# GitHub Advisory malware sweep, 30 October 2026

> Fifty-ish fresh GHSA advisories across the 2026-10-29 → 2026-10-30 window. Headlines are the `spectral-core` 10-version gyp-based AWS-metadata infostealer, three dep-confusion beacon clusters (`amahrou1w` mw-/mui-trio, `kill_shs` `@zmtcdn` pair, `hologrammmm0x` `identity-two-factor` Coinbase lure), kam193 PyPI PTH-sitecustomize cluster (`bq-helix-*` + `twitter-request-diagnostics` + `test-01-rafamarrara-learning-dc`), a `black-spindle-2` ngrok wave-2, a 10-pack casino 789bet/m98 typosquat family, and a 5-pack `dowload_ebok` book-piracy lure.

- Published: 2026-10-30
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 37 packages, 68 compromised versions
- Tags: typosquat, dependency-confusion, infostealer, credential-theft, obfuscation
- Also known as: GHSA 2026-10-29 late batch + 2026-10-30 first wave, spectral-core AWS-metadata infostealer, amahrou1w mw-/mui-wrapper dep-confusion, kill_shs @zmtcdn pair, kam193 bq-helix-recon, kam193 test-01-rafamarrara-learning-dc, black-spindle wave 2, @sudobility DSH wave 4, 789bet/m98 casino typosquat family
- Detected by: GitHub Advisory Database, OpenSSF Package Analysis, Amazon Inspector
- Incident ID: multi-2026-10-30-ghsa-malware-sweep

## Affected packages (37)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@chatunitycenter/baileys](https://dependencywatch.io/package/npm/@chatunitycenter/baileys) | npm | 0.0.0 |
| [@dmangal/curse-dependent-ecto](https://dependencywatch.io/package/npm/@dmangal/curse-dependent-ecto) | npm | 99999.0.0, 99999.0.1, 99999.0.2 |
| [@zmtcdn/components](https://dependencywatch.io/package/npm/@zmtcdn/components) | npm | 9999.0.0 |
| [@zmtcdn/ui](https://dependencywatch.io/package/npm/@zmtcdn/ui) | npm | 9999.0.0, 9999.0.7 |
| [789bet](https://dependencywatch.io/package/npm/789bet) | npm | 0.0.0 |
| [789bet-entrance](https://dependencywatch.io/package/npm/789bet-entrance) | npm | 0.0.0 |
| [789bet-login-th](https://dependencywatch.io/package/npm/789bet-login-th) | npm | 0.0.0 |
| [789bet-slot](https://dependencywatch.io/package/npm/789bet-slot) | npm | 0.0.0 |
| [789bet-vip](https://dependencywatch.io/package/npm/789bet-vip) | npm | 0.0.0 |
| [789bet-vip-login](https://dependencywatch.io/package/npm/789bet-vip-login) | npm | 0.0.0 |
| [789bet-vip-online-login](https://dependencywatch.io/package/npm/789bet-vip-online-login) | npm | 0.0.0 |
| [bcxhdh1kjlopsde](https://dependencywatch.io/package/npm/bcxhdh1kjlopsde) | npm | 0.0.0 |
| [black-spindle-2](https://dependencywatch.io/package/npm/black-spindle-2) | npm | 100.0.0, 301.0.0 |
| [bq-helix-build-hook-6ade983e](https://dependencywatch.io/package/pypi/bq-helix-build-hook-6ade983e) | PyPI | 0.1.0 |
| [bq-helix-recon-6ade983e](https://dependencywatch.io/package/pypi/bq-helix-recon-6ade983e) | PyPI | 0.1.0, 0.1.2 |
| [cjlowuxbnexkhgpzq](https://dependencywatch.io/package/npm/cjlowuxbnexkhgpzq) | npm | 0.0.0 |
| [dowload_ebok_armageddon_by_max_hastings_kv3s4](https://dependencywatch.io/package/npm/dowload_ebok_armageddon_by_max_hastings_kv3s4) | npm | 0.0.0 |
| [dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc](https://dependencywatch.io/package/npm/dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc) | npm | 0.0.0 |
| [dowload_ebok_lolita_by_vladimir_nabokov_oy1gy](https://dependencywatch.io/package/npm/dowload_ebok_lolita_by_vladimir_nabokov_oy1gy) | npm | 0.0.0 |
| [dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t](https://dependencywatch.io/package/npm/dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t) | npm | 0.0.0 |
| [dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p](https://dependencywatch.io/package/npm/dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p) | npm | 0.0.0 |
| [dsh-volcengine-provider](https://dependencywatch.io/package/npm/dsh-volcengine-provider) | npm | 0.2.5, 0.2.8 |
| [identity-two-factor](https://dependencywatch.io/package/npm/identity-two-factor) | npm | 999.0.0 |
| [m98bet](https://dependencywatch.io/package/npm/m98bet) | npm | 0.0.0 |
| [m98th](https://dependencywatch.io/package/npm/m98th) | npm | 0.0.0 |
| [m98vip](https://dependencywatch.io/package/npm/m98vip) | npm | 0.0.0 |
| [mui-wrapper-x-date-pickers](https://dependencywatch.io/package/npm/mui-wrapper-x-date-pickers) | npm | 1.0.0, 10.0.0 |
| [mw-communication-client](https://dependencywatch.io/package/npm/mw-communication-client) | npm | 1.0.1, 10.0.0 |
| [mw-test-utils](https://dependencywatch.io/package/npm/mw-test-utils) | npm | 1.0.0, 10.0.0, 10.0.1 |
| [orderbook-volt-plugin](https://dependencywatch.io/package/npm/orderbook-volt-plugin) | npm | 0.0.0-stage, 0.0.1, 0.0.2 |
| [poc-revshell](https://dependencywatch.io/package/pypi/poc-revshell) | PyPI | 0.1.0 |
| [react-native-drago-callkit](https://dependencywatch.io/package/npm/react-native-drago-callkit) | npm | 0.0.0-stage, 1.0.0, 1.0.1, 1.0.2, 1.0.15, 1.0.16 |
| [siren-lament](https://dependencywatch.io/package/npm/siren-lament) | npm | 0.0.0-stage, 2.14.822, 2.14.824, 2.14.827 |
| [spectral-core](https://dependencywatch.io/package/npm/spectral-core) | npm | 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.9, 3.0.10, 3.0.11, 3.0.12 |
| [spectral-net-probe](https://dependencywatch.io/package/npm/spectral-net-probe) | npm | 1.0.1, 1.0.4, 1.0.10 |
| [test-01-rafamarrara-learning-dc](https://dependencywatch.io/package/pypi/test-01-rafamarrara-learning-dc) | PyPI | 1.0.0 |
| [twitter-request-diagnostics](https://dependencywatch.io/package/pypi/twitter-request-diagnostics) | PyPI | 1.0.0 |

## What happened

Between 2026-10-29 06:00 UTC (yesterday`s sweep cut-off) and 2026-10-30 06:00 UTC (today`s ingest-window start) the GitHub Advisory Database published ~50 npm and PyPI malware advisories. The headlines today are a 10-version `spectral-core` AWS-metadata infostealer (first confirmed-payload install-time infostealer typosquat targeting `@stoplight/spectral-core` since the May 2026 Shai-Hulud burst), four coordinated dep-confusion beacon campaigns, two named `kam193` PyPI campaigns (BigQuery PTH-sitecustomize + web-middleware backdoor), continued operator-continuity under `black-spindle` and the `@sudobility`/DSH family, a 10-pack casino SEO-poisoning typosquat family, and a 5-pack book-piracy lure cluster.

## Headlines

**`spectral-core` 10-version AWS-metadata infostealer** (Cluster A): 10 contiguous versions 3.0.2 through 3.0.12 (skipping 3.0.8) under GHSA-jpgq-34qx-jwwc / OSSF MAL-2026-18377. The attack uses `gypfile: true` so `node-gyp rebuild` runs during install; `binding.gyp` ships no native source and runs an inline `node -e` script that reads `/proc/1/environ` + `/proc/self/environ` (container-init and installing-process env), harvests DNS/socket/ARP/route reconnaissance, queries the AWS EC2 metadata service at `169.254.169.254` for user-data and meta-data, and POSTs the bundle to `https://webhook.site/d6092bdc-05c0-45da-a280-c343ea6d6156`. The declared `main: index.js` is not shipped - the package has no legitimate function. The slug typosquats the real linter `@stoplight/spectral-core`.

**`spectral-net-probe` file-exfil beacon** (also Cluster A): three versions by publisher `kristol07`. 1.0.1 / 1.0.4 ping Cloudflare quick tunnels; 1.0.10 fetches `/api/modules/ECT-654321` from both `http://154.57.164.64:30664` and `http://127.0.0.1:3000`, interprets the reply`s `data.cargo_hold` as a list of 10 filesystem paths, reads each, and PUTs the first 400 bytes of each file to a sibling endpoint - operator-controlled file-content exfil primitive.

**Four dep-confusion beacon campaigns** (Clusters B / C / D / E): `amahrou1w` published `mw-communication-client`, `mw-test-utils` and `mui-wrapper-x-date-pickers` as a 7-version trio with `preinstall`+`postinstall` beacons to `38.242.235.206/depconf/*`; `kill_shs` published `@zmtcdn/components` and `@zmtcdn/ui` as a 3-version pair with `postinstall` beacons to `webhook.site` and `www.hinny.shop/api`; `hologrammmm0x` published `identity-two-factor@999.0.0` with a `cbhq-canary` beacon targeted at Coinbase internal engineering; `@dmangal/curse-dependent-ecto@99999.0.*` is an HTB-flavoured CTF/pentest probe that greps `/workspace/`, `/root/`, `/tmp/`, `/opt/`, `/var/`, `/etc/` for `HTB{` and exfils env.

**Two named `kam193` PyPI campaigns** (Clusters G + H): `2026-10-bq-helix-recon` with `bq-helix-recon-6ade983e@0.1.0, 0.1.2` and `bq-helix-build-hook-6ade983e@0.1.0` places `.pth` / `sitecustomize.py` files for every-Python-startup persistence and exfils cloud metadata + env + credentials - the OSSF reason-tag combination `abuses-pth` + `exfiltration-cloud-tokens` + `exfiltration-generic` + `exfiltration-env-variables` + `exfiltration-credentials` is the standard kam193 shape; `2026-10-test-01-rafamarrara-learning-dc` with `twitter-request-diagnostics@1.0.0` and `test-01-rafamarrara-learning-dc@1.0.0` is a middleware-backdoor + env-exfil pair (first live-today 10-30 PyPI entry), with the `twitter-request-diagnostics` slug typosquatting Twitter/X API clients.

**Operator continuity**: `black-spindle` operator rotated to `black-spindle-2` within 24h of yesterday`s takedown (ngrok beacon continuity); `@sudobility`/DSH family added `dsh-volcengine-provider` as wave-4 (ByteDance Volcengine-themed); the 2026-10-20 Nodveta/Torre.ai fake-interview tailwind-animatecss campaign saw a GHSA-wide republish today expanding the specific-version takedown to "all versions" across `tailwind-animate-kit`, `tailwind-kinetic`, `tailwind-animationlab`, `tailwind-keyframes`, `tailwindcss-animate-catalog`, `tailwindcss-keyframe-kit` AND flagging the previously-private payload scope `@jasperquinn/postcss-motion-helpers` as public malware - those updates are tracked on the 2026-10-20 record rather than duplicated here.

**Casino + book typosquat families** (Clusters K + L): `789bet-*` (7 slugs) + `m98*` (3 slugs) is a coordinated 10-pack SEO-lure mesh impersonating Vietnamese/Thai online-casino brands; `dowload_ebok_*` (5 slugs; deliberate misspelling of "download ebook") is a book-piracy-themed SEO lure. Both are CWE-506 boilerplate on today`s advisories, but the coordinated-mesh and brand-impersonation patterns mark them as serious operator campaigns.

## Classification

`sweep`. Severity `high` (above the sweep baseline `medium`) because Cluster A carries two confirmed-payload install-time infostealers with real AWS-metadata + file-content exfil, Cluster G carries a confirmed PTH-sitecustomize persistence primitive on real PyPI typosquats, and Cluster H carries a confirmed web-exposed backdoor-with-command-execution. Clusters B through F, I through N are `medium`: dep-confusion beacons with captured network IOCs, operator-continuity signals, CTF probes, SEO typosquat meshes, and CWE-506-only takedowns. No cluster reaches `critical` - no legitimate widely-used package was hijacked and no self-propagating worm was observed.

## Discovery

`GitHub Advisory Database`, `OpenSSF malicious-packages` (MAL-2026-18372 through MAL-2026-18403 range on today`s batch), Amazon Inspector static analysis on the npm clusters (A / B / C / D / E / F / M), kam193 operator-controlled tracker `bad-packages.kam193.eu` (Clusters G + H).

## Impact

- **Cluster A - npm `spectral-core` 10-version AWS-metadata infostealer (malicious-package; 1 package / 10 versions, GHSA 2026-10-29)**: `spectral-core@3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.9, 3.0.10, 3.0.11, 3.0.12` (note 3.0.8 skipped) under GHSA-jpgq-34qx-jwwc / OSSF MAL-2026-18377. The slug typosquats `@stoplight/spectral-core` (the real linter from Stoplight) and the AI-ops company Spectral. The attack uses `gypfile: true` so `node-gyp rebuild` runs during install: `binding.gyp` ships NO native source and instead invokes an inline `node -e` script that reads `/proc/1/environ` and `/proc/self/environ` (CI/CD secrets and cloud credentials from the container init and the installing process), harvests DNS/socket/ARP/route reconnaissance output, queries the AWS EC2 metadata service (`169.254.169.254`) for `/latest/user-data` and `/latest/meta-data/`, and POSTs the full bundle to `https://webhook.site/d6092bdc-05c0-45da-a280-c343ea6d6156`. The declared `main: index.js` is not shipped so the package has no legitimate function - the entire tarball exists only to run the install-time infostealer. Amazon Inspector source identifier `451c36f03e81be0ff6c85334587d7ff401de1e5134e179557ec4bc454cd7ba76`. **Severity `high`** (confirmed install-time infostealer with real AWS-metadata/CI-secret-exfil capability; reach is limited to anyone who installed the typosquat, but any build host that ran `npm install` on it is fully exposed and cloud credentials from the container should be treated as leaked)
- **Cluster A also - npm `spectral-net-probe` 3-version file-exfil beacon (malicious-package; 1 package / 3 versions, publisher `kristol07`, GHSA 2026-10-29)**: `spectral-net-probe@1.0.1, 1.0.4, 1.0.10` under GHSA-48mf-mvf8-x4v3 / OSSF MAL-2026-18368. Versions 1.0.1 and 1.0.4 run a `postinstall` → `node index.js` that HTTPS-GETs two Cloudflare quick-tunnel URLs (`nobody-johnston-with-enabling.trycloudflare.com/aa?x=1` and `imaging-amazing-trunk-surgeons.trycloudflare.com/marker104?v=1`) for host-identification pings. Version 1.0.10 escalates: on module load it fetches `/api/modules/ECT-654321` from both `http://154.57.164.64:30664` and `http://127.0.0.1:3000`, interprets the reply`s `data.cargo_hold` field as a list of up to 10 local filesystem paths, reads each, and PUTs the first 400 characters of each file to `/api/modules/ECT-987654` on both hosts. Related placeholder slugs by the same publisher `kristol07`: `phantom-chartwinds`, `phantom-powder-keg` (both pre-published, not yet weaponised). **Severity `high`** (confirmed file-content exfiltration primitive with operator-controlled file selection; same reach caveat as Cluster A)
- **Cluster B - npm `amahrou1w` dep-confusion beacon trio (dependency-confusion; 3 packages / 7 versions, publisher `amahrou1w`, published 2026-10-27, GHSA 2026-10-29)**: `mw-communication-client@1.0.1, 10.0.0` (GHSA-4h9g-fh86-j87q), `mw-test-utils@1.0.0, 10.0.0, 10.0.1` (GHSA-j7r7-x5hv-p975), `mui-wrapper-x-date-pickers@1.0.0, 10.0.0` (GHSA-98qv-v7qr-v3gx) - the `mui-wrapper-*` slug typosquats the MUI X Date Pickers component library. All three run `preinstall` + `postinstall` scripts that HTTP-GET `38.242.235.206/depconf/<package-name>/preinstall` and `/postinstall` with user name, host name and working directory in the request. The README on each slug literally identifies the package as a "dependency-confusion proof of concept" for a bug bounty programme; `0.0.0-stage` placeholder published ~1 minute before each malicious version. Tarball SHA-256: `mw-communication-client` 1.0.1 `f7ea5239784db30ae39f8b3108b85561d52d1771af4f4e41b603a959824ea722`, 10.0.0 `f8aa10f8f000515af3ded7f91db57c266abcc30cecb68565b8fba4ab136a0b11`; `mw-test-utils` 1.0.0 `06a3870b3807b00636c95eea01b057c748dd908fe2677c5dbc05516519a08c56`, 10.0.0 `70cf433a26fee76da087163816b8e3d1939fee9650b1cc6bd0b02b70bba90d9e`, 10.0.1 `1dbbab093762b688298ca21abab34018a5988b9e9647e56ac72152a3b2c8a011`; `mui-wrapper-x-date-pickers` 1.0.0 `32199161095f611bcc41a9d7ae4cbc2abde7b8f697f7decde2152723bd05bff9`, 10.0.0 `b6b650ae811c65b52766a046a10622f638691406f2da8fa180d785d1ef1bdb81`. **Severity `medium`** (dep-confusion probe with confirmed beacon code and leaked host-fingerprint; readme self-identifies as a bug-bounty PoC, but any internal registry that resolves these slugs ahead of the public probe has leaked the win)
- **Cluster C - npm `kill_shs` `@zmtcdn` dep-confusion beacon pair (dependency-confusion; 2 packages / 3 versions, publisher `kill_shs`, GHSA 2026-10-29)**: `@zmtcdn/components@9999.0.0` (GHSA-2pph-m662-c8hg / MAL-2026-18372) and `@zmtcdn/ui@9999.0.0, 9999.0.7` (GHSA-g2vv-m33m-p9qf / MAL-2026-18373). Both run `postinstall` → `node postinstall.js` which POSTs host-name / user-name / platform / cwd / enumerated environment-variable names. `@zmtcdn/components` beacons to `https://webhook.site/f52af355-4783-4acb-9de1-5e44b5963025`; `@zmtcdn/ui` beacons to `https://www.hinny.shop/api`. Description string "Security research PoC" and empty `index.js` match a standard dep-confusion probe. **Severity `medium`** (dep-confusion probes with env-variable-name enumeration leaked; `www.hinny.shop` is operator infrastructure that outlasts a webhook.site rotation)
- **Cluster D - npm `identity-two-factor` Coinbase dep-confusion lure (dependency-confusion; 1 package / 1 version, publisher `hologrammmm0x`, GHSA 2026-10-29)**: `identity-two-factor@999.0.0` (GHSA-2hrq-h3vj-5wxm). `postinstall` → `node postinstall.js` writes a marker file into the OS temp dir and POSTs host-name / user-name / cwd basename / CI flag / Node version to `https://webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary`. The `cbhq-canary` path is explicit: `cbhq` = Coinbase Holdings, so this is a targeted dep-confusion probe against the Coinbase internal registry under the internal-package name `identity-two-factor`. **Severity `medium`** (confirmed targeted dep-confusion probe against a named organisation; nothing to clean up outside Coinbase internal engineering, but anyone else who installed it leaked a host fingerprint)
- **Cluster E - npm `@dmangal/curse-dependent-ecto` HackTheBox/CTF probe (dependency-confusion; 1 package / 3 versions, GHSA 2026-10-29)**: `@dmangal/curse-dependent-ecto@99999.0.0, 99999.0.1, 99999.0.2` (GHSA-prqg-vvv3-2xf8 / MAL-2026-18375). `binding.gyp` runs an inline `node -e` script during `node-gyp rebuild`: searches `/workspace/`, `/root/`, `/tmp/`, `/opt/`, `/var/`, `/etc/` for the literal string `HTB{` (the HackTheBox CTF flag format), reads `/tmp/scent-trail.jsonl` and `/workspace/repo/package.json`, enumerates every `process.env` key/value pair, and POSTs the triple to `https://webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0` prefixed `GREP:`, `FILE:`, or `ALLENV:` by category. The `99999.0.*` version shape marks this as dep-confusion; the HTB{ grep and the workspace-repo targeting mark it as a CTF or red-team-exercise probe rather than an opportunistic attack. **Severity `medium`** (CTF-shaped probe with confirmed env-variable + workspace-file exfil; harmless on a non-HTB machine but exfilrates env on any host that installed it)
- **Cluster F - npm `black-spindle-2` wave-2 ngrok beacon (dependency-confusion; 1 package / 2 versions, GHSA 2026-10-29)**: `black-spindle-2@100.0.0, 301.0.0` (GHSA-qcg8-4xw5-5ccq / OSSF MAL-2026-18376). `postinstall` curl against `http://778e-181-63-25-28.ngrok-free.app` over plain HTTP; the URL path embeds a shell command-substitution expression so it runs on `npm install` and leaks the expanded output. `index.js` is empty. The slug and version-shape continuity with yesterday`s Cluster C `black-spindle@999.0.0` (GHSA-9939-65w7-25v2) confirms the same operator rotated to a sibling slug within 24h after takedown. Source identifier `433228fbed18f3104fed4cd1bce59bc5a76b8ea061d18c8fc9516c92b6b26e90`. **Severity `medium`** (operator continuity with yesterday`s `black-spindle` plus confirmed ngrok-tunnel install-confirmation beacon)
- **Cluster G - PyPI kam193 `2026-10-bq-helix-recon` BigQuery PTH-sitecustomize infostealer (malicious-package; 2 packages / 3 versions, OSSF campaign `2026-10-bq-helix-recon`, GHSA 2026-10-29)**: `bq-helix-recon-6ade983e@0.1.0, 0.1.2` (GHSA-9r7r-h4fq-xj8p / MAL-2026-18396) and `bq-helix-build-hook-6ade983e@0.1.0` (GHSA-526r-6j5j-v9pv / MAL-2026-18395). The slugs typosquat Google BigQuery (`bq-*`) tooling; the `-6ade983e` 8-hex suffix is the shared campaign tag the operator uses to correlate the pair at the OSSF tracker (`bad-packages.kam193.eu/pypi/package/<name>`). Each package places a `.pth` and/or `sitecustomize.py` file so arbitrary code runs on EVERY Python interpreter startup (not just once at install) - a persistence primitive. The code then collects credential files, environment variables and cloud metadata and exfiltrates them. OSSF reason tags: `abuses-pth`, `exfiltration-cloud-tokens`, `exfiltration-generic`, `exfiltration-env-variables`, `exfiltration-credentials`. **Severity `medium`** (confirmed cloud-metadata + env-var infostealer with PTH-persistence; reach limited to Python developers who installed the typosquat but any host that ran either package is both exfiltrated AND persistently hooked for every subsequent Python invocation on that interpreter)
- **Cluster H - PyPI kam193 `2026-10-test-01-rafamarrara-learning-dc` middleware-backdoor campaign (malicious-package; 2 packages / 2 versions, OSSF campaign tag, GHSA 2026-10-30)**: `twitter-request-diagnostics@1.0.0` (GHSA-w3jr-q4jr-xq95 / MAL-2026-18403) and `test-01-rafamarrara-learning-dc@1.0.0` (GHSA-9wjc-g5vf-3m22 / MAL-2026-18402). Both present as a web-app middleware adding a "diagnostic endpoint" - OSSF reason tags are `backdoor` and `exfiltration-env-variables`. The hidden endpoint exfiltrates environment variables AND executes attacker-sent commands - this is a web-exposed backdoor, not an install-time beacon. The `twitter-request-diagnostics` slug typosquats legitimate Twitter / X API client libraries. The campaign tag names a user `rafamarrara` (plausibly the operator throwaway identity, cf. 2026-10-28 `kam193` cluster where the operator-controlled tracker reused forum-handle shaped tags). **Severity `medium`** (confirmed backdoor with command execution AND env exfil, but the attack requires the victim to deploy the middleware in a web app, so reach is narrow)
- **Cluster I - PyPI `poc-revshell` localhost reverse shell PoC (malicious-package; 1 package / 1 version, GHSA 2026-10-29)**: `poc-revshell@0.1.0` (GHSA-h7h9-fmhv-56wh / MAL-2026-18378). `setup.py` registers a custom `install` cmdclass (PostInstall) that spawns a daemon thread during `pip install`; the thread opens a TCP socket to `127.0.0.1:4444`, dup2s it onto stdin/stdout/stderr, and launches `/bin/sh -i` (Windows: `cmd.exe`). `__init__.py` repeats the same thread on `import poc_revshell`. The loopback destination limits exploitation to a co-resident attacker on the same host; nothing is exfiltrated remotely. Amazon Inspector source identifier `08edc162927c80cde9e467244a435780f65ca95823e97ec73534faf34233ac9a`. **Severity `medium`** (confirmed reverse-shell primitive, but the loopback target makes it a research PoC rather than a reach-into-prod attack; still blocks `pip install` on any shared/multi-tenant host from being safe)
- **Cluster J - npm `@sudobility`/DSH family wave-4 continuation (malicious-package; 1 new package today, 2026-10-29 GHSA advisory)**: `dsh-volcengine-provider@0.2.5, 0.2.8` (GHSA-8hr2-m7vq-fhpg). CWE-506 boilerplate on the GHSA advisory without captured payload bytes. The `dsh-` prefix continues the DeepSeek-Harness-themed lure family (yesterday was `dsh-redteam-mode@0.15.2` and bare-slug `dsh-plugin-blender-3d@0.2.1`; two days ago was scoped `@sudobility/dsh-plugin-blender-3d`); the `volcengine` suffix names ByteDance`s public cloud, so this slug targets ByteDance/Volcengine SDK integrators. Working assumption is the same `networkservicesupp.flashhub.net:8443` XMRig Monero pool shape as the 2026-10-22 / 10-26 / 10-28 waves pending a vendor post-mortem. **Severity `medium`** for the cluster (operator continuity confirmed; nothing legitimate depends on these slugs; any host that installed either should be hunted for XMRig egress to the standing-denylist pool)
- **Cluster K - npm casino 789bet / m98 10-pack typosquat family (typosquat; 10 packages, all versions, 2026-10-29 GHSA advisories)**: `789bet` (GHSA-cccw-qphx-7whg), `789bet-vip` (GHSA-rvxc-82gp-xpr6), `789bet-slot` (GHSA-q68g-454g-9qww), `789bet-entrance` (GHSA-6xqc-cfvp-q89v), `789bet-vip-online-login` (GHSA-f5mv-v4rc-qq2q), `789bet-login-th` (GHSA-wg3r-wqgc-7fgf), `789bet-vip-login` (GHSA-4rjq-j97h-cqxc), `m98bet` (GHSA-6ggw-hqvq-8wcm), `m98vip` (GHSA-gp92-xqcg-876c), `m98th` (GHSA-x82c-crm3-jcwv) - each at `>= 0` (all versions). All CWE-506 boilerplate on today`s advisories without captured payload bytes. The `789bet` and `m98` brand prefixes are high-profile Vietnamese/Thai online-casino operators (789bet.com and m98 chain are well-known in Southeast-Asian gambling markets), the `-slot` / `-entrance` / `-login` / `-vip-online-login` / `-login-th` suffixes are classic SEO-poisoning lure terminology for players seeking casino login portals, and the 10-pack coordinated-slug mesh is a clear operator pattern. **Severity `medium`** for the cluster (CWE-506-only on today`s advisories but the coordinated 10-pack SEO-lure mesh plus the casino-brand impersonation make this a serious coordinated typosquat; the plausible target is SEO-poisoned traffic to malicious login pages rather than npm installs, but any dev who added one of these as a dependency chasing an "SDK" is fully compromised)
- **Cluster L - npm `dowload_ebok_*` 5-pack book-piracy typosquat lure (typosquat; 5 packages, all versions, 2026-10-29 GHSA advisories)**: `dowload_ebok_lolita_by_vladimir_nabokov_oy1gy` (GHSA-cjmr-6xg2-vf8h), `dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc` (GHSA-j272-m9j4-g3v9), `dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t` (GHSA-5cmc-vx46-22wx), `dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p` (GHSA-h86m-7gvf-j79h), `dowload_ebok_armageddon_by_max_hastings_kv3s4` (GHSA-p6mc-228w-6q75) - each at `>= 0`. All CWE-506 boilerplate without captured payload. The `dowload_ebok` prefix (misspelled "download ebook") plus book-title + author + random hex suffix matches a bulk SEO-poisoning / piracy-lure pattern previously seen targeting Google Scholar / ResearchGate searches - the operator wants traffic to a malicious ebook download page, not npm installs. **Severity `medium`** (coordinated SEO-lure typosquat family; limited npm reach, but anyone whose dependency manager auto-resolved these slugs is in scope)
- **Cluster M - npm `siren-lament` OSSF-flagged but contradictory analysis (malicious-package; 1 package / 4 versions, 2026-10-29 GHSA advisory)**: `siren-lament@2.14.822, 2.14.824, 2.14.827, 0.0.0-stage` (GHSA-3jx4-3p7f-pv7p). OSSF Package Analysis flagged 2.14.827 "The package executes one or more commands associated with malicious behavior" (hash `092c6ea787d7e5e30dda10413bd19dd94ef1007bec6652aa050ecd4e27acbf4f`); Amazon Inspector`s analysis (hash `66198e889b19f908f338ab5cad00c57bc95194bff8938dcf26c4a853c0b260d8`) found NO lifecycle scripts, remote fetches, credential reads or exfiltration paths and noted the two-file package and `0.0.0-stage` version may indicate a placeholder/staging publish. The advisory is linked to OSSF campaign MAL-2025-49247 (note 2025 - old record). **Severity `medium`** (contradictory analysis - OSSF-only flag with no corroboration from a second tool - but the slug and 4-version takedown pattern mark the operator)
- **Cluster N - npm CWE-506 long tail (malicious-package; 6 packages, 2026-10-29 GHSA advisories)**: `@chatunitycenter/baileys` all versions (GHSA-g6j7-j669-23g6, slug typosquats the `baileys` WhatsApp Web library used in bot / automation projects), `react-native-drago-callkit@0.0.0-stage, 1.0.0, 1.0.1, 1.0.2, 1.0.15, 1.0.16` (GHSA-jp74-4rg3-7ppj, React Native CallKit-themed lure), `orderbook-volt-plugin@0.0.0-stage, 0.0.1, 0.0.2` (GHSA-w9pq-6r9f-pj96, DeFi orderbook-themed lure), `cjlowuxbnexkhgpzq` all versions (GHSA-pr23-gvcv-c422, random slug - keyboard-mash lure), `bcxhdh1kjlopsde` all versions (GHSA-v78q-7787-v9rq, random slug - keyboard-mash lure). CWE-506 boilerplate on all five without captured payload. **Severity `medium`** per package
- **Operator continuity**: **`kam193` PyPI campaign operator is active again** - the 2026-10-28 sweep covered `trajmetrics` / `numprint` / `h13t0ry-hello-demo` as "kam193 Cluster A"; today reveals two new named campaigns from the same operator-controlled tracker (`bad-packages.kam193.eu`): `2026-10-bq-helix-recon` (BigQuery PTH-sitecustomize infostealer, Cluster G) and `2026-10-test-01-rafamarrara-learning-dc` (middleware backdoor, Cluster H, first live on 10-30). **`black-spindle` operator is back** - yesterday`s Cluster C `black-spindle@999.0.0` → today`s Cluster F `black-spindle-2@100.0.0, 301.0.0` is the ngrok-beacon operator rotating to a sibling slug within 24h. **`@sudobility`/DSH family is on wave-4** - the 2026-10-28 sweep claimed "idle today", the 2026-10-29 sweep (today`s predecessor) added three slugs including `dsh-redteam-mode@0.15.2`, and today`s Cluster J adds `dsh-volcengine-provider` (ByteDance Volcengine typosquat continuation). **tailwind-animatecss fake interview is on wave-2** - today`s GHSA batch republishes `tailwind-animate-kit` / `tailwind-kinetic` / `tailwind-animationlab` / `tailwind-keyframes` / `tailwindcss-animate-catalog` / `tailwindcss-keyframe-kit` as "all versions" (expanding the specific-version takedown from 2026-10-20), AND for the first time flags the private payload scope `@jasperquinn/postcss-motion-helpers` as public malware. These updates are tracked on the [2026-10-20 Nodveta/Torre.ai record](https://dependencywatch.io/incident/npm-2026-10-20-tailwind-animatecss-fake-interview-campaign) rather than duplicated here. **New operator identities**: npm `amahrou1w` (Cluster B dep-confusion trio), npm `kill_shs` (Cluster C @zmtcdn pair), npm `kristol07` (Cluster A spectral-net-probe, also phantom-chartwinds / phantom-powder-keg placeholders), npm `hologrammmm0x` (Cluster D Coinbase lure). Carve-outs [LiteLLM 1.107.0](https://dependencywatch.io/incident/pypi-2026-10-21-litellm-infostealer-rat), [Tailwind Animate.css fake-interview](https://dependencywatch.io/incident/npm-2026-10-20-tailwind-animatecss-fake-interview-campaign), [Apex Accelerator REF8801](https://dependencywatch.io/incident/npm-2026-10-19-apex-accelerator-malicious-npm-packages), [TensorLake AI](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise), [hridoy FB credential stealer](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer), [anthropic-sdk PyPI typosquat](https://dependencywatch.io/incident/pypi-2026-10-05-anthropic-sdk-typosquat), the [2026-10-27 netweavex NetworkX typosquat](https://dependencywatch.io/incident/multi-2026-10-27-ghsa-malware-sweep), the [2026-10-28 kam193 PyPI trio + camera.ui NVR compromise](https://dependencywatch.io/incident/multi-2026-10-28-ghsa-malware-sweep) and the [2026-10-29 @testsecuiitytestme Shai-Hulud wave-2 shaped loader](https://dependencywatch.io/incident/npm-2026-10-29-ghsa-malware-sweep) all remain confirmed-recovered with no wave-2 malicious republish observed today

## What to do

1. **For Cluster A `spectral-core` AWS-metadata infostealer (CONFIRMED PAYLOAD - treat as high-urgency)**: grep every `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, Dockerfile and container-image manifest for the literal string `spectral-core` (unscoped). On any hit: treat the build host as compromised, assume the AWS EC2 metadata service returned user-data and IAM role credentials, rotate every cloud credential reachable from that host (AWS access keys, IAM role credentials, user-data secrets, every secret-manager entry readable to the role), rotate every CI/CD secret the container had access to, and audit CloudTrail / GuardDuty for unusual API calls using the role between the first install and discovery. Block egress to `webhook.site/d6092bdc-05c0-45da-a280-c343ea6d6156` on every host (and broader `webhook.site/*` on CI/build hosts). Add `spectral-core` (unscoped) to the npm denylist; the legitimate linter is `@stoplight/spectral-core` and should be pinned explicitly going forward
2. **For Cluster A `spectral-net-probe` file-exfil beacon (CONFIRMED PAYLOAD)**: grep every manifest for `spectral-net-probe` AND for the related placeholder slugs `phantom-chartwinds`, `phantom-powder-keg`. On any hit against versions 1.0.1 or 1.0.4: rebuild cleanly from a verified mirror. On any hit against 1.0.10: treat the host as compromised AND assume whatever paths were in the `cargo_hold` reply were read and the first 400 bytes exfiltrated - audit the host for recent sensitive file reads matching the known trycloudflare / `154.57.164.64:30664` pattern, and rotate any credential or key file that was reachable. Block egress to `nobody-johnston-with-enabling.trycloudflare.com`, `imaging-amazing-trunk-surgeons.trycloudflare.com`, `154.57.164.64:30664`, and the broader `*.trycloudflare.com` wildcard on CI/build hosts (quick-tunnels are a persistent operator-rotation vehicle). Add `kristol07` npm identity to the publish-watchlist
3. **For Cluster B `amahrou1w` dep-confusion trio**: grep every manifest for `mw-communication-client`, `mw-test-utils`, `mui-wrapper-x-date-pickers`. On any hit: block egress to `38.242.235.206` on every host (plain HTTP, path `/depconf/*`), audit internal registry resolution to confirm the internal `mw-*` and `mui-*` packages win against the public probe, and add `amahrou1w` npm identity to the publish-watchlist. The MUI typosquat is sharp - audit any downstream project that pins `mui-wrapper-x-date-pickers` by mistake for the actual MUI X Date Pickers
4. **For Cluster C `kill_shs` `@zmtcdn` pair**: grep every manifest for `@zmtcdn/components` and `@zmtcdn/ui`. On any hit: block egress to `webhook.site/f52af355-4783-4acb-9de1-5e44b5963025` AND `www.hinny.shop` apex + all subdomains. Audit internal registry resolution for the `@zmtcdn` scope. Add `kill_shs` to the publish-watchlist and `@zmtcdn/*` to the npm registry mirror`s manual-approval list
5. **For Cluster D `identity-two-factor` (Coinbase)**: on any Coinbase internal-engineering host, audit internal-registry resolution for `identity-two-factor` to confirm the internal package wins. For everyone else, grep manifests for the slug + 999.0.0; on any hit, remove, rebuild, add to denylist. Block egress to `webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/*` on every host
6. **For Cluster E `@dmangal/curse-dependent-ecto` (HTB/CTF probe)**: grep manifests for the exact slug + any 99999.0.* version. On any hit: block egress to `webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0`, rotate CI secrets, and audit `/tmp/scent-trail.jsonl` + any workspace that was indexed. If this was installed on a non-CTF host, treat it as a real exfil and rotate env
7. **For Cluster F `black-spindle-2` ngrok continuity**: grep manifests for `black-spindle-2` + 100.0.0 / 301.0.0 and (from yesterday) `black-spindle` + 999.0.0. On any hit, remove, rebuild, add to denylist, and extend the standing block of the ngrok-free.app subdomain pattern (block `*.ngrok-free.app` on CI/build hosts if your operational posture allows - it is a persistent operator-rotation vehicle)
8. **For Cluster G kam193 BigQuery PTH-sitecustomize cluster (CONFIRMED PAYLOAD; PERSISTENCE)**: grep every Python requirements file, Pipfile, Pipfile.lock, poetry.lock, uv.lock, pdm.lock and Dockerfile for `bq-helix-recon-6ade983e` and `bq-helix-build-hook-6ade983e`. On any hit: on top of a credential rotation (environment variables, cloud credentials, any secret file the installing user could read), AUDIT the interpreter`s `site-packages/` for stray `.pth` files AND `sitecustomize.py` planted by this cluster, and `pip uninstall` + rebuild the interpreter from a known-good cache. PTH-based persistence survives package removal, so a clean `pip uninstall` is not enough. Block egress to `bad-packages.kam193.eu` (though note that is OSSF`s tracker, not the operator`s exfil endpoint - the actual exfil endpoint was not published in the GHSA advisory, so block broadly and watch firewall logs)
9. **For Cluster H kam193 middleware-backdoor cluster (CONFIRMED BACKDOOR; command execution)**: grep requirements files for `twitter-request-diagnostics` and `test-01-rafamarrara-learning-dc`. On any hit on a production web host: assume the "diagnostic endpoint" was exposed and that the backdoor received at least one attacker command - treat the web host as compromised, pull it off network, image for forensics, rebuild from source. The `twitter-request-diagnostics` slug is particularly sharp because any Twitter / X API client project could pin it by mistake
10. **For Cluster I `poc-revshell` (PoC reverse shell to loopback)**: grep requirements files for `poc-revshell`. On any hit: no remote impact (localhost-only), but a co-resident attacker on the same host could have taken the shell - audit for suspicious processes with parent PID matching `pip`, `python`, or `python3`, and remove the package
11. **For Cluster J `@sudobility`/DSH wave-4 (`dsh-volcengine-provider`)**: grep manifests for `dsh-volcengine-provider` + 0.2.5 / 0.2.8. On any hit: assume same `networkservicesupp.flashhub.net:8443` XMRig pool shape as prior waves - hunt for XMRig processes, block egress to that pool, add the broader `dsh-` bare prefix AND `@sudobility/*` to the npm mirror manual-approval list (already done from prior sweeps - verify)
12. **For Cluster K casino 789bet / m98 10-pack typosquat**: grep manifests for all 10 slugs - `789bet`, `789bet-vip`, `789bet-slot`, `789bet-entrance`, `789bet-vip-online-login`, `789bet-login-th`, `789bet-vip-login`, `m98bet`, `m98vip`, `m98th`. On any hit on a non-casino-sector developer host, treat as a serious infection vector - the slug mesh is coordinated, add `789bet-*` and `m98*` prefixes to the npm denylist. Alert developers to retire any such slug from AI-assistant prompts
13. **For Cluster L `dowload_ebok_*` 5-pack book-piracy lure**: grep manifests for the `dowload_ebok_` prefix (note deliberate misspelling of "download ebook"). On any hit, remove, rebuild. Add the exact prefix to the npm denylist
14. **For Cluster M `siren-lament`**: grep manifests for the exact slug + any of 2.14.822 / 2.14.824 / 2.14.827 / 0.0.0-stage. OSSF-flagged but Amazon-Inspector-cleared, so analysis is uncertain - treat as a soft remove: remove, rebuild, watch for a wave-2 slug under the same `siren-*` or `*-lament` prefix. Add slug to the mirror manual-approval list rather than full denylist pending a second analyst`s confirmation
15. **For Cluster N CWE-506 long tail**: grep manifests for `@chatunitycenter/baileys`, `react-native-drago-callkit`, `orderbook-volt-plugin`, `cjlowuxbnexkhgpzq`, `bcxhdh1kjlopsde`. On any hit, remove, rebuild, add to denylist. Note the `@chatunitycenter/baileys` typosquats the `baileys` WhatsApp Web library, so WhatsApp-bot developers are the plausible target - alert that developer community
16. **Standing egress-denylist carry-forward from prior sweeps** (keep in place): continue to block `networkservicesupp.flashhub.net:8443` (XMRig Monero pool, 2026-10-22 + 2026-10-26 + 2026-10-29 wave-3 + today`s wave-4), `cdn-status.mulderitsme.net` (2026-10-29 csvflow-schema `f0x_mulder`), `13.140.137.222:8787` + `/_ah/dc` + `185.158.107.175:8787` (same operator, 2026-10-29 `@webapp-shared/login-vmok` + MAL-2026-18276 lineage), `api.github.com/repos/jerryjohnston91/*` + `codeload.github.com/jerryjohnston91/*` (2026-10-27 netweavex), `c2-worker.crawlnet-claim.workers.dev` apex + `/dl/pyupd`, `34.143.131.27:18080` + `/x-VA-1/main.js`, `webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/`, `75.119.137.232:31337` + `/depconfuse`, `transfer.archivete.am` apex + `/H2Uxm/fabdeploycheck-config.json`, `realwbx.com` apex + `/ip.php` + `/ip`, `artifacts.creditslib.com` apex + `/npm/*`, `login.fromthehotel.com` apex, `googleforum.pythonanywhere.com`, `space-z.ai`, `dxpoc.gt.tc`, `raw.githubusercontent.com/anonrider404/pypl/*`, `api-bsx.pages.dev` + `/download`, `177.7.60.239:48080` + `oob.recon.dev`, `uncoder.eu.org` + `/cc-checker/api.php`, `accenture-npm.azurewebsites.net`, `limbomail.com`, `collector.oob.s4yhii.com` + `*.oob.s4yhii.com` + `s4yhii.com`, `64.181.165.115/dc`, `167.88.172.33:8087` + `jsonspack.com`, `goxtools.shop`, `minhdong.site`, `45.138.12.177:8089`, `ltidi.storage.googleapis.com/depenconf/`, `oob.s4yhii.com:9999/native`, `*.oast.pro`/`*.oast.me`/`*.oast.fun`/`*.oast.site`/`*.oastify.com`, `frjmzbjbhwvtdnsuodmu.supabase.co`, `api.npoint.io`, `tele.metry.orgin.net`, `morroncr0w.io`, `api.telegram.org` on untrusted CI/build hosts, `appsecc.com`, generic `webhook.site/*` paths, `nfjbill.ren`, `storage.googleapis.com/depenconf/`, `10.0.19.0/24` + `10.0.49.0/24`, `api.nm-streetwear.space`, Discord webhook URLs, `ipify.org` + `ifconfig.me`, `gitflic.ru`, `api.wagmiwallet.org`, `backend-cybersecuritydashboard.onrender.com`, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, `chinazhangsan.ccwu.cc`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `npm-canary.aveliscare.com`, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil patterns, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, `tuamaeaquelaursa.com`, `45.138.0.0/16` RubyGems wgkit CIDRs, `apexaccs.org` apex + subdomains, `arenapex.cloud`, `apexfdn.xyz` apex + subdomains, `fdn4apex.com`, `router-apex.com` apex + subdomains, `ccmihr.com`, `0auth-chromium.com`, `ehegisnightmare.icu`, `cloudmain365duo.top`, `www.litellm.dev/healthcheck`, `raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt`, SSH relay services `srv.us`, `*.devtunnels.ms`, `*.devtunnels.visualstudio.com`, `*.ngrok-free.dev/canary`, `109.94.169.196:8443` + `*.sslip.io:8443`, `api.github.com/gists/3775fd9235aa6ef29e96eb96274a0e34`, `115.190.210.22`. **New-sharp today**: `webhook.site/d6092bdc-05c0-45da-a280-c343ea6d6156` (Cluster A spectral-core AWS-metadata infostealer), `nobody-johnston-with-enabling.trycloudflare.com` + `imaging-amazing-trunk-surgeons.trycloudflare.com` + `154.57.164.64:30664` (Cluster A spectral-net-probe file-exfil beacon), `38.242.235.206/depconf/*` (Cluster B amahrou1w dep-confusion trio), `webhook.site/f52af355-4783-4acb-9de1-5e44b5963025` + `www.hinny.shop` apex (Cluster C @zmtcdn pair), `webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary` (Cluster D Coinbase lure), `webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0` (Cluster E HTB probe), `*.ngrok-free.app` on CI/build hosts (Cluster F black-spindle-2), `bad-packages.kam193.eu` (Cluster G + H kam193 OSSF tracker reference - note this is OSSF`s tracker, not the exfil endpoint). **New operator identities**: npm `amahrou1w` (Cluster B), npm `kill_shs` (Cluster C), npm `kristol07` (Cluster A spectral-net-probe + placeholders phantom-chartwinds / phantom-powder-keg), npm `hologrammmm0x` (Cluster D Coinbase lure)

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-jpgq-34qx-jwwc - npm spectral-core@3.0.2-3.0.12 (Cluster A - gyp AWS-metadata + /proc/*/environ infostealer, OSSF MAL-2026-18377, typosquats @stoplight/spectral-core)](https://github.com/advisories/GHSA-jpgq-34qx-jwwc) - GitHub
- [GHSA-48mf-mvf8-x4v3 - npm spectral-net-probe@1.0.1,1.0.4,1.0.10 (Cluster A - trycloudflare + 154.57.164.64:30664 file-exfil beacon, publisher kristol07, OSSF MAL-2026-18368)](https://github.com/advisories/GHSA-48mf-mvf8-x4v3) - GitHub
- [GHSA-4h9g-fh86-j87q - npm mw-communication-client@1.0.1,10.0.0 (Cluster B - amahrou1w dep-confusion, 38.242.235.206 beacon)](https://github.com/advisories/GHSA-4h9g-fh86-j87q) - GitHub
- [GHSA-j7r7-x5hv-p975 - npm mw-test-utils@1.0.0,10.0.0,10.0.1 (Cluster B - amahrou1w dep-confusion)](https://github.com/advisories/GHSA-j7r7-x5hv-p975) - GitHub
- [GHSA-98qv-v7qr-v3gx - npm mui-wrapper-x-date-pickers@1.0.0,10.0.0 (Cluster B - amahrou1w dep-confusion, MUI X Date Pickers typosquat)](https://github.com/advisories/GHSA-98qv-v7qr-v3gx) - GitHub
- [GHSA-2pph-m662-c8hg - npm @zmtcdn/components@9999.0.0 (Cluster C - kill_shs dep-confusion, webhook.site beacon, MAL-2026-18372)](https://github.com/advisories/GHSA-2pph-m662-c8hg) - GitHub
- [GHSA-g2vv-m33m-p9qf - npm @zmtcdn/ui@9999.0.0,9999.0.7 (Cluster C - kill_shs dep-confusion, hinny.shop beacon, MAL-2026-18373)](https://github.com/advisories/GHSA-g2vv-m33m-p9qf) - GitHub
- [GHSA-2hrq-h3vj-5wxm - npm identity-two-factor@999.0.0 (Cluster D - hologrammmm0x Coinbase cbhq-canary beacon)](https://github.com/advisories/GHSA-2hrq-h3vj-5wxm) - GitHub
- [GHSA-prqg-vvv3-2xf8 - npm @dmangal/curse-dependent-ecto@99999.0.0-99999.0.2 (Cluster E - gyp CTF/HTB{ probe, MAL-2026-18375)](https://github.com/advisories/GHSA-prqg-vvv3-2xf8) - GitHub
- [GHSA-qcg8-4xw5-5ccq - npm black-spindle-2@100.0.0,301.0.0 (Cluster F - ngrok wave-2 continuity of yesterday`s black-spindle, MAL-2026-18376)](https://github.com/advisories/GHSA-qcg8-4xw5-5ccq) - GitHub
- [GHSA-9r7r-h4fq-xj8p - PyPI bq-helix-recon-6ade983e@0.1.0,0.1.2 (Cluster G - kam193 2026-10-bq-helix-recon PTH/sitecustomize infostealer, MAL-2026-18396)](https://github.com/advisories/GHSA-9r7r-h4fq-xj8p) - GitHub
- [GHSA-526r-6j5j-v9pv - PyPI bq-helix-build-hook-6ade983e@0.1.0 (Cluster G - kam193 campaign, MAL-2026-18395)](https://github.com/advisories/GHSA-526r-6j5j-v9pv) - GitHub
- [GHSA-w3jr-q4jr-xq95 - PyPI twitter-request-diagnostics@1.0.0 (Cluster H - kam193 2026-10-test-01-rafamarrara-learning-dc middleware backdoor + env exfil, MAL-2026-18403)](https://github.com/advisories/GHSA-w3jr-q4jr-xq95) - GitHub
- [GHSA-9wjc-g5vf-3m22 - PyPI test-01-rafamarrara-learning-dc@1.0.0 (Cluster H - kam193 campaign root, MAL-2026-18402)](https://github.com/advisories/GHSA-9wjc-g5vf-3m22) - GitHub
- [GHSA-h7h9-fmhv-56wh - PyPI poc-revshell@0.1.0 (Cluster I - localhost reverse shell PoC, MAL-2026-18378)](https://github.com/advisories/GHSA-h7h9-fmhv-56wh) - GitHub
- [GHSA-8hr2-m7vq-fhpg - npm dsh-volcengine-provider@0.2.5,0.2.8 (Cluster J - @sudobility/DSH wave-4 continuity, ByteDance Volcengine typosquat)](https://github.com/advisories/GHSA-8hr2-m7vq-fhpg) - GitHub
- [GHSA-cccw-qphx-7whg - npm 789bet (Cluster K - casino typosquat family)](https://github.com/advisories/GHSA-cccw-qphx-7whg) - GitHub
- [GHSA-rvxc-82gp-xpr6 - npm 789bet-vip (Cluster K)](https://github.com/advisories/GHSA-rvxc-82gp-xpr6) - GitHub
- [GHSA-q68g-454g-9qww - npm 789bet-slot (Cluster K)](https://github.com/advisories/GHSA-q68g-454g-9qww) - GitHub
- [GHSA-6xqc-cfvp-q89v - npm 789bet-entrance (Cluster K)](https://github.com/advisories/GHSA-6xqc-cfvp-q89v) - GitHub
- [GHSA-f5mv-v4rc-qq2q - npm 789bet-vip-online-login (Cluster K)](https://github.com/advisories/GHSA-f5mv-v4rc-qq2q) - GitHub
- [GHSA-wg3r-wqgc-7fgf - npm 789bet-login-th (Cluster K)](https://github.com/advisories/GHSA-wg3r-wqgc-7fgf) - GitHub
- [GHSA-4rjq-j97h-cqxc - npm 789bet-vip-login (Cluster K)](https://github.com/advisories/GHSA-4rjq-j97h-cqxc) - GitHub
- [GHSA-6ggw-hqvq-8wcm - npm m98bet (Cluster K)](https://github.com/advisories/GHSA-6ggw-hqvq-8wcm) - GitHub
- [GHSA-gp92-xqcg-876c - npm m98vip (Cluster K)](https://github.com/advisories/GHSA-gp92-xqcg-876c) - GitHub
- [GHSA-x82c-crm3-jcwv - npm m98th (Cluster K)](https://github.com/advisories/GHSA-x82c-crm3-jcwv) - GitHub
- [GHSA-cjmr-6xg2-vf8h - npm dowload_ebok_lolita_by_vladimir_nabokov_oy1gy (Cluster L - book-piracy typosquat lure)](https://github.com/advisories/GHSA-cjmr-6xg2-vf8h) - GitHub
- [GHSA-j272-m9j4-g3v9 - npm dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc (Cluster L)](https://github.com/advisories/GHSA-j272-m9j4-g3v9) - GitHub
- [GHSA-5cmc-vx46-22wx - npm dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t (Cluster L)](https://github.com/advisories/GHSA-5cmc-vx46-22wx) - GitHub
- [GHSA-h86m-7gvf-j79h - npm dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p (Cluster L)](https://github.com/advisories/GHSA-h86m-7gvf-j79h) - GitHub
- [GHSA-p6mc-228w-6q75 - npm dowload_ebok_armageddon_by_max_hastings_kv3s4 (Cluster L)](https://github.com/advisories/GHSA-p6mc-228w-6q75) - GitHub
- [GHSA-3jx4-3p7f-pv7p - npm siren-lament@0.0.0-stage,2.14.822,2.14.824,2.14.827 (Cluster M - OSSF flag vs Amazon Inspector contradicting, MAL-2025-49247)](https://github.com/advisories/GHSA-3jx4-3p7f-pv7p) - GitHub
- [GHSA-g6j7-j669-23g6 - npm @chatunitycenter/baileys (Cluster N - baileys WhatsApp Web library typosquat)](https://github.com/advisories/GHSA-g6j7-j669-23g6) - GitHub
- [GHSA-jp74-4rg3-7ppj - npm react-native-drago-callkit (Cluster N - React Native CallKit lure)](https://github.com/advisories/GHSA-jp74-4rg3-7ppj) - GitHub
- [GHSA-w9pq-6r9f-pj96 - npm orderbook-volt-plugin@0.0.0-stage,0.0.1,0.0.2 (Cluster N - DeFi orderbook lure)](https://github.com/advisories/GHSA-w9pq-6r9f-pj96) - GitHub
- [GHSA-pr23-gvcv-c422 - npm cjlowuxbnexkhgpzq (Cluster N - keyboard-mash lure)](https://github.com/advisories/GHSA-pr23-gvcv-c422) - GitHub
- [GHSA-v78q-7787-v9rq - npm bcxhdh1kjlopsde (Cluster N - keyboard-mash lure)](https://github.com/advisories/GHSA-v78q-7787-v9rq) - GitHub
- [DependencyWatch: npm-2026-10-29-ghsa-malware-sweep (prior day - @testsecuiitytestme Shai-Hulud wave-2 shaped loader + csvflow-schema + @webapp-shared beacon operator)](https://dependencywatch.io/incident/npm-2026-10-29-ghsa-malware-sweep)
- [DependencyWatch: multi-2026-10-28-ghsa-malware-sweep (two days prior - kam193 PyPI trio + camera.ui NVR compromise)](https://dependencywatch.io/incident/multi-2026-10-28-ghsa-malware-sweep)
- [DependencyWatch: npm-2026-10-20-tailwind-animatecss-fake-interview-campaign (Nodveta / Torre.ai fake interview, wave-2 updates today)](https://dependencywatch.io/incident/npm-2026-10-20-tailwind-animatecss-fake-interview-campaign)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-30-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-30-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).