# GitHub Advisory malware sweep, 28 October 2026

> GHSA late 2026-10-27 batch plus first 2026-10-28 advisories. Three CONFIRMED kam193 PyPI payloads: `trajmetrics` file-exfiltration infostealer (MAL-2026-18354, today), `numprint` setup.py RAT via GitHub Gist C2 (MAL-2026-18343), `h13t0ry-hello-demo` import-time reverse shell to 115.190.210.22 (MAL-2026-18336). Plus a confirmed trusted-publisher compromise of the legitimate `@camera.ui/camera-ui-nvr-windows-amd64` 1.6.1 release, a `csec/ccsec/ccsseecc` 7-pack npm typosquat mesh, `@flexmr/*` dep-confusion by `robdotty`, and `sc-*`/`ccl-*`/`paychex-pdftron` dep-confusion batch.

- Published: 2026-10-28
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 29 packages, 57 compromised versions
- Tags: typosquat, dependency-confusion, infostealer, maintainer-takeover, ci-cd-compromise, credential-theft, obfuscation
- Also known as: GHSA 2026-10-27 late batch + 2026-10-28 first wave, 2026-10-trajmetrics, 2026-10-numprint, 2026-10-h13t0ry-hello-demo, csec-form-validator mesh wave 2, FlexMR @flexmr dep-confusion
- Detected by: GitHub Advisory Database, OpenSSF Package Analysis, kam193, Vulert, ReversingLabs
- Incident ID: multi-2026-10-28-ghsa-malware-sweep

## Affected packages (29)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@azure-growth/signup-ux-components](https://dependencywatch.io/package/npm/@azure-growth/signup-ux-components) | npm | 1.2.2, 1.2.3 |
| [@camera.ui/camera-ui-nvr-windows-amd64](https://dependencywatch.io/package/npm/@camera.ui/camera-ui-nvr-windows-amd64) | npm | 1.6.1 |
| [@flexmr/survey-client](https://dependencywatch.io/package/npm/@flexmr/survey-client) | npm | 1.0.0, 1.0.12, 2.0.12, 3.0.12, 10.0.12 |
| [@flexmr/survey-conversation](https://dependencywatch.io/package/npm/@flexmr/survey-conversation) | npm | 1.0.0, 1.0.12, 2.0.12, 3.0.12, 10.0.12 |
| [@flexmr/utils](https://dependencywatch.io/package/npm/@flexmr/utils) | npm | 1.0.0, 1.0.12, 2.0.12, 3.0.12, 10.0.12 |
| [@tableau__catalog-messages/database_lower](https://dependencywatch.io/package/npm/@tableau__catalog-messages/database_lower) | npm | 99.9.9, 99.9.91 |
| [6161test1234](https://dependencywatch.io/package/npm/6161test1234) | npm | 1.0.0, 1.0.2 |
| [adyen-web-v6](https://dependencywatch.io/package/npm/adyen-web-v6) | npm | 99.1.0 |
| [agentenact](https://dependencywatch.io/package/npm/agentenact) | npm | 0.2.0 |
| [buttoncontent](https://dependencywatch.io/package/npm/buttoncontent) | npm | 99.0.0, 99.0.1, 99.0.2 |
| [ccl-global-shopping](https://dependencywatch.io/package/npm/ccl-global-shopping) | npm | 99.9.1 |
| [ccsec-crypto-toolkit](https://dependencywatch.io/package/npm/ccsec-crypto-toolkit) | npm | 4.5.1 |
| [ccsec-form-validator](https://dependencywatch.io/package/npm/ccsec-form-validator) | npm | 3.0.0 |
| [ccsseecc-crypto-toolkit](https://dependencywatch.io/package/npm/ccsseecc-crypto-toolkit) | npm | 4.5.1 |
| [ccsseecc-form-validator](https://dependencywatch.io/package/npm/ccsseecc-form-validator) | npm | 3.0.0 |
| [csec-crypto-toolkit](https://dependencywatch.io/package/npm/csec-crypto-toolkit) | npm | 4.2.1, 4.2.2, 4.2.4 |
| [csec-form-validator](https://dependencywatch.io/package/npm/csec-form-validator) | npm | 1.0.0, 1.0.1 |
| [csec-form-validatorr](https://dependencywatch.io/package/npm/csec-form-validatorr) | npm | 1.0.2 |
| [dsh-vm-tester](https://dependencywatch.io/package/npm/dsh-vm-tester) | npm | 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7 |
| [fetch-hash-cache-atomic](https://dependencywatch.io/package/npm/fetch-hash-cache-atomic) | npm | 1.0.0 |
| [glyphmatrix-fixture](https://dependencywatch.io/package/npm/glyphmatrix-fixture) | npm | 1.0.0, 1.0.1 |
| [h13t0ry-hello-demo](https://dependencywatch.io/package/pypi/h13t0ry-hello-demo) | PyPI | 0.1.0 |
| [macro-kernel-record-reader](https://dependencywatch.io/package/npm/macro-kernel-record-reader) | npm | 1.0.0 |
| [numprint](https://dependencywatch.io/package/pypi/numprint) | PyPI | 1.2.0 |
| [paychex-pdftron](https://dependencywatch.io/package/npm/paychex-pdftron) | npm | 99.9.1 |
| [sc-announcer](https://dependencywatch.io/package/npm/sc-announcer) | npm | 99.9.1 |
| [sc-hydrate-carousel-price](https://dependencywatch.io/package/npm/sc-hydrate-carousel-price) | npm | 99.9.1 |
| [string-target-mapper-hash](https://dependencywatch.io/package/npm/string-target-mapper-hash) | npm | 1.0.0 |
| [trajmetrics](https://dependencywatch.io/package/pypi/trajmetrics) | PyPI | 0.5.3 |

## What happened

Between 2026-10-27 06:00 UTC (yesterday`s sweep cut-off) and 2026-10-28 06:00 UTC (today`s ingest-window start), the GitHub Advisory Database published ~30 fresh malware advisories across npm and PyPI, dominated by a dated-batch takedown pass that cleared out April-published dep-confusion probes alongside freshly-flagged kam193 PyPI payloads. The headline items are three CONFIRMED kam193 PyPI payloads carrying real malicious code (not boilerplate), a confirmed single-version compromise of a legitimate npm Windows NVR package via a trusted-publisher OIDC breach, a `csec/ccsec/ccsseecc` 7-pack coordinated typosquat mesh, a dep-confusion scope-probe against the UK market-research SaaS FlexMR by a new operator `robdotty`, and a coordinated 99.9.1 sentinel-version dep-confusion batch targeting Salesforce Commerce and Paychex internal namespaces.

## Headlines

**Three CONFIRMED kam193 PyPI payloads** (Cluster A): `trajmetrics@0.5.3` (MAL-2026-18354, published 2026-10-28) is a filesystem-wide infostealer that scans the whole disk and exfiltrates files by type as they change, to `109.94.169.196:8443` via the `*.sslip.io` wildcard DNS service. `numprint@1.2.0` (MAL-2026-18343) is a RAT that overrides setup.py install, then polls `api.github.com/gists/3775fd9235aa6ef29e96eb96274a0e34` for attacker commands and executes them in a background process - notable because the GitHub-Gist-as-C2 technique extends yesterday`s `netweavex` GitHub-repo-as-C2 pattern (the operator is iterating different GitHub surfaces for free, resilient C2 that evades conventional egress blocks against commercial PaaS). `h13t0ry-hello-demo@0.1.0` (MAL-2026-18336) opens a reverse shell on import to `115.190.210.22`. All three are MALICIOUS category per kam193 / OpenSSF; all three have captured SHA-256 artefact hashes for hunting.

**`@camera.ui/camera-ui-nvr-windows-amd64@1.6.1` trusted-publisher compromise** (Cluster B): the legitimate `github.com/cameraui/camera-ui-nvr` project (home-security NVR Windows build maintained by `seydx`) had its 1.6.1 release pushed malicious then quickly unpublished on 2026-10-25. The clean 1.6.2 released 2026-10-27 shows the maintainer rotated the trusted-publisher OIDC configuration id from the prior `dc943c58-...` to a new `80ad1a61-dcd0-4d61-b14b-78174d320d61`, confirming the compromise mechanism was an OIDC token breach rather than account-password theft. Payload bytes were not captured in registry metadata because 1.6.1 was unpublished within hours, but any Windows NVR install during the ~48-hour exposure window is candidate-compromised.

**`csec/ccsec/ccsseecc` 7-pack npm typosquat mesh** (Cluster C): seven npm packages across three "csec"-family prefixes (`csec-*`, `ccsec-*`, `ccsseecc-*`), each with form-validator and crypto-toolkit variants, each with its own internal typo of its own typosquat (`csec-form-validatorr` with double-r). All seven were originally April-published and batch-taken-down 2026-10-27 23:03-23:09 UTC. The mesh pattern plus the family continuation of the 2026-07 `csec-form-helpers` / `@dany47/csec-crypto-utils` cluster that ReversingLabs previously flagged (MAL-2026-7063 / MAL-2026-7249) confirms coordinated malicious intent even though today`s GHSA advisory text is CWE-506 boilerplate without captured payload bytes.

**`@flexmr/*` FlexMR dep-confusion probe** (Cluster D): three npm scope packages (`@flexmr/utils`, `@flexmr/survey-conversation`, `@flexmr/survey-client`), each at `1.0.0`, `1.0.12`, `2.0.12`, `3.0.12`, `10.0.12` (five sentinel-version-mesh entries per package = 15 total malicious artefacts), all published by npm identity `robdotty` on 2026-10-14 and all taken down 2026-10-27. The sentinel-version-mesh pattern is a classic dep-confusion range-bump, and a sibling `@flexmr/ui@99.99.99` was previously flagged by Vulert as running a `beacon.js` preinstall-hook performing DNS lookup + remote-IP exfil of host fingerprint - so the same TTP is the working assumption for the three packages taken down today. FlexMR is a legitimate UK-based market-research SaaS at `flexmr.net`; this is a confirmed dep-confusion probe against their internal `@flexmr/*` scope.

**`sc-*`/`ccl-*`/`paychex-pdftron` 99.9.1 sentinel-version dep-confusion batch** (Cluster E): four npm packages all at 99.9.1, all co-published in a 5-minute window on 2026-10-20 03:33-03:38 UTC, all batch-taken-down 2026-10-27 15:11-15:13 UTC. The `sc-*` prefix most plausibly corresponds to Salesforce Commerce (SFCC) internal "storefront commerce" naming; `ccl-global-shopping` matches a Salesforce Commerce internal shopping-cart naming convention; `paychex-pdftron` matches Paychex internal naming for a PDFTron SDK wrapper. The 99.9.1 sentinel is a classic internal-registry-pin dep-confusion probe.

**Novel operator identities to watch**: `robdotty` (`@flexmr/*` dep-confusion, 15 artefacts in one batch) and `yugejixian` (`dsh-vm-tester` DeepSeek-Harness lure, 8 iterative versions over a short window) both appeared this week and warrant tracking for wave-2 slugs.

## Classification

`sweep`. Severity `high` (upgraded from the sweep baseline `medium`) because Clusters A and B both carry confirmed malicious payloads: Cluster A`s three kam193 PyPI items (filesystem-wide infostealer, GitHub-Gist RAT, import-time reverse shell) each have captured artefact SHA-256 hashes and MAL IDs; Cluster B is a confirmed single-version compromise of a legitimate project. The rest (Clusters C-I) are `medium` - CWE-506 boilerplate, dep-confusion probes, or pentest / lure artefacts. No cluster reaches `critical` - Cluster A`s payloads have limited reach (nothing legitimate depends on `trajmetrics`, `numprint`, or `h13t0ry-hello-demo`), Cluster B is already remediated by the maintainer`s 1.6.2 clean release, and none of the compromised names are already-depended-on at the scale that would make them critical. Anything that would itself be `critical` (hijack of an already-widely-depended-on name, an active self-propagating worm against legitimate packages, a maintainer takeover with downstream reach at the scale of TanStack / `@uipath/*` / `axios`) would get its own named incident file; none of today`s advisories meet that bar.

## Discovery

`GitHub Advisory Database`, `OpenSSF malicious-packages` (Clusters A specifically MAL-2026-18354, 18343, 18336 plus Cluster G MAL-2026-18338), `kam193 bad-packages` (campaign tags `2026-10-trajmetrics`, `2026-10-numprint`, `2026-10-h13t0ry-hello-demo`), `Vulert` (Cluster D sibling `@flexmr/ui@99.99.99` beacon.js TTP), `ReversingLabs` (Cluster C family precedent MAL-2026-7063 / MAL-2026-7249 for `csec-form-helpers` / `@dany47/csec-crypto-utils`).

## Impact

- **Cluster A - kam193 PyPI confirmed-payload trio (malicious-package; 3 packages, 2026-10-27 and 2026-10-28, OSSF MALICIOUS category, kam193 campaigns)**: `trajmetrics@0.5.3` (GHSA-rm9p-x4m7-hxmp, OSSF MAL-2026-18354, kam193 campaign `2026-10-trajmetrics`, published 2026-10-28, SHA-256 `3370d77977a536de8b2ea99267086960e8be3aea34a1efac6d975bb2bad98271`) is a FILESYSTEM-WIDE INFOSTEALER: when `trajmetrics` runs as a module (`python -m trajmetrics` or the README-recommended entry point), it starts a background job that scans the whole filesystem and exfiltrates selected files by type as they change, to `109-94-169-196.sslip.io:8443` (resolves to `109.94.169.196:8443`); the kam193 upstream GitHub source is `github.com/hehesama527/data-analising`. `numprint@1.2.0` (GHSA-g9fj-q87h-6h4c, OSSF MAL-2026-18343, kam193 campaign `2026-10-numprint`, published 2026-10-27, SHA-256 `ca6ff316077349c92e2d1e5d7c3683a16e6542b952d5c7fc8743efa5d4c80243`) overrides the setup.py install command and spawns a background RAT that pulls commands from a GitHub Gist at `api.github.com/gists/3775fd9235aa6ef29e96eb96274a0e34` and runs them (notable: Gist-as-C2 extends yesterday`s `netweavex` GitHub-repo-as-C2 pattern - the operator is iterating different GitHub surfaces for C2). `h13t0ry-hello-demo@0.1.0` (GHSA-5crq-52j9-fc74, OSSF MAL-2026-18336, kam193 campaign `2026-10-h13t0ry-hello-demo`, published 2026-10-27, SHA-256 `e27409f6c0ba5c7e7ba22f21c8b4806686ae8b64f4d7daf2dd9a7e6182bef5ab`) opens a reverse shell on import to the hardcoded IP `115.190.210.22`. **Severity `high`** for the cluster (three confirmed malicious payloads each with limited reach - nothing legitimate depends on these PyPI names, but any host that ran them is fully compromised, and the Gist-C2 technique in `numprint` is a new TTP worth hunting for across other recently-published PyPI packages)
- **Cluster B - `@camera.ui/camera-ui-nvr-windows-amd64` trusted-publisher compromise (compromise; 1 package, 2026-10-25 publish/unpublish, 2026-10-27 patched release)**: `@camera.ui/camera-ui-nvr-windows-amd64@1.6.1` (GHSA-2w7v-jwxh-w7wc). The legitimate project is `github.com/cameraui/camera-ui-nvr`, a home-security NVR Windows build maintained by `seydx`. 1.6.1 was published on 2026-10-25 then immediately unpublished; the trusted-publisher OIDC configuration id for the package was rotated from the prior `dc943c58-...` to `80ad1a61-dcd0-4d61-b14b-78174d320d61` beginning with the clean 1.6.2 published 2026-10-27 - strong evidence of a maintainer breach via trusted-publisher OIDC token compromise followed by a credential reset. GHSA`s advisory text is CWE-506 boilerplate (payload bytes were not captured in registry metadata because 1.6.1 was unpublished within hours), but the trusted-publishing rotation and the single-version-only infected release pattern match the TensorLake AI maintainer-compromise shape from [2026-10-08](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise). **Severity `high`** for this cluster (confirmed single-version compromise of a legitimate package with downstream reach via Windows NVR deployments, mitigated quickly by maintainer`s rotation but any machine that installed 1.6.1 during the ~48-hour window is candidate-compromised)
- **Cluster C - npm `csec/ccsec/ccsseecc` typosquat mesh (typosquat; 7 packages, originally April 2026 publishes, batch-taken-down 2026-10-27 23:03-23:09 UTC)**: `csec-form-validator@1.0.0, 1.0.1` (GHSA-wh86-6qm8-xgw2), `csec-form-validatorr@1.0.2` (GHSA-ph3g-jrf5-8792, note the double-`r` typo-of-the-typosquat), `csec-crypto-toolkit@4.2.1, 4.2.2, 4.2.4` (GHSA-v383-2358-576w), `ccsec-form-validator@3.0.0` (GHSA-r889-j2qv-2jv6), `ccsec-crypto-toolkit@4.5.1` (GHSA-2732-c6cp-rx5v), `ccsseecc-form-validator@3.0.0` (GHSA-h5wr-j55v-8m79), `ccsseecc-crypto-toolkit@4.5.1` (GHSA-v9xw-mxj4-fm5q). GHSA advisory text is CWE-506 boilerplate (full-control claim, no captured payload bytes - package tarballs are now npm-security-held). The mesh pattern (`c` + `?sec` prefix × `form-validator`/`crypto-toolkit` suffix, with internal typosquats of its own typosquats) is a coordinated operator pattern, and the family continues the 2026-07 `csec-form-helpers`/`@dany47/csec-crypto-utils` cluster that ReversingLabs flagged (MAL-2026-7063/7249). **Severity `medium`** for the cluster (CWE-506-only on today`s advisories but the mesh-of-mesh naming + ReversingLabs 7-month precedent confirm malicious intent; the "csec" lure name reads as a cybersecurity-SDK impersonation that a security-adjacent developer could reach for from a snippet)
- **Cluster D - npm `@flexmr/*` FlexMR dep-confusion probe (dependency-confusion; 3 packages × 5 sentinel versions each, 2026-10-14 publish by `robdotty`, 2026-10-27 15:49-15:50 UTC takedown)**: `@flexmr/utils`, `@flexmr/survey-conversation`, `@flexmr/survey-client` - each at `1.0.0, 1.0.12, 2.0.12, 3.0.12, 10.0.12` (GHSA-hpc9-fxqh-hhf8, GHSA-hc8w-gq4q-fr74, GHSA-rh7q-f888-q36c). Published by npm identity `robdotty` (contact `robdotty30@gmail.com`). The sentinel-version mesh is a classic dep-confusion range-bump pattern (publish at every plausible internal-registry pinned version so whichever one the target org pins to, the public resolver wins). Vulert previously flagged a sibling `@flexmr/ui@99.99.99` running a `beacon.js` preinstall / install / postinstall hook performing DNS lookup + remote-IP exfil of host fingerprint - today`s three packages share the operator, so same `beacon.js` + fingerprint-exfil TTP is the working assumption even though today`s GHSA advisories are CWE-506 boilerplate. FlexMR is a legitimate UK-based market-research SaaS company (`flexmr.net`), so this is a confirmed dep-confusion probe against their internal `@flexmr/*` scope. **Severity `medium`** (confirmed dep-confusion beacon-only on sibling package, no post-exfil payload captured; any FlexMR engineer or FlexMR-integrator who ran `npm install` during the exposure window probably leaked host fingerprint via DNS)
- **Cluster E - npm `sc-*`/`ccl-*`/`paychex-pdftron` coordinated 99.9.1 dep-confusion batch (dependency-confusion; 4 packages, all at `99.9.1`, all published 2026-10-20 03:33-03:38 UTC, batch-taken-down 2026-10-27 15:11-15:13 UTC)**: `sc-announcer@99.9.1` (GHSA-fxw2-4j5q-6hwg), `sc-hydrate-carousel-price@99.9.1` (GHSA-9gcx-88qx-rxch), `ccl-global-shopping@99.9.1` (GHSA-hh3m-f424-g8v5), `paychex-pdftron@99.9.1` (GHSA-9mgv-25w8-jwhf). The `sc-*` prefix most plausibly corresponds to Salesforce Commerce (SFCC - internal naming `sc-*` for Storefront Commerce components), `ccl-global-shopping` matches a Salesforce Commerce internal shopping-cart naming convention, and `paychex-pdftron` matches a Paychex (US payroll SaaS) internal naming for a PDFTron SDK wrapper. The 99.9.1 sentinel across all four and the 5-minute publish window confirms a single operator probing multiple adjacent enterprise targets in one batch. GHSA advisories are CWE-506 boilerplate - no payload captured. **Severity `medium`** (dep-confusion probe batch with no post-fingerprint payload captured; any Salesforce-Commerce / Paychex engineer who pinned any of these internal names needs to audit the public-registry resolution path)
- **Cluster F - npm "verbose-utility" lure batch (malicious-package; 3 packages × 1 version each, all 1.0.0, all published 2026-10-13 20:40-20:44 UTC, all taken down 2026-10-27 15:48-15:51 UTC)**: `fetch-hash-cache-atomic@1.0.0` (GHSA-w9mp-cvjp-jfqp), `string-target-mapper-hash@1.0.0` (GHSA-wfcx-722r-fg5h), `macro-kernel-record-reader@1.0.0` (GHSA-32g3-f74c-pcxq). Same operator (co-publish within 4 minutes, same naming pattern of multi-word utility slugs that could plausibly appear in an AI-assistant code suggestion), same takedown window. GHSA advisories are CWE-506 boilerplate - no payload captured. **Severity `medium`** (lure-name batch targeting AI-assistant code suggestions or developer snippet copy-paste; the slugs read as plausible utility names a developer could reach for without critical review)
- **Cluster G - single enterprise brand dep-confusion probes (dependency-confusion; 3 packages, mixed publish dates, all taken down 2026-10-27)**: `@tableau__catalog-messages/database_lower@99.9.9, 99.9.91` (GHSA-wmfr-2pvv-wmf3, published 2026-04-09, 6-month-old probe, note the unusual double-underscore `__` in the scope); `adyen-web-v6@99.1.0` (GHSA-r77r-rw3m-rjh5, published 2026-04-27, Adyen payments SDK impersonation); `@azure-growth/signup-ux-components@1.2.2, 1.2.3` (GHSA-m8mp-r4jx-43fw, OSSF MAL-2026-18338 - note `@azure-growth` is NOT a legitimate Microsoft Azure scope, this reads as an impersonation of the real `@azure/*` scope with a "growth-team" variant). GHSA advisories are CWE-506 boilerplate; the long publish-to-takedown lags (6 months for Tableau, 6 months for Adyen) suggest sleeper dep-confusion probes that finally caught GHSA`s automated takedown attention. **Severity `medium`** (dep-confusion / typosquat probes with no captured payload; Tableau/Salesforce engineers, Adyen integrators, and anyone using `@azure/*` scoped SDKs should audit internal-registry resolution)
- **Cluster H - npm `dsh-vm-tester` and `agentenact` singleton CWE-506 takedowns (malicious-package / compromise; 2 packages, mixed publishers)**: `dsh-vm-tester@0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7` (GHSA-84fw-gj66-p5v3) published by npm identity `yugejixian` (contact `979080113@qq.com`) with a description claiming "DeepSeek Harness VirtualBox GUI testing" - **not** related to the 2026-10-26 `@sudobility/dsh-plugin-blender-3d` + `walknpm/@walknpm` XMRig operator despite the `dsh-` prefix (different publisher, different payload shape, different version shape); the operator appears to be luring the DeepSeek-ecosystem developer audience with a plausibly-named helper. `agentenact@0.2.0` (GHSA-7p7m-8jmq-qp93) published by `knrs` / Kerem Noras (`kerem@noras.tech`) on 2026-10-27 20:17 UTC and taken down the same day - the 0.0.1 and 0.1.1 prior versions are clean, so the 0.2.0 single-bump pattern matches the TensorLake AI maintainer-compromise shape from [2026-10-08](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise); kind `compromise` is the working assumption even though no vendor confirmation has been published and no downstream dependents are known. **Severity `medium`** per package (CWE-506 boilerplate without captured payload at advisory time; `agentenact` warrants watch for a wave-2 malicious republish and for the maintainer to publicly comment)
- **Cluster I - npm CWE-506 boilerplate long tail (malicious-package; 3 packages, 2026-10-27 and 2026-10-28 advisories)**: `glyphmatrix-fixture@1.0.0, 1.0.1` (GHSA-vc33-3x34-x6jm, published 2026-10-28 00:16-00:54 UTC by `manbearpig.mb`/`jeanmichelremiboudreau@gmail.com` - the first live-today listing on the GHSA feed, caught before npm security-hold), `6161test1234@1.0.0, 1.0.2` (GHSA-r9qx-xcg2-7wcc, test-slug boilerplate from 2026-04-21 batch-taken-down 2026-10-27), `buttoncontent@99.0.0, 99.0.1, 99.0.2` (GHSA-6crh-vwr2-4qfp, 99.x sentinel from 2026-04-07, another dep-confusion probe that aged out before takedown). **Severity `medium`** per package (CWE-506 only, no captured payload at advisory time; `glyphmatrix-fixture` is the only one still freshly-published rather than aged)
- **Operator continuity**: **`@sudobility` XMRig cluster is idle today** - no new `walknpm`-published, `@sudobility`-published or `dsh-plugin-*` slugs match the 2026-10-22 → 2026-10-26 wave 1+2 payload shape. `networkservicesupp.flashhub.net:8443` egress block from yesterday`s sweep stays sharp. **kam193 cadence** - continues strongly with 3 CONFIRMED-MALICIOUS payloads today: `2026-10-trajmetrics` (new, filesystem-wide infostealer, HIGH), `2026-10-numprint` (new, setup.py RAT with GitHub Gist C2, HIGH, novel TTP), `2026-10-h13t0ry-hello-demo` (new, import-time reverse shell to 115.190.210.22, HIGH). The `GENERIC-standard-pypi-install-pentest` campaign from yesterday`s `zagents-framework` / `changes-lxc-wrapper` is idle today. **`testmetest` operator** (yesterday`s `path-stream-utils-testmetest`, 2026-10-26`s `event-bus-lite-testmetest` Bun loader) is idle today. **`wiseke` and `s4yhii` npm pentest operators** are idle today. **New operator**: `robdotty` publishing the `@flexmr/*` dep-confusion mesh at 5 sentinel versions each - watch for wave 2 against other UK-based SaaS internal scopes. **`seydx` maintainer compromise** (`@camera.ui/camera-ui-nvr-windows-amd64@1.6.1`) is a new named maintainer-breach event worth tracking for recurrence; the clean 1.6.2 patched release and the OIDC trusted-publisher rotation show the maintainer has already remediated, but any machine that installed 1.6.1 during the 2026-10-25 → 2026-10-27 window remains candidate-compromised. Carve-outs [LiteLLM 1.107.0](https://dependencywatch.io/incident/pypi-2026-10-21-litellm-infostealer-rat), [Tailwind Animate.css fake-interview](https://dependencywatch.io/incident/npm-2026-10-20-tailwind-animatecss-fake-interview-campaign), [Apex Accelerator REF8801](https://dependencywatch.io/incident/npm-2026-10-19-apex-accelerator-malicious-npm-packages), [TensorLake AI](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise), [hridoy FB credential stealer](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer), [anthropic-sdk PyPI typosquat](https://dependencywatch.io/incident/pypi-2026-10-05-anthropic-sdk-typosquat), and the [2026-10-27 netweavex NetworkX typosquat](https://dependencywatch.io/incident/multi-2026-10-27-ghsa-malware-sweep) all remain confirmed-recovered with no wave-2 malicious republish observed today

## What to do

1. **For Cluster A (kam193 PyPI confirmed-payload trio - CONFIRMED PAYLOADS)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, `conda env.yml`, every internal PyPI mirror, every `Dockerfile`, every data-science / ML / graph-analysis / testing repo for the literal strings `trajmetrics`, `numprint`, and `h13t0ry-hello-demo`. On ANY hit on a host that imported or ran these: treat as fully compromised. For `trajmetrics` specifically: hunt for background Python processes with the filesystem-scan signature, hunt for the egress to `109-94-169-196.sslip.io` or `109.94.169.196` on port 8443, and audit all files on disk for `recent-read-and-exfil` log entries during the exposure window. For `numprint`: hunt for background processes polling `api.github.com/gists/3775fd9235aa6ef29e96eb96274a0e34` (the gist id is the sharp IOC - the gist content may change but the id is fixed in the payload bytes); block egress to `api.github.com/gists/3775fd9235aa6ef29e96eb96274a0e34` on CI/build hosts, and alert on any outbound to a Gist id that is not on an operator-approved allowlist. For `h13t0ry-hello-demo`: block egress to `115.190.210.22` on every host, hunt for reverse-shell children of the Python process, and alert on any process whose parent is `python -c "import h13t0ry_hello_demo"`. Hunt wheel/tarball hashes: `trajmetrics` SHA-256 `3370d77977a536de8b2ea99267086960e8be3aea34a1efac6d975bb2bad98271`, `numprint` SHA-256 `ca6ff316077349c92e2d1e5d7c3683a16e6542b952d5c7fc8743efa5d4c80243`, `h13t0ry-hello-demo` SHA-256 `e27409f6c0ba5c7e7ba22f21c8b4806686ae8b64f4d7daf2dd9a7e6182bef5ab`. Add `trajmetrics`, `numprint`, `h13t0ry-hello-demo` to the PyPI denylist; broaden to `traj*` + `num*print*` + `h13t0ry*` adjacent-guess entries for the next 7 days against repeat waves
2. **For Cluster B (`@camera.ui/camera-ui-nvr-windows-amd64@1.6.1` trusted-publisher compromise)**: grep every `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, Dockerfile, and container image manifest for `@camera.ui/camera-ui-nvr-windows-amd64@1.6.1` (the single compromised version - 1.6.2 and later are clean). On any hit on a Windows NVR deployment or home-security build: treat the host as candidate-compromised during the 2026-10-25 → 2026-10-27 window, rebuild from a clean 1.6.2+ release, rotate any credentials or secrets on that host. Audit `@camera.ui/*` scope for any other dependents in your tree; the maintainer `seydx` has rotated the trusted-publisher OIDC configuration (new id `80ad1a61-dcd0-4d61-b14b-78174d320d61`) but the compromise window is proven. **Add a watch**: alert on any `@camera.ui/*` package published outside the maintainer`s declared release cadence. If you deploy an NVR Windows build in production, cross-check the artifact against `github.com/cameraui/camera-ui-nvr` release notes for 1.6.2`s commit SHA before trusting it. Report the compromise to `seydx` directly via the project`s GitHub if you observed install-time behaviour from 1.6.1 so vendor can publish a formal advisory
3. **For Cluster C (`csec/ccsec/ccsseecc` 7-pack npm typosquat mesh)**: grep every npm manifest for exact matches of `csec-form-validator`, `csec-form-validatorr`, `csec-crypto-toolkit`, `ccsec-form-validator`, `ccsec-crypto-toolkit`, `ccsseecc-form-validator`, `ccsseecc-crypto-toolkit`. Also grep for the broader prefix patterns `csec-*`, `ccsec-*`, `ccsseecc-*` (the operator`s mesh pattern suggests more slugs under the same prefix) and the family-older sibling `csec-form-helpers` / `@dany47/csec-crypto-utils` from the 2026-07 ReversingLabs flag. On any hit: assume CWE-506 malicious intent even though the payload bytes are not captured (the mesh pattern + ReversingLabs precedent is strong enough evidence); remove the package, audit `node_modules/<pkg>/` for any residual postinstall script or bundled binary, rebuild from a clean npm registry mirror. Add `csec-*`, `ccsec-*`, `ccsseecc-*` to the npm denylist. Alert the developer who introduced the dependency (the "csec" cybersecurity-SDK lure name is the kind of slug a security-adjacent developer could reach for from an AI-assistant suggestion or a crypto-utility snippet)
4. **For Cluster D (`@flexmr/*` FlexMR dep-confusion probe by `robdotty`)**: grep every npm manifest for the `@flexmr/` scope prefix. Any FlexMR engineer or FlexMR-integrator org (`flexmr.net`, UK market-research SaaS) should audit internal-registry resolution: confirm the internal `@flexmr/*` scope resolves to the internal registry before the public npm registry falls back, pin registry resolution with `.npmrc` / organisation `always-auth`. On any hit against today`s versions (`1.0.0`, `1.0.12`, `2.0.12`, `3.0.12`, `10.0.12`): treat the install host as a probe-successful target (host fingerprint exfiltrated via DNS beacon at minimum, per the Vulert-captured sibling `@flexmr/ui@99.99.99` TTP). Rotate any secrets on the install host. Add `@flexmr/*` scope to the npm registry mirror`s manual-approval list, and watch for the next operator slug (likely `@flexmr/*` with another sentinel version, or a sibling internal scope under the same `robdotty` publisher)
5. **For Cluster E (`sc-*`/`ccl-*`/`paychex-pdftron` 99.9.1 dep-confusion batch)**: grep every npm manifest for `sc-announcer@99.9.1`, `sc-hydrate-carousel-price@99.9.1`, `ccl-global-shopping@99.9.1`, `paychex-pdftron@99.9.1`. Salesforce Commerce (SFCC) engineers and Paychex developers should audit internal-registry resolution for the `sc-*`, `ccl-*`, and `paychex-*` namespaces specifically; the 99.9.1 sentinel is a classic dep-confusion attempt against an internal pin. Any CI runner that installed any of these needs its npm resolution path audited and - as a precaution - its host fingerprint treated as exfiltrated. Add `sc-announcer`, `sc-hydrate-carousel-price`, `ccl-global-shopping`, `paychex-pdftron` to the npm denylist. Broaden the registry-resolver denylist to any `99.9.*` sentinel versions of the `sc-*`, `ccl-*`, `paychex-*` namespaces
6. **For Cluster F (npm "verbose-utility" lure batch - `fetch-hash-cache-atomic`, `string-target-mapper-hash`, `macro-kernel-record-reader`)**: grep every npm manifest for the exact slugs. These names read as plausible npm utility names that could appear in an AI-assistant code suggestion or a developer`s snippet copy-paste; alert the developer who introduced the dependency so the slug is retired from internal docs / AI-assistant prompts. On any hit: remove the package, audit `node_modules/<pkg>/` for postinstall scripts and bundled binaries, rebuild from a clean mirror. Add these exact slugs to the npm denylist
7. **For Cluster G (single enterprise brand dep-confusion probes - `@tableau__catalog-messages/database_lower`, `adyen-web-v6`, `@azure-growth/signup-ux-components`)**: grep every npm manifest for the exact slugs. Tableau / Salesforce internal engineers should audit the double-underscore `@tableau__catalog-messages` scope and any internal `@tableau/*` resolution path (the double-underscore is unusual and may indicate a scanner-evasion attempt). Adyen integrators should audit any pin on `adyen-web`-prefixed packages: the legitimate scope is `@adyen/*`, so any un-scoped `adyen-*` or `adyen-web-*` pin is a candidate dep-confusion target. For `@azure-growth/*`: this is NOT a legitimate Microsoft scope - audit any CI runner`s `.npmrc` and registry resolver config for a stray `@azure-growth/*` pin that could resolve to the public registry. On any hit: remove, audit, rebuild. Add `@tableau__*`, `adyen-web-v6`, `@azure-growth/*` to the npm denylist
8. **For Cluster H (`dsh-vm-tester` + `agentenact`)**: grep every npm manifest for `dsh-vm-tester` (any version 0.1.0 → 0.1.7) and `agentenact@0.2.0`. For `dsh-vm-tester`: DeepSeek-ecosystem developers (anyone using DeepSeek-Harness or DeepSeek-related VirtualBox testing scaffolding) should audit for the specific `yugejixian`-published tarball; on hit, assume CWE-506 malicious intent, remove, rebuild. For `agentenact`: the prior 0.0.1 and 0.1.1 are clean legitimate releases by Kerem Noras / `knrs`; the 0.2.0 single-bump pattern is maintainer-compromise-shaped. Keep 0.0.1 / 0.1.1 but add 0.2.0 to the npm denylist; alert the maintainer `knrs` via GitHub to confirm whether 0.2.0 was authorised. Add watches for 0.2.1+ wave-2 publishes under the same identity
9. **For Cluster I (CWE-506 boilerplate long tail - `glyphmatrix-fixture`, `6161test1234`, `buttoncontent`)**: grep every npm manifest for exact matches. `glyphmatrix-fixture@1.0.0, 1.0.1` is the only one freshly published (2026-10-28, today) and may still be live on npm at the time of your audit - if your CI runner installed it today, assume CWE-506 malicious intent. The other two are aged April 2026 publishes that caught the GHSA takedown attention this week; they are low-exposure. Remove, audit, rebuild. Add exact slugs to the npm denylist
10. **Standing egress-denylist carry-forward from prior sweeps** (keep in place; today`s new-sharp IOCs are below): continue to block `networkservicesupp.flashhub.net:8443` (2026-10-22 + 2026-10-26 `@sudobility` XMRig cross-wave Monero pool), `api.github.com/repos/jerryjohnston91/*` + `codeload.github.com/jerryjohnston91/*` (2026-10-27 Cluster C `netweavex` import-time RCE source), `c2-worker.crawlnet-claim.workers.dev` apex + `/dl/pyupd` path, `34.143.131.27:18080` + `/x-VA-1/main.js` path, `webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/`, `75.119.137.232:31337` + `/depconfuse` path, `transfer.archivete.am` apex + `/H2Uxm/fabdeploycheck-config.json` path, `realwbx.com` apex + `/ip.php` + `/ip` paths, `artifacts.creditslib.com` apex + `/npm/*` paths, `login.fromthehotel.com` apex, `googleforum.pythonanywhere.com`, `space-z.ai` apex, `dxpoc.gt.tc` apex, `raw.githubusercontent.com/anonrider404/pypl/*`, `api-bsx.pages.dev` + `/download`, `177.7.60.239:48080` + `oob.recon.dev`, `uncoder.eu.org` + `/cc-checker/api.php`, `accenture-npm.azurewebsites.net`, `limbomail.com`, `collector.oob.s4yhii.com` + `*.oob.s4yhii.com` + `s4yhii.com`, `64.181.165.115/dc`, `167.88.172.33:8087` + `jsonspack.com`, `goxtools.shop`, `minhdong.site`, `45.138.12.177:8089`, `185.158.107.175:8787`, `ltidi.storage.googleapis.com/depenconf/`, `oob.s4yhii.com:9999/native`, `*.oast.pro`/`*.oast.me`/`*.oast.fun`/`*.oast.site`/`*.oastify.com`, `frjmzbjbhwvtdnsuodmu.supabase.co`, `api.npoint.io`, `tele.metry.orgin.net`, `morroncr0w.io`, `api.telegram.org` on untrusted CI/build hosts, `appsecc.com`, generic `webhook.site/*` paths other than legitimate dev webhooks, `nfjbill.ren`, `storage.googleapis.com/depenconf/`, `10.0.19.0/24` + `10.0.49.0/24`, `api.nm-streetwear.space`, Discord webhook URL patterns, `ipify.org` + `ifconfig.me`, `gitflic.ru`, `api.wagmiwallet.org`, `backend-cybersecuritydashboard.onrender.com`, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, `chinazhangsan.ccwu.cc`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `npm-canary.aveliscare.com`, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil patterns, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, `tuamaeaquelaursa.com`, `45.138.0.0/16` RubyGems wgkit CIDRs, `apexaccs.org` apex + subdomains, `arenapex.cloud`, `apexfdn.xyz` apex + subdomains, `fdn4apex.com`, `router-apex.com` apex + subdomains, `ccmihr.com`, `0auth-chromium.com`, `ehegisnightmare.icu`, `cloudmain365duo.top`, `www.litellm.dev/healthcheck`, `raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt`, known SSH relay services `srv.us`, `*.devtunnels.ms`, `*.devtunnels.visualstudio.com` on build/CI networks, `*.ngrok-free.dev/canary`. **New-sharp today for Cluster A**: `109.94.169.196:8443` + `*.sslip.io:8443` paths (the `sslip.io` wildcard DNS service is being abused by Cluster A `trajmetrics` for a DNS-encoded exfil endpoint - block the specific IP but also alert on any `*.sslip.io` resolution from a CI/build host since the operator can rotate the IP within the same wildcard service); `api.github.com/gists/3775fd9235aa6ef29e96eb96274a0e34` (specific Gist id for Cluster A `numprint` C2 - the Gist content can rotate but the id is fixed in the payload bytes); `115.190.210.22` (Cluster A `h13t0ry-hello-demo` reverse-shell target). **New operator identities to watch**: npm `robdotty` (Cluster D `@flexmr/*` dep-confusion), npm `yugejixian` (Cluster H `dsh-vm-tester` DeepSeek lure), kam193 upstream `github.com/hehesama527/data-analising` (Cluster A `trajmetrics`)

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-rm9p-x4m7-hxmp - pypi trajmetrics@0.5.3 (Cluster A - filesystem-wide infostealer, OSSF MAL-2026-18354, kam193 campaign 2026-10-trajmetrics, SHA-256 3370d779...8271)](https://github.com/advisories/GHSA-rm9p-x4m7-hxmp) - GitHub
- [ossf/malicious-packages record for trajmetrics (MAL-2026-18354)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/trajmetrics/MAL-2026-18354.json) - OpenSSF
- [GHSA-g9fj-q87h-6h4c - pypi numprint@1.2.0 (Cluster A - setup.py RAT with GitHub Gist C2, OSSF MAL-2026-18343, kam193 campaign 2026-10-numprint, SHA-256 ca6ff316...0243)](https://github.com/advisories/GHSA-g9fj-q87h-6h4c) - GitHub
- [ossf/malicious-packages record for numprint (MAL-2026-18343)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/numprint/MAL-2026-18343.json) - OpenSSF
- [GHSA-5crq-52j9-fc74 - pypi h13t0ry-hello-demo@0.1.0 (Cluster A - import-time reverse shell to 115.190.210.22, OSSF MAL-2026-18336, kam193 campaign 2026-10-h13t0ry-hello-demo, SHA-256 e27409f6...f5ab)](https://github.com/advisories/GHSA-5crq-52j9-fc74) - GitHub
- [ossf/malicious-packages record for h13t0ry-hello-demo (MAL-2026-18336)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/h13t0ry-hello-demo/MAL-2026-18336.json) - OpenSSF
- [GHSA-2w7v-jwxh-w7wc - npm @camera.ui/camera-ui-nvr-windows-amd64@1.6.1 (Cluster B - trusted-publisher OIDC compromise, maintainer seydx rotated OIDC config id, clean 1.6.2 patched release 2026-10-27)](https://github.com/advisories/GHSA-2w7v-jwxh-w7wc) - GitHub
- [GHSA-wh86-6qm8-xgw2 - npm csec-form-validator@1.0.0, 1.0.1 (Cluster C)](https://github.com/advisories/GHSA-wh86-6qm8-xgw2) - GitHub
- [GHSA-ph3g-jrf5-8792 - npm csec-form-validatorr@1.0.2 (Cluster C - note double-r typo-of-typosquat)](https://github.com/advisories/GHSA-ph3g-jrf5-8792) - GitHub
- [GHSA-v383-2358-576w - npm csec-crypto-toolkit@4.2.1, 4.2.2, 4.2.4 (Cluster C)](https://github.com/advisories/GHSA-v383-2358-576w) - GitHub
- [GHSA-r889-j2qv-2jv6 - npm ccsec-form-validator@3.0.0 (Cluster C)](https://github.com/advisories/GHSA-r889-j2qv-2jv6) - GitHub
- [GHSA-2732-c6cp-rx5v - npm ccsec-crypto-toolkit@4.5.1 (Cluster C)](https://github.com/advisories/GHSA-2732-c6cp-rx5v) - GitHub
- [GHSA-h5wr-j55v-8m79 - npm ccsseecc-form-validator@3.0.0 (Cluster C)](https://github.com/advisories/GHSA-h5wr-j55v-8m79) - GitHub
- [GHSA-v9xw-mxj4-fm5q - npm ccsseecc-crypto-toolkit@4.5.1 (Cluster C)](https://github.com/advisories/GHSA-v9xw-mxj4-fm5q) - GitHub
- [GHSA-hpc9-fxqh-hhf8 - npm @flexmr/utils (Cluster D - 5 sentinel versions, publisher robdotty, FlexMR UK market-research dep-confusion)](https://github.com/advisories/GHSA-hpc9-fxqh-hhf8) - GitHub
- [GHSA-hc8w-gq4q-fr74 - npm @flexmr/survey-conversation (Cluster D)](https://github.com/advisories/GHSA-hc8w-gq4q-fr74) - GitHub
- [GHSA-rh7q-f888-q36c - npm @flexmr/survey-client (Cluster D)](https://github.com/advisories/GHSA-rh7q-f888-q36c) - GitHub
- [GHSA-fxw2-4j5q-6hwg - npm sc-announcer@99.9.1 (Cluster E - Salesforce Commerce dep-confusion batch)](https://github.com/advisories/GHSA-fxw2-4j5q-6hwg) - GitHub
- [GHSA-9gcx-88qx-rxch - npm sc-hydrate-carousel-price@99.9.1 (Cluster E)](https://github.com/advisories/GHSA-9gcx-88qx-rxch) - GitHub
- [GHSA-hh3m-f424-g8v5 - npm ccl-global-shopping@99.9.1 (Cluster E - Salesforce Commerce internal shopping-cart dep-confusion)](https://github.com/advisories/GHSA-hh3m-f424-g8v5) - GitHub
- [GHSA-9mgv-25w8-jwhf - npm paychex-pdftron@99.9.1 (Cluster E - Paychex PDFTron SDK dep-confusion)](https://github.com/advisories/GHSA-9mgv-25w8-jwhf) - GitHub
- [GHSA-w9mp-cvjp-jfqp - npm fetch-hash-cache-atomic@1.0.0 (Cluster F - verbose-utility lure)](https://github.com/advisories/GHSA-w9mp-cvjp-jfqp) - GitHub
- [GHSA-wfcx-722r-fg5h - npm string-target-mapper-hash@1.0.0 (Cluster F)](https://github.com/advisories/GHSA-wfcx-722r-fg5h) - GitHub
- [GHSA-32g3-f74c-pcxq - npm macro-kernel-record-reader@1.0.0 (Cluster F)](https://github.com/advisories/GHSA-32g3-f74c-pcxq) - GitHub
- [GHSA-wmfr-2pvv-wmf3 - npm @tableau__catalog-messages/database_lower@99.9.9, 99.9.91 (Cluster G - Tableau internal name dep-confusion, note double-underscore)](https://github.com/advisories/GHSA-wmfr-2pvv-wmf3) - GitHub
- [GHSA-r77r-rw3m-rjh5 - npm adyen-web-v6@99.1.0 (Cluster G - Adyen payments SDK impersonation)](https://github.com/advisories/GHSA-r77r-rw3m-rjh5) - GitHub
- [GHSA-m8mp-r4jx-43fw - npm @azure-growth/signup-ux-components@1.2.2, 1.2.3 (Cluster G - fake Azure scope impersonation, OSSF MAL-2026-18338)](https://github.com/advisories/GHSA-m8mp-r4jx-43fw) - GitHub
- [GHSA-84fw-gj66-p5v3 - npm dsh-vm-tester@0.1.0-0.1.7 (Cluster H - DeepSeek-Harness lure, publisher yugejixian, unrelated to 2026-10-26 @sudobility XMRig family)](https://github.com/advisories/GHSA-84fw-gj66-p5v3) - GitHub
- [GHSA-7p7m-8jmq-qp93 - npm agentenact@0.2.0 (Cluster H - single-bump candidate maintainer compromise of knrs/Kerem Noras project)](https://github.com/advisories/GHSA-7p7m-8jmq-qp93) - GitHub
- [GHSA-vc33-3x34-x6jm - npm glyphmatrix-fixture@1.0.0, 1.0.1 (Cluster I - 2026-10-28 live publish)](https://github.com/advisories/GHSA-vc33-3x34-x6jm) - GitHub
- [GHSA-r9qx-xcg2-7wcc - npm 6161test1234@1.0.0, 1.0.2 (Cluster I - aged April 2026 publish)](https://github.com/advisories/GHSA-r9qx-xcg2-7wcc) - GitHub
- [GHSA-6crh-vwr2-4qfp - npm buttoncontent@99.0.0, 99.0.1, 99.0.2 (Cluster I - 99.x sentinel aged dep-confusion probe)](https://github.com/advisories/GHSA-6crh-vwr2-4qfp) - GitHub
- [DependencyWatch: multi-2026-10-27-ghsa-malware-sweep (prior day, @sudobility XMRig wave 2 + netweavex NetworkX typosquat + publish-poc worm POC)](https://dependencywatch.io/incident/multi-2026-10-27-ghsa-malware-sweep)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-28-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-28-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).