhiitestpoc r2/scan pentest POC batch (10 packages) and the usual CWE-506 boilerplate takedown long tail.

- Published: 2026-10-26
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 82 packages, 90 compromised versions
- Tags: typosquat, dependency-confusion, infostealer, credential-theft, obfuscation, dns-exfiltration, crypto-wallet-drain
- Threat actor: kam193-tracked operators (campaigns 2026-09-donutautosellsrc, 2026-10-nebulallm, 2026-10-dictmerge-lite, 2026-10-fontus, s4yhii pentest); `wiseke` npm operator (14-pkg dep-confusion scope sweep)
- Also known as: 2026-10-26 GHSA sweep, 2026-09-donutautosellsrc claudeopus Anthropic brand typosquat cluster, event-bus-lite-testmetest Bun loader TanStack TTP family, wiseke @greenlake @sxm-web @drone-js-ext @ppa-web-components dep-confusion scope sweep, 2026-10-nebulallm kam193 JScript-DLL loader, 2026-10-dictmerge-lite kam193 dev-workstation infostealer, @s4yhiitestpoc r2/scan pentest POC batch, npm social scraper Appit cordova lure cluster
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, kam193 bad-packages, Amazon Inspector
- Incident ID: multi-2026-10-26-ghsa-malware-sweep

## Affected packages (82)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@capsense/ccx-welcome-page](https://dependencywatch.io/package/npm/@capsense/ccx-welcome-page) | npm | 0.0.0 |
| [@capsense/core-ui](https://dependencywatch.io/package/npm/@capsense/core-ui) | npm | 0.0.0 |
| [@drone-js-ext/core](https://dependencywatch.io/package/npm/@drone-js-ext/core) | npm | 3.0.0 |
| [@drone-js-ext/vip-badge](https://dependencywatch.io/package/npm/@drone-js-ext/vip-badge) | npm | 3.0.0 |
| [@eforms/forms-api](https://dependencywatch.io/package/npm/@eforms/forms-api) | npm | 0.0.0 |
| [@factoryz/apollo](https://dependencywatch.io/package/npm/@factoryz/apollo) | npm | 0.0.0 |
| [@fmr-ap153177/apex-kit-icons](https://dependencywatch.io/package/npm/@fmr-ap153177/apex-kit-icons) | npm | 0.0.0 |
| [@futurae-public/adaptive-js](https://dependencywatch.io/package/npm/@futurae-public/adaptive-js) | npm | 0.0.0 |
| [@generic-means/ing-feat-scanner-libs](https://dependencywatch.io/package/npm/@generic-means/ing-feat-scanner-libs) | npm | 0.0.0 |
| [@greenlake/auth](https://dependencywatch.io/package/npm/@greenlake/auth) | npm | 3.0.0 |
| [@greenlake/common-context](https://dependencywatch.io/package/npm/@greenlake/common-context) | npm | 3.0.0 |
| [@greenlake/context-pane](https://dependencywatch.io/package/npm/@greenlake/context-pane) | npm | 3.0.0 |
| [@greenlake/mfe-login-url](https://dependencywatch.io/package/npm/@greenlake/mfe-login-url) | npm | 3.0.0 |
| [@greenlake/session](https://dependencywatch.io/package/npm/@greenlake/session) | npm | 3.0.0 |
| [@jm-telefonica/multibrand-components](https://dependencywatch.io/package/npm/@jm-telefonica/multibrand-components) | npm | 0.0.0 |
| [@postex/common](https://dependencywatch.io/package/npm/@postex/common) | npm | 99.9.1 |
| [@ppa-web-components/ppa-banner](https://dependencywatch.io/package/npm/@ppa-web-components/ppa-banner) | npm | 3.0.0 |
| [@ppa-web-components/ppa-builder](https://dependencywatch.io/package/npm/@ppa-web-components/ppa-builder) | npm | 3.0.0 |
| [@ppa-web-components/ppa-headerfooter](https://dependencywatch.io/package/npm/@ppa-web-components/ppa-headerfooter) | npm | 3.0.0 |
| [@ppa-web-components/ppa-hotel-collection](https://dependencywatch.io/package/npm/@ppa-web-components/ppa-hotel-collection) | npm | 3.0.0 |
| [@ppa-web-components/ppa-navigation](https://dependencywatch.io/package/npm/@ppa-web-components/ppa-navigation) | npm | 3.0.0 |
| [@ppa-web-components/ppa-searchform](https://dependencywatch.io/package/npm/@ppa-web-components/ppa-searchform) | npm | 3.0.0 |
| [@regex33-hackerone/tb-compat](https://dependencywatch.io/package/npm/@regex33-hackerone/tb-compat) | npm | 0.0.0 |
| [@s4yhiitestpoc/r2-control](https://dependencywatch.io/package/npm/@s4yhiitestpoc/r2-control) | npm | 0.0.0 |
| [@s4yhiitestpoc/r2-dns](https://dependencywatch.io/package/npm/@s4yhiitestpoc/r2-dns) | npm | 0.0.0 |
| [@s4yhiitestpoc/r2-echo](https://dependencywatch.io/package/npm/@s4yhiitestpoc/r2-echo) | npm | 0.0.0 |
| [@s4yhiitestpoc/r2-https-b](https://dependencywatch.io/package/npm/@s4yhiitestpoc/r2-https-b) | npm | 0.0.0 |
| [@s4yhiitestpoc/r2-https-dualuse](https://dependencywatch.io/package/npm/@s4yhiitestpoc/r2-https-dualuse) | npm | 0.0.0 |
| [@s4yhiitestpoc/scan-control-a](https://dependencywatch.io/package/npm/@s4yhiitestpoc/scan-control-a) | npm | 0.0.0 |
| [@s4yhiitestpoc/scan-dns-c](https://dependencywatch.io/package/npm/@s4yhiitestpoc/scan-dns-c) | npm | 0.0.0 |
| [@s4yhiitestpoc/scan-echo-b](https://dependencywatch.io/package/npm/@s4yhiitestpoc/scan-echo-b) | npm | 0.0.0 |
| [@s4yhiitestpoc/scan-https-d](https://dependencywatch.io/package/npm/@s4yhiitestpoc/scan-https-d) | npm | 0.0.0 |
| [@s4yhiitestpoc/scan-https-dualuse-e](https://dependencywatch.io/package/npm/@s4yhiitestpoc/scan-https-dualuse-e) | npm | 0.0.0 |
| [@sxm-web/client-sdk-core](https://dependencywatch.io/package/npm/@sxm-web/client-sdk-core) | npm | 3.0.0 |
| [ap3-foundations-ui](https://dependencywatch.io/package/npm/ap3-foundations-ui) | npm | 0.0.0 |
| [appit-cordova-admob](https://dependencywatch.io/package/npm/appit-cordova-admob) | npm | 0.0.0 |
| [appit-cordova-plugin-ionic](https://dependencywatch.io/package/npm/appit-cordova-plugin-ionic) | npm | 0.0.0 |
| [bow-test](https://dependencywatch.io/package/npm/bow-test) | npm | 0.0.0 |
| [brass-common](https://dependencywatch.io/package/npm/brass-common) | npm | 0.0.0 |
| [cert-infos](https://dependencywatch.io/package/npm/cert-infos) | npm | 0.0.0 |
| [claudeopuseni](https://dependencywatch.io/package/pypi/claudeopuseni) | PyPI | 0.1.0, 0.1.1 |
| [claudeopusenifile](https://dependencywatch.io/package/pypi/claudeopusenifile) | PyPI | 0.1.3 |
| [claudeopusfile](https://dependencywatch.io/package/pypi/claudeopusfile) | PyPI | 0.1.1, 0.1.2 |
| [cordova-plugin-geofence-appit](https://dependencywatch.io/package/npm/cordova-plugin-geofence-appit) | npm | 0.0.0 |
| [css-flexgap-shim](https://dependencywatch.io/package/npm/css-flexgap-shim) | npm | 0.0.0 |
| [css-grid-snap-util](https://dependencywatch.io/package/npm/css-grid-snap-util) | npm | 0.0.0 |
| [css-hnhxwd-polyfill](https://dependencywatch.io/package/npm/css-hnhxwd-polyfill) | npm | 0.0.0 |
| [css-overscroll-contain](https://dependencywatch.io/package/npm/css-overscroll-contain) | npm | 0.0.0 |
| [dictmerge-lite](https://dependencywatch.io/package/pypi/dictmerge-lite) | PyPI | 1.0.0 |
| [dsh-native](https://dependencywatch.io/package/npm/dsh-native) | npm | 0.0.0 |
| [event-bus-lite-testmetest](https://dependencywatch.io/package/npm/event-bus-lite-testmetest) | npm | 0.0.6 |
| [fontus](https://dependencywatch.io/package/pypi/fontus) | PyPI | 0.0.1, 0.0.2, 0.0.3 |
| [insta-api-wrapper](https://dependencywatch.io/package/npm/insta-api-wrapper) | npm | 0.0.0 |
| [insta-reel-search](https://dependencywatch.io/package/npm/insta-reel-search) | npm | 0.0.0 |
| [ionic-insta-api-wrapper](https://dependencywatch.io/package/npm/ionic-insta-api-wrapper) | npm | 0.0.0 |
| [ionic-insta-search](https://dependencywatch.io/package/npm/ionic-insta-search) | npm | 0.0.0 |
| [ionic-sound-cloud-loader-api](https://dependencywatch.io/package/npm/ionic-sound-cloud-loader-api) | npm | 0.0.0 |
| [ionic-tiktok-scraper](https://dependencywatch.io/package/npm/ionic-tiktok-scraper) | npm | 0.0.0 |
| [ionic-youtube-search](https://dependencywatch.io/package/npm/ionic-youtube-search) | npm | 0.0.0 |
| [ionic-youtube-streams](https://dependencywatch.io/package/npm/ionic-youtube-streams) | npm | 0.0.0 |
| [jshelperdependenceny](https://dependencywatch.io/package/npm/jshelperdependenceny) | npm | 99.0.0 |
| [monitoring-agent](https://dependencywatch.io/package/npm/monitoring-agent) | npm | 0.0.0 |
| [nebulallm](https://dependencywatch.io/package/pypi/nebulallm) | PyPI | 1.4.3 |
| [noelc-css-blender](https://dependencywatch.io/package/npm/noelc-css-blender) | npm | 0.0.0 |
| [numbors](https://dependencywatch.io/package/npm/numbors) | npm | 1.6.1 |
| [ocsp-hashes](https://dependencywatch.io/package/npm/ocsp-hashes) | npm | 0.0.0 |
| [orderly-plugin-liquidity-heatmap](https://dependencywatch.io/package/npm/orderly-plugin-liquidity-heatmap) | npm | 0.0.0 |
| [p12-pem](https://dependencywatch.io/package/npm/p12-pem) | npm | 0.0.0 |
| [paychex-pdftron](https://dependencywatch.io/package/npm/paychex-pdftron) | npm | 0.0.0 |
| [react-dropzone-v4](https://dependencywatch.io/package/npm/react-dropzone-v4) | npm | 0.0.0 |
| [react-native-bright-sdk](https://dependencywatch.io/package/npm/react-native-bright-sdk) | npm | 9000.0.0 |
| [redis-dumper](https://dependencywatch.io/package/npm/redis-dumper) | npm | 0.0.0 |
| [sc-hydrate-carousel-price](https://dependencywatch.io/package/npm/sc-hydrate-carousel-price) | npm | 0.0.0 |
| [sound-cloud-loader-api](https://dependencywatch.io/package/npm/sound-cloud-loader-api) | npm | 0.0.0 |
| [tailwind-base-buttons](https://dependencywatch.io/package/npm/tailwind-base-buttons) | npm | 0.0.0 |
| [tailwindcss-theme-kit](https://dependencywatch.io/package/npm/tailwindcss-theme-kit) | npm | 0.0.0 |
| [tiktok-video-scraper](https://dependencywatch.io/package/npm/tiktok-video-scraper) | npm | 0.0.0 |
| [util-foriepft](https://dependencywatch.io/package/npm/util-foriepft) | npm | 0.0.0 |
| [w-mousekey](https://dependencywatch.io/package/npm/w-mousekey) | npm | 1.0.41, 1.0.42 |
| [youtube-info-streams](https://dependencywatch.io/package/npm/youtube-info-streams) | npm | 0.0.0 |
| [youtube-search-without-api-key](https://dependencywatch.io/package/npm/youtube-search-without-api-key) | npm | 0.0.0 |
| [zagents-message-bus](https://dependencywatch.io/package/pypi/zagents-message-bus) | PyPI | 1.0.5, 1.0.10, 99.99.99, 99.99.100 |

## What happened

Between 2026-10-24 06:00 UTC (yesterday`s sweep cut-off) and 2026-10-26 06:00 UTC (today`s ingest-window start), the GitHub Advisory Database published ~71 fresh malware advisories across npm and PyPI, spanning 2026-10-24 (2 new), 2026-10-25 (~42), and 2026-10-26 (~25). Today`s batch is dominated by the resurgence of the `kam193` `2026-09-donutautosellsrc` PyPI campaign under Anthropic-brand typosquats (`claudeopuseni`, `claudeopusenifile`, `claudeopusfile`) with a confirmed steganography-based infostealer that retrieves its C2 address from Polygon blockchain transactions, plus a one-off Bun-runtime loader on npm (`event-bus-lite-testmetest`) carrying the TanStack / Mini Shai-Hulud TTP signature, plus a 14-package `wiseke` operator dep-confusion scope sweep across HPE GreenLake / SiriusXM / DJI / public-sector namespaces, plus kam193 PyPI singles (`nebulallm` with a JScript-to-DLL loader, `dictmerge-lite` with a crypto-wallet-and-dev-credentials infostealer, `fontus` and `zagents-message-bus` as pentest fingerprinting probes), plus a 10-package `@s4yhiitestpoc` npm pentest POC batch, plus a ~16-package "social scraper / Appit cordova" npm cluster of plausible-looking hobbyist mobile-app lures, plus a ~12-package miscellaneous dep-confusion cluster targeting named orgs, plus the usual CWE-506 boilerplate long tail of ~15 unanalysed takedowns.

## Headlines

**PyPI `claudeopus*` 2026-09-donutautosellsrc steganography infostealer** (Cluster A): three Anthropic-brand typosquats (`claudeopuseni@0.1.0/0.1.1`, `claudeopusenifile@0.1.3`, `claudeopusfile@0.1.1/0.1.2`) flagged 2026-10-26 under campaign tag `2026-09-donutautosellsrc`. OpenSSF rates the campaign MALICIOUS. The install-time behaviour is explicit: obfuscated setup code fetches hidden code from a bundled image via steganography; the decoded Python program loads a native extension module whose only purpose is an obfuscated infostealer; the C2 address is retrieved from Polygon blockchain transactions of operator address `0x9c0a507300fd902787bb193d80fca5ce6e1bff9a` (VirusTotal file hash `d03c42c275f0dbc617428441508c49ae1adcbbc95af4eeb094bca4e4f8943f3e`). This is the second Anthropic-SDK-adjacent PyPI campaign in the DependencyWatch corpus after the 2026-10-05 [anthropic-sdk](https://dependencywatch.io/incident/pypi-2026-10-05-anthropic-sdk-typosquat) typosquat, and is a different operator (donutautosellsrc campaign vs 2026-10-anthropic-sdk campaign).

**npm `event-bus-lite-testmetest` Bun-runtime binding.gyp loader** (Cluster B): one package at `0.0.6`, 2026-10-25. Amazon Inspector and OSSF caught a `binding.gyp` with no C/C++ sources that runs `node index.js` during the automatic `node-gyp rebuild` on `npm install`. The decoded loader uses AES-128-GCM with hardcoded key/IV/AAD to decrypt a Brotli-compressed, high-entropy `lib_native.dat` and launches Bun (not Node) to execute the plaintext. This is the exact TTP family of the TanStack / Mini Shai-Hulud / TeamPCP Bun stealer; no operator attribution yet.

**npm `wiseke` operator dep-confusion scope sweep** (Cluster C): fourteen packages at `3.0.0` across `@greenlake`, `@sxm-web`, `@drone-js-ext`, `@ppa-web-components`, posted Oct 23 21:23 UTC through Oct 25 14:28 UTC. The `beacon.cjs` `postinstall` script sends hostname + install path + cwd to `http://185.158.107.175:8787/_ah/dc` (already in our standing egress denylist from prior waves). The `index.js` is byte-identical to prior-wave `ph-common` (MAL-2026-1809), confirming operator continuity.

**PyPI kam193 malicious-package singles** (Cluster D): `nebulallm@1.4.3` is a typosquat that downloads a JScript file on install which then downloads a malicious DLL; `dictmerge-lite@1.0.0` is a dev-workstation infostealer against crypto wallets, browser data, SSH keys, and development credential files; `fontus@0.0.1-0.0.3` and `zagents-message-bus@1.0.5/1.0.10/99.99.99/99.99.100` are OSSF-rated PROBABLY_PENTEST fingerprinting probes.

**npm `@s4yhiitestpoc` pentest POC batch** (Cluster E): ten `@s4yhiitestpoc/r2-*` and `@s4yhiitestpoc/scan-*` packages flagged 2026-10-26 from the known kam193-tracked `s4yhii` pentest operator; standing-denylisted apex (`collector.oob.s4yhii.com`, `oob.s4yhii.com:9999/native`) already blocks the beacon.

**npm "social scraper / Appit cordova" cluster** (Cluster F): ~16 packages flagged 2026-10-25 with CWE-506 boilerplate advisories only. The naming (`insta-reel-search`, `tiktok-video-scraper`, `ionic-sound-cloud-loader-api`, `youtube-search-without-api-key`, `appit-cordova-plugin-ionic`) reads as a single operator building a lure brand around social-media scraper utilities and cordova/ionic plugin impersonators that a hobbyist mobile-app developer could install from a Stack Overflow / AI-assistant snippet.

**npm miscellaneous dep-confusion probes** (Cluster G): ~12 scoped and sentinel-versioned packages 2026-10-25/26 targeting named orgs - HPE GreenLake, SiriusXM, DJI drone, Fidelity Management & Research, Capital One (@capsense), Telefónica (@jm-telefonica), ING Bank (@generic-means), Postex, Factoryz, Paychex, and the Bright SDK brand. Beacons on install to a webhook, a ngrok tunnel, or a sentinel endpoint.

**CWE-506 boilerplate takedowns** (Cluster H): ~15 npm packages 2026-10-24/25/26 with no vendor runtime analysis. Several are plainly typosquats (`react-dropzone-v4`, `numbors`, `ocsp-hashes`, `p12-pem`, `tailwindcss-theme-kit`); several are plausible-looking lures (`monitoring-agent`, `brass-common`); for all of them the install-time behaviour is uncaptured and the only published evidence is the CWE-506 flag.

## Classification

`sweep`. Severity `high` (upgraded from the sweep baseline `medium`) because Cluster A ships a confirmed infostealer payload with sandbox detection and blockchain-hidden C2, and Cluster B carries a confirmed Bun-runtime loader matching the TanStack / Mini Shai-Hulud family TTP signature. Cluster C is `medium-high` (confirmed exfil to an already-known operator endpoint; dependency-confusion, limited reach for orgs that lock the resolution path). Clusters D (`nebulallm`, `dictmerge-lite` sub-cluster) step up to `high` on confirmed payloads; the rest of D plus Clusters E-H are `medium`. No cluster reaches `critical` - all are typosquats, dependency-confusion probes, pentest POCs, or one-off loaders against packages with no legitimate established dependents. Anything that would itself be `critical` (a hijack of an already-dependent-on name, a worm, a maintainer takeover with downstream reach) would get its own named incident file; none of today`s advisories meet that bar.

## Discovery

`GitHub Advisory Database`, `OpenSSF malicious-packages` (Clusters A, C, D - specifically MAL-2026-18271, 18285, 18288, 18290, 18292, 18296-18301, 18316), `Amazon Inspector` (Clusters B, C, G - several Oct 25 npm takedowns), `kam193 bad-packages` (campaign tags `2026-09-donutautosellsrc`, `2026-10-nebulallm`, `2026-10-dictmerge-lite`, `2026-10-fontus`, `GENERIC-standard-pypi-install-pentest`, `s4yhii`).

## Impact

- **Cluster A - PyPI `claudeopus*` 2026-09-donutautosellsrc steganography infostealer (typosquat; 3 Anthropic-brand lures, 5 total versions, OSSF `MALICIOUS` category, campaign tag `2026-09-donutautosellsrc`, kam193-tracked)**: `claudeopuseni@0.1.0, 0.1.1` (GHSA-6m96-8rw5-4rhw, OSSF MAL-2026-18299), `claudeopusenifile@0.1.3` (GHSA-8whx-wfhh-6vh5, OSSF MAL-2026-18300), `claudeopusfile@0.1.1, 0.1.2` (GHSA-jgm6-7jxr-97gx, OSSF MAL-2026-18298). All three run obfuscated code during installation that fetches a payload from a bundled image via steganography; the decoded payload is a Python application with a native extension module containing an obfuscated infostealer. The C2 server address is retrieved from the Polygon blockchain transaction history of operator address `0x9c0a507300fd902787bb193d80fca5ce6e1bff9a`. VirusTotal file hash `d03c42c275f0dbc617428441508c49ae1adcbbc95af4eeb094bca4e4f8943f3e` applies to the shared image/payload. The names typosquat Anthropic`s Claude Opus brand (`claudeopuseni`, `claudeopusenifile`, `claudeopusfile` as spellings a developer could land on when typing `claude-opus` / `claude-opus-eni` / `claude-opus-file` from an AI assistant`s suggestion). Reported behaviours: infostealer; downloads and executes a remote executable; obfuscation; sandbox detection; steganography; native-extension use; C2 hidden in blockchain data. **Severity `high`** (confirmed infostealer payload with sandbox detection and blockchain-hidden C2, limited reach because nothing legitimate depends on these typosquats)
- **Cluster B - npm `event-bus-lite-testmetest` Bun-runtime binding.gyp loader (malicious-package; 1 pkg, 1 version 0.0.6, 2026-10-25, GHSA-7xwf-5j6m-rjff, OSSF MAL-2026-18292, Amazon Inspector source)**: the package ships a `binding.gyp` with a target that has no C/C++ sources - its only purpose is to run `node index.js` during the automatic `node-gyp rebuild` that fires on `npm install`. `index.js` is Caesar-shift-obfuscated and uses `eval()` to execute a decoded loader that reads the bundled `lib_native.dat` file (~312 KB, high entropy), decompresses it with Brotli, decrypts it with AES-128-GCM using hardcoded key/IV/AAD, writes the plaintext to a temporary `index.js` in a `.b-` directory, and launches the Bun runtime (not Node) to execute the decrypted script - Node-only security tooling misses it. Published payload hash SHA-256 `e1ab1e330d3db532d511d4af4386ab2d2c6245ca807410f51c1211ae48814d73`. This is the same TTP family as the May 2026 TanStack / Mini Shai-Hulud TeamPCP Bun-runtime stealer; the loader cannot be inspected offline so the ultimate payload is unknown. **Severity `high`** (confirmed Bun-runtime loader with the TanStack family TTP signature, limited reach because the slug is a one-off testmetest with no legitimate dependents)
- **Cluster C - npm `wiseke` operator dep-confusion scope sweep (dependency-confusion; 14 packages across 4 scopes, beacon `http://185.158.107.175:8787/_ah/dc`, Oct 23 21:23 UTC through Oct 25 14:28 UTC, byte-identical `index.js` to prior-wave `ph-common` MAL-2026-1809)**: @greenlake scope - `@greenlake/auth@3.0.0` (GHSA-pfqf-544g-rvp9, MAL-2026-18316), `@greenlake/common-context@3.0.0` (GHSA-p5fc-j294-qr5q), `@greenlake/session@3.0.0` (GHSA-ph7p-r8mj-5q6r), `@greenlake/mfe-login-url@3.0.0` (GHSA-968q-w3j5-w6rq), `@greenlake/context-pane@3.0.0` (GHSA-pmfr-35rg-27xm); @sxm-web scope - `@sxm-web/client-sdk-core@3.0.0` (GHSA-j5p5-hcm3-6gx9); @drone-js-ext scope - `@drone-js-ext/core@3.0.0` (GHSA-68q8-r62c-rwgx), `@drone-js-ext/vip-badge@3.0.0` (GHSA-g6h7-w896-4p29); @ppa-web-components scope - `@ppa-web-components/ppa-headerfooter@3.0.0` (GHSA-vhvr-f5ww-qh72), `@ppa-web-components/ppa-hotel-collection@3.0.0` (GHSA-g7m6-g9fm-57wh), `@ppa-web-components/ppa-navigation@3.0.0` (GHSA-38w9-666c-chmr), `@ppa-web-components/ppa-banner@3.0.0` (GHSA-2g28-gqgq-ghvf), `@ppa-web-components/ppa-builder@3.0.0` (GHSA-gpx7-mx94-wfv3), `@ppa-web-components/ppa-searchform@3.0.0` (GHSA-xv6m-ch98-25c4). All 14 use inflated version `3.0.0`, run `node beacon.cjs` as `postinstall`, and `index.js` exports a Proxy returning no-op functions so builds that import the package keep running; `beacon.cjs` sends hostname + install path + cwd to `http://185.158.107.175:8787/_ah/dc` over plain HTTP. The targeted scopes map to real orgs (@greenlake = HPE GreenLake private namespace; @sxm-web = SiriusXM web team scope; @drone-js-ext = DJI drone SDK extension namespace; @ppa-web-components = PPA / public-sector web components library). **Severity `medium`** per cluster (dependency-confusion probes beaconing to an endpoint already in our standing egress denylist; no payload beyond host-fingerprint exfil)
- **Cluster D - PyPI kam193 malicious-package singles (malicious-package / dependency-confusion mix; 4 packages, 2026-10-25)**: `nebulallm@1.4.3` (GHSA-mvgr-2gjf-h99c, OSSF MAL-2026-18297, campaign `2026-10-nebulallm`, OSSF `MALICIOUS` category - typosquats some other LLM-related project; overrides `setup.py` install command; downloads a JScript file on install which then downloads a malicious DLL; downloads and executes a remote executable and a remote script); `dictmerge-lite@1.0.0` (GHSA-825m-m2h7-7cwc, OSSF MAL-2026-18301, campaign `2026-10-dictmerge-lite`, OSSF `MALICIOUS` category - typosquat of `dict-merge` / `dictmerge`; overrides `setup.py` install command; exfiltrates cryptocurrency wallet data, browser data, SSH keys, and development credential files - full infostealer against dev workstations); `fontus@0.0.1, 0.0.2, 0.0.3` (GHSA-g5mh-f2v3-6p25, OSSF MAL-2026-18271, campaign `2026-10-fontus`, OSSF `PROBABLY_PENTEST` category - fingerprinting-only, exfiltrates basic info and installed fonts); `zagents-message-bus@1.0.5, 1.0.10, 99.99.99, 99.99.100` (GHSA-2hr3-wchh-6g2q, OSSF MAL-2026-18296, OSSF `GENERIC-standard-pypi-install-pentest` category, pentest sentinel versions 99.99.99/99.99.100 are the dep-confusion halves - overrides `setup.py` install command, exfiltrates host fingerprint only). **Severity `high`** for the `nebulallm` + `dictmerge-lite` sub-cluster (confirmed infostealer / loader payloads, OSSF-rated MALICIOUS), **medium** for `fontus` + `zagents-message-bus` (OSSF-rated PROBABLY_PENTEST / standard install pentest)
- **Cluster E - npm @s4yhiitestpoc r2/scan pentest POC batch (dependency-confusion; 10 packages, 2026-10-26, kam193-tracked `s4yhii` pentest operator, standing egress-denylist entries `collector.oob.s4yhii.com`, `*.oob.s4yhii.com`, `s4yhii.com`, `oob.s4yhii.com:9999/native` already in place from 2026-09 and 2026-10 prior sweeps)**: `@s4yhiitestpoc/scan-https-d` (GHSA-96fg-4mp3-2hj5), `@s4yhiitestpoc/scan-dns-c` (GHSA-vhw8-ph25-jc87), `@s4yhiitestpoc/scan-echo-b` (GHSA-2wfm-2q62-f937), `@s4yhiitestpoc/r2-control` (GHSA-mgmq-xcr7-2945), `@s4yhiitestpoc/r2-dns` (GHSA-jr92-v3rg-vg3w), `@s4yhiitestpoc/scan-https-dualuse-e` (GHSA-5957-rhph-hx5p), `@s4yhiitestpoc/r2-echo` (GHSA-gcfx-vpjf-86m9), `@s4yhiitestpoc/r2-https-b` (GHSA-h99w-8693-g33v), `@s4yhiitestpoc/r2-https-dualuse` (GHSA-mv2r-j9qg-322h), `@s4yhiitestpoc/scan-control-a` (GHSA-m9p6-4pgh-6gqx). All ten are CWE-506 boilerplate advisories with no vendor runtime analysis in the GHSA entry itself; the naming pattern (`r2-*`, `scan-*`, `dualuse-*`) matches the `s4yhii` scoped POC namespace that previously beaconed to `collector.oob.s4yhii.com` / `oob.s4yhii.com:9999/native`. **Severity `medium`** (pentest POC artefacts; no new C2 beyond the already-denylisted s4yhii apex)
- **Cluster F - npm single-maintainer "social scraper / Appit cordova" cluster (malicious-package; ~16 packages, 2026-10-25, all CWE-506 boilerplate without vendor runtime analysis, naming pattern suggests a single operator building a lure brand around social-media scraper utilities and cordova/ionic plugin impersonators)**: scrapers - `insta-reel-search` (GHSA-v2r2-x76j-6fcx), `insta-api-wrapper` (GHSA-j8vh-32vh-rj39), `tiktok-video-scraper` (GHSA-5xjv-xr86-9hrv), `ionic-tiktok-scraper` (GHSA-wwj3-4v8w-w98j), `ionic-sound-cloud-loader-api` (GHSA-g89m-8c48-9x73), `sound-cloud-loader-api` (GHSA-5f99-52fc-5rc9), `youtube-search-without-api-key` (GHSA-f6m2-r9qr-44fx), `youtube-info-streams` (GHSA-7mfw-r26v-9r9f), `ionic-youtube-search` (GHSA-7p9r-26fp-m47g), `ionic-youtube-streams` (GHSA-3cc7-77mx-rmj6), `ionic-insta-api-wrapper` (GHSA-65qr-q8w8-4q7r), `ionic-insta-search` (GHSA-4fw4-xm5r-mh69); dev-tool impersonators - `redis-dumper` (GHSA-8gg8-xq45-8fx5), `ocsp-hashes` (GHSA-9v69-fx5h-r6p6, likely typosquat of `ocsp` + `node-ocsp`), `cert-infos` (GHSA-8mjx-r4j6-3h6g), `p12-pem` (GHSA-74xg-w33f-jpv3, likely typosquat of `p12-pem-converter` / `pem`); cordova-plugin impersonators - `appit-cordova-plugin-ionic` (GHSA-fr38-45mf-vcqf), `appit-cordova-admob` (GHSA-9w8h-674f-4x2j), `cordova-plugin-geofence-appit` (GHSA-5pw8-3xv5-6cmg). Severity `medium` (no vendor runtime analysis; the "social scraper" branding (TikTok/Instagram/YouTube/SoundCloud) and the "cordova-plugin-*" / "appit-*" naming both read as plausible-sounding lures a hobbyist mobile-app developer could install, so some real installs are likely)
- **Cluster G - npm miscellaneous dep-confusion probes with sentinel versions (dependency-confusion; 10 scoped and 2 unscoped packages, 2026-10-25/26)**: `react-native-bright-sdk@9000.0.0` (GHSA-fjcx-639f-h39g, MAL-2026-18290, Amazon Inspector - preinstall `canary.js` beacons hostname + timestamp to a hardcoded `*.ngrok-free.dev/canary` tunnel; name impersonates Bright SDK), `jshelperdependenceny@99.0.0` (GHSA-249c-6w49-6274, MAL-2026-18288, Amazon Inspector - preinstall beacons host+os+arch via POST to env-overridable `DC_CALLBACK_URL` defaulting to `127.0.0.1:5656/exfil`, inflated 99.0.0 to shadow internal v1.0.0), `@postex/common@99.9.1` (GHSA-cxq5-px5q-3gm4, MAL-2026-18285, Amazon Inspector - stub `index.js` with the only dependency being a bare `ltidisafe` HTTPS tarball on `ltidi.storage.googleapis.com`, i.e. install-time arbitrary-code pull from a user-controlled Google Cloud Storage bucket already in our egress denylist), `@futurae-public/adaptive-js` (GHSA-79qp-32qv-632x), `@fmr-ap153177/apex-kit-icons` (GHSA-vw9v-ghxv-m2gw, scope `@fmr-ap153177` = Fidelity Management & Research team naming), `@factoryz/apollo` (GHSA-8wg4-rwxf-cv7v), `@capsense/core-ui` (GHSA-f24f-639h-q46v), `@capsense/ccx-welcome-page` (GHSA-v7w7-x8q8-wp4r), `@jm-telefonica/multibrand-components` (GHSA-xrpm-2w69-j2r7), `@generic-means/ing-feat-scanner-libs` (GHSA-3qv7-4fg6-54gp, `@generic-means` + `ing-feat-*` naming matches ING Bank internal-registry pattern), `@eforms/forms-api` (GHSA-2cfq-pcr7-8572), `paychex-pdftron` (GHSA-qg7g-2jr4-vjw8, `paychex-` prefix impersonates Paychex SDK naming). **Severity `medium`** (dep-confusion probes targeting named orgs - HPE, Paychex, Fidelity, Capital One, Telefónica, ING, Postex, Factoryz; most beacon on install to a webhook or sentinel endpoint without further payload)
- **Cluster H - npm CWE-506 boilerplate takedowns, no vendor runtime analysis (malicious-package; ~15 packages across 2026-10-24/25/26)**: `tailwindcss-theme-kit` (GHSA-v5xr-xjx7-ggwf, 2026-10-24, impersonates tailwindcss theme ecosystem), `noelc-css-blender` (GHSA-cj2x-975v-jmwf, 2026-10-24), `tailwind-base-buttons` (GHSA-5j43-343m-gggg, 2026-10-25), `w-mousekey` (GHSA-gmhr-j769-j6qf, 2026-10-25), `sc-hydrate-carousel-price` (GHSA-p6gr-jpmq-4hjq, 2026-10-25), `monitoring-agent` (GHSA-fvjv-j94x-c8wm, 2026-10-26, plausible lure name), `numbors@1.6.1` (GHSA-682c-pwqm-7gxv, 2026-10-26, likely typosquat of `numbro`), `dsh-native` (GHSA-x94m-hxm5-m298, 2026-10-26), `bow-test` (GHSA-w53j-w72q-2f32, 2026-10-26), `brass-common` (GHSA-g6mf-8rwx-xgwh, 2026-10-26), `css-overscroll-contain` (GHSA-xjrr-fv8j-9hw7, 2026-10-26), `css-hnhxwd-polyfill` (GHSA-r2cx-wgxm-g93q, 2026-10-26), `util-foriepft` (GHSA-rc7p-6p9r-rfj9, 2026-10-26), `css-flexgap-shim` (GHSA-xv83-g4vx-88wf, 2026-10-26), `css-grid-snap-util` (GHSA-ww37-mhpw-cm3q, 2026-10-26), `ap3-foundations-ui` (GHSA-g9j6-f655-22p6, 2026-10-26), `react-dropzone-v4` (GHSA-cqf2-3c3q-p639, 2026-10-26, likely typosquat of `react-dropzone`), `orderly-plugin-liquidity-heatmap` (GHSA-83cj-fp7v-jmfx, 2026-10-26), `@regex33-hackerone/tb-compat` (GHSA-vwp8-h222-46p8, 2026-10-26, scope name `@regex33-hackerone` indicates a bug-bounty researcher scope). Severity `medium` (CWE-506 boilerplate takedowns without published vendor runtime payload analysis; several are plainly typosquats or dep-confusion probes but with no captured C2 or payload the install-time behaviour is uncaptured)
- **Operator continuity**: `kam193` cadence - the `2026-10-voice-synthesis-profiles` PyPI loader campaign that ran a 43-pkg wave 1 on 2026-10-22 and a 21-pkg wave 2 on 2026-10-23 appears idle today (no new matching slugs flagged 2026-10-24/25/26 in the GHSA feed), suggesting a 2-day burst. The `2026-10-sitecard` kam193 PyPI SSH-tunnel backdoor flagged yesterday (13 versions of `sitecard`) is a single-package campaign and no new sibling slugs appeared today. New today from kam193: the `2026-09-donutautosellsrc` campaign resurfaced on PyPI with Anthropic-brand typosquats (`claudeopuseni`, `claudeopusenifile`, `claudeopusfile`) and new slugs `nebulallm`, `dictmerge-lite`, `fontus`, `zagents-message-bus`. New today from `wiseke` npm operator: 14-pkg dep-confusion scope sweep across HPE GreenLake / SiriusXM / DJI / public-sector scopes, same byte-identical `index.js` as prior-wave `ph-common` and the same beacon endpoint `185.158.107.175:8787/_ah/dc` already in our standing egress denylist. New today from an unknown Amazon-Inspector-flagged operator: a `binding.gyp` + Brotli + AES-128-GCM + Bun-runtime loader (`event-bus-lite-testmetest`) matching the TanStack / Mini Shai-Hulud family TTP signature - no evidence yet linking it to TeamPCP but worth monitoring the slug prefix. The `s4yhii` npm pentest operator (standing-denylisted `collector.oob.s4yhii.com` apex) posted a 10-pkg POC batch under `@s4yhiitestpoc/r2-*` and `@s4yhiitestpoc/scan-*` naming today. Carve-outs [LiteLLM 1.107.0](https://dependencywatch.io/incident/pypi-2026-10-21-litellm-infostealer-rat), [Tailwind Animate.css fake-interview](https://dependencywatch.io/incident/npm-2026-10-20-tailwind-animatecss-fake-interview-campaign), [Apex Accelerator REF8801](https://dependencywatch.io/incident/npm-2026-10-19-apex-accelerator-malicious-npm-packages), [TensorLake AI](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise), [hridoy FB credential stealer](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer), [anthropic-sdk PyPI typosquat](https://dependencywatch.io/incident/pypi-2026-10-05-anthropic-sdk-typosquat) all remain confirmed-recovered with no wave-2 malicious republish observed - PyPI quarantine of `litellm` 1.107.0 holds, no new `anthropic`-prefix typosquats beyond today`s `claudeopus*` cluster

## What to do

1. **For Cluster A (`claudeopus*` 2026-09-donutautosellsrc steganography infostealer, 3 PyPI typosquats)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, `conda env.yml`, every internal PyPI mirror, every `Dockerfile`, and every AI-pipeline / LangChain / Claude-SDK / Cursor-rules repo for the literal strings `claudeopuseni`, `claudeopusenifile`, `claudeopusfile`. The legitimate Anthropic Python SDK is `anthropic` (import `from anthropic import Anthropic`); the Claude Opus family of models is addressed through that SDK, there is NO separate `claudeopus*` PyPI package. On any hit: treat the host as fully compromised (steganography payload with sandbox detection and blockchain-hidden C2 = full infostealer with evasion). Rotate: Anthropic API keys, all SSH/GPG keys, cloud credentials (AWS/GCP/Azure), browser-stored passwords and cookies, every `.env` file on the host, every AI-tool credential store (`~/.config/claude*`, `~/.anthropic`, `~/.config/anthropic*`, `~/.cursor`, `~/.codex`, `~/.gemini`). Block egress to Polygon blockchain RPC endpoints from CI/build hosts (the C2 address is retrieved from Polygon transaction history, so blocking the retrieval breaks the lookup even if the operator rotates C2); block egress to any domain resolving from Polygon transactions of `0x9c0a507300fd902787bb193d80fca5ce6e1bff9a`. Add `claudeopuseni`, `claudeopusenifile`, `claudeopusfile`, `claudeopus-sdk`, `claudeopus`, `claude-opus-sdk`, `claude-opus` as adjacent-guess PyPI denylist entries - the operator rotates spellings around the Claude Opus brand
2. **For Cluster B (`event-bus-lite-testmetest` Bun-runtime binding.gyp loader, 1 npm pkg)**: grep every `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, Dockerfile, and container image manifest for `event-bus-lite-testmetest` at version `0.0.6`. On any hit: treat the host as a candidate TanStack-family-TTP implant (Bun runtime + binding.gyp install trigger + Brotli-wrapped AES-128-GCM-encrypted native payload). Hunt for `.b-*/` temporary directories under `node_modules/event-bus-lite-testmetest/`, hunt for the Bun runtime binary on hosts that do not normally use Bun, and hunt for the `lib_native.dat` artefact (SHA-256 `e1ab1e330d3db532d511d4af4386ab2d2c6245ca807410f51c1211ae48814d73`). Rotate secrets from a clean machine; rebuild the host rather than attempt in-place cleanup. Add `event-bus-lite-testmetest` and sibling slugs starting `event-bus-lite-*` to the npm denylist; alert when any package in the dependency tree ships both a `binding.gyp` and a bundled `.dat` / `.bin` file over 100 KB
3. **For Cluster C (`wiseke` npm dep-confusion scope sweep, 14 packages across @greenlake/@sxm-web/@drone-js-ext/@ppa-web-components)**: grep every `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, container image manifest, and private-registry mirror config for `@greenlake/`, `@sxm-web/`, `@drone-js-ext/`, `@ppa-web-components/`, `wiseke` (the npm maintainer), and specifically for the 14 package names in Cluster A at version `3.0.0`. On any hit: treat the host as compromised (postinstall ran `node beacon.cjs`, exfiltrated host+path+cwd to `185.158.107.175:8787/_ah/dc`, which is already in our standing egress denylist); confirm no inbound reach was granted to the C2 (the beacon exfils identity info useful for a targeted follow-up). For organisations that have ANY internal usage of the `@greenlake` / `@sxm-web` / `@drone-js-ext` / `@ppa-web-components` scopes against an internal registry: audit the internal-registry resolution path and ensure the public npm registry is not the fallback; the operator`s 3.0.0 version wins against lower-numbered internal versions. Keep `185.158.107.175:8787/_ah/dc` blocked at egress
4. **For Cluster D (kam193 PyPI malicious singles - `nebulallm`, `dictmerge-lite`, `fontus`, `zagents-message-bus`)**: grep every PyPI manifest and internal mirror for `nebulallm==1.4.3`, `dictmerge-lite==1.0.0`, `fontus==0.0.1/0.0.2/0.0.3`, `zagents-message-bus==1.0.5/1.0.10/99.99.99/99.99.100`. On `nebulallm` or `dictmerge-lite` hit on any host: treat the host as fully compromised (nebulallm chains JScript-to-DLL loader; dictmerge-lite is a dev-workstation infostealer against crypto wallets, browser profiles, SSH keys, and development credentials). On `fontus` or `zagents-message-bus` hit: treat as a confirmed pentest probe - the host`s basic fingerprint (IP, username, platform, arch) has been exfiltrated and the install itself proves resolution worked, so follow-up targeting is possible. Add `nebulallm`, `dictmerge-lite`, `fontus`, `zagents-message-bus` to the PyPI denylist; the sentinel `99.99.99`/`99.99.100` versions on `zagents-message-bus` indicate internal-registry dep-confusion so audit for an internal `zagents-message-bus` package first
5. **For Cluster E (`@s4yhiitestpoc/r2-*` and `@s4yhiitestpoc/scan-*` pentest POC batch, 10 npm pkgs)**: grep every npm manifest for `@s4yhiitestpoc/`. On hit: this is a known kam193-tracked `s4yhii` pentest operator namespace with standing-denylisted C2 (`collector.oob.s4yhii.com`, `*.oob.s4yhii.com`, `oob.s4yhii.com:9999/native`); treat the install as a successful bug-bounty / dep-confusion probe and investigate how the public `@s4yhiitestpoc` scope reached the resolver. Keep the standing s4yhii egress denylist in place
6. **For Cluster F (npm "social scraper / Appit cordova" cluster, ~16 packages)**: grep every npm manifest for `insta-reel-search`, `insta-api-wrapper`, `tiktok-video-scraper`, `ionic-tiktok-scraper`, `ionic-sound-cloud-loader-api`, `sound-cloud-loader-api`, `youtube-search-without-api-key`, `youtube-info-streams`, `ionic-youtube-search`, `ionic-youtube-streams`, `ionic-insta-api-wrapper`, `ionic-insta-search`, `redis-dumper`, `ocsp-hashes`, `cert-infos`, `p12-pem`, `appit-cordova-plugin-ionic`, `appit-cordova-admob`, `cordova-plugin-geofence-appit`. On any hit from a hobbyist mobile-app repo or a cordova/ionic prototype: treat as suspicious-install (CWE-506 boilerplate indicates malicious intent but no vendor payload analysis is published); audit `node_modules/<pkg>/` for postinstall scripts and bundled binary files; rebuild from a clean npm registry mirror. For `ocsp-hashes` and `p12-pem` specifically: the legitimate packages are `ocsp` and `pem` / `node-forge` / `node-pem` - treat these as typosquats and alert the developer who introduced them
7. **For Cluster G (npm miscellaneous dep-confusion probes, ~12 scoped and sentinel-versioned packages)**: grep every npm manifest for the full scope list `@greenlake`, `@sxm-web`, `@drone-js-ext`, `@ppa-web-components`, `@futurae-public`, `@fmr-ap153177`, `@factoryz`, `@capsense`, `@jm-telefonica`, `@generic-means`, `@postex`, `@eforms`, `paychex-pdftron`, `react-native-bright-sdk`, `jshelperdependenceny`. These impersonate HPE GreenLake, SiriusXM, DJI drone, PPA/public-sector, Fidelity Management & Research, Factoryz, Capital One (@capsense), Telefónica (@jm-telefonica), ING Bank (@generic-means + ing-feat), Postex, eForms, Paychex, and the Bright SDK name. On any hit against your organisation`s internal-registry namespace: this is a confirmed targeted dep-confusion probe, not a drive-by - audit the internal-registry resolution path, confirm the public npm registry is not the fallback, and treat the install host as compromised (fingerprint exfiltrated at minimum). Keep `ltidi.storage.googleapis.com/depenconf/` and `*.ngrok-free.dev/canary` in the egress denylist
8. **For Cluster H (CWE-506 boilerplate takedown long tail, ~15 npm pkgs)**: grep every npm manifest for `tailwindcss-theme-kit`, `noelc-css-blender`, `tailwind-base-buttons`, `w-mousekey`, `sc-hydrate-carousel-price`, `monitoring-agent`, `numbors`, `dsh-native`, `bow-test`, `brass-common`, `css-overscroll-contain`, `css-hnhxwd-polyfill`, `util-foriepft`, `css-flexgap-shim`, `css-grid-snap-util`, `ap3-foundations-ui`, `react-dropzone-v4`, `orderly-plugin-liquidity-heatmap`, `@regex33-hackerone/tb-compat`, `@eforms/forms-api`. On hit: remove the package, audit any postinstall script that ran, and rebuild from a clean mirror; alert the developer who introduced the dependency so the operator`s lure name is retired from internal docs/snippets. `react-dropzone-v4` specifically appears to typosquat `react-dropzone`; `numbors` likely typosquats `numbro`; `ocsp-hashes` and `p12-pem` (listed in Cluster F) typosquat `ocsp` and `pem`
9. **Standing egress-denylist carry-forward from prior sweeps** (keep in place; today`s batch adds no new sharp network IOCs beyond the Polygon-blockchain-hosted C2 for Cluster A, where the retrieval endpoint is any Polygon RPC gateway rather than a fixed C2 apex): continue to block `networkservicesupp.flashhub.net:8443` (2026-10-22 `@sudobility` XMRig Monero pool), `c2-worker.crawlnet-claim.workers.dev` apex + `/dl/pyupd` path, `34.143.131.27:18080` + `/x-VA-1/main.js` path, `webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/` (2026-10-21 `rs-lookout-sandbox-poc` AWS IMDS exfil), `75.119.137.232:31337` + `/depconfuse` path (2026-10-20), `transfer.archivete.am` apex + `/H2Uxm/fabdeploycheck-config.json` path (2026-10-19), `realwbx.com` apex + `/ip.php` + `/ip` paths, `artifacts.creditslib.com` apex + `/npm/*` paths, `login.fromthehotel.com` apex, `googleforum.pythonanywhere.com`, `space-z.ai` apex, `dxpoc.gt.tc` apex, `raw.githubusercontent.com/anonrider404/pypl/*`, `api-bsx.pages.dev` + `/download`, `177.7.60.239:48080` + `oob.recon.dev`, `uncoder.eu.org` + `/cc-checker/api.php`, `accenture-npm.azurewebsites.net`, `limbomail.com`, `collector.oob.s4yhii.com` + `*.oob.s4yhii.com` + `s4yhii.com`, `64.181.165.115/dc`, `167.88.172.33:8087` + `jsonspack.com`, `goxtools.shop`, `minhdong.site`, `45.138.12.177:8089`, `185.158.107.175:8787` (today`s Cluster C beacon - stays sharp), `ltidi.storage.googleapis.com/depenconf/`, `oob.s4yhii.com:9999/native`, `*.oast.pro`/`*.oast.me`/`*.oast.fun`/`*.oast.site`/`*.oastify.com`, `frjmzbjbhwvtdnsuodmu.supabase.co`, `api.npoint.io`, `tele.metry.orgin.net`, `morroncr0w.io`, `api.telegram.org` on untrusted CI/build hosts, `appsecc.com`, generic `webhook.site/*` paths other than legitimate dev webhooks, `nfjbill.ren`, `storage.googleapis.com/depenconf/`, `10.0.19.0/24` + `10.0.49.0/24`, `api.nm-streetwear.space`, Discord webhook URL patterns, `ipify.org` + `ifconfig.me`, `gitflic.ru`, `api.wagmiwallet.org`, `backend-cybersecuritydashboard.onrender.com`, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints (specifically re-emphasised for today`s Cluster A - block Polygon mainnet JSON-RPC from CI/build hosts to break the blockchain-hidden C2 lookup; the operator address of record is `0x9c0a507300fd902787bb193d80fca5ce6e1bff9a` whose transaction history returns the current C2 string), `chinazhangsan.ccwu.cc`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `npm-canary.aveliscare.com`, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil patterns, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, `tuamaeaquelaursa.com`, `45.138.0.0/16` RubyGems wgkit CIDRs, `apexaccs.org` apex + subdomains, `arenapex.cloud`, `apexfdn.xyz` apex + subdomains, `fdn4apex.com`, `router-apex.com` apex + subdomains, `ccmihr.com`, `0auth-chromium.com`, `ehegisnightmare.icu`, `cloudmain365duo.top`, `www.litellm.dev/healthcheck`, `raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt`, known SSH relay services `srv.us`, `*.devtunnels.ms`, `*.devtunnels.visualstudio.com` on build/CI networks. New today for Cluster G: `*.ngrok-free.dev/canary` subdomain pattern (`react-native-bright-sdk@9000.0.0` preinstall beacon)

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-6m96-8rw5-4rhw - pypi claudeopuseni@0.1.0, 0.1.1 (Cluster A - 2026-09-donutautosellsrc steganography infostealer, Polygon C2, OSSF MAL-2026-18299, VT d03c42c2...43f3e)](https://github.com/advisories/GHSA-6m96-8rw5-4rhw) - GitHub
- [GHSA-8whx-wfhh-6vh5 - pypi claudeopusenifile@0.1.3 (Cluster A - OSSF MAL-2026-18300)](https://github.com/advisories/GHSA-8whx-wfhh-6vh5) - GitHub
- [GHSA-jgm6-7jxr-97gx - pypi claudeopusfile@0.1.1, 0.1.2 (Cluster A - OSSF MAL-2026-18298)](https://github.com/advisories/GHSA-jgm6-7jxr-97gx) - GitHub
- [GHSA-7xwf-5j6m-rjff - npm event-bus-lite-testmetest@0.0.6 (Cluster B - binding.gyp + Brotli + AES-128-GCM + Bun-runtime loader, OSSF MAL-2026-18292, Amazon Inspector, payload hash e1ab1e33...814d73)](https://github.com/advisories/GHSA-7xwf-5j6m-rjff) - GitHub
- [GHSA-pfqf-544g-rvp9 - npm @greenlake/auth@3.0.0 (Cluster C - wiseke dep-confusion to 185.158.107.175:8787/_ah/dc, byte-identical index.js to ph-common MAL-2026-1809, OSSF MAL-2026-18316)](https://github.com/advisories/GHSA-pfqf-544g-rvp9) - GitHub
- [GHSA-p5fc-j294-qr5q - npm @greenlake/common-context@3.0.0 (Cluster C)](https://github.com/advisories/GHSA-p5fc-j294-qr5q) - GitHub
- [GHSA-ph7p-r8mj-5q6r - npm @greenlake/session@3.0.0 (Cluster C)](https://github.com/advisories/GHSA-ph7p-r8mj-5q6r) - GitHub
- [GHSA-968q-w3j5-w6rq - npm @greenlake/mfe-login-url@3.0.0 (Cluster C)](https://github.com/advisories/GHSA-968q-w3j5-w6rq) - GitHub
- [GHSA-pmfr-35rg-27xm - npm @greenlake/context-pane@3.0.0 (Cluster C)](https://github.com/advisories/GHSA-pmfr-35rg-27xm) - GitHub
- [GHSA-j5p5-hcm3-6gx9 - npm @sxm-web/client-sdk-core@3.0.0 (Cluster C - SiriusXM scope)](https://github.com/advisories/GHSA-j5p5-hcm3-6gx9) - GitHub
- [GHSA-68q8-r62c-rwgx - npm @drone-js-ext/core@3.0.0 (Cluster C - DJI drone SDK extension scope)](https://github.com/advisories/GHSA-68q8-r62c-rwgx) - GitHub
- [GHSA-g6h7-w896-4p29 - npm @drone-js-ext/vip-badge@3.0.0 (Cluster C)](https://github.com/advisories/GHSA-g6h7-w896-4p29) - GitHub
- [GHSA-vhvr-f5ww-qh72 - npm @ppa-web-components/ppa-headerfooter@3.0.0 (Cluster C - public-sector web components scope)](https://github.com/advisories/GHSA-vhvr-f5ww-qh72) - GitHub
- [GHSA-g7m6-g9fm-57wh - npm @ppa-web-components/ppa-hotel-collection@3.0.0 (Cluster C)](https://github.com/advisories/GHSA-g7m6-g9fm-57wh) - GitHub
- [GHSA-38w9-666c-chmr - npm @ppa-web-components/ppa-navigation@3.0.0 (Cluster C)](https://github.com/advisories/GHSA-38w9-666c-chmr) - GitHub
- [GHSA-2g28-gqgq-ghvf - npm @ppa-web-components/ppa-banner@3.0.0 (Cluster C)](https://github.com/advisories/GHSA-2g28-gqgq-ghvf) - GitHub
- [GHSA-gpx7-mx94-wfv3 - npm @ppa-web-components/ppa-builder@3.0.0 (Cluster C)](https://github.com/advisories/GHSA-gpx7-mx94-wfv3) - GitHub
- [GHSA-xv6m-ch98-25c4 - npm @ppa-web-components/ppa-searchform@3.0.0 (Cluster C)](https://github.com/advisories/GHSA-xv6m-ch98-25c4) - GitHub
- [GHSA-mvgr-2gjf-h99c - pypi nebulallm@1.4.3 (Cluster D - OSSF MALICIOUS, campaign 2026-10-nebulallm, JScript-to-DLL loader, MAL-2026-18297)](https://github.com/advisories/GHSA-mvgr-2gjf-h99c) - GitHub
- [GHSA-825m-m2h7-7cwc - pypi dictmerge-lite@1.0.0 (Cluster D - OSSF MALICIOUS, campaign 2026-10-dictmerge-lite, crypto wallet / browser / SSH / dev credential infostealer, MAL-2026-18301)](https://github.com/advisories/GHSA-825m-m2h7-7cwc) - GitHub
- [GHSA-g5mh-f2v3-6p25 - pypi fontus@0.0.1, 0.0.2, 0.0.3 (Cluster D - OSSF PROBABLY_PENTEST, campaign 2026-10-fontus, basic info + fonts fingerprinting, MAL-2026-18271)](https://github.com/advisories/GHSA-g5mh-f2v3-6p25) - GitHub
- [GHSA-2hr3-wchh-6g2q - pypi zagents-message-bus@1.0.5, 1.0.10, 99.99.99, 99.99.100 (Cluster D - OSSF GENERIC-standard-pypi-install-pentest, dep-confusion sentinel versions, MAL-2026-18296)](https://github.com/advisories/GHSA-2hr3-wchh-6g2q) - GitHub
- [GHSA-96fg-4mp3-2hj5 - npm @s4yhiitestpoc/scan-https-d (Cluster E - s4yhii pentest POC)](https://github.com/advisories/GHSA-96fg-4mp3-2hj5) - GitHub
- [GHSA-vhw8-ph25-jc87 - npm @s4yhiitestpoc/scan-dns-c (Cluster E)](https://github.com/advisories/GHSA-vhw8-ph25-jc87) - GitHub
- [GHSA-2wfm-2q62-f937 - npm @s4yhiitestpoc/scan-echo-b (Cluster E)](https://github.com/advisories/GHSA-2wfm-2q62-f937) - GitHub
- [GHSA-mgmq-xcr7-2945 - npm @s4yhiitestpoc/r2-control (Cluster E)](https://github.com/advisories/GHSA-mgmq-xcr7-2945) - GitHub
- [GHSA-jr92-v3rg-vg3w - npm @s4yhiitestpoc/r2-dns (Cluster E)](https://github.com/advisories/GHSA-jr92-v3rg-vg3w) - GitHub
- [GHSA-5957-rhph-hx5p - npm @s4yhiitestpoc/scan-https-dualuse-e (Cluster E)](https://github.com/advisories/GHSA-5957-rhph-hx5p) - GitHub
- [GHSA-gcfx-vpjf-86m9 - npm @s4yhiitestpoc/r2-echo (Cluster E)](https://github.com/advisories/GHSA-gcfx-vpjf-86m9) - GitHub
- [GHSA-h99w-8693-g33v - npm @s4yhiitestpoc/r2-https-b (Cluster E)](https://github.com/advisories/GHSA-h99w-8693-g33v) - GitHub
- [GHSA-mv2r-j9qg-322h - npm @s4yhiitestpoc/r2-https-dualuse (Cluster E)](https://github.com/advisories/GHSA-mv2r-j9qg-322h) - GitHub
- [GHSA-m9p6-4pgh-6gqx - npm @s4yhiitestpoc/scan-control-a (Cluster E)](https://github.com/advisories/GHSA-m9p6-4pgh-6gqx) - GitHub
- [GHSA-v2r2-x76j-6fcx - npm insta-reel-search (Cluster F - social scraper lure)](https://github.com/advisories/GHSA-v2r2-x76j-6fcx) - GitHub
- [GHSA-j8vh-32vh-rj39 - npm insta-api-wrapper (Cluster F)](https://github.com/advisories/GHSA-j8vh-32vh-rj39) - GitHub
- [GHSA-5xjv-xr86-9hrv - npm tiktok-video-scraper (Cluster F)](https://github.com/advisories/GHSA-5xjv-xr86-9hrv) - GitHub
- [GHSA-wwj3-4v8w-w98j - npm ionic-tiktok-scraper (Cluster F)](https://github.com/advisories/GHSA-wwj3-4v8w-w98j) - GitHub
- [GHSA-g89m-8c48-9x73 - npm ionic-sound-cloud-loader-api (Cluster F)](https://github.com/advisories/GHSA-g89m-8c48-9x73) - GitHub
- [GHSA-5f99-52fc-5rc9 - npm sound-cloud-loader-api (Cluster F)](https://github.com/advisories/GHSA-5f99-52fc-5rc9) - GitHub
- [GHSA-f6m2-r9qr-44fx - npm youtube-search-without-api-key (Cluster F)](https://github.com/advisories/GHSA-f6m2-r9qr-44fx) - GitHub
- [GHSA-7mfw-r26v-9r9f - npm youtube-info-streams (Cluster F)](https://github.com/advisories/GHSA-7mfw-r26v-9r9f) - GitHub
- [GHSA-7p9r-26fp-m47g - npm ionic-youtube-search (Cluster F)](https://github.com/advisories/GHSA-7p9r-26fp-m47g) - GitHub
- [GHSA-3cc7-77mx-rmj6 - npm ionic-youtube-streams (Cluster F)](https://github.com/advisories/GHSA-3cc7-77mx-rmj6) - GitHub
- [GHSA-65qr-q8w8-4q7r - npm ionic-insta-api-wrapper (Cluster F)](https://github.com/advisories/GHSA-65qr-q8w8-4q7r) - GitHub
- [GHSA-4fw4-xm5r-mh69 - npm ionic-insta-search (Cluster F)](https://github.com/advisories/GHSA-4fw4-xm5r-mh69) - GitHub
- [GHSA-8gg8-xq45-8fx5 - npm redis-dumper (Cluster F)](https://github.com/advisories/GHSA-8gg8-xq45-8fx5) - GitHub
- [GHSA-9v69-fx5h-r6p6 - npm ocsp-hashes (Cluster F - typosquat of ocsp)](https://github.com/advisories/GHSA-9v69-fx5h-r6p6) - GitHub
- [GHSA-8mjx-r4j6-3h6g - npm cert-infos (Cluster F)](https://github.com/advisories/GHSA-8mjx-r4j6-3h6g) - GitHub
- [GHSA-74xg-w33f-jpv3 - npm p12-pem (Cluster F - typosquat of pem)](https://github.com/advisories/GHSA-74xg-w33f-jpv3) - GitHub
- [GHSA-fr38-45mf-vcqf - npm appit-cordova-plugin-ionic (Cluster F)](https://github.com/advisories/GHSA-fr38-45mf-vcqf) - GitHub
- [GHSA-9w8h-674f-4x2j - npm appit-cordova-admob (Cluster F)](https://github.com/advisories/GHSA-9w8h-674f-4x2j) - GitHub
- [GHSA-5pw8-3xv5-6cmg - npm cordova-plugin-geofence-appit (Cluster F)](https://github.com/advisories/GHSA-5pw8-3xv5-6cmg) - GitHub
- [GHSA-fjcx-639f-h39g - npm react-native-bright-sdk@9000.0.0 (Cluster G - preinstall canary beacon to *.ngrok-free.dev/canary, MAL-2026-18290)](https://github.com/advisories/GHSA-fjcx-639f-h39g) - GitHub
- [GHSA-249c-6w49-6274 - npm jshelperdependenceny@99.0.0 (Cluster G - DC_CALLBACK_URL preinstall beacon, MAL-2026-18288)](https://github.com/advisories/GHSA-249c-6w49-6274) - GitHub
- [GHSA-cxq5-px5q-3gm4 - npm @postex/common@99.9.1 (Cluster G - ltidisafe GCS-tarball install-time payload, MAL-2026-18285)](https://github.com/advisories/GHSA-cxq5-px5q-3gm4) - GitHub
- [GHSA-79qp-32qv-632x - npm @futurae-public/adaptive-js (Cluster G - Futurae scope)](https://github.com/advisories/GHSA-79qp-32qv-632x) - GitHub
- [GHSA-vw9v-ghxv-m2gw - npm @fmr-ap153177/apex-kit-icons (Cluster G - Fidelity Management & Research scope)](https://github.com/advisories/GHSA-vw9v-ghxv-m2gw) - GitHub
- [GHSA-8wg4-rwxf-cv7v - npm @factoryz/apollo (Cluster G)](https://github.com/advisories/GHSA-8wg4-rwxf-cv7v) - GitHub
- [GHSA-f24f-639h-q46v - npm @capsense/core-ui (Cluster G)](https://github.com/advisories/GHSA-f24f-639h-q46v) - GitHub
- [GHSA-v7w7-x8q8-wp4r - npm @capsense/ccx-welcome-page (Cluster G)](https://github.com/advisories/GHSA-v7w7-x8q8-wp4r) - GitHub
- [GHSA-xrpm-2w69-j2r7 - npm @jm-telefonica/multibrand-components (Cluster G - Telefónica scope)](https://github.com/advisories/GHSA-xrpm-2w69-j2r7) - GitHub
- [GHSA-3qv7-4fg6-54gp - npm @generic-means/ing-feat-scanner-libs (Cluster G - ING Bank naming)](https://github.com/advisories/GHSA-3qv7-4fg6-54gp) - GitHub
- [GHSA-2cfq-pcr7-8572 - npm @eforms/forms-api (Cluster G)](https://github.com/advisories/GHSA-2cfq-pcr7-8572) - GitHub
- [GHSA-qg7g-2jr4-vjw8 - npm paychex-pdftron (Cluster G - Paychex SDK impersonation)](https://github.com/advisories/GHSA-qg7g-2jr4-vjw8) - GitHub
- [GHSA-v5xr-xjx7-ggwf - npm tailwindcss-theme-kit (Cluster H - 2026-10-24)](https://github.com/advisories/GHSA-v5xr-xjx7-ggwf) - GitHub
- [GHSA-cj2x-975v-jmwf - npm noelc-css-blender (Cluster H - 2026-10-24)](https://github.com/advisories/GHSA-cj2x-975v-jmwf) - GitHub
- [GHSA-5j43-343m-gggg - npm tailwind-base-buttons (Cluster H - 2026-10-25)](https://github.com/advisories/GHSA-5j43-343m-gggg) - GitHub
- [GHSA-gmhr-j769-j6qf - npm w-mousekey@1.0.41, 1.0.42 (Cluster H - 2026-10-25)](https://github.com/advisories/GHSA-gmhr-j769-j6qf) - GitHub
- [GHSA-p6gr-jpmq-4hjq - npm sc-hydrate-carousel-price (Cluster H - 2026-10-25)](https://github.com/advisories/GHSA-p6gr-jpmq-4hjq) - GitHub
- [GHSA-fvjv-j94x-c8wm - npm monitoring-agent (Cluster H - 2026-10-26, plausible lure)](https://github.com/advisories/GHSA-fvjv-j94x-c8wm) - GitHub
- [GHSA-682c-pwqm-7gxv - npm numbors@1.6.1 (Cluster H - likely typosquat of numbro, 2026-10-26)](https://github.com/advisories/GHSA-682c-pwqm-7gxv) - GitHub
- [GHSA-x94m-hxm5-m298 - npm dsh-native (Cluster H - 2026-10-26)](https://github.com/advisories/GHSA-x94m-hxm5-m298) - GitHub
- [GHSA-w53j-w72q-2f32 - npm bow-test (Cluster H - 2026-10-26)](https://github.com/advisories/GHSA-w53j-w72q-2f32) - GitHub
- [GHSA-g6mf-8rwx-xgwh - npm brass-common (Cluster H - 2026-10-26)](https://github.com/advisories/GHSA-g6mf-8rwx-xgwh) - GitHub
- [GHSA-xjrr-fv8j-9hw7 - npm css-overscroll-contain (Cluster H - 2026-10-26)](https://github.com/advisories/GHSA-xjrr-fv8j-9hw7) - GitHub
- [GHSA-r2cx-wgxm-g93q - npm css-hnhxwd-polyfill (Cluster H - 2026-10-26)](https://github.com/advisories/GHSA-r2cx-wgxm-g93q) - GitHub
- [GHSA-rc7p-6p9r-rfj9 - npm util-foriepft (Cluster H - 2026-10-26)](https://github.com/advisories/GHSA-rc7p-6p9r-rfj9) - GitHub
- [GHSA-xv83-g4vx-88wf - npm css-flexgap-shim (Cluster H - 2026-10-26)](https://github.com/advisories/GHSA-xv83-g4vx-88wf) - GitHub
- [GHSA-ww37-mhpw-cm3q - npm css-grid-snap-util (Cluster H - 2026-10-26)](https://github.com/advisories/GHSA-ww37-mhpw-cm3q) - GitHub
- [GHSA-g9j6-f655-22p6 - npm ap3-foundations-ui (Cluster H - 2026-10-26)](https://github.com/advisories/GHSA-g9j6-f655-22p6) - GitHub
- [GHSA-cqf2-3c3q-p639 - npm react-dropzone-v4 (Cluster H - likely typosquat of react-dropzone, 2026-10-26)](https://github.com/advisories/GHSA-cqf2-3c3q-p639) - GitHub
- [GHSA-83cj-fp7v-jmfx - npm orderly-plugin-liquidity-heatmap (Cluster H - 2026-10-26)](https://github.com/advisories/GHSA-83cj-fp7v-jmfx) - GitHub
- [GHSA-vwp8-h222-46p8 - npm @regex33-hackerone/tb-compat (Cluster H - bug-bounty researcher scope, 2026-10-26)](https://github.com/advisories/GHSA-vwp8-h222-46p8) - GitHub
- [DependencyWatch: multi-2026-10-24-ghsa-malware-sweep (two days back - 2026-10-voice-synthesis-profiles wave 2 kam193 21-pkg loader cluster, sitecard kam193 SSH-tunnel backdoor, @k18k entrypoint-sdk tunnel-gateway lure, overarch/liauto Windows-binary droppers)](https://dependencywatch.io/incident/multi-2026-10-24-ghsa-malware-sweep)
- [DependencyWatch: multi-2026-10-23-ghsa-malware-sweep (three days back - journey-teste-shellhello wave 2, @ecg-internal + @grabcad dep-confusion probe clusters, @pkgship/frp reverse-proxy binaries, darknode-cli Ren Protocol impersonator)](https://dependencywatch.io/incident/multi-2026-10-23-ghsa-malware-sweep)
- [DependencyWatch: pypi-2026-10-05-anthropic-sdk-typosquat (prior Anthropic-brand typosquat campaign, different operator, non-overlapping)](https://dependencywatch.io/incident/pypi-2026-10-05-anthropic-sdk-typosquat)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-26-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-26-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).