DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 30 October 2026

HighAdvisory sweepnpmPyPI

Fifty-ish fresh GHSA advisories across the 2026-10-29 → 2026-10-30 window. Headlines are the spectral-core 10-version gyp-based AWS-metadata infostealer, three dep-confusion beacon clusters (amahrou1w mw-/mui-trio, kill_shs @zmtcdn pair, hologrammmm0x identity-two-factor Coinbase lure), kam193 PyPI PTH-sitecustomize cluster (bq-helix-* + twitter-request-diagnostics + test-01-rafamarrara-learning-dc), a black-spindle-2 ngrok wave-2, a 10-pack casino 789bet/m98 typosquat family, and a 5-pack dowload_ebok book-piracy lure.

Published 30 Oct 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-10-30-ghsa-malware-sweep
37
Packages tracked68 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
30 Oct 2026
Ecosystems
npmPyPI
Detected by
GitHub Advisory Database, OpenSSF Package Analysis, Amazon Inspector
Also known as
GHSA 2026-10-29 late batch + 2026-10-30 first wave, spectral-core AWS-metadata infostealer, amahrou1w mw-/mui-wrapper dep-confusion

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

Between 2026-10-29 06:00 UTC (yesterdays sweep cut-off) and 2026-10-30 06:00 UTC (todays ingest-window start) the GitHub Advisory Database published ~50 npm and PyPI malware advisories. The headlines today are a 10-version spectral-core AWS-metadata infostealer (first confirmed-payload install-time infostealer typosquat targeting @stoplight/spectral-core since the May 2026 Shai-Hulud burst), four coordinated dep-confusion beacon campaigns, two named kam193 PyPI campaigns (BigQuery PTH-sitecustomize + web-middleware backdoor), continued operator-continuity under black-spindle and the @sudobility/DSH family, a 10-pack casino SEO-poisoning typosquat family, and a 5-pack book-piracy lure cluster.

Headlines

spectral-core 10-version AWS-metadata infostealer (Cluster A): 10 contiguous versions 3.0.2 through 3.0.12 (skipping 3.0.8) under GHSA-jpgq-34qx-jwwc / OSSF MAL-2026-18377. The attack uses gypfile: true so node-gyp rebuild runs during install; binding.gyp ships no native source and runs an inline node -e script that reads /proc/1/environ + /proc/self/environ (container-init and installing-process env), harvests DNS/socket/ARP/route reconnaissance, queries the AWS EC2 metadata service at 169.254.169.254 for user-data and meta-data, and POSTs the bundle to https://webhook.site/d6092bdc-05c0-45da-a280-c343ea6d6156. The declared main: index.js is not shipped - the package has no legitimate function. The slug typosquats the real linter @stoplight/spectral-core.

spectral-net-probe file-exfil beacon (also Cluster A): three versions by publisher kristol07. 1.0.1 / 1.0.4 ping Cloudflare quick tunnels; 1.0.10 fetches /api/modules/ECT-654321 from both http://154.57.164.64:30664 and http://127.0.0.1:3000, interprets the replys data.cargo_hold` as a list of 10 filesystem paths, reads each, and PUTs the first 400 bytes of each file to a sibling endpoint - operator-controlled file-content exfil primitive.

Four dep-confusion beacon campaigns (Clusters B / C / D / E): amahrou1w published mw-communication-client, mw-test-utils and mui-wrapper-x-date-pickers as a 7-version trio with preinstall+postinstall beacons to 38.242.235.206/depconf/*; kill_shs published @zmtcdn/components and @zmtcdn/ui as a 3-version pair with postinstall beacons to webhook.site and www.hinny.shop/api; hologrammmm0x published identity-two-factor@999.0.0 with a cbhq-canary beacon targeted at Coinbase internal engineering; @dmangal/curse-dependent-ecto@99999.0.* is an HTB-flavoured CTF/pentest probe that greps /workspace/, /root/, /tmp/, /opt/, /var/, /etc/ for HTB{ and exfils env.

Two named kam193 PyPI campaigns (Clusters G + H): 2026-10-bq-helix-recon with bq-helix-recon-6ade983e@0.1.0, 0.1.2 and bq-helix-build-hook-6ade983e@0.1.0 places .pth / sitecustomize.py files for every-Python-startup persistence and exfils cloud metadata + env + credentials - the OSSF reason-tag combination abuses-pth + exfiltration-cloud-tokens + exfiltration-generic + exfiltration-env-variables + exfiltration-credentials is the standard kam193 shape; 2026-10-test-01-rafamarrara-learning-dc with twitter-request-diagnostics@1.0.0 and test-01-rafamarrara-learning-dc@1.0.0 is a middleware-backdoor + env-exfil pair (first live-today 10-30 PyPI entry), with the twitter-request-diagnostics slug typosquatting Twitter/X API clients.

Operator continuity: black-spindle operator rotated to black-spindle-2 within 24h of yesterdays takedown (ngrok beacon continuity); @sudobility/DSH family added dsh-volcengine-provider as wave-4 (ByteDance Volcengine-themed); the 2026-10-20 Nodveta/Torre.ai fake-interview tailwind-animatecss campaign saw a GHSA-wide republish today expanding the specific-version takedown to "all versions" across tailwind-animate-kit, tailwind-kinetic, tailwind-animationlab, tailwind-keyframes, tailwindcss-animate-catalog, tailwindcss-keyframe-kit AND flagging the previously-private payload scope @jasperquinn/postcss-motion-helpers` as public malware - those updates are tracked on the 2026-10-20 record rather than duplicated here.

Casino + book typosquat families (Clusters K + L): 789bet-* (7 slugs) + m98* (3 slugs) is a coordinated 10-pack SEO-lure mesh impersonating Vietnamese/Thai online-casino brands; dowload_ebok_* (5 slugs; deliberate misspelling of "download ebook") is a book-piracy-themed SEO lure. Both are CWE-506 boilerplate on today`s advisories, but the coordinated-mesh and brand-impersonation patterns mark them as serious operator campaigns.

Classification

sweep. Severity high (above the sweep baseline medium) because Cluster A carries two confirmed-payload install-time infostealers with real AWS-metadata + file-content exfil, Cluster G carries a confirmed PTH-sitecustomize persistence primitive on real PyPI typosquats, and Cluster H carries a confirmed web-exposed backdoor-with-command-execution. Clusters B through F, I through N are medium: dep-confusion beacons with captured network IOCs, operator-continuity signals, CTF probes, SEO typosquat meshes, and CWE-506-only takedowns. No cluster reaches critical - no legitimate widely-used package was hijacked and no self-propagating worm was observed.

Discovery

GitHub Advisory Database, OpenSSF malicious-packages (MAL-2026-18372 through MAL-2026-18403 range on todays batch), Amazon Inspector static analysis on the npm clusters (A / B / C / D / E / F / M), kam193 operator-controlled tracker bad-packages.kam193.eu` (Clusters G + H).

typosquatdependency-confusioninfostealercredential-theftobfuscation
Affected packages

37 packages 68 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • Cluster A - npm spectral-core 10-version AWS-metadata infostealer (malicious-package; 1 package / 10 versions, GHSA 2026-10-29): spectral-core@3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.9, 3.0.10, 3.0.11, 3.0.12 (note 3.0.8 skipped) under GHSA-jpgq-34qx-jwwc / OSSF MAL-2026-18377. The slug typosquats @stoplight/spectral-core (the real linter from Stoplight) and the AI-ops company Spectral. The attack uses gypfile: true so node-gyp rebuild runs during install: binding.gyp ships NO native source and instead invokes an inline node -e script that reads /proc/1/environ and /proc/self/environ (CI/CD secrets and cloud credentials from the container init and the installing process), harvests DNS/socket/ARP/route reconnaissance output, queries the AWS EC2 metadata service (169.254.169.254) for /latest/user-data and /latest/meta-data/, and POSTs the full bundle to https://webhook.site/d6092bdc-05c0-45da-a280-c343ea6d6156. The declared main: index.js is not shipped so the package has no legitimate function - the entire tarball exists only to run the install-time infostealer. Amazon Inspector source identifier 451c36f03e81be0ff6c85334587d7ff401de1e5134e179557ec4bc454cd7ba76. Severity high (confirmed install-time infostealer with real AWS-metadata/CI-secret-exfil capability; reach is limited to anyone who installed the typosquat, but any build host that ran npm install on it is fully exposed and cloud credentials from the container should be treated as leaked)
  • Cluster A also - npm spectral-net-probe 3-version file-exfil beacon (malicious-package; 1 package / 3 versions, publisher kristol07, GHSA 2026-10-29): spectral-net-probe@1.0.1, 1.0.4, 1.0.10 under GHSA-48mf-mvf8-x4v3 / OSSF MAL-2026-18368. Versions 1.0.1 and 1.0.4 run a postinstall → node index.js that HTTPS-GETs two Cloudflare quick-tunnel URLs (nobody-johnston-with-enabling.trycloudflare.com/aa?x=1 and imaging-amazing-trunk-surgeons.trycloudflare.com/marker104?v=1) for host-identification pings. Version 1.0.10 escalates: on module load it fetches /api/modules/ECT-654321 from both http://154.57.164.64:30664 and http://127.0.0.1:3000, interprets the replys data.cargo_hold field as a list of up to 10 local filesystem paths, reads each, and PUTs the first 400 characters of each file to /api/modules/ECT-987654 on both hosts. Related placeholder slugs by the same publisher kristol07: phantom-chartwinds, phantom-powder-keg (both pre-published, not yet weaponised). **Severity high`** (confirmed file-content exfiltration primitive with operator-controlled file selection; same reach caveat as Cluster A)
  • Cluster B - npm amahrou1w dep-confusion beacon trio (dependency-confusion; 3 packages / 7 versions, publisher amahrou1w, published 2026-10-27, GHSA 2026-10-29): mw-communication-client@1.0.1, 10.0.0 (GHSA-4h9g-fh86-j87q), mw-test-utils@1.0.0, 10.0.0, 10.0.1 (GHSA-j7r7-x5hv-p975), mui-wrapper-x-date-pickers@1.0.0, 10.0.0 (GHSA-98qv-v7qr-v3gx) - the mui-wrapper-* slug typosquats the MUI X Date Pickers component library. All three run preinstall + postinstall scripts that HTTP-GET 38.242.235.206/depconf/<package-name>/preinstall and /postinstall with user name, host name and working directory in the request. The README on each slug literally identifies the package as a "dependency-confusion proof of concept" for a bug bounty programme; 0.0.0-stage placeholder published ~1 minute before each malicious version. Tarball SHA-256: mw-communication-client 1.0.1 f7ea5239784db30ae39f8b3108b85561d52d1771af4f4e41b603a959824ea722, 10.0.0 f8aa10f8f000515af3ded7f91db57c266abcc30cecb68565b8fba4ab136a0b11; mw-test-utils 1.0.0 06a3870b3807b00636c95eea01b057c748dd908fe2677c5dbc05516519a08c56, 10.0.0 70cf433a26fee76da087163816b8e3d1939fee9650b1cc6bd0b02b70bba90d9e, 10.0.1 1dbbab093762b688298ca21abab34018a5988b9e9647e56ac72152a3b2c8a011; mui-wrapper-x-date-pickers 1.0.0 32199161095f611bcc41a9d7ae4cbc2abde7b8f697f7decde2152723bd05bff9, 10.0.0 b6b650ae811c65b52766a046a10622f638691406f2da8fa180d785d1ef1bdb81. Severity medium (dep-confusion probe with confirmed beacon code and leaked host-fingerprint; readme self-identifies as a bug-bounty PoC, but any internal registry that resolves these slugs ahead of the public probe has leaked the win)
  • Cluster C - npm kill_shs @zmtcdn dep-confusion beacon pair (dependency-confusion; 2 packages / 3 versions, publisher kill_shs, GHSA 2026-10-29): @zmtcdn/components@9999.0.0 (GHSA-2pph-m662-c8hg / MAL-2026-18372) and @zmtcdn/ui@9999.0.0, 9999.0.7 (GHSA-g2vv-m33m-p9qf / MAL-2026-18373). Both run postinstall → node postinstall.js which POSTs host-name / user-name / platform / cwd / enumerated environment-variable names. @zmtcdn/components beacons to https://webhook.site/f52af355-4783-4acb-9de1-5e44b5963025; @zmtcdn/ui beacons to https://www.hinny.shop/api. Description string "Security research PoC" and empty index.js match a standard dep-confusion probe. Severity medium (dep-confusion probes with env-variable-name enumeration leaked; www.hinny.shop is operator infrastructure that outlasts a webhook.site rotation)
  • Cluster D - npm identity-two-factor Coinbase dep-confusion lure (dependency-confusion; 1 package / 1 version, publisher hologrammmm0x, GHSA 2026-10-29): identity-two-factor@999.0.0 (GHSA-2hrq-h3vj-5wxm). postinstall → node postinstall.js writes a marker file into the OS temp dir and POSTs host-name / user-name / cwd basename / CI flag / Node version to https://webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary. The cbhq-canary path is explicit: cbhq = Coinbase Holdings, so this is a targeted dep-confusion probe against the Coinbase internal registry under the internal-package name identity-two-factor. Severity medium (confirmed targeted dep-confusion probe against a named organisation; nothing to clean up outside Coinbase internal engineering, but anyone else who installed it leaked a host fingerprint)
  • Cluster E - npm @dmangal/curse-dependent-ecto HackTheBox/CTF probe (dependency-confusion; 1 package / 3 versions, GHSA 2026-10-29): @dmangal/curse-dependent-ecto@99999.0.0, 99999.0.1, 99999.0.2 (GHSA-prqg-vvv3-2xf8 / MAL-2026-18375). binding.gyp runs an inline node -e script during node-gyp rebuild: searches /workspace/, /root/, /tmp/, /opt/, /var/, /etc/ for the literal string HTB{ (the HackTheBox CTF flag format), reads /tmp/scent-trail.jsonl and /workspace/repo/package.json, enumerates every process.env key/value pair, and POSTs the triple to https://webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0 prefixed GREP:, FILE:, or ALLENV: by category. The 99999.0.* version shape marks this as dep-confusion; the HTB{ grep and the workspace-repo targeting mark it as a CTF or red-team-exercise probe rather than an opportunistic attack. Severity medium (CTF-shaped probe with confirmed env-variable + workspace-file exfil; harmless on a non-HTB machine but exfilrates env on any host that installed it)
  • Cluster F - npm black-spindle-2 wave-2 ngrok beacon (dependency-confusion; 1 package / 2 versions, GHSA 2026-10-29): black-spindle-2@100.0.0, 301.0.0 (GHSA-qcg8-4xw5-5ccq / OSSF MAL-2026-18376). postinstall curl against http://778e-181-63-25-28.ngrok-free.app over plain HTTP; the URL path embeds a shell command-substitution expression so it runs on npm install and leaks the expanded output. index.js is empty. The slug and version-shape continuity with yesterdays Cluster C black-spindle@999.0.0 (GHSA-9939-65w7-25v2) confirms the same operator rotated to a sibling slug within 24h after takedown. Source identifier 433228fbed18f3104fed4cd1bce59bc5a76b8ea061d18c8fc9516c92b6b26e90. **Severity medium** (operator continuity with yesterdays black-spindle plus confirmed ngrok-tunnel install-confirmation beacon)
  • Cluster G - PyPI kam193 2026-10-bq-helix-recon BigQuery PTH-sitecustomize infostealer (malicious-package; 2 packages / 3 versions, OSSF campaign 2026-10-bq-helix-recon, GHSA 2026-10-29): bq-helix-recon-6ade983e@0.1.0, 0.1.2 (GHSA-9r7r-h4fq-xj8p / MAL-2026-18396) and bq-helix-build-hook-6ade983e@0.1.0 (GHSA-526r-6j5j-v9pv / MAL-2026-18395). The slugs typosquat Google BigQuery (bq-*) tooling; the -6ade983e 8-hex suffix is the shared campaign tag the operator uses to correlate the pair at the OSSF tracker (bad-packages.kam193.eu/pypi/package/<name>). Each package places a .pth and/or sitecustomize.py file so arbitrary code runs on EVERY Python interpreter startup (not just once at install) - a persistence primitive. The code then collects credential files, environment variables and cloud metadata and exfiltrates them. OSSF reason tags: abuses-pth, exfiltration-cloud-tokens, exfiltration-generic, exfiltration-env-variables, exfiltration-credentials. Severity medium (confirmed cloud-metadata + env-var infostealer with PTH-persistence; reach limited to Python developers who installed the typosquat but any host that ran either package is both exfiltrated AND persistently hooked for every subsequent Python invocation on that interpreter)
  • Cluster H - PyPI kam193 2026-10-test-01-rafamarrara-learning-dc middleware-backdoor campaign (malicious-package; 2 packages / 2 versions, OSSF campaign tag, GHSA 2026-10-30): twitter-request-diagnostics@1.0.0 (GHSA-w3jr-q4jr-xq95 / MAL-2026-18403) and test-01-rafamarrara-learning-dc@1.0.0 (GHSA-9wjc-g5vf-3m22 / MAL-2026-18402). Both present as a web-app middleware adding a "diagnostic endpoint" - OSSF reason tags are backdoor and exfiltration-env-variables. The hidden endpoint exfiltrates environment variables AND executes attacker-sent commands - this is a web-exposed backdoor, not an install-time beacon. The twitter-request-diagnostics slug typosquats legitimate Twitter / X API client libraries. The campaign tag names a user rafamarrara (plausibly the operator throwaway identity, cf. 2026-10-28 kam193 cluster where the operator-controlled tracker reused forum-handle shaped tags). Severity medium (confirmed backdoor with command execution AND env exfil, but the attack requires the victim to deploy the middleware in a web app, so reach is narrow)
  • Cluster I - PyPI poc-revshell localhost reverse shell PoC (malicious-package; 1 package / 1 version, GHSA 2026-10-29): poc-revshell@0.1.0 (GHSA-h7h9-fmhv-56wh / MAL-2026-18378). setup.py registers a custom install cmdclass (PostInstall) that spawns a daemon thread during pip install; the thread opens a TCP socket to 127.0.0.1:4444, dup2s it onto stdin/stdout/stderr, and launches /bin/sh -i (Windows: cmd.exe). __init__.py repeats the same thread on import poc_revshell. The loopback destination limits exploitation to a co-resident attacker on the same host; nothing is exfiltrated remotely. Amazon Inspector source identifier 08edc162927c80cde9e467244a435780f65ca95823e97ec73534faf34233ac9a. Severity medium (confirmed reverse-shell primitive, but the loopback target makes it a research PoC rather than a reach-into-prod attack; still blocks pip install on any shared/multi-tenant host from being safe)
  • Cluster J - npm @sudobility/DSH family wave-4 continuation (malicious-package; 1 new package today, 2026-10-29 GHSA advisory): dsh-volcengine-provider@0.2.5, 0.2.8 (GHSA-8hr2-m7vq-fhpg). CWE-506 boilerplate on the GHSA advisory without captured payload bytes. The dsh- prefix continues the DeepSeek-Harness-themed lure family (yesterday was dsh-redteam-mode@0.15.2 and bare-slug dsh-plugin-blender-3d@0.2.1; two days ago was scoped @sudobility/dsh-plugin-blender-3d); the volcengine suffix names ByteDances public cloud, so this slug targets ByteDance/Volcengine SDK integrators. Working assumption is the same networkservicesupp.flashhub.net:8443 XMRig Monero pool shape as the 2026-10-22 / 10-26 / 10-28 waves pending a vendor post-mortem. **Severity medium`** for the cluster (operator continuity confirmed; nothing legitimate depends on these slugs; any host that installed either should be hunted for XMRig egress to the standing-denylist pool)
  • Cluster K - npm casino 789bet / m98 10-pack typosquat family (typosquat; 10 packages, all versions, 2026-10-29 GHSA advisories): 789bet (GHSA-cccw-qphx-7whg), 789bet-vip (GHSA-rvxc-82gp-xpr6), 789bet-slot (GHSA-q68g-454g-9qww), 789bet-entrance (GHSA-6xqc-cfvp-q89v), 789bet-vip-online-login (GHSA-f5mv-v4rc-qq2q), 789bet-login-th (GHSA-wg3r-wqgc-7fgf), 789bet-vip-login (GHSA-4rjq-j97h-cqxc), m98bet (GHSA-6ggw-hqvq-8wcm), m98vip (GHSA-gp92-xqcg-876c), m98th (GHSA-x82c-crm3-jcwv) - each at >= 0 (all versions). All CWE-506 boilerplate on todays advisories without captured payload bytes. The 789bet and m98 brand prefixes are high-profile Vietnamese/Thai online-casino operators (789bet.com and m98 chain are well-known in Southeast-Asian gambling markets), the -slot / -entrance / -login / -vip-online-login / -login-th suffixes are classic SEO-poisoning lure terminology for players seeking casino login portals, and the 10-pack coordinated-slug mesh is a clear operator pattern. **Severity medium** for the cluster (CWE-506-only on todays advisories but the coordinated 10-pack SEO-lure mesh plus the casino-brand impersonation make this a serious coordinated typosquat; the plausible target is SEO-poisoned traffic to malicious login pages rather than npm installs, but any dev who added one of these as a dependency chasing an "SDK" is fully compromised)
  • *Cluster L - npm `dowload_ebok_ 5-pack book-piracy typosquat lure (typosquat; 5 packages, all versions, 2026-10-29 GHSA advisories)**: dowload_ebok_lolita_by_vladimir_nabokov_oy1gy (GHSA-cjmr-6xg2-vf8h), dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc (GHSA-j272-m9j4-g3v9), dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t (GHSA-5cmc-vx46-22wx), dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p (GHSA-h86m-7gvf-j79h), dowload_ebok_armageddon_by_max_hastings_kv3s4 (GHSA-p6mc-228w-6q75) - each at >= 0. All CWE-506 boilerplate without captured payload. The dowload_ebok prefix (misspelled "download ebook") plus book-title + author + random hex suffix matches a bulk SEO-poisoning / piracy-lure pattern previously seen targeting Google Scholar / ResearchGate searches - the operator wants traffic to a malicious ebook download page, not npm installs. **Severity medium`** (coordinated SEO-lure typosquat family; limited npm reach, but anyone whose dependency manager auto-resolved these slugs is in scope)
  • Cluster M - npm siren-lament OSSF-flagged but contradictory analysis (malicious-package; 1 package / 4 versions, 2026-10-29 GHSA advisory): siren-lament@2.14.822, 2.14.824, 2.14.827, 0.0.0-stage (GHSA-3jx4-3p7f-pv7p). OSSF Package Analysis flagged 2.14.827 "The package executes one or more commands associated with malicious behavior" (hash 092c6ea787d7e5e30dda10413bd19dd94ef1007bec6652aa050ecd4e27acbf4f); Amazon Inspectors analysis (hash 66198e889b19f908f338ab5cad00c57bc95194bff8938dcf26c4a853c0b260d8) found NO lifecycle scripts, remote fetches, credential reads or exfiltration paths and noted the two-file package and 0.0.0-stage version may indicate a placeholder/staging publish. The advisory is linked to OSSF campaign MAL-2025-49247 (note 2025 - old record). **Severity medium`** (contradictory analysis - OSSF-only flag with no corroboration from a second tool - but the slug and 4-version takedown pattern mark the operator)
  • Cluster N - npm CWE-506 long tail (malicious-package; 6 packages, 2026-10-29 GHSA advisories): @chatunitycenter/baileys all versions (GHSA-g6j7-j669-23g6, slug typosquats the baileys WhatsApp Web library used in bot / automation projects), react-native-drago-callkit@0.0.0-stage, 1.0.0, 1.0.1, 1.0.2, 1.0.15, 1.0.16 (GHSA-jp74-4rg3-7ppj, React Native CallKit-themed lure), orderbook-volt-plugin@0.0.0-stage, 0.0.1, 0.0.2 (GHSA-w9pq-6r9f-pj96, DeFi orderbook-themed lure), cjlowuxbnexkhgpzq all versions (GHSA-pr23-gvcv-c422, random slug - keyboard-mash lure), bcxhdh1kjlopsde all versions (GHSA-v78q-7787-v9rq, random slug - keyboard-mash lure). CWE-506 boilerplate on all five without captured payload. Severity medium per package
  • Operator continuity: kam193 PyPI campaign operator is active again - the 2026-10-28 sweep covered trajmetrics / numprint / h13t0ry-hello-demo as "kam193 Cluster A"; today reveals two new named campaigns from the same operator-controlled tracker (bad-packages.kam193.eu): 2026-10-bq-helix-recon (BigQuery PTH-sitecustomize infostealer, Cluster G) and 2026-10-test-01-rafamarrara-learning-dc (middleware backdoor, Cluster H, first live on 10-30). black-spindle operator is back - yesterdays Cluster C black-spindle@999.0.0 → todays Cluster F black-spindle-2@100.0.0, 301.0.0 is the ngrok-beacon operator rotating to a sibling slug within 24h. @sudobility/DSH family is on wave-4 - the 2026-10-28 sweep claimed "idle today", the 2026-10-29 sweep (todays predecessor) added three slugs including dsh-redteam-mode@0.15.2, and todays Cluster J adds dsh-volcengine-provider (ByteDance Volcengine typosquat continuation). tailwind-animatecss fake interview is on wave-2 - todays GHSA batch republishes tailwind-animate-kit / tailwind-kinetic / tailwind-animationlab / tailwind-keyframes / tailwindcss-animate-catalog / tailwindcss-keyframe-kit as "all versions" (expanding the specific-version takedown from 2026-10-20), AND for the first time flags the private payload scope @jasperquinn/postcss-motion-helpers as public malware. These updates are tracked on the [2026-10-20 Nodveta/Torre.ai record](/incident/npm-2026-10-20-tailwind-animatecss-fake-interview-campaign) rather than duplicated here. **New operator identities**: npm amahrou1w (Cluster B dep-confusion trio), npm kill_shs (Cluster C @zmtcdn pair), npm kristol07 (Cluster A spectral-net-probe, also phantom-chartwinds / phantom-powder-keg placeholders), npm hologrammmm0x` (Cluster D Coinbase lure). Carve-outs LiteLLM 1.107.0, Tailwind Animate.css fake-interview, Apex Accelerator REF8801, TensorLake AI, hridoy FB credential stealer, anthropic-sdk PyPI typosquat, the 2026-10-27 netweavex NetworkX typosquat, the 2026-10-28 kam193 PyPI trio + camera.ui NVR compromise and the 2026-10-29 @testsecuiitytestme Shai-Hulud wave-2 shaped loader all remain confirmed-recovered with no wave-2 malicious republish observed today
What to do

Clean-up steps

  1. For Cluster A spectral-core AWS-metadata infostealer (CONFIRMED PAYLOAD - treat as high-urgency): grep every package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, Dockerfile and container-image manifest for the literal string spectral-core (unscoped). On any hit: treat the build host as compromised, assume the AWS EC2 metadata service returned user-data and IAM role credentials, rotate every cloud credential reachable from that host (AWS access keys, IAM role credentials, user-data secrets, every secret-manager entry readable to the role), rotate every CI/CD secret the container had access to, and audit CloudTrail / GuardDuty for unusual API calls using the role between the first install and discovery. Block egress to webhook.site/d6092bdc-05c0-45da-a280-c343ea6d6156 on every host (and broader webhook.site/* on CI/build hosts). Add spectral-core (unscoped) to the npm denylist; the legitimate linter is @stoplight/spectral-core and should be pinned explicitly going forward
  2. For Cluster A spectral-net-probe file-exfil beacon (CONFIRMED PAYLOAD): grep every manifest for spectral-net-probe AND for the related placeholder slugs phantom-chartwinds, phantom-powder-keg. On any hit against versions 1.0.1 or 1.0.4: rebuild cleanly from a verified mirror. On any hit against 1.0.10: treat the host as compromised AND assume whatever paths were in the cargo_hold reply were read and the first 400 bytes exfiltrated - audit the host for recent sensitive file reads matching the known trycloudflare / 154.57.164.64:30664 pattern, and rotate any credential or key file that was reachable. Block egress to nobody-johnston-with-enabling.trycloudflare.com, imaging-amazing-trunk-surgeons.trycloudflare.com, 154.57.164.64:30664, and the broader *.trycloudflare.com wildcard on CI/build hosts (quick-tunnels are a persistent operator-rotation vehicle). Add kristol07 npm identity to the publish-watchlist
  3. For Cluster B amahrou1w dep-confusion trio: grep every manifest for mw-communication-client, mw-test-utils, mui-wrapper-x-date-pickers. On any hit: block egress to 38.242.235.206 on every host (plain HTTP, path /depconf/*), audit internal registry resolution to confirm the internal mw-* and mui-* packages win against the public probe, and add amahrou1w npm identity to the publish-watchlist. The MUI typosquat is sharp - audit any downstream project that pins mui-wrapper-x-date-pickers by mistake for the actual MUI X Date Pickers
  4. For Cluster C kill_shs @zmtcdn pair: grep every manifest for @zmtcdn/components and @zmtcdn/ui. On any hit: block egress to webhook.site/f52af355-4783-4acb-9de1-5e44b5963025 AND www.hinny.shop apex + all subdomains. Audit internal registry resolution for the @zmtcdn scope. Add kill_shs to the publish-watchlist and @zmtcdn/* to the npm registry mirror`s manual-approval list
  5. For Cluster D identity-two-factor (Coinbase): on any Coinbase internal-engineering host, audit internal-registry resolution for identity-two-factor to confirm the internal package wins. For everyone else, grep manifests for the slug + 999.0.0; on any hit, remove, rebuild, add to denylist. Block egress to webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/* on every host
  6. For Cluster E @dmangal/curse-dependent-ecto (HTB/CTF probe): grep manifests for the exact slug + any 99999.0.* version. On any hit: block egress to webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0, rotate CI secrets, and audit /tmp/scent-trail.jsonl + any workspace that was indexed. If this was installed on a non-CTF host, treat it as a real exfil and rotate env
  7. For Cluster F black-spindle-2 ngrok continuity: grep manifests for black-spindle-2 + 100.0.0 / 301.0.0 and (from yesterday) black-spindle + 999.0.0. On any hit, remove, rebuild, add to denylist, and extend the standing block of the ngrok-free.app subdomain pattern (block *.ngrok-free.app on CI/build hosts if your operational posture allows - it is a persistent operator-rotation vehicle)
  8. For Cluster G kam193 BigQuery PTH-sitecustomize cluster (CONFIRMED PAYLOAD; PERSISTENCE): grep every Python requirements file, Pipfile, Pipfile.lock, poetry.lock, uv.lock, pdm.lock and Dockerfile for bq-helix-recon-6ade983e and bq-helix-build-hook-6ade983e. On any hit: on top of a credential rotation (environment variables, cloud credentials, any secret file the installing user could read), AUDIT the interpreters site-packages/ for stray .pth files AND sitecustomize.py planted by this cluster, and pip uninstall + rebuild the interpreter from a known-good cache. PTH-based persistence survives package removal, so a clean pip uninstall is not enough. Block egress to bad-packages.kam193.eu (though note that is OSSFs tracker, not the operator`s exfil endpoint - the actual exfil endpoint was not published in the GHSA advisory, so block broadly and watch firewall logs)
  9. For Cluster H kam193 middleware-backdoor cluster (CONFIRMED BACKDOOR; command execution): grep requirements files for twitter-request-diagnostics and test-01-rafamarrara-learning-dc. On any hit on a production web host: assume the "diagnostic endpoint" was exposed and that the backdoor received at least one attacker command - treat the web host as compromised, pull it off network, image for forensics, rebuild from source. The twitter-request-diagnostics slug is particularly sharp because any Twitter / X API client project could pin it by mistake
  10. For Cluster I poc-revshell (PoC reverse shell to loopback): grep requirements files for poc-revshell. On any hit: no remote impact (localhost-only), but a co-resident attacker on the same host could have taken the shell - audit for suspicious processes with parent PID matching pip, python, or python3, and remove the package
  11. For Cluster J @sudobility/DSH wave-4 (dsh-volcengine-provider): grep manifests for dsh-volcengine-provider + 0.2.5 / 0.2.8. On any hit: assume same networkservicesupp.flashhub.net:8443 XMRig pool shape as prior waves - hunt for XMRig processes, block egress to that pool, add the broader dsh- bare prefix AND @sudobility/* to the npm mirror manual-approval list (already done from prior sweeps - verify)
  12. For Cluster K casino 789bet / m98 10-pack typosquat: grep manifests for all 10 slugs - 789bet, 789bet-vip, 789bet-slot, 789bet-entrance, 789bet-vip-online-login, 789bet-login-th, 789bet-vip-login, m98bet, m98vip, m98th. On any hit on a non-casino-sector developer host, treat as a serious infection vector - the slug mesh is coordinated, add 789bet-* and m98* prefixes to the npm denylist. Alert developers to retire any such slug from AI-assistant prompts
  13. *For Cluster L `dowload_ebok_ 5-pack book-piracy lure**: grep manifests for the dowload_ebok_` prefix (note deliberate misspelling of "download ebook"). On any hit, remove, rebuild. Add the exact prefix to the npm denylist
  14. For Cluster M siren-lament: grep manifests for the exact slug + any of 2.14.822 / 2.14.824 / 2.14.827 / 0.0.0-stage. OSSF-flagged but Amazon-Inspector-cleared, so analysis is uncertain - treat as a soft remove: remove, rebuild, watch for a wave-2 slug under the same siren-* or *-lament prefix. Add slug to the mirror manual-approval list rather than full denylist pending a second analyst`s confirmation
  15. For Cluster N CWE-506 long tail: grep manifests for @chatunitycenter/baileys, react-native-drago-callkit, orderbook-volt-plugin, cjlowuxbnexkhgpzq, bcxhdh1kjlopsde. On any hit, remove, rebuild, add to denylist. Note the @chatunitycenter/baileys typosquats the baileys WhatsApp Web library, so WhatsApp-bot developers are the plausible target - alert that developer community
  16. Standing egress-denylist carry-forward from prior sweeps (keep in place): continue to block networkservicesupp.flashhub.net:8443 (XMRig Monero pool, 2026-10-22 + 2026-10-26 + 2026-10-29 wave-3 + todays wave-4), cdn-status.mulderitsme.net (2026-10-29 csvflow-schema f0x_mulder), 13.140.137.222:8787 + /_ah/dc + 185.158.107.175:8787 (same operator, 2026-10-29 @webapp-shared/login-vmok + MAL-2026-18276 lineage), api.github.com/repos/jerryjohnston91/ + codeload.github.com/jerryjohnston91/ (2026-10-27 netweavex), c2-worker.crawlnet-claim.workers.dev apex + /dl/pyupd, 34.143.131.27:18080 + /x-VA-1/main.js, webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/, 75.119.137.232:31337 + /depconfuse, transfer.archivete.am apex + /H2Uxm/fabdeploycheck-config.json, realwbx.com apex + /ip.php + /ip, artifacts.creditslib.com apex + /npm/, login.fromthehotel.com apex, googleforum.pythonanywhere.com, space-z.ai, dxpoc.gt.tc, raw.githubusercontent.com/anonrider404/pypl/, api-bsx.pages.dev + /download, 177.7.60.239:48080 + oob.recon.dev, uncoder.eu.org + /cc-checker/api.php, accenture-npm.azurewebsites.net, limbomail.com, collector.oob.s4yhii.com + .oob.s4yhii.com + s4yhii.com, 64.181.165.115/dc, 167.88.172.33:8087 + jsonspack.com, goxtools.shop, minhdong.site, 45.138.12.177:8089, ltidi.storage.googleapis.com/depenconf/, oob.s4yhii.com:9999/native, .oast.pro/.oast.me/.oast.fun/.oast.site/.oastify.com, frjmzbjbhwvtdnsuodmu.supabase.co, api.npoint.io, tele.metry.orgin.net, morroncr0w.io, api.telegram.org on untrusted CI/build hosts, appsecc.com, generic webhook.site/ paths, nfjbill.ren, storage.googleapis.com/depenconf/, 10.0.19.0/24 + 10.0.49.0/24, api.nm-streetwear.space, Discord webhook URLs, ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, chinazhangsan.ccwu.cc, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil patterns, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com, 45.138.0.0/16 RubyGems wgkit CIDRs, apexaccs.org apex + subdomains, arenapex.cloud, apexfdn.xyz apex + subdomains, fdn4apex.com, router-apex.com apex + subdomains, ccmihr.com, 0auth-chromium.com, ehegisnightmare.icu, cloudmain365duo.top, www.litellm.dev/healthcheck, raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt, SSH relay services srv.us, .devtunnels.ms, .devtunnels.visualstudio.com, .ngrok-free.dev/canary, 109.94.169.196:8443 + .sslip.io:8443, api.github.com/gists/3775fd9235aa6ef29e96eb96274a0e34, 115.190.210.22`. New-sharp today: webhook.site/d6092bdc-05c0-45da-a280-c343ea6d6156 (Cluster A spectral-core AWS-metadata infostealer), nobody-johnston-with-enabling.trycloudflare.com + imaging-amazing-trunk-surgeons.trycloudflare.com + 154.57.164.64:30664 (Cluster A spectral-net-probe file-exfil beacon), `38.242.235.206/depconf/ (Cluster B amahrou1w dep-confusion trio), webhook.site/f52af355-4783-4acb-9de1-5e44b5963025 + www.hinny.shop apex (Cluster C @zmtcdn pair), webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary (Cluster D Coinbase lure), webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0 (Cluster E HTB probe), .ngrok-free.app on CI/build hosts (Cluster F black-spindle-2), bad-packages.kam193.eu (Cluster G + H kam193 OSSF tracker reference - note this is OSSFs tracker, not the exfil endpoint). New operator identities*: npm amahrou1w (Cluster B), npm kill_shs (Cluster C), npm kristol07 (Cluster A spectral-net-probe + placeholders phantom-chartwinds / phantom-powder-keg), npm hologrammmm0x (Cluster D Coinbase lure)
References

Sources

multi-2026-10-30-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents