# GitHub Advisory malware sweep, 31 October 2026

> About twenty-five fresh GHSA malware advisories in the 2026-10-30 → 2026-10-31 window. Headlines are a 12-slug SiriusXM-shaped corporate dep-confusion dump (`vas-tops2-*` + `@tops2/*` + `@sxm-content-creators/*` + `@pcb-dp/*` + `ssite-mock-server` + sibling slugs), a confirmed kam193 PyPI second-stage downloader `log-utils-sdk 0.4.1` (campaign `2025-11-spellcheckers`), a kam193 PyPI pentest probe `stdid-nyxprobe`, baileys WhatsApp Web typosquat wave-2 (`ourin-baileys`, `grizzly-baileys` continuing yesterday`s `@chatunitycenter/baileys`), and a 5-pack SDK/tool typosquat tail (`apex-fetch`, `wrangler-deploy@1.5.5`, `neuralwhatsapp`, `dependencykfeg`, `tabby-fknat@0.1.2`).

- Published: 2026-10-31
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 21 packages, 23 compromised versions
- Tags: typosquat, dependency-confusion, infostealer, credential-theft
- Also known as: GHSA 2026-10-30 → 2026-10-31 batch, SiriusXM TOPS2 dep-confusion dump, kam193 2025-11-spellcheckers log-utils-sdk, kam193 stdid-nyxprobe pentest probe, baileys WhatsApp Web typosquat wave-2
- Detected by: GitHub Advisory Database, OpenSSF Package Analysis, OpenSSF malicious-packages
- Incident ID: multi-2026-10-31-ghsa-malware-sweep

## Affected packages (21)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@pcb-dp/qa-commons](https://dependencywatch.io/package/npm/@pcb-dp/qa-commons) | npm | 0.0.0 |
| [@sxm-content-creators/tools-ds](https://dependencywatch.io/package/npm/@sxm-content-creators/tools-ds) | npm | 0.0.0 |
| [@tops2/digital-assistant-ui](https://dependencywatch.io/package/npm/@tops2/digital-assistant-ui) | npm | 0.0.0 |
| [apex-fetch](https://dependencywatch.io/package/npm/apex-fetch) | npm | 0.0.0 |
| [claims-acct-unlock](https://dependencywatch.io/package/npm/claims-acct-unlock) | npm | 0.0.0, 25.2.1 |
| [dependencykfeg](https://dependencywatch.io/package/npm/dependencykfeg) | npm | 0.0.0 |
| [grizzly-baileys](https://dependencywatch.io/package/npm/grizzly-baileys) | npm | 0.0.0 |
| [log-utils-sdk](https://dependencywatch.io/package/pypi/log-utils-sdk) | PyPI | 0.4.1 |
| [neuralwhatsapp](https://dependencywatch.io/package/npm/neuralwhatsapp) | npm | 0.0.0 |
| [ourin-baileys](https://dependencywatch.io/package/npm/ourin-baileys) | npm | 0.0.0 |
| [ssite-mock-server](https://dependencywatch.io/package/npm/ssite-mock-server) | npm | 0.0.0 |
| [stdid-nyxprobe](https://dependencywatch.io/package/pypi/stdid-nyxprobe) | PyPI | 0.0.1, 0.0.2 |
| [tabby-fknat](https://dependencywatch.io/package/npm/tabby-fknat) | npm | 0.1.2 |
| [tefeest-npm-com-test](https://dependencywatch.io/package/npm/tefeest-npm-com-test) | npm | 0.0.0 |
| [vas-tops2-bidmatrix-ui](https://dependencywatch.io/package/npm/vas-tops2-bidmatrix-ui) | npm | 0.0.0 |
| [vas-tops2-core-client-cleanup-ui](https://dependencywatch.io/package/npm/vas-tops2-core-client-cleanup-ui) | npm | 0.0.0 |
| [vas-tops2-core-clients-search](https://dependencywatch.io/package/npm/vas-tops2-core-clients-search) | npm | 0.0.0 |
| [vas-tops2-core-property-search](https://dependencywatch.io/package/npm/vas-tops2-core-property-search) | npm | 0.0.0 |
| [vas-tops2-digital-assistant-ui](https://dependencywatch.io/package/npm/vas-tops2-digital-assistant-ui) | npm | 0.0.0 |
| [vas-tops2-reportingui](https://dependencywatch.io/package/npm/vas-tops2-reportingui) | npm | 0.0.0 |
| [wrangler-deploy](https://dependencywatch.io/package/npm/wrangler-deploy) | npm | 1.5.5 |

## What happened

Between 2026-10-30 06:00 UTC (yesterday`s sweep cut-off) and 2026-10-31 06:00 UTC (today`s ingest-window start) the GitHub Advisory Database published ~25 malware advisories. The headlines today are a 12-slug SiriusXM-shaped corporate dep-confusion dump (`vas-tops2-*` + `@tops2/*` + `@sxm-content-creators/*` + `@pcb-dp/*` + sibling slugs, one of which has OSSF-confirmed C2 communication at version 25.2.1), two new kam193 PyPI campaigns (confirmed-payload `log-utils-sdk` second-stage downloader + pentest-probe `stdid-nyxprobe`), baileys WhatsApp Web typosquat wave-2 continuity, and a 5-pack SDK/tool typosquat tail.

## Headlines

**SiriusXM-shaped corporate dep-confusion dump** (Cluster A): 12 npm slugs, all CWE-506 boilerplate on the GHSA advisories without captured payload bytes except `claims-acct-unlock@25.2.1` which OSSF Package Analysis flagged for communicating with a domain tied to malicious activity AND running commands associated with malicious behavior. The slug mesh is tight - six `vas-tops2-*` prefixed packages, a paired `@tops2/digital-assistant-ui` scoped mirror, `@sxm-content-creators/tools-ds` (SXM = SiriusXM standard brand abbreviation), `@pcb-dp/qa-commons`, `ssite-mock-server`, `tefeest-npm-com-test` as a throwaway test package - which strongly resembles a mass dep-confusion dump against SiriusXM`s internal engineering registry (plausibly targeting the TOPS2 ad-sales / telematics system). The dump is probably bug-bounty-researcher-shaped (the all-versions-marked-as-malware shape + the "test" slug would be unusual on a real exfil operator) but the `claims-acct-unlock@25.2.1` OSSF confirmation makes it a confirmed-payload one-version at least.

**kam193 PyPI continuation** (Clusters B + C): `log-utils-sdk@0.4.1` under campaign `2025-11-spellcheckers` is a confirmed second-stage downloader built on a clone of a legitimate package - the operator cloned real library code + metadata, then injected an import-time hook that pulls a second stage from attacker infrastructure. `stdid-nyxprobe@0.0.1, 0.0.2` under campaign `GENERIC-standard-pypi-install-pentest` is a pentest-shape host-fingerprint probe that overrides `setup.py install` cmdclass to exfiltrate basic host info at install time and again at import time. Both are tagged in OSSF`s kam193 operator-controlled tracker (`bad-packages.kam193.eu`) following the same tagging convention as the 2026-10-28 trio and the 2026-10-30 `bq-helix-recon` + `test-01-rafamarrara-learning-dc` pair.

**baileys WhatsApp Web typosquat wave-2** (Cluster D): `ourin-baileys` + `grizzly-baileys` continue yesterday`s `@chatunitycenter/baileys` under the standard CWE-506 boilerplate shape, targeting WhatsApp-bot developers (the `baileys` library is the dominant WhatsApp Web client in automation projects).

**SDK/tool typosquat tail** (Cluster E): `apex-fetch` (prefix-adjacent to the ongoing Apex Accelerator REF8801 operator), `wrangler-deploy@1.5.5` (Cloudflare Wrangler typosquat; specific version at odds with the usual all-versions boilerplate), `neuralwhatsapp` (WhatsApp AI integration lure), `dependencykfeg` (generic throwaway slug), `tabby-fknat@0.1.2` (Tabby terminal / Tabby code-AI typosquat).

**Carve-out**: Nodveta/Torre.ai tailwind-animatecss fake-interview campaign wave-3 - two more all-versions republishes (`tailwindcss-visual-kit`, `tailwindcss-effect-lab` under fresh GHSA IDs) plus a new THIRD private payload scope `@nexlayerlabs/postcss-keyframe-utils` first-time-public today. Those updates are tracked on the [2026-10-20 record](https://dependencywatch.io/incident/npm-2026-10-20-tailwind-animatecss-fake-interview-campaign) rather than duplicated here.

## Classification

`sweep`. Severity `high` (above the sweep baseline `medium`) because Cluster B carries a confirmed install-time second-stage downloader on a cloned-legitimate-package shell (kam193 `2025-11-spellcheckers`), and Cluster A carries one OSSF-confirmed C2 communication at `claims-acct-unlock@25.2.1`. Clusters C through E are `medium`: a pentest-shape host-fingerprint probe, baileys wave-2 CWE-506 boilerplate, and SDK/tool typosquat long tail with no analysis bytes published. No cluster reaches `critical` - no legitimate widely-used package was hijacked, no self-propagating worm, and the corporate dep-confusion dump is probably bug-bounty-researcher-shaped rather than targeted exfil.

## Discovery

`GitHub Advisory Database`, `OpenSSF malicious-packages` (MAL-2026-18405 for `log-utils-sdk`, MAL-2026-18406 for `stdid-nyxprobe`), OSSF Package Analysis flag on `claims-acct-unlock@25.2.1`, kam193 operator-controlled tracker `bad-packages.kam193.eu` (Clusters B + C).

## Impact

- **Cluster A - npm SiriusXM-shaped `vas-tops2-*` / `@tops2/*` corporate dep-confusion dump (dependency-confusion; 12 packages, all versions ">= 0", 2026-10-30 GHSA batch)**: `vas-tops2-digital-assistant-ui` (GHSA-pqp6-xfcj-j37c), `vas-tops2-core-clients-search` (GHSA-7r8m-hmch-q36r), `vas-tops2-reportingui` (GHSA-v8fw-jm5x-fgg2), `vas-tops2-core-property-search` (GHSA-3p56-fv8q-65jf), `vas-tops2-core-client-cleanup-ui` (GHSA-8j2v-vwh4-x2hm), `vas-tops2-bidmatrix-ui` (GHSA-3vw9-xvmr-x46h), `@tops2/digital-assistant-ui` (GHSA-r7vf-2jch-g55h), `@sxm-content-creators/tools-ds` (GHSA-x4jx-pc3h-93v6), `@pcb-dp/qa-commons` (GHSA-w4v4-fj9q-cfj5), `ssite-mock-server` (GHSA-h5wr-6cx4-x5v4), `tefeest-npm-com-test` (GHSA-w7c9-wmgh-2r69), `claims-acct-unlock` all versions (GHSA-7338-2qv3-86fw) AND `claims-acct-unlock@25.2.1` (GHSA-73xg-497j-5qqr) with OSSF Package Analysis flagging the 25.2.1 release for communicating with a domain tied to malicious activity AND running commands associated with malicious behavior. All CWE-506 boilerplate on the GHSA advisories without captured payload bytes, but the slug mesh is tight: `vas-tops2-*` (6 slugs with the same `vas-tops2-` prefix), paired `@tops2/digital-assistant-ui` scoped version mirroring `vas-tops2-digital-assistant-ui`, the `@sxm-content-creators` scope (SXM = SiriusXM`s standard brand abbreviation), the `@pcb-dp` and `ssite-mock-server` corporate-shaped slugs, and `tefeest-npm-com-test` as a throwaway test package. The combination strongly resembles a mass dep-confusion dump against SiriusXM`s internal engineering registry (likely the TOPS2 ad-sales / telematics system), probably from a bug-bounty researcher given the "test" slug and the all-versions-marked-as-malware shape (an operator with real exfil would not usually publish all-versions as malware). The `claims-acct-unlock` OSSF confirmation is the strongest payload evidence in the cluster and should be treated as confirmed C2 for that one version. **Severity `medium`** (corporate dep-confusion dump with one OSSF-confirmed payload; reach limited to the targeted internal registry plus anyone who installed `claims-acct-unlock@25.2.1`)
- **Cluster B - PyPI kam193 `2025-11-spellcheckers` cloned-package second-stage downloader (malicious-package; 1 package / 1 version, 2026-10-30 GHSA)**: `log-utils-sdk@0.4.1` (GHSA-gm8f-99q4-fpjh / MAL-2026-18405). OSSF Package Analysis via kam193`s operator-controlled tracker (`bad-packages.kam193.eu/pypi/package/log-utils-sdk`) classifies this as `MALICIOUS`, campaign `2025-11-spellcheckers`. The published analysis states the package "contains hidden code that is effectively run during importing or using the library, and downloads second stage code" and that the code is "built on a clone of a legitimate package" - the operator cloned a real library`s file layout + metadata to make the typosquat look legitimate, then injected an import-time hook that pulls a second stage from attacker infrastructure. The exact exfil / second-stage endpoint is not published on the GHSA page. Note the campaign-tag year (`2025-11-spellcheckers`) is older than the publish date; kam193 reuses older campaign tags on fresh batches to correlate operator continuity. **Severity `high`** for this package itself (confirmed install-time second-stage downloader built on a legitimate-package clone; reach limited to anyone who installed the slug but every host that did is fully exfiltrated at the next Python import of the module)
- **Cluster C - PyPI kam193 `stdid-nyxprobe` pentest-shape host-exfil probe (malicious-package; 1 package / 2 versions, 2026-10-30 GHSA)**: `stdid-nyxprobe@0.0.1, 0.0.2` (GHSA-9g52-4q2j-2cg3 / MAL-2026-18406). OSSF classification `PROBABLY_PENTEST` under campaign `GENERIC-standard-pypi-install-pentest`. Analysis note: "Installing the package or importing the module exfiltrates basic information about the host" via a custom `setup.py install` cmdclass override that runs at `pip install` time (not just at import). The pentest classification plus the `stdid-nyxprobe` slug (`stdid` resembling internal-SDK naming + `-nyxprobe` as the probe tag) is consistent with a bug-bounty / internal-pentest discovery probe rather than a payload-carrying infostealer. **Severity `medium`** (pentest probe with confirmed install-time + import-time host-fingerprint exfil; harmless beyond the fingerprint leak but any CI host that resolved it leaked host identification)
- **Cluster D - npm baileys WhatsApp Web typosquat wave-2 (typosquat; 2 packages, all versions, 2026-10-30 GHSA batch)**: `ourin-baileys` all versions (GHSA-5qgv-v3j9-f64g), `grizzly-baileys` all versions (GHSA-7vq2-mvjp-g5gf). Both are CWE-506 boilerplate on the GHSA advisories without captured payload bytes. The slugs typosquat `baileys` (`@WhiskeySockets/Baileys`), a widely-used WhatsApp Web client library popular in WhatsApp-bot and automation projects. This is wave-2 continuity of yesterday`s `@chatunitycenter/baileys` (2026-10-29 Cluster N on the previous sweep). Expect wave-3 under additional `<colour>-baileys` / `<animal>-baileys` / scoped `baileys` variants. **Severity `medium`** for the cluster (CWE-506-only but the coordinated baileys-targeting + wave-2 continuity + WhatsApp-bot developer target population are all serious signals)
- **Cluster E - npm SDK/tool typosquat long tail (typosquat; 5 packages, 2026-10-30 GHSA batch)**: `apex-fetch` all versions (GHSA-gm35-cprq-hwp5, slug prefix `apex-` is sibling-shaped to the ongoing Apex Accelerator REF8801 campaign but no scope or analysis match is published to confirm attribution), `wrangler-deploy@1.5.5` (GHSA-5vmf-xjrj-jqhh, typosquats Cloudflare`s `wrangler` Workers CLI with a plausible-adjacent slug and a specific version at odds with the usual all-versions-malware shape - suggesting a captured-payload release not a boilerplate takedown), `neuralwhatsapp` all versions (GHSA-367q-mf84-m8j3, WhatsApp AI integration lure), `dependencykfeg` all versions (GHSA-7p3p-8gfg-8grq, generic throwaway slug), `tabby-fknat@0.1.2` (GHSA-2qvg-983g-prh5, specific version at 0.1.2; `tabby-` prefix typosquats the Tabby terminal emulator or the Tabby code-completion AI library). CWE-506 boilerplate on all five without captured payload. **Severity `medium`** per package (no analysis bytes published; brand-adjacent slugs make these plausible operator payloads but no second-tool corroboration yet)
- **Carve-out: Nodveta/Torre.ai tailwind-animatecss fake-interview campaign wave-3**: today GHSA added two more all-versions republishes (`tailwindcss-visual-kit` GHSA-f37w-2g4f-58r3, `tailwindcss-effect-lab` GHSA-px86-h2q8-cjjr - the originals from the 2026-10-20 batch were GHSA-m8c8-f5hx-664g and GHSA-259h-r4vh-ph5j respectively) AND for the first time flagged a **third** previously-private payload scope `@nexlayerlabs/postcss-keyframe-utils` (GHSA-p485-mr88-5q38, all versions) joining the already-known `@jasperquinn/postcss-motion-helpers` and `@aaron205whitmore/postcss-animate-utils`. The `@nexlayerlabs` scope mimics an AI/dev-tooling startup brand name, consistent with the operator rotating payload scopes to split blast radius. These wave-3 updates are tracked on the [2026-10-20 Nodveta/Torre.ai record](https://dependencywatch.io/incident/npm-2026-10-20-tailwind-animatecss-fake-interview-campaign) and NOT duplicated here
- **Operator continuity signals**: **kam193 PyPI operator is still active** - the 2026-10-28 sweep had the `trajmetrics` / `numprint` / `h13t0ry-hello-demo` trio (`kam193 Cluster A`), the 2026-10-30 sweep had the `bq-helix-recon` + `test-01-rafamarrara-learning-dc` pair (`kam193 Clusters G + H`), and today`s batch adds a new `2025-11-spellcheckers` cluster (`log-utils-sdk`, Cluster B) and a new `GENERIC-standard-pypi-install-pentest` probe (`stdid-nyxprobe`, Cluster C). **Nodveta/Torre.ai fake-interview operator is on wave-3** - two more all-versions republishes today plus a third payload scope `@nexlayerlabs/postcss-keyframe-utils` first-time-public today (details on the 2026-10-20 record). **baileys WhatsApp Web typosquat is on wave-2** - yesterday`s `@chatunitycenter/baileys` → today`s `ourin-baileys` + `grizzly-baileys`. **New operator identities**: npm `vas-tops2-*` / `@tops2` corporate-shape SiriusXM dep-confusion operator (Cluster A). Carve-outs [LiteLLM 1.107.0](https://dependencywatch.io/incident/pypi-2026-10-21-litellm-infostealer-rat), [Tailwind Animate.css fake-interview](https://dependencywatch.io/incident/npm-2026-10-20-tailwind-animatecss-fake-interview-campaign) (wave-3 updates today), [Apex Accelerator REF8801](https://dependencywatch.io/incident/npm-2026-10-19-apex-accelerator-malicious-npm-packages), [TensorLake AI](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise), [hridoy FB credential stealer](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer), [anthropic-sdk PyPI typosquat](https://dependencywatch.io/incident/pypi-2026-10-05-anthropic-sdk-typosquat), the [2026-10-27 netweavex NetworkX typosquat](https://dependencywatch.io/incident/multi-2026-10-27-ghsa-malware-sweep), the [2026-10-28 kam193 PyPI trio + camera.ui NVR compromise](https://dependencywatch.io/incident/multi-2026-10-28-ghsa-malware-sweep), the [2026-10-29 @testsecuiitytestme Shai-Hulud wave-2 shaped loader](https://dependencywatch.io/incident/npm-2026-10-29-ghsa-malware-sweep) and the [2026-10-30 spectral-core AWS-metadata infostealer + kam193 bq-helix-recon + black-spindle-2](https://dependencywatch.io/incident/multi-2026-10-30-ghsa-malware-sweep) all remain confirmed-recovered with no new wave-N malicious republish observed today

## What to do

1. **For Cluster A SiriusXM-shaped corporate dep-confusion (`vas-tops2-*` + `@tops2/*` + `@sxm-content-creators/*` + `@pcb-dp/*` + `ssite-mock-server` + `tefeest-npm-com-test` + `claims-acct-unlock`)**: on any SiriusXM-adjacent engineering host (or any host operating a TOPS2 ad-sales / telematics stack), audit internal-registry resolution for every slug in the list to confirm the internal package wins the resolve. For everyone else, grep manifests for the full set (`vas-tops2-digital-assistant-ui`, `vas-tops2-core-clients-search`, `vas-tops2-reportingui`, `vas-tops2-core-property-search`, `vas-tops2-core-client-cleanup-ui`, `vas-tops2-bidmatrix-ui`, `@tops2/digital-assistant-ui`, `@sxm-content-creators/tools-ds`, `@pcb-dp/qa-commons`, `ssite-mock-server`, `tefeest-npm-com-test`, `claims-acct-unlock`). On any hit, remove, rebuild, add to denylist. On `claims-acct-unlock@25.2.1` specifically (OSSF-confirmed C2 communication) rotate every credential reachable from the host - OSSF has not published the exact exfil endpoint but the "communicating with a domain tied to malicious activity" flag means at least one network beacon fired. Add `vas-tops2-*`, `@tops2/*`, `@sxm-content-creators/*`, `@pcb-dp/*` scope + prefixes to the npm registry mirror`s manual-approval list
2. **For Cluster B PyPI `log-utils-sdk` (CONFIRMED kam193 second-stage downloader)**: grep every `requirements.txt`, `Pipfile`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, Dockerfile and container-image manifest for the exact slug `log-utils-sdk` and the exact version `0.4.1`. On any hit: assume the second-stage downloader fired at every `python -m <module>` or `python -c "import <module>"` invocation that pulled the slug, so the host is compromised; rotate every credential reachable from the host (environment variables, every secret file the installing user could read, cloud CLI credentials, every `~/.pypirc` and `~/.netrc` entry, SSH keys, git credential helper entries); image for forensics before rebuild. The exact exfil endpoint was not published on the GHSA page but kam193`s standing campaign shape points at the operator-controlled tracker `bad-packages.kam193.eu` for IOCs - watch firewall logs broadly for any outbound HTTPS from the host at install time. Add `log-utils-sdk` to the PyPI denylist and watch for a wave-2 slug (`log-utils`, `log-utility-sdk`, `logutils-sdk`, scoped `@log-utils/sdk`-style)
3. **For Cluster C PyPI `stdid-nyxprobe` (CONFIRMED install-time + import-time host-fingerprint exfil)**: grep requirements files for `stdid-nyxprobe` and the versions `0.0.1` / `0.0.2`. On any hit: the exfil is only basic host info (hostname, user, platform, env-variable names, cwd) so this is a leak-of-fingerprint event rather than a full compromise - but a CI host that resolved it has leaked its identity to the probe operator. Remove, rebuild, add to denylist. Note the pentest classification suggests this is a bug-bounty researcher`s discovery probe rather than a malicious operator; still worth retiring and watching for sibling `*-nyxprobe` / `std*-probe` slugs
4. **For Cluster D baileys WhatsApp Web typosquat wave-2 (`ourin-baileys` + `grizzly-baileys`)**: grep manifests for `ourin-baileys` and `grizzly-baileys` AND (from yesterday`s Cluster N) `@chatunitycenter/baileys`. On any hit, remove, rebuild, add to denylist. The target population is WhatsApp-bot and automation project developers - alert that developer community (there are active automation / botnet-forming operators continually publishing lures against this niche). Expect wave-3 under additional `<colour>-baileys` / `<animal>-baileys` / scoped `baileys` variants - add the bare `-baileys` suffix as a prefix-wildcard watch on the npm mirror if operational posture allows
5. **For Cluster E SDK/tool typosquat tail (`apex-fetch` + `wrangler-deploy@1.5.5` + `neuralwhatsapp` + `dependencykfeg` + `tabby-fknat@0.1.2`)**: grep manifests for each slug. On `apex-fetch` hits treat as potential (unconfirmed) continuity of the Apex Accelerator REF8801 campaign and hunt for apexaccs.org / apexfdn.xyz / router-apex.com egress on the host out of an abundance of caution. On `wrangler-deploy@1.5.5` hits treat the install host as potentially compromised (the specific-version shape is a captured-payload release pattern not a boilerplate takedown) - rotate every Cloudflare API token / account key on the host and audit the Cloudflare account for any unauthorised Worker deploys. On `neuralwhatsapp`, `dependencykfeg`, `tabby-fknat@0.1.2` hits, remove, rebuild, add to denylist
6. **Standing egress-denylist carry-forward from prior sweeps** (keep in place): continue to block `webhook.site/d6092bdc-05c0-45da-a280-c343ea6d6156` (2026-10-30 Cluster A spectral-core AWS-metadata infostealer), `nobody-johnston-with-enabling.trycloudflare.com` + `imaging-amazing-trunk-surgeons.trycloudflare.com` + `154.57.164.64:30664` (2026-10-30 spectral-net-probe file-exfil beacon), `38.242.235.206/depconf/*` (2026-10-30 amahrou1w dep-confusion trio), `webhook.site/f52af355-4783-4acb-9de1-5e44b5963025` + `www.hinny.shop` apex (2026-10-30 @zmtcdn pair), `webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary` (2026-10-30 Coinbase lure), `webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0` (2026-10-30 HTB probe), `*.ngrok-free.app` on CI/build hosts (2026-10-30 black-spindle-2), `bad-packages.kam193.eu` (OSSF tracker reference for kam193 batches), `networkservicesupp.flashhub.net:8443` (XMRig Monero pool, 2026-10-22 + 2026-10-26 + 2026-10-29 + 2026-10-30 DSH waves), `cdn-status.mulderitsme.net` (2026-10-29 csvflow-schema), `13.140.137.222:8787` + `/_ah/dc` + `185.158.107.175:8787` (2026-10-29 @webapp-shared operator), `api.github.com/repos/jerryjohnston91/*` + `codeload.github.com/jerryjohnston91/*` (2026-10-27 netweavex), `c2-worker.crawlnet-claim.workers.dev` apex, `34.143.131.27:18080` + `/x-VA-1/main.js`, `webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/`, `75.119.137.232:31337` + `/depconfuse`, `transfer.archivete.am` apex + `/H2Uxm/fabdeploycheck-config.json`, `realwbx.com` apex, `artifacts.creditslib.com` apex, `login.fromthehotel.com` apex, `googleforum.pythonanywhere.com`, `space-z.ai`, `dxpoc.gt.tc`, `raw.githubusercontent.com/anonrider404/pypl/*`, `api-bsx.pages.dev` + `/download`, `177.7.60.239:48080` + `oob.recon.dev`, `uncoder.eu.org`, `accenture-npm.azurewebsites.net`, `limbomail.com`, `collector.oob.s4yhii.com` + `*.oob.s4yhii.com` + `s4yhii.com`, `64.181.165.115/dc`, `167.88.172.33:8087` + `jsonspack.com`, `goxtools.shop`, `minhdong.site`, `45.138.12.177:8089`, `ltidi.storage.googleapis.com/depenconf/`, `oob.s4yhii.com:9999/native`, `*.oast.pro`/`*.oast.me`/`*.oast.fun`/`*.oast.site`/`*.oastify.com`, `frjmzbjbhwvtdnsuodmu.supabase.co`, `api.npoint.io`, `tele.metry.orgin.net`, `morroncr0w.io`, `api.telegram.org` on untrusted CI/build hosts, `appsecc.com`, generic `webhook.site/*` paths, `nfjbill.ren`, `storage.googleapis.com/depenconf/`, `10.0.19.0/24` + `10.0.49.0/24`, `api.nm-streetwear.space`, Discord webhook URLs, `ipify.org` + `ifconfig.me`, `gitflic.ru`, `api.wagmiwallet.org`, `backend-cybersecuritydashboard.onrender.com`, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, `chinazhangsan.ccwu.cc`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `npm-canary.aveliscare.com`, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil patterns, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, `tuamaeaquelaursa.com`, `45.138.0.0/16` RubyGems wgkit CIDRs, `apexaccs.org` apex + subdomains, `arenapex.cloud`, `apexfdn.xyz` apex + subdomains, `fdn4apex.com`, `router-apex.com` apex + subdomains, `ccmihr.com`, `0auth-chromium.com`, `ehegisnightmare.icu`, `cloudmain365duo.top`, `www.litellm.dev/healthcheck`, `raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt`, SSH relay services `srv.us`, `*.devtunnels.ms`, `*.devtunnels.visualstudio.com`, `*.ngrok-free.dev/canary`, `109.94.169.196:8443` + `*.sslip.io:8443`, `api.github.com/gists/3775fd9235aa6ef29e96eb96274a0e34`, `115.190.210.22`. **New operator identities today**: npm SiriusXM-shaped `vas-tops2-*` / `@tops2` / `@sxm-content-creators` / `@pcb-dp` corporate dep-confusion operator (Cluster A), PyPI kam193 continuation under campaigns `2025-11-spellcheckers` + `GENERIC-standard-pypi-install-pentest` (Clusters B + C)

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-pqp6-xfcj-j37c - npm vas-tops2-digital-assistant-ui (Cluster A - SiriusXM TOPS2 dep-confusion dump)](https://github.com/advisories/GHSA-pqp6-xfcj-j37c) - GitHub
- [GHSA-7r8m-hmch-q36r - npm vas-tops2-core-clients-search (Cluster A)](https://github.com/advisories/GHSA-7r8m-hmch-q36r) - GitHub
- [GHSA-v8fw-jm5x-fgg2 - npm vas-tops2-reportingui (Cluster A)](https://github.com/advisories/GHSA-v8fw-jm5x-fgg2) - GitHub
- [GHSA-3p56-fv8q-65jf - npm vas-tops2-core-property-search (Cluster A)](https://github.com/advisories/GHSA-3p56-fv8q-65jf) - GitHub
- [GHSA-8j2v-vwh4-x2hm - npm vas-tops2-core-client-cleanup-ui (Cluster A)](https://github.com/advisories/GHSA-8j2v-vwh4-x2hm) - GitHub
- [GHSA-3vw9-xvmr-x46h - npm vas-tops2-bidmatrix-ui (Cluster A)](https://github.com/advisories/GHSA-3vw9-xvmr-x46h) - GitHub
- [GHSA-r7vf-2jch-g55h - npm @tops2/digital-assistant-ui (Cluster A - scoped mirror)](https://github.com/advisories/GHSA-r7vf-2jch-g55h) - GitHub
- [GHSA-x4jx-pc3h-93v6 - npm @sxm-content-creators/tools-ds (Cluster A - SXM = SiriusXM scope)](https://github.com/advisories/GHSA-x4jx-pc3h-93v6) - GitHub
- [GHSA-w4v4-fj9q-cfj5 - npm @pcb-dp/qa-commons (Cluster A - corporate dep-confusion)](https://github.com/advisories/GHSA-w4v4-fj9q-cfj5) - GitHub
- [GHSA-h5wr-6cx4-x5v4 - npm ssite-mock-server (Cluster A - mock-server slug)](https://github.com/advisories/GHSA-h5wr-6cx4-x5v4) - GitHub
- [GHSA-w7c9-wmgh-2r69 - npm tefeest-npm-com-test (Cluster A - throwaway test slug)](https://github.com/advisories/GHSA-w7c9-wmgh-2r69) - GitHub
- [GHSA-7338-2qv3-86fw - npm claims-acct-unlock all versions (Cluster A - CWE-506 boilerplate)](https://github.com/advisories/GHSA-7338-2qv3-86fw) - GitHub
- [GHSA-73xg-497j-5qqr - npm claims-acct-unlock@25.2.1 (Cluster A - OSSF-confirmed C2 communication + command execution)](https://github.com/advisories/GHSA-73xg-497j-5qqr) - GitHub
- [GHSA-gm8f-99q4-fpjh - PyPI log-utils-sdk@0.4.1 (Cluster B - kam193 2025-11-spellcheckers campaign, legitimate-package clone with second-stage downloader, MAL-2026-18405)](https://github.com/advisories/GHSA-gm8f-99q4-fpjh) - GitHub
- [GHSA-9g52-4q2j-2cg3 - PyPI stdid-nyxprobe@0.0.1,0.0.2 (Cluster C - kam193 GENERIC-standard-pypi-install-pentest campaign, setup.py install host-fingerprint exfil, MAL-2026-18406)](https://github.com/advisories/GHSA-9g52-4q2j-2cg3) - GitHub
- [GHSA-5qgv-v3j9-f64g - npm ourin-baileys (Cluster D - baileys WhatsApp Web typosquat wave-2)](https://github.com/advisories/GHSA-5qgv-v3j9-f64g) - GitHub
- [GHSA-7vq2-mvjp-g5gf - npm grizzly-baileys (Cluster D)](https://github.com/advisories/GHSA-7vq2-mvjp-g5gf) - GitHub
- [GHSA-gm35-cprq-hwp5 - npm apex-fetch (Cluster E - apex- prefix sibling-shaped to REF8801 Apex Accelerator campaign)](https://github.com/advisories/GHSA-gm35-cprq-hwp5) - GitHub
- [GHSA-5vmf-xjrj-jqhh - npm wrangler-deploy@1.5.5 (Cluster E - Cloudflare Wrangler typosquat; specific-version shape)](https://github.com/advisories/GHSA-5vmf-xjrj-jqhh) - GitHub
- [GHSA-367q-mf84-m8j3 - npm neuralwhatsapp (Cluster E - WhatsApp AI integration lure)](https://github.com/advisories/GHSA-367q-mf84-m8j3) - GitHub
- [GHSA-7p3p-8gfg-8grq - npm dependencykfeg (Cluster E - generic throwaway slug)](https://github.com/advisories/GHSA-7p3p-8gfg-8grq) - GitHub
- [GHSA-2qvg-983g-prh5 - npm tabby-fknat@0.1.2 (Cluster E - Tabby terminal / Tabby code-AI typosquat)](https://github.com/advisories/GHSA-2qvg-983g-prh5) - GitHub
- [DependencyWatch: npm-2026-10-20-tailwind-animatecss-fake-interview-campaign (wave-3 updates today: tailwindcss-visual-kit + tailwindcss-effect-lab all-versions republishes AND third payload scope @nexlayerlabs/postcss-keyframe-utils first public)](https://dependencywatch.io/incident/npm-2026-10-20-tailwind-animatecss-fake-interview-campaign)
- [DependencyWatch: multi-2026-10-30-ghsa-malware-sweep (prior day - spectral-core AWS-metadata infostealer, kam193 bq-helix-recon, black-spindle-2)](https://dependencywatch.io/incident/multi-2026-10-30-ghsa-malware-sweep)
- [DependencyWatch: npm-2026-10-29-ghsa-malware-sweep (two days prior - @testsecuiitytestme Shai-Hulud wave-2 shaped loader + csvflow-schema + @webapp-shared operator)](https://dependencywatch.io/incident/npm-2026-10-29-ghsa-malware-sweep)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-31-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-31-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).