DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 31 October 2026

HighAdvisory sweepnpmPyPI

About twenty-five fresh GHSA malware advisories in the 2026-10-30 → 2026-10-31 window. Headlines are a 12-slug SiriusXM-shaped corporate dep-confusion dump (vas-tops2-* + @tops2/* + @sxm-content-creators/* + @pcb-dp/* + ssite-mock-server + sibling slugs), a confirmed kam193 PyPI second-stage downloader log-utils-sdk 0.4.1 (campaign 2025-11-spellcheckers), a kam193 PyPI pentest probe stdid-nyxprobe, baileys WhatsApp Web typosquat wave-2 (ourin-baileys, grizzly-baileys continuing yesterdays @chatunitycenter/baileys), and a 5-pack SDK/tool typosquat tail (apex-fetch, wrangler-deploy@1.5.5, neuralwhatsapp, dependencykfeg, tabby-fknat@0.1.2`).

Published 31 Oct 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-10-31-ghsa-malware-sweep
21
Packages tracked23 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
31 Oct 2026
Ecosystems
npmPyPI
Detected by
GitHub Advisory Database, OpenSSF Package Analysis, OpenSSF malicious-packages
Also known as
GHSA 2026-10-30 → 2026-10-31 batch, SiriusXM TOPS2 dep-confusion dump, kam193 2025-11-spellcheckers log-utils-sdk

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

Between 2026-10-30 06:00 UTC (yesterdays sweep cut-off) and 2026-10-31 06:00 UTC (todays ingest-window start) the GitHub Advisory Database published ~25 malware advisories. The headlines today are a 12-slug SiriusXM-shaped corporate dep-confusion dump (vas-tops2-* + @tops2/* + @sxm-content-creators/* + @pcb-dp/* + sibling slugs, one of which has OSSF-confirmed C2 communication at version 25.2.1), two new kam193 PyPI campaigns (confirmed-payload log-utils-sdk second-stage downloader + pentest-probe stdid-nyxprobe), baileys WhatsApp Web typosquat wave-2 continuity, and a 5-pack SDK/tool typosquat tail.

Headlines

SiriusXM-shaped corporate dep-confusion dump (Cluster A): 12 npm slugs, all CWE-506 boilerplate on the GHSA advisories without captured payload bytes except claims-acct-unlock@25.2.1 which OSSF Package Analysis flagged for communicating with a domain tied to malicious activity AND running commands associated with malicious behavior. The slug mesh is tight - six vas-tops2-* prefixed packages, a paired @tops2/digital-assistant-ui scoped mirror, @sxm-content-creators/tools-ds (SXM = SiriusXM standard brand abbreviation), @pcb-dp/qa-commons, ssite-mock-server, tefeest-npm-com-test as a throwaway test package - which strongly resembles a mass dep-confusion dump against SiriusXMs internal engineering registry (plausibly targeting the TOPS2 ad-sales / telematics system). The dump is probably bug-bounty-researcher-shaped (the all-versions-marked-as-malware shape + the "test" slug would be unusual on a real exfil operator) but the claims-acct-unlock@25.2.1` OSSF confirmation makes it a confirmed-payload one-version at least.

kam193 PyPI continuation (Clusters B + C): log-utils-sdk@0.4.1 under campaign 2025-11-spellcheckers is a confirmed second-stage downloader built on a clone of a legitimate package - the operator cloned real library code + metadata, then injected an import-time hook that pulls a second stage from attacker infrastructure. stdid-nyxprobe@0.0.1, 0.0.2 under campaign GENERIC-standard-pypi-install-pentest is a pentest-shape host-fingerprint probe that overrides setup.py install cmdclass to exfiltrate basic host info at install time and again at import time. Both are tagged in OSSFs kam193 operator-controlled tracker (bad-packages.kam193.eu) following the same tagging convention as the 2026-10-28 trio and the 2026-10-30 bq-helix-recon + test-01-rafamarrara-learning-dc` pair.

baileys WhatsApp Web typosquat wave-2 (Cluster D): ourin-baileys + grizzly-baileys continue yesterdays @chatunitycenter/baileys under the standard CWE-506 boilerplate shape, targeting WhatsApp-bot developers (the baileys` library is the dominant WhatsApp Web client in automation projects).

SDK/tool typosquat tail (Cluster E): apex-fetch (prefix-adjacent to the ongoing Apex Accelerator REF8801 operator), wrangler-deploy@1.5.5 (Cloudflare Wrangler typosquat; specific version at odds with the usual all-versions boilerplate), neuralwhatsapp (WhatsApp AI integration lure), dependencykfeg (generic throwaway slug), tabby-fknat@0.1.2 (Tabby terminal / Tabby code-AI typosquat).

Carve-out: Nodveta/Torre.ai tailwind-animatecss fake-interview campaign wave-3 - two more all-versions republishes (tailwindcss-visual-kit, tailwindcss-effect-lab under fresh GHSA IDs) plus a new THIRD private payload scope @nexlayerlabs/postcss-keyframe-utils first-time-public today. Those updates are tracked on the 2026-10-20 record rather than duplicated here.

Classification

sweep. Severity high (above the sweep baseline medium) because Cluster B carries a confirmed install-time second-stage downloader on a cloned-legitimate-package shell (kam193 2025-11-spellcheckers), and Cluster A carries one OSSF-confirmed C2 communication at claims-acct-unlock@25.2.1. Clusters C through E are medium: a pentest-shape host-fingerprint probe, baileys wave-2 CWE-506 boilerplate, and SDK/tool typosquat long tail with no analysis bytes published. No cluster reaches critical - no legitimate widely-used package was hijacked, no self-propagating worm, and the corporate dep-confusion dump is probably bug-bounty-researcher-shaped rather than targeted exfil.

Discovery

GitHub Advisory Database, OpenSSF malicious-packages (MAL-2026-18405 for log-utils-sdk, MAL-2026-18406 for stdid-nyxprobe), OSSF Package Analysis flag on claims-acct-unlock@25.2.1, kam193 operator-controlled tracker bad-packages.kam193.eu (Clusters B + C).

typosquatdependency-confusioninfostealercredential-theft
Affected packages

21 packages 23 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • *Cluster A - npm SiriusXM-shaped `vas-tops2- / @tops2/` corporate dep-confusion dump (dependency-confusion; 12 packages, all versions ">= 0", 2026-10-30 GHSA batch): vas-tops2-digital-assistant-ui (GHSA-pqp6-xfcj-j37c), vas-tops2-core-clients-search (GHSA-7r8m-hmch-q36r), vas-tops2-reportingui (GHSA-v8fw-jm5x-fgg2), vas-tops2-core-property-search (GHSA-3p56-fv8q-65jf), vas-tops2-core-client-cleanup-ui (GHSA-8j2v-vwh4-x2hm), vas-tops2-bidmatrix-ui (GHSA-3vw9-xvmr-x46h), @tops2/digital-assistant-ui (GHSA-r7vf-2jch-g55h), @sxm-content-creators/tools-ds (GHSA-x4jx-pc3h-93v6), @pcb-dp/qa-commons (GHSA-w4v4-fj9q-cfj5), ssite-mock-server (GHSA-h5wr-6cx4-x5v4), tefeest-npm-com-test (GHSA-w7c9-wmgh-2r69), claims-acct-unlock all versions (GHSA-7338-2qv3-86fw) AND claims-acct-unlock@25.2.1 (GHSA-73xg-497j-5qqr) with OSSF Package Analysis flagging the 25.2.1 release for communicating with a domain tied to malicious activity AND running commands associated with malicious behavior. All CWE-506 boilerplate on the GHSA advisories without captured payload bytes, but the slug mesh is tight: `vas-tops2- (6 slugs with the same vas-tops2- prefix), paired @tops2/digital-assistant-ui scoped version mirroring vas-tops2-digital-assistant-ui, the @sxm-content-creators scope (SXM = SiriusXMs standard brand abbreviation), the @pcb-dp and ssite-mock-server corporate-shaped slugs, and tefeest-npm-com-test as a throwaway test package. The combination strongly resembles a mass dep-confusion dump against SiriusXMs internal engineering registry (likely the TOPS2 ad-sales / telematics system), probably from a bug-bounty researcher given the "test" slug and the all-versions-marked-as-malware shape (an operator with real exfil would not usually publish all-versions as malware). The claims-acct-unlock OSSF confirmation is the strongest payload evidence in the cluster and should be treated as confirmed C2 for that one version. **Severity medium** (corporate dep-confusion dump with one OSSF-confirmed payload; reach limited to the targeted internal registry plus anyone who installed claims-acct-unlock@25.2.1`)
  • Cluster B - PyPI kam193 2025-11-spellcheckers cloned-package second-stage downloader (malicious-package; 1 package / 1 version, 2026-10-30 GHSA): log-utils-sdk@0.4.1 (GHSA-gm8f-99q4-fpjh / MAL-2026-18405). OSSF Package Analysis via kam193s operator-controlled tracker (bad-packages.kam193.eu/pypi/package/log-utils-sdk) classifies this as MALICIOUS, campaign 2025-11-spellcheckers. The published analysis states the package "contains hidden code that is effectively run during importing or using the library, and downloads second stage code" and that the code is "built on a clone of a legitimate package" - the operator cloned a real librarys file layout + metadata to make the typosquat look legitimate, then injected an import-time hook that pulls a second stage from attacker infrastructure. The exact exfil / second-stage endpoint is not published on the GHSA page. Note the campaign-tag year (2025-11-spellcheckers) is older than the publish date; kam193 reuses older campaign tags on fresh batches to correlate operator continuity. Severity high for this package itself (confirmed install-time second-stage downloader built on a legitimate-package clone; reach limited to anyone who installed the slug but every host that did is fully exfiltrated at the next Python import of the module)
  • Cluster C - PyPI kam193 stdid-nyxprobe pentest-shape host-exfil probe (malicious-package; 1 package / 2 versions, 2026-10-30 GHSA): stdid-nyxprobe@0.0.1, 0.0.2 (GHSA-9g52-4q2j-2cg3 / MAL-2026-18406). OSSF classification PROBABLY_PENTEST under campaign GENERIC-standard-pypi-install-pentest. Analysis note: "Installing the package or importing the module exfiltrates basic information about the host" via a custom setup.py install cmdclass override that runs at pip install time (not just at import). The pentest classification plus the stdid-nyxprobe slug (stdid resembling internal-SDK naming + -nyxprobe as the probe tag) is consistent with a bug-bounty / internal-pentest discovery probe rather than a payload-carrying infostealer. Severity medium (pentest probe with confirmed install-time + import-time host-fingerprint exfil; harmless beyond the fingerprint leak but any CI host that resolved it leaked host identification)
  • Cluster D - npm baileys WhatsApp Web typosquat wave-2 (typosquat; 2 packages, all versions, 2026-10-30 GHSA batch): ourin-baileys all versions (GHSA-5qgv-v3j9-f64g), grizzly-baileys all versions (GHSA-7vq2-mvjp-g5gf). Both are CWE-506 boilerplate on the GHSA advisories without captured payload bytes. The slugs typosquat baileys (@WhiskeySockets/Baileys), a widely-used WhatsApp Web client library popular in WhatsApp-bot and automation projects. This is wave-2 continuity of yesterdays @chatunitycenter/baileys (2026-10-29 Cluster N on the previous sweep). Expect wave-3 under additional <colour>-baileys / <animal>-baileys / scoped baileys variants. **Severity medium`** for the cluster (CWE-506-only but the coordinated baileys-targeting + wave-2 continuity + WhatsApp-bot developer target population are all serious signals)
  • Cluster E - npm SDK/tool typosquat long tail (typosquat; 5 packages, 2026-10-30 GHSA batch): apex-fetch all versions (GHSA-gm35-cprq-hwp5, slug prefix apex- is sibling-shaped to the ongoing Apex Accelerator REF8801 campaign but no scope or analysis match is published to confirm attribution), wrangler-deploy@1.5.5 (GHSA-5vmf-xjrj-jqhh, typosquats Cloudflares wrangler Workers CLI with a plausible-adjacent slug and a specific version at odds with the usual all-versions-malware shape - suggesting a captured-payload release not a boilerplate takedown), neuralwhatsapp all versions (GHSA-367q-mf84-m8j3, WhatsApp AI integration lure), dependencykfeg all versions (GHSA-7p3p-8gfg-8grq, generic throwaway slug), tabby-fknat@0.1.2 (GHSA-2qvg-983g-prh5, specific version at 0.1.2; tabby- prefix typosquats the Tabby terminal emulator or the Tabby code-completion AI library). CWE-506 boilerplate on all five without captured payload. **Severity medium`** per package (no analysis bytes published; brand-adjacent slugs make these plausible operator payloads but no second-tool corroboration yet)
  • Carve-out: Nodveta/Torre.ai tailwind-animatecss fake-interview campaign wave-3: today GHSA added two more all-versions republishes (tailwindcss-visual-kit GHSA-f37w-2g4f-58r3, tailwindcss-effect-lab GHSA-px86-h2q8-cjjr - the originals from the 2026-10-20 batch were GHSA-m8c8-f5hx-664g and GHSA-259h-r4vh-ph5j respectively) AND for the first time flagged a third previously-private payload scope @nexlayerlabs/postcss-keyframe-utils (GHSA-p485-mr88-5q38, all versions) joining the already-known @jasperquinn/postcss-motion-helpers and @aaron205whitmore/postcss-animate-utils. The @nexlayerlabs scope mimics an AI/dev-tooling startup brand name, consistent with the operator rotating payload scopes to split blast radius. These wave-3 updates are tracked on the 2026-10-20 Nodveta/Torre.ai record and NOT duplicated here
  • Operator continuity signals: kam193 PyPI operator is still active - the 2026-10-28 sweep had the trajmetrics / numprint / h13t0ry-hello-demo trio (kam193 Cluster A), the 2026-10-30 sweep had the bq-helix-recon + test-01-rafamarrara-learning-dc pair (kam193 Clusters G + H), and todays batch adds a new 2025-11-spellcheckers cluster (log-utils-sdk, Cluster B) and a new GENERIC-standard-pypi-install-pentest probe (stdid-nyxprobe, Cluster C). **Nodveta/Torre.ai fake-interview operator is on wave-3** - two more all-versions republishes today plus a third payload scope @nexlayerlabs/postcss-keyframe-utils first-time-public today (details on the 2026-10-20 record). **baileys WhatsApp Web typosquat is on wave-2** - yesterdays @chatunitycenter/baileys → todays ourin-baileys + grizzly-baileys. **New operator identities**: npm vas-tops2-* / @tops2` corporate-shape SiriusXM dep-confusion operator (Cluster A). Carve-outs LiteLLM 1.107.0, Tailwind Animate.css fake-interview (wave-3 updates today), Apex Accelerator REF8801, TensorLake AI, hridoy FB credential stealer, anthropic-sdk PyPI typosquat, the 2026-10-27 netweavex NetworkX typosquat, the 2026-10-28 kam193 PyPI trio + camera.ui NVR compromise, the 2026-10-29 @testsecuiitytestme Shai-Hulud wave-2 shaped loader and the 2026-10-30 spectral-core AWS-metadata infostealer + kam193 bq-helix-recon + black-spindle-2 all remain confirmed-recovered with no new wave-N malicious republish observed today
What to do

Clean-up steps

  1. *For Cluster A SiriusXM-shaped corporate dep-confusion (`vas-tops2- + @tops2/ + @sxm-content-creators/ + @pcb-dp/ + ssite-mock-server + tefeest-npm-com-test + claims-acct-unlock`): on any SiriusXM-adjacent engineering host (or any host operating a TOPS2 ad-sales / telematics stack), audit internal-registry resolution for every slug in the list to confirm the internal package wins the resolve. For everyone else, grep manifests for the full set (vas-tops2-digital-assistant-ui, vas-tops2-core-clients-search, vas-tops2-reportingui, vas-tops2-core-property-search, vas-tops2-core-client-cleanup-ui, vas-tops2-bidmatrix-ui, @tops2/digital-assistant-ui, @sxm-content-creators/tools-ds, @pcb-dp/qa-commons, ssite-mock-server, tefeest-npm-com-test, claims-acct-unlock). On any hit, remove, rebuild, add to denylist. On claims-acct-unlock@25.2.1 specifically (OSSF-confirmed C2 communication) rotate every credential reachable from the host - OSSF has not published the exact exfil endpoint but the "communicating with a domain tied to malicious activity" flag means at least one network beacon fired. Add `vas-tops2-, @tops2/, @sxm-content-creators/, @pcb-dp/* scope + prefixes to the npm registry mirrors manual-approval list
  2. For Cluster B PyPI log-utils-sdk (CONFIRMED kam193 second-stage downloader): grep every requirements.txt, Pipfile, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, Dockerfile and container-image manifest for the exact slug log-utils-sdk and the exact version 0.4.1. On any hit: assume the second-stage downloader fired at every python -m <module> or python -c "import <module>" invocation that pulled the slug, so the host is compromised; rotate every credential reachable from the host (environment variables, every secret file the installing user could read, cloud CLI credentials, every ~/.pypirc and ~/.netrc entry, SSH keys, git credential helper entries); image for forensics before rebuild. The exact exfil endpoint was not published on the GHSA page but kam193s standing campaign shape points at the operator-controlled tracker bad-packages.kam193.eu for IOCs - watch firewall logs broadly for any outbound HTTPS from the host at install time. Add log-utils-sdk to the PyPI denylist and watch for a wave-2 slug (log-utils, log-utility-sdk, logutils-sdk, scoped @log-utils/sdk`-style)
  3. For Cluster C PyPI stdid-nyxprobe (CONFIRMED install-time + import-time host-fingerprint exfil): grep requirements files for stdid-nyxprobe and the versions 0.0.1 / 0.0.2. On any hit: the exfil is only basic host info (hostname, user, platform, env-variable names, cwd) so this is a leak-of-fingerprint event rather than a full compromise - but a CI host that resolved it has leaked its identity to the probe operator. Remove, rebuild, add to denylist. Note the pentest classification suggests this is a bug-bounty researchers discovery probe rather than a malicious operator; still worth retiring and watching for sibling -nyxprobe / std-probe` slugs
  4. For Cluster D baileys WhatsApp Web typosquat wave-2 (ourin-baileys + grizzly-baileys): grep manifests for ourin-baileys and grizzly-baileys AND (from yesterdays Cluster N) @chatunitycenter/baileys. On any hit, remove, rebuild, add to denylist. The target population is WhatsApp-bot and automation project developers - alert that developer community (there are active automation / botnet-forming operators continually publishing lures against this niche). Expect wave-3 under additional <colour>-baileys / <animal>-baileys / scoped baileys variants - add the bare -baileys` suffix as a prefix-wildcard watch on the npm mirror if operational posture allows
  5. For Cluster E SDK/tool typosquat tail (apex-fetch + wrangler-deploy@1.5.5 + neuralwhatsapp + dependencykfeg + tabby-fknat@0.1.2): grep manifests for each slug. On apex-fetch hits treat as potential (unconfirmed) continuity of the Apex Accelerator REF8801 campaign and hunt for apexaccs.org / apexfdn.xyz / router-apex.com egress on the host out of an abundance of caution. On wrangler-deploy@1.5.5 hits treat the install host as potentially compromised (the specific-version shape is a captured-payload release pattern not a boilerplate takedown) - rotate every Cloudflare API token / account key on the host and audit the Cloudflare account for any unauthorised Worker deploys. On neuralwhatsapp, dependencykfeg, tabby-fknat@0.1.2 hits, remove, rebuild, add to denylist
  6. Standing egress-denylist carry-forward from prior sweeps (keep in place): continue to block webhook.site/d6092bdc-05c0-45da-a280-c343ea6d6156 (2026-10-30 Cluster A spectral-core AWS-metadata infostealer), nobody-johnston-with-enabling.trycloudflare.com + imaging-amazing-trunk-surgeons.trycloudflare.com + 154.57.164.64:30664 (2026-10-30 spectral-net-probe file-exfil beacon), 38.242.235.206/depconf/* (2026-10-30 amahrou1w dep-confusion trio), webhook.site/f52af355-4783-4acb-9de1-5e44b5963025 + www.hinny.shop apex (2026-10-30 @zmtcdn pair), webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary (2026-10-30 Coinbase lure), webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0 (2026-10-30 HTB probe), *.ngrok-free.app on CI/build hosts (2026-10-30 black-spindle-2), bad-packages.kam193.eu (OSSF tracker reference for kam193 batches), networkservicesupp.flashhub.net:8443 (XMRig Monero pool, 2026-10-22 + 2026-10-26 + 2026-10-29 + 2026-10-30 DSH waves), cdn-status.mulderitsme.net (2026-10-29 csvflow-schema), 13.140.137.222:8787 + /_ah/dc + 185.158.107.175:8787 (2026-10-29 @webapp-shared operator), api.github.com/repos/jerryjohnston91/* + codeload.github.com/jerryjohnston91/* (2026-10-27 netweavex), c2-worker.crawlnet-claim.workers.dev apex, 34.143.131.27:18080 + /x-VA-1/main.js, webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/, 75.119.137.232:31337 + /depconfuse, transfer.archivete.am apex + /H2Uxm/fabdeploycheck-config.json, realwbx.com apex, artifacts.creditslib.com apex, login.fromthehotel.com apex, googleforum.pythonanywhere.com, space-z.ai, dxpoc.gt.tc, raw.githubusercontent.com/anonrider404/pypl/*, api-bsx.pages.dev + /download, 177.7.60.239:48080 + oob.recon.dev, uncoder.eu.org, accenture-npm.azurewebsites.net, limbomail.com, collector.oob.s4yhii.com + *.oob.s4yhii.com + s4yhii.com, 64.181.165.115/dc, 167.88.172.33:8087 + jsonspack.com, goxtools.shop, minhdong.site, 45.138.12.177:8089, ltidi.storage.googleapis.com/depenconf/, oob.s4yhii.com:9999/native, *.oast.pro/*.oast.me/*.oast.fun/*.oast.site/*.oastify.com, frjmzbjbhwvtdnsuodmu.supabase.co, api.npoint.io, tele.metry.orgin.net, morroncr0w.io, api.telegram.org on untrusted CI/build hosts, appsecc.com, generic webhook.site/* paths, nfjbill.ren, storage.googleapis.com/depenconf/, 10.0.19.0/24 + 10.0.49.0/24, api.nm-streetwear.space, Discord webhook URLs, ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, chinazhangsan.ccwu.cc, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil patterns, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com, 45.138.0.0/16 RubyGems wgkit CIDRs, apexaccs.org apex + subdomains, arenapex.cloud, apexfdn.xyz apex + subdomains, fdn4apex.com, router-apex.com apex + subdomains, ccmihr.com, 0auth-chromium.com, ehegisnightmare.icu, cloudmain365duo.top, www.litellm.dev/healthcheck, raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt, SSH relay services srv.us, *.devtunnels.ms, *.devtunnels.visualstudio.com, *.ngrok-free.dev/canary, 109.94.169.196:8443 + *.sslip.io:8443, api.github.com/gists/3775fd9235aa6ef29e96eb96274a0e34, 115.190.210.22. New operator identities today: npm SiriusXM-shaped vas-tops2-* / @tops2 / @sxm-content-creators / @pcb-dp corporate dep-confusion operator (Cluster A), PyPI kam193 continuation under campaigns 2025-11-spellcheckers + GENERIC-standard-pypi-install-pentest (Clusters B + C)
References

Sources

multi-2026-10-31-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents