DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 28 October 2026

HighAdvisory sweepnpmPyPI

GHSA late 2026-10-27 batch plus first 2026-10-28 advisories. Three CONFIRMED kam193 PyPI payloads: trajmetrics file-exfiltration infostealer (MAL-2026-18354, today), numprint setup.py RAT via GitHub Gist C2 (MAL-2026-18343), h13t0ry-hello-demo import-time reverse shell to 115.190.210.22 (MAL-2026-18336). Plus a confirmed trusted-publisher compromise of the legitimate @camera.ui/camera-ui-nvr-windows-amd64 1.6.1 release, a csec/ccsec/ccsseecc 7-pack npm typosquat mesh, @flexmr/* dep-confusion by robdotty, and sc-*/ccl-*/paychex-pdftron dep-confusion batch.

Published 28 Oct 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-10-28-ghsa-malware-sweep
29
Packages tracked57 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
28 Oct 2026
Ecosystems
npmPyPI
Detected by
GitHub Advisory Database, OpenSSF Package Analysis, kam193, Vulert, ReversingLabs
Also known as
GHSA 2026-10-27 late batch + 2026-10-28 first wave, 2026-10-trajmetrics, 2026-10-numprint

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

Between 2026-10-27 06:00 UTC (yesterdays sweep cut-off) and 2026-10-28 06:00 UTC (todays ingest-window start), the GitHub Advisory Database published ~30 fresh malware advisories across npm and PyPI, dominated by a dated-batch takedown pass that cleared out April-published dep-confusion probes alongside freshly-flagged kam193 PyPI payloads. The headline items are three CONFIRMED kam193 PyPI payloads carrying real malicious code (not boilerplate), a confirmed single-version compromise of a legitimate npm Windows NVR package via a trusted-publisher OIDC breach, a csec/ccsec/ccsseecc 7-pack coordinated typosquat mesh, a dep-confusion scope-probe against the UK market-research SaaS FlexMR by a new operator robdotty, and a coordinated 99.9.1 sentinel-version dep-confusion batch targeting Salesforce Commerce and Paychex internal namespaces.

Headlines

Three CONFIRMED kam193 PyPI payloads (Cluster A): trajmetrics@0.5.3 (MAL-2026-18354, published 2026-10-28) is a filesystem-wide infostealer that scans the whole disk and exfiltrates files by type as they change, to 109.94.169.196:8443 via the *.sslip.io wildcard DNS service. numprint@1.2.0 (MAL-2026-18343) is a RAT that overrides setup.py install, then polls api.github.com/gists/3775fd9235aa6ef29e96eb96274a0e34 for attacker commands and executes them in a background process - notable because the GitHub-Gist-as-C2 technique extends yesterdays netweavex GitHub-repo-as-C2 pattern (the operator is iterating different GitHub surfaces for free, resilient C2 that evades conventional egress blocks against commercial PaaS). h13t0ry-hello-demo@0.1.0 (MAL-2026-18336) opens a reverse shell on import to 115.190.210.22`. All three are MALICIOUS category per kam193 / OpenSSF; all three have captured SHA-256 artefact hashes for hunting.

@camera.ui/camera-ui-nvr-windows-amd64@1.6.1 trusted-publisher compromise (Cluster B): the legitimate github.com/cameraui/camera-ui-nvr project (home-security NVR Windows build maintained by seydx) had its 1.6.1 release pushed malicious then quickly unpublished on 2026-10-25. The clean 1.6.2 released 2026-10-27 shows the maintainer rotated the trusted-publisher OIDC configuration id from the prior dc943c58-... to a new 80ad1a61-dcd0-4d61-b14b-78174d320d61, confirming the compromise mechanism was an OIDC token breach rather than account-password theft. Payload bytes were not captured in registry metadata because 1.6.1 was unpublished within hours, but any Windows NVR install during the ~48-hour exposure window is candidate-compromised.

csec/ccsec/ccsseecc 7-pack npm typosquat mesh (Cluster C): seven npm packages across three "csec"-family prefixes (csec-*, ccsec-*, ccsseecc-*), each with form-validator and crypto-toolkit variants, each with its own internal typo of its own typosquat (csec-form-validatorr with double-r). All seven were originally April-published and batch-taken-down 2026-10-27 23:03-23:09 UTC. The mesh pattern plus the family continuation of the 2026-07 csec-form-helpers / @dany47/csec-crypto-utils cluster that ReversingLabs previously flagged (MAL-2026-7063 / MAL-2026-7249) confirms coordinated malicious intent even though today`s GHSA advisory text is CWE-506 boilerplate without captured payload bytes.

*`@flexmr/ FlexMR dep-confusion probe** (Cluster D): three npm scope packages (@flexmr/utils, @flexmr/survey-conversation, @flexmr/survey-client), each at 1.0.0, 1.0.12, 2.0.12, 3.0.12, 10.0.12 (five sentinel-version-mesh entries per package = 15 total malicious artefacts), all published by npm identity robdotty on 2026-10-14 and all taken down 2026-10-27. The sentinel-version-mesh pattern is a classic dep-confusion range-bump, and a sibling @flexmr/ui@99.99.99 was previously flagged by Vulert as running a beacon.js preinstall-hook performing DNS lookup + remote-IP exfil of host fingerprint - so the same TTP is the working assumption for the three packages taken down today. FlexMR is a legitimate UK-based market-research SaaS at flexmr.net; this is a confirmed dep-confusion probe against their internal @flexmr/*` scope.

*`sc-/ccl-/paychex-pdftron` 99.9.1 sentinel-version dep-confusion batch (Cluster E): four npm packages all at 99.9.1, all co-published in a 5-minute window on 2026-10-20 03:33-03:38 UTC, all batch-taken-down 2026-10-27 15:11-15:13 UTC. The `sc- prefix most plausibly corresponds to Salesforce Commerce (SFCC) internal "storefront commerce" naming; ccl-global-shopping matches a Salesforce Commerce internal shopping-cart naming convention; paychex-pdftron` matches Paychex internal naming for a PDFTron SDK wrapper. The 99.9.1 sentinel is a classic internal-registry-pin dep-confusion probe.

Novel operator identities to watch: robdotty (@flexmr/* dep-confusion, 15 artefacts in one batch) and yugejixian (dsh-vm-tester DeepSeek-Harness lure, 8 iterative versions over a short window) both appeared this week and warrant tracking for wave-2 slugs.

Classification

sweep. Severity high (upgraded from the sweep baseline medium) because Clusters A and B both carry confirmed malicious payloads: Cluster As three kam193 PyPI items (filesystem-wide infostealer, GitHub-Gist RAT, import-time reverse shell) each have captured artefact SHA-256 hashes and MAL IDs; Cluster B is a confirmed single-version compromise of a legitimate project. The rest (Clusters C-I) are medium - CWE-506 boilerplate, dep-confusion probes, or pentest / lure artefacts. No cluster reaches critical - Cluster As payloads have limited reach (nothing legitimate depends on trajmetrics, numprint, or h13t0ry-hello-demo), Cluster B is already remediated by the maintainers 1.6.2 clean release, and none of the compromised names are already-depended-on at the scale that would make them critical. Anything that would itself be critical (hijack of an already-widely-depended-on name, an active self-propagating worm against legitimate packages, a maintainer takeover with downstream reach at the scale of TanStack / @uipath/* / axios) would get its own named incident file; none of todays advisories meet that bar.

Discovery

GitHub Advisory Database, OpenSSF malicious-packages (Clusters A specifically MAL-2026-18354, 18343, 18336 plus Cluster G MAL-2026-18338), kam193 bad-packages (campaign tags 2026-10-trajmetrics, 2026-10-numprint, 2026-10-h13t0ry-hello-demo), Vulert (Cluster D sibling @flexmr/ui@99.99.99 beacon.js TTP), ReversingLabs (Cluster C family precedent MAL-2026-7063 / MAL-2026-7249 for csec-form-helpers / @dany47/csec-crypto-utils).

typosquatdependency-confusioninfostealermaintainer-takeoverci-cd-compromisecredential-theftobfuscation
Affected packages

29 packages 57 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • Cluster A - kam193 PyPI confirmed-payload trio (malicious-package; 3 packages, 2026-10-27 and 2026-10-28, OSSF MALICIOUS category, kam193 campaigns): trajmetrics@0.5.3 (GHSA-rm9p-x4m7-hxmp, OSSF MAL-2026-18354, kam193 campaign 2026-10-trajmetrics, published 2026-10-28, SHA-256 3370d77977a536de8b2ea99267086960e8be3aea34a1efac6d975bb2bad98271) is a FILESYSTEM-WIDE INFOSTEALER: when trajmetrics runs as a module (python -m trajmetrics or the README-recommended entry point), it starts a background job that scans the whole filesystem and exfiltrates selected files by type as they change, to 109-94-169-196.sslip.io:8443 (resolves to 109.94.169.196:8443); the kam193 upstream GitHub source is github.com/hehesama527/data-analising. numprint@1.2.0 (GHSA-g9fj-q87h-6h4c, OSSF MAL-2026-18343, kam193 campaign 2026-10-numprint, published 2026-10-27, SHA-256 ca6ff316077349c92e2d1e5d7c3683a16e6542b952d5c7fc8743efa5d4c80243) overrides the setup.py install command and spawns a background RAT that pulls commands from a GitHub Gist at api.github.com/gists/3775fd9235aa6ef29e96eb96274a0e34 and runs them (notable: Gist-as-C2 extends yesterdays netweavex GitHub-repo-as-C2 pattern - the operator is iterating different GitHub surfaces for C2). h13t0ry-hello-demo@0.1.0 (GHSA-5crq-52j9-fc74, OSSF MAL-2026-18336, kam193 campaign 2026-10-h13t0ry-hello-demo, published 2026-10-27, SHA-256 e27409f6c0ba5c7e7ba22f21c8b4806686ae8b64f4d7daf2dd9a7e6182bef5ab) opens a reverse shell on import to the hardcoded IP 115.190.210.22. **Severity high** for the cluster (three confirmed malicious payloads each with limited reach - nothing legitimate depends on these PyPI names, but any host that ran them is fully compromised, and the Gist-C2 technique in numprint` is a new TTP worth hunting for across other recently-published PyPI packages)
  • Cluster B - @camera.ui/camera-ui-nvr-windows-amd64 trusted-publisher compromise (compromise; 1 package, 2026-10-25 publish/unpublish, 2026-10-27 patched release): @camera.ui/camera-ui-nvr-windows-amd64@1.6.1 (GHSA-2w7v-jwxh-w7wc). The legitimate project is github.com/cameraui/camera-ui-nvr, a home-security NVR Windows build maintained by seydx. 1.6.1 was published on 2026-10-25 then immediately unpublished; the trusted-publisher OIDC configuration id for the package was rotated from the prior dc943c58-... to 80ad1a61-dcd0-4d61-b14b-78174d320d61 beginning with the clean 1.6.2 published 2026-10-27 - strong evidence of a maintainer breach via trusted-publisher OIDC token compromise followed by a credential reset. GHSAs advisory text is CWE-506 boilerplate (payload bytes were not captured in registry metadata because 1.6.1 was unpublished within hours), but the trusted-publishing rotation and the single-version-only infected release pattern match the TensorLake AI maintainer-compromise shape from [2026-10-08](/incident/npm-2026-10-08-tensorlake-maintainer-compromise). **Severity high** for this cluster (confirmed single-version compromise of a legitimate package with downstream reach via Windows NVR deployments, mitigated quickly by maintainers rotation but any machine that installed 1.6.1 during the ~48-hour window is candidate-compromised)
  • Cluster C - npm csec/ccsec/ccsseecc typosquat mesh (typosquat; 7 packages, originally April 2026 publishes, batch-taken-down 2026-10-27 23:03-23:09 UTC): csec-form-validator@1.0.0, 1.0.1 (GHSA-wh86-6qm8-xgw2), csec-form-validatorr@1.0.2 (GHSA-ph3g-jrf5-8792, note the double-r typo-of-the-typosquat), csec-crypto-toolkit@4.2.1, 4.2.2, 4.2.4 (GHSA-v383-2358-576w), ccsec-form-validator@3.0.0 (GHSA-r889-j2qv-2jv6), ccsec-crypto-toolkit@4.5.1 (GHSA-2732-c6cp-rx5v), ccsseecc-form-validator@3.0.0 (GHSA-h5wr-j55v-8m79), ccsseecc-crypto-toolkit@4.5.1 (GHSA-v9xw-mxj4-fm5q). GHSA advisory text is CWE-506 boilerplate (full-control claim, no captured payload bytes - package tarballs are now npm-security-held). The mesh pattern (c + ?sec prefix × form-validator/crypto-toolkit suffix, with internal typosquats of its own typosquats) is a coordinated operator pattern, and the family continues the 2026-07 csec-form-helpers/@dany47/csec-crypto-utils cluster that ReversingLabs flagged (MAL-2026-7063/7249). Severity medium for the cluster (CWE-506-only on today`s advisories but the mesh-of-mesh naming + ReversingLabs 7-month precedent confirm malicious intent; the "csec" lure name reads as a cybersecurity-SDK impersonation that a security-adjacent developer could reach for from a snippet)
  • *Cluster D - npm `@flexmr/ FlexMR dep-confusion probe (dependency-confusion; 3 packages × 5 sentinel versions each, 2026-10-14 publish by robdotty, 2026-10-27 15:49-15:50 UTC takedown)**: @flexmr/utils, @flexmr/survey-conversation, @flexmr/survey-client - each at 1.0.0, 1.0.12, 2.0.12, 3.0.12, 10.0.12 (GHSA-hpc9-fxqh-hhf8, GHSA-hc8w-gq4q-fr74, GHSA-rh7q-f888-q36c). Published by npm identity robdotty (contact robdotty30@gmail.com). The sentinel-version mesh is a classic dep-confusion range-bump pattern (publish at every plausible internal-registry pinned version so whichever one the target org pins to, the public resolver wins). Vulert previously flagged a sibling @flexmr/ui@99.99.99 running a beacon.js preinstall / install / postinstall hook performing DNS lookup + remote-IP exfil of host fingerprint - todays three packages share the operator, so same beacon.js + fingerprint-exfil TTP is the working assumption even though todays GHSA advisories are CWE-506 boilerplate. FlexMR is a legitimate UK-based market-research SaaS company (flexmr.net), so this is a confirmed dep-confusion probe against their internal @flexmr/` scope. Severity medium* (confirmed dep-confusion beacon-only on sibling package, no post-exfil payload captured; any FlexMR engineer or FlexMR-integrator who ran npm install during the exposure window probably leaked host fingerprint via DNS)
  • *Cluster E - npm `sc-/ccl-/paychex-pdftron coordinated 99.9.1 dep-confusion batch (dependency-confusion; 4 packages, all at 99.9.1`, all published 2026-10-20 03:33-03:38 UTC, batch-taken-down 2026-10-27 15:11-15:13 UTC): sc-announcer@99.9.1 (GHSA-fxw2-4j5q-6hwg), sc-hydrate-carousel-price@99.9.1 (GHSA-9gcx-88qx-rxch), ccl-global-shopping@99.9.1 (GHSA-hh3m-f424-g8v5), paychex-pdftron@99.9.1 (GHSA-9mgv-25w8-jwhf). The `sc- prefix most plausibly corresponds to Salesforce Commerce (SFCC - internal naming sc- for Storefront Commerce components), ccl-global-shopping matches a Salesforce Commerce internal shopping-cart naming convention, and paychex-pdftron` matches a Paychex (US payroll SaaS) internal naming for a PDFTron SDK wrapper. The 99.9.1 sentinel across all four and the 5-minute publish window confirms a single operator probing multiple adjacent enterprise targets in one batch. GHSA advisories are CWE-506 boilerplate - no payload captured. Severity medium* (dep-confusion probe batch with no post-fingerprint payload captured; any Salesforce-Commerce / Paychex engineer who pinned any of these internal names needs to audit the public-registry resolution path)
  • Cluster F - npm "verbose-utility" lure batch (malicious-package; 3 packages × 1 version each, all 1.0.0, all published 2026-10-13 20:40-20:44 UTC, all taken down 2026-10-27 15:48-15:51 UTC): fetch-hash-cache-atomic@1.0.0 (GHSA-w9mp-cvjp-jfqp), string-target-mapper-hash@1.0.0 (GHSA-wfcx-722r-fg5h), macro-kernel-record-reader@1.0.0 (GHSA-32g3-f74c-pcxq). Same operator (co-publish within 4 minutes, same naming pattern of multi-word utility slugs that could plausibly appear in an AI-assistant code suggestion), same takedown window. GHSA advisories are CWE-506 boilerplate - no payload captured. Severity medium (lure-name batch targeting AI-assistant code suggestions or developer snippet copy-paste; the slugs read as plausible utility names a developer could reach for without critical review)
  • Cluster G - single enterprise brand dep-confusion probes (dependency-confusion; 3 packages, mixed publish dates, all taken down 2026-10-27): @tableau__catalog-messages/database_lower@99.9.9, 99.9.91 (GHSA-wmfr-2pvv-wmf3, published 2026-04-09, 6-month-old probe, note the unusual double-underscore __ in the scope); adyen-web-v6@99.1.0 (GHSA-r77r-rw3m-rjh5, published 2026-04-27, Adyen payments SDK impersonation); @azure-growth/signup-ux-components@1.2.2, 1.2.3 (GHSA-m8mp-r4jx-43fw, OSSF MAL-2026-18338 - note @azure-growth is NOT a legitimate Microsoft Azure scope, this reads as an impersonation of the real @azure/* scope with a "growth-team" variant). GHSA advisories are CWE-506 boilerplate; the long publish-to-takedown lags (6 months for Tableau, 6 months for Adyen) suggest sleeper dep-confusion probes that finally caught GHSAs automated takedown attention. **Severity medium** (dep-confusion / typosquat probes with no captured payload; Tableau/Salesforce engineers, Adyen integrators, and anyone using @azure/*` scoped SDKs should audit internal-registry resolution)
  • Cluster H - npm dsh-vm-tester and agentenact singleton CWE-506 takedowns (malicious-package / compromise; 2 packages, mixed publishers): dsh-vm-tester@0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7 (GHSA-84fw-gj66-p5v3) published by npm identity yugejixian (contact 979080113@qq.com) with a description claiming "DeepSeek Harness VirtualBox GUI testing" - not related to the 2026-10-26 @sudobility/dsh-plugin-blender-3d + walknpm/@walknpm XMRig operator despite the dsh- prefix (different publisher, different payload shape, different version shape); the operator appears to be luring the DeepSeek-ecosystem developer audience with a plausibly-named helper. agentenact@0.2.0 (GHSA-7p7m-8jmq-qp93) published by knrs / Kerem Noras (kerem@noras.tech) on 2026-10-27 20:17 UTC and taken down the same day - the 0.0.1 and 0.1.1 prior versions are clean, so the 0.2.0 single-bump pattern matches the TensorLake AI maintainer-compromise shape from 2026-10-08; kind compromise is the working assumption even though no vendor confirmation has been published and no downstream dependents are known. Severity medium per package (CWE-506 boilerplate without captured payload at advisory time; agentenact warrants watch for a wave-2 malicious republish and for the maintainer to publicly comment)
  • Cluster I - npm CWE-506 boilerplate long tail (malicious-package; 3 packages, 2026-10-27 and 2026-10-28 advisories): glyphmatrix-fixture@1.0.0, 1.0.1 (GHSA-vc33-3x34-x6jm, published 2026-10-28 00:16-00:54 UTC by manbearpig.mb/jeanmichelremiboudreau@gmail.com - the first live-today listing on the GHSA feed, caught before npm security-hold), 6161test1234@1.0.0, 1.0.2 (GHSA-r9qx-xcg2-7wcc, test-slug boilerplate from 2026-04-21 batch-taken-down 2026-10-27), buttoncontent@99.0.0, 99.0.1, 99.0.2 (GHSA-6crh-vwr2-4qfp, 99.x sentinel from 2026-04-07, another dep-confusion probe that aged out before takedown). Severity medium per package (CWE-506 only, no captured payload at advisory time; glyphmatrix-fixture is the only one still freshly-published rather than aged)
  • Operator continuity: @sudobility XMRig cluster is idle today - no new walknpm-published, @sudobility-published or dsh-plugin-* slugs match the 2026-10-22 → 2026-10-26 wave 1+2 payload shape. networkservicesupp.flashhub.net:8443 egress block from yesterdays sweep stays sharp. **kam193 cadence** - continues strongly with 3 CONFIRMED-MALICIOUS payloads today: 2026-10-trajmetrics (new, filesystem-wide infostealer, HIGH), 2026-10-numprint (new, setup.py RAT with GitHub Gist C2, HIGH, novel TTP), 2026-10-h13t0ry-hello-demo (new, import-time reverse shell to 115.190.210.22, HIGH). The GENERIC-standard-pypi-install-pentest campaign from yesterdays zagents-framework / changes-lxc-wrapper is idle today. testmetest operator (yesterdays path-stream-utils-testmetest, 2026-10-26s event-bus-lite-testmetest Bun loader) is idle today. wiseke and s4yhii npm pentest operators are idle today. New operator: robdotty publishing the @flexmr/* dep-confusion mesh at 5 sentinel versions each - watch for wave 2 against other UK-based SaaS internal scopes. seydx maintainer compromise (@camera.ui/camera-ui-nvr-windows-amd64@1.6.1) is a new named maintainer-breach event worth tracking for recurrence; the clean 1.6.2 patched release and the OIDC trusted-publisher rotation show the maintainer has already remediated, but any machine that installed 1.6.1 during the 2026-10-25 → 2026-10-27 window remains candidate-compromised. Carve-outs LiteLLM 1.107.0, Tailwind Animate.css fake-interview, Apex Accelerator REF8801, TensorLake AI, hridoy FB credential stealer, anthropic-sdk PyPI typosquat, and the 2026-10-27 netweavex NetworkX typosquat all remain confirmed-recovered with no wave-2 malicious republish observed today
What to do

Clean-up steps

  1. For Cluster A (kam193 PyPI confirmed-payload trio - CONFIRMED PAYLOADS): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda env.yml, every internal PyPI mirror, every Dockerfile, every data-science / ML / graph-analysis / testing repo for the literal strings trajmetrics, numprint, and h13t0ry-hello-demo. On ANY hit on a host that imported or ran these: treat as fully compromised. For trajmetrics specifically: hunt for background Python processes with the filesystem-scan signature, hunt for the egress to 109-94-169-196.sslip.io or 109.94.169.196 on port 8443, and audit all files on disk for recent-read-and-exfil log entries during the exposure window. For numprint: hunt for background processes polling api.github.com/gists/3775fd9235aa6ef29e96eb96274a0e34 (the gist id is the sharp IOC - the gist content may change but the id is fixed in the payload bytes); block egress to api.github.com/gists/3775fd9235aa6ef29e96eb96274a0e34 on CI/build hosts, and alert on any outbound to a Gist id that is not on an operator-approved allowlist. For h13t0ry-hello-demo: block egress to 115.190.210.22 on every host, hunt for reverse-shell children of the Python process, and alert on any process whose parent is python -c "import h13t0ry_hello_demo". Hunt wheel/tarball hashes: trajmetrics SHA-256 3370d77977a536de8b2ea99267086960e8be3aea34a1efac6d975bb2bad98271, numprint SHA-256 ca6ff316077349c92e2d1e5d7c3683a16e6542b952d5c7fc8743efa5d4c80243, h13t0ry-hello-demo SHA-256 e27409f6c0ba5c7e7ba22f21c8b4806686ae8b64f4d7daf2dd9a7e6182bef5ab. Add trajmetrics, numprint, h13t0ry-hello-demo to the PyPI denylist; broaden to traj* + num*print* + h13t0ry* adjacent-guess entries for the next 7 days against repeat waves
  2. For Cluster B (@camera.ui/camera-ui-nvr-windows-amd64@1.6.1 trusted-publisher compromise): grep every package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, Dockerfile, and container image manifest for @camera.ui/camera-ui-nvr-windows-amd64@1.6.1 (the single compromised version - 1.6.2 and later are clean). On any hit on a Windows NVR deployment or home-security build: treat the host as candidate-compromised during the 2026-10-25 → 2026-10-27 window, rebuild from a clean 1.6.2+ release, rotate any credentials or secrets on that host. Audit @camera.ui/* scope for any other dependents in your tree; the maintainer seydx has rotated the trusted-publisher OIDC configuration (new id 80ad1a61-dcd0-4d61-b14b-78174d320d61) but the compromise window is proven. Add a watch: alert on any @camera.ui/* package published outside the maintainers declared release cadence. If you deploy an NVR Windows build in production, cross-check the artifact against github.com/cameraui/camera-ui-nvr release notes for 1.6.2s commit SHA before trusting it. Report the compromise to seydx directly via the project`s GitHub if you observed install-time behaviour from 1.6.1 so vendor can publish a formal advisory
  3. For Cluster C (csec/ccsec/ccsseecc 7-pack npm typosquat mesh): grep every npm manifest for exact matches of csec-form-validator, csec-form-validatorr, csec-crypto-toolkit, ccsec-form-validator, ccsec-crypto-toolkit, ccsseecc-form-validator, ccsseecc-crypto-toolkit. Also grep for the broader prefix patterns csec-*, ccsec-*, ccsseecc-* (the operators mesh pattern suggests more slugs under the same prefix) and the family-older sibling csec-form-helpers / @dany47/csec-crypto-utils from the 2026-07 ReversingLabs flag. On any hit: assume CWE-506 malicious intent even though the payload bytes are not captured (the mesh pattern + ReversingLabs precedent is strong enough evidence); remove the package, audit node_modules/<pkg>/ for any residual postinstall script or bundled binary, rebuild from a clean npm registry mirror. Add csec-, ccsec-, ccsseecc-*` to the npm denylist. Alert the developer who introduced the dependency (the "csec" cybersecurity-SDK lure name is the kind of slug a security-adjacent developer could reach for from an AI-assistant suggestion or a crypto-utility snippet)
  4. *For Cluster D (`@flexmr/ FlexMR dep-confusion probe by robdotty)**: grep every npm manifest for the @flexmr/ scope prefix. Any FlexMR engineer or FlexMR-integrator org (flexmr.net, UK market-research SaaS) should audit internal-registry resolution: confirm the internal @flexmr/ scope resolves to the internal registry before the public npm registry falls back, pin registry resolution with .npmrc / organisation always-auth. On any hit against todays versions (1.0.0, 1.0.12, 2.0.12, 3.0.12, 10.0.12): treat the install host as a probe-successful target (host fingerprint exfiltrated via DNS beacon at minimum, per the Vulert-captured sibling @flexmr/ui@99.99.99 TTP). Rotate any secrets on the install host. Add `@flexmr/ scope to the npm registry mirrors manual-approval list, and watch for the next operator slug (likely @flexmr/* with another sentinel version, or a sibling internal scope under the same robdotty publisher)
  5. *For Cluster E (`sc-/ccl-/paychex-pdftron` 99.9.1 dep-confusion batch): grep every npm manifest for sc-announcer@99.9.1, sc-hydrate-carousel-price@99.9.1, ccl-global-shopping@99.9.1, paychex-pdftron@99.9.1. Salesforce Commerce (SFCC) engineers and Paychex developers should audit internal-registry resolution for the `sc-, ccl-, and paychex- namespaces specifically; the 99.9.1 sentinel is a classic dep-confusion attempt against an internal pin. Any CI runner that installed any of these needs its npm resolution path audited and - as a precaution - its host fingerprint treated as exfiltrated. Add sc-announcer, sc-hydrate-carousel-price, ccl-global-shopping, paychex-pdftron to the npm denylist. Broaden the registry-resolver denylist to any 99.9. sentinel versions of the sc-, ccl-, paychex-` namespaces
  6. For Cluster F (npm "verbose-utility" lure batch - fetch-hash-cache-atomic, string-target-mapper-hash, macro-kernel-record-reader): grep every npm manifest for the exact slugs. These names read as plausible npm utility names that could appear in an AI-assistant code suggestion or a developers snippet copy-paste; alert the developer who introduced the dependency so the slug is retired from internal docs / AI-assistant prompts. On any hit: remove the package, audit node_modules/<pkg>/` for postinstall scripts and bundled binaries, rebuild from a clean mirror. Add these exact slugs to the npm denylist
  7. For Cluster G (single enterprise brand dep-confusion probes - @tableau__catalog-messages/database_lower, adyen-web-v6, @azure-growth/signup-ux-components): grep every npm manifest for the exact slugs. Tableau / Salesforce internal engineers should audit the double-underscore @tableau__catalog-messages scope and any internal @tableau/* resolution path (the double-underscore is unusual and may indicate a scanner-evasion attempt). Adyen integrators should audit any pin on adyen-web-prefixed packages: the legitimate scope is @adyen/*, so any un-scoped adyen-* or adyen-web-* pin is a candidate dep-confusion target. For @azure-growth/*: this is NOT a legitimate Microsoft scope - audit any CI runners .npmrc and registry resolver config for a stray @azure-growth/ pin that could resolve to the public registry. On any hit: remove, audit, rebuild. Add @tableau__, adyen-web-v6, @azure-growth/*` to the npm denylist
  8. For Cluster H (dsh-vm-tester + agentenact): grep every npm manifest for dsh-vm-tester (any version 0.1.0 → 0.1.7) and agentenact@0.2.0. For dsh-vm-tester: DeepSeek-ecosystem developers (anyone using DeepSeek-Harness or DeepSeek-related VirtualBox testing scaffolding) should audit for the specific yugejixian-published tarball; on hit, assume CWE-506 malicious intent, remove, rebuild. For agentenact: the prior 0.0.1 and 0.1.1 are clean legitimate releases by Kerem Noras / knrs; the 0.2.0 single-bump pattern is maintainer-compromise-shaped. Keep 0.0.1 / 0.1.1 but add 0.2.0 to the npm denylist; alert the maintainer knrs via GitHub to confirm whether 0.2.0 was authorised. Add watches for 0.2.1+ wave-2 publishes under the same identity
  9. For Cluster I (CWE-506 boilerplate long tail - glyphmatrix-fixture, 6161test1234, buttoncontent): grep every npm manifest for exact matches. glyphmatrix-fixture@1.0.0, 1.0.1 is the only one freshly published (2026-10-28, today) and may still be live on npm at the time of your audit - if your CI runner installed it today, assume CWE-506 malicious intent. The other two are aged April 2026 publishes that caught the GHSA takedown attention this week; they are low-exposure. Remove, audit, rebuild. Add exact slugs to the npm denylist
  10. Standing egress-denylist carry-forward from prior sweeps (keep in place; todays new-sharp IOCs are below): continue to block networkservicesupp.flashhub.net:8443 (2026-10-22 + 2026-10-26 @sudobility XMRig cross-wave Monero pool), api.github.com/repos/jerryjohnston91/ + codeload.github.com/jerryjohnston91/ (2026-10-27 Cluster C netweavex import-time RCE source), c2-worker.crawlnet-claim.workers.dev apex + /dl/pyupd path, 34.143.131.27:18080 + /x-VA-1/main.js path, webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/, 75.119.137.232:31337 + /depconfuse path, transfer.archivete.am apex + /H2Uxm/fabdeploycheck-config.json path, realwbx.com apex + /ip.php + /ip paths, artifacts.creditslib.com apex + /npm/ paths, login.fromthehotel.com apex, googleforum.pythonanywhere.com, space-z.ai apex, dxpoc.gt.tc apex, raw.githubusercontent.com/anonrider404/pypl/, api-bsx.pages.dev + /download, 177.7.60.239:48080 + oob.recon.dev, uncoder.eu.org + /cc-checker/api.php, accenture-npm.azurewebsites.net, limbomail.com, collector.oob.s4yhii.com + .oob.s4yhii.com + s4yhii.com, 64.181.165.115/dc, 167.88.172.33:8087 + jsonspack.com, goxtools.shop, minhdong.site, 45.138.12.177:8089, 185.158.107.175:8787, ltidi.storage.googleapis.com/depenconf/, oob.s4yhii.com:9999/native, .oast.pro/.oast.me/.oast.fun/.oast.site/.oastify.com, frjmzbjbhwvtdnsuodmu.supabase.co, api.npoint.io, tele.metry.orgin.net, morroncr0w.io, api.telegram.org on untrusted CI/build hosts, appsecc.com, generic webhook.site/ paths other than legitimate dev webhooks, nfjbill.ren, storage.googleapis.com/depenconf/, 10.0.19.0/24 + 10.0.49.0/24, api.nm-streetwear.space, Discord webhook URL patterns, ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, chinazhangsan.ccwu.cc, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil patterns, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com, 45.138.0.0/16 RubyGems wgkit CIDRs, apexaccs.org apex + subdomains, arenapex.cloud, apexfdn.xyz apex + subdomains, fdn4apex.com, router-apex.com apex + subdomains, ccmihr.com, 0auth-chromium.com, ehegisnightmare.icu, cloudmain365duo.top, www.litellm.dev/healthcheck, raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt, known SSH relay services srv.us, .devtunnels.ms, .devtunnels.visualstudio.com on build/CI networks, .ngrok-free.dev/canary. **New-sharp today for Cluster A**: 109.94.169.196:8443 + .sslip.io:8443 paths (the sslip.io wildcard DNS service is being abused by Cluster A trajmetrics for a DNS-encoded exfil endpoint - block the specific IP but also alert on any .sslip.io resolution from a CI/build host since the operator can rotate the IP within the same wildcard service); api.github.com/gists/3775fd9235aa6ef29e96eb96274a0e34 (specific Gist id for Cluster A numprint C2 - the Gist content can rotate but the id is fixed in the payload bytes); 115.190.210.22 (Cluster A h13t0ry-hello-demo reverse-shell target). **New operator identities to watch**: npm robdotty (Cluster D @flexmr/* dep-confusion), npm yugejixian (Cluster H dsh-vm-tester DeepSeek lure), kam193 upstream github.com/hehesama527/data-analising (Cluster A trajmetrics`)
References

Sources

multi-2026-10-28-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents