DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 1 November 2026

HighAdvisory sweepnpmPyPI

Eight fresh GHSA malware advisories in the 2026-10-31 → 2026-11-01 window. Headlines are the carved-out PyPI pystr-codec first-PyPI Miasma worm variant (own record), a four-package PyPI 2026-10-is-it-ai kam193 campaign (hidden-dep remote-executable loader, confirmed C2 at cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app), a kam193 PyPI pentest probe doctreelstm, and two CWE-506 npm takedowns @mamans2973/maman + local-commander-agent.

Published 1 Nov 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-11-01-ghsa-malware-sweep
7
Packages tracked23 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
1 Nov 2026
Ecosystems
npmPyPI
Detected by
GitHub Advisory Database, OpenSSF Package Analysis, OpenSSF malicious-packages, kam193, SafeDep
Also known as
GHSA 2026-10-31 → 2026-11-01 batch, kam193 2026-10-is-it-ai hidden-dep campaign, Miasma PyPI variant pystr-codec (carve-out)

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

Between 2026-10-31 06:00 UTC (yesterdays sweep cut-off) and 2026-11-01 06:00 UTC (todays ingest-window start) the GitHub Advisory Database published eight malware advisories. The headline is the carved-out PyPI pystr-codec first-PyPI Miasma worm variant (full detail on its own record). The sweep catches four PyPI kam193 slugs under a new 2026-10-is-it-ai hidden-dependency remote-executable-loader campaign, a kam193 PyPI pentest probe doctreelstm, and two CWE-506 boilerplate npm takedowns.

Headlines

pystr-codec Miasma PyPI variant (carved out): kam193 and OpenSSF published MAL-2026-18432 on 2026-11-01 flagging pystr-codec@0.1.0, 0.1.1, 0.1.2 as a Miasma-family worm variant - the first observed PyPI incarnation of the June-2026 npm Miasma worm (SafeDep alias testmetest). The .pth on-startup hook, Bun-runtime payload, GitHub-dead-drop exfil, worm propagation via publish tokens, and conditional-wiper destructive-actions trigger are all preserved from the npm family TTP. See the carve-out record for IOCs, remediation sequence (IMAGE BEFORE ROTATING - credential rotation itself detonates the wiper), and attribution linkage to the npm -testmetest slug family across the 2026-10-22 through 2026-10-26 sweeps.

kam193 2026-10-is-it-ai hidden-dep campaign (Cluster A): 4 PyPI packages / 13 versions under a new campaign shape for kam193. The three "wrapper" slugs (skills-analyzer, md-to-slides, multi-convert) each pin is-it-ai as a dependency at the specific version that carries the malicious payload; the payload fingerprints the environment, contacts a Google Cloud Run C2 at cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app/v1/session/info, and if the server replies with a URL downloads and executes whatever is at that URL. Server-side victim filtering ("targetted-attack" OSSF tag) means sandbox resolution gets a null reply and looks clean while real victims get the second stage. The cover-release pattern (publishing several versions where only one triggers) is explicit scanner evasion.

kam193 doctreelstm pentest probe (Cluster B): single-slug sibling of yesterdays stdid-nyxprobe under the same GENERIC-standard-pypi-install-pentest campaign. Install-time + import-time host-fingerprint exfil via a custom setup.py install` cmdclass override.

npm CWE-506 boilerplate takedown (Cluster C): @mamans2973/maman (personal scope, 4-version pre-staged iteration) and local-commander-agent@0.3.52 (developer-tool-lure-shaped slug). No published analysis bytes at advisory time.

Classification

sweep. Severity high (above the sweep baseline medium) because the carved-out pystr-codec Miasma variant is critical on its own record, Cluster A carries a confirmed install-time remote-executable loader with server-side victim filtering across four real PyPI slugs, and Cluster B carries confirmed install-time host-fingerprint exfil. Cluster C is medium CWE-506 boilerplate without captured payload. No cluster inside the sweep itself clears the critical threshold - the critical finding was pulled out into its own named incident file per the authoring policy for critical-severity items inside a sweep.

Discovery

GitHub Advisory Database, OpenSSF Package Analysis, OpenSSF malicious-packages (MAL-2026-18426 through MAL-2026-18432 range), kam193 operator-controlled tracker bad-packages.kam193.eu (Clusters A + B and the carve-out), SafeDep (carve-out attribution to Miasma family).

infostealercredential-theftdependency-confusionobfuscationpersistence
Affected packages

7 packages 23 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • Carve-out: PyPI pystr-codec first-PyPI Miasma worm variant (malicious-package; 1 package / 3 versions, 2026-11-01, kam193 campaign 2026-11-pystr-codec, MAL-2026-18432, OSSF reasons obfuscation+abuses-pth+infostealer+worm+backdoor+persistence+exfiltration-credentials+destructive-actions): tracked on its own named record and NOT duplicated here. Headline-worthy enough to pull out of the sweep because it is the first observed PyPI incarnation of the June-2026 Miasma self-propagating credential worm (SafeDep alias testmetest) with confirmed .pth persistence, Bun-runtime payload, paleasbest.top C2, and destructive-actions-on-credential-invalidation primitive. The SafeDep + OSSF cross-attribution upgrades the previously-logged npm *-testmetest slug family (2026-10-22 batch of 9 slugs, 2026-10-25 event-bus-lite-testmetest@0.0.6 Bun loader, 2026-10-26 path-stream-utils-testmetest) from "research / canary" to confirmed Miasma variant - treat historical hits on any -testmetest suffix slug accordingly
  • Cluster A - PyPI kam193 2026-10-is-it-ai hidden-dependency remote-executable loader campaign (malicious-package; 4 packages / 13 versions total, 2026-10-31, OSSF campaign tag 2026-10-is-it-ai, OSSF reasons targetted-attack+action-hidden-in-lib-usage+downloads-executes-remote-executable): is-it-ai@0.1.0, 0.1.1, 0.1.3 (GHSA-76h8-w3px-47hx / MAL-2026-18426, the actual payload carrier), skills-analyzer@0.1.0, 0.1.1, 0.1.2 (GHSA-r92r-m9r8-78vj / MAL-2026-18427, trigger in 0.1.1 - other versions exist as cover), md-to-slides@0.1.0, 0.1.1, 0.1.2, 0.1.3 (GHSA-7p4v-mm6f-8g5c / MAL-2026-18428, trigger in 0.1.1), multi-convert@0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5 (GHSA-vh26-86vj-f72g / MAL-2026-18429, trigger in 0.1.4). The campaign shape is hidden-dependency malware: the three "wrapper" packages (skills-analyzer, md-to-slides, multi-convert) each present as a benign utility and pin is-it-ai as a dependency at the specific version that carries the malicious payload. The payload fingerprints the install environment, contacts https://cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app/v1/session/info, and if the server responds with a URL, downloads and executes whatever is at that URL - a two-stage dropper with the second stage controlled server-side at install time, so the actual malicious payload varies by target. The "targetted-attack" OSSF tag indicates server-side victim filtering (the C2 only returns a payload URL for interesting hosts, so sandbox resolution gets a null reply and looks clean). The campaign tags all four packages under 2026-10-is-it-ai and the shared C2 apex confirms single-operator attribution. The cover-release pattern (uploading several versions where only one is actually malicious) is a scanner-evasion technique: a scanner that spot-checks is-it-ai@0.1.0 sees nothing and clears the slug; the targeted-attack pin on 0.1.3 fires only on real victims. Severity high for the whole cluster (confirmed remote-executable loader with server-side victim filtering on real PyPI slugs; reach limited to anyone who installed one of the wrapper packages but every host that did ran attacker-chosen code at install time with the hidden-dep slug is-it-ai as the actual payload carrier)
  • Cluster B - PyPI kam193 GENERIC-standard-pypi-install-pentest doctreelstm pentest-shape host-exfil probe (malicious-package; 1 package / 2 versions, 2026-10-31, GHSA-5fxv-5qc2-53g8 / MAL-2026-18430, OSSF classification PROBABLY_PENTEST): doctreelstm@1.0.0, 10.0.0. OSSF analysis note: "Installing the package or importing the module exfiltrates basic information about the host" via a custom setup.py install cmdclass override that runs at pip install time. The pentest classification plus the doctreelstm slug (plausibly reads as a doc-tree LSTM Python package - targeting ML / NLP researchers) is consistent with a bug-bounty / internal-pentest discovery probe rather than a payload-carrying infostealer. Sibling continuity: this slug follows yesterdays stdid-nyxprobe@0.0.1, 0.0.2 (2026-10-31 Cluster C on the 2026-10-31 sweep) under the same GENERIC-standard-pypi-install-pentest campaign. **Severity medium`** (pentest probe with confirmed install-time + import-time host-fingerprint exfil; harmless beyond the fingerprint leak but any CI host that resolved it leaked host identification)
  • Cluster C - npm CWE-506 boilerplate takedown (malicious-package; 2 packages, 2026-10-31): @mamans2973/maman@1.0.0, 1.0.1, 1.0.2, 1.0.3 (GHSA-fg5w-8hhw-8j6h) and local-commander-agent@0.3.52 (GHSA-7j62-5j84-72fv). Both are CWE-506 boilerplate on the GHSA advisories without captured payload bytes - the standard "Any computer that has this package installed or running should be considered fully compromised" language. The @mamans2973/maman slug reads as a personal-scope test / lure (Arabic name, 4-version pre-staged iteration pattern); the local-commander-agent slug reads plausibly as a developer-adjacent lure targeting people searching for a local commander agent / CLI tool. No analysis bytes published, no C2 or IOC captured at advisory time. Severity medium per package (no analysis bytes published; brand-adjacent slugs make these plausible operator payloads but no second-tool corroboration yet)
  • Operator continuity signals: kam193 PyPI operator is still active - 2026-10-28 trio (trajmetrics / numprint / h13t0ry-hello-demo), 2026-10-30 pair (bq-helix-recon + test-01-rafamarrara-learning-dc), 2026-10-31 pair (log-utils-sdk + stdid-nyxprobe), todays 5 slugs under 2026-10-is-it-ai (4 packages) + GENERIC-standard-pypi-install-pentest (doctreelstm). The 2026-10-is-it-ai campaign is a new TTP shape for kam193 - the hidden-dependency pattern with cover versions is distinct from the operators usual direct install-time infostealer. Watch for a wave-2 under additional slugs pinning is-it-ai as a dependency. testmetest / Miasma family - today upgrades the previously-logged npm -testmetest slug family to confirmed Miasma variant, with pystr-codec as the first PyPI variant. Nodveta/Torre.ai fake-interview operator is idle today (no new wave-N republishes beyond yesterdays wave-3). **baileys WhatsApp Web typosquat operator** (yesterdays ourin-baileys + grizzly-baileys + prior @chatunitycenter/baileys) is idle today. *SiriusXM-shaped `vas-tops2- / @tops2 dep-confusion operator** (yesterdays 12-slug dump) is idle today. Carve-outs pystr-codec Miasma PyPI variant (today`s own named incident), LiteLLM 1.107.0, Tailwind Animate.css fake-interview, Apex Accelerator REF8801, TensorLake AI, hridoy FB credential stealer, anthropic-sdk PyPI typosquat, netweavex NetworkX typosquat, kam193 PyPI trio + camera.ui NVR compromise, @testsecuiitytestme Shai-Hulud wave-2 shaped loader, spectral-core AWS-metadata infostealer + kam193 bq-helix-recon + black-spindle-2, and the 2026-10-31 SiriusXM-shaped vas-tops2 dep-confusion dump + log-utils-sdk kam193 second-stage downloader + baileys wave-2 all remain confirmed-recovered with no new wave-N malicious republish observed today
What to do

Clean-up steps

  1. For the carved-out pystr-codec Miasma PyPI variant see the own record`s recommendation list in full - immediate egress block on paleasbest.top, image hosts BEFORE rotating credentials (destructive-actions trigger fires on credential invalidation), audit PyPI publish history and GitHub exfil dead-drop repos
  2. For Cluster A PyPI 2026-10-is-it-ai hidden-dep campaign (CONFIRMED remote-executable loader with server-side victim filtering): grep every requirements.txt, Pipfile, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, Dockerfile and container-image manifest for ANY of the four slugs AND their dependency is-it-ai: is-it-ai@0.1.0, 0.1.1, 0.1.3, skills-analyzer@0.1.0, 0.1.1, 0.1.2, md-to-slides@0.1.0, 0.1.1, 0.1.2, 0.1.3, multi-convert@0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5. On any hit on a host that EVER ran pip install or import of the slug: assume the two-stage dropper fired (if the C2 picked the host as a target - sandboxes and uninteresting hosts likely got the null-reply path and look clean, but a null reply at install time does not prove the host was uninteresting at the second visit, so treat every hit as compromised); rotate every credential reachable from the host (cloud, Vault, Kubernetes, package registries, GitHub PATs); image for forensics before rebuild. Egress block cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app apex AND the broader Google Cloud Run *.a.run.app pattern (operator used a Google Cloud Run auto-generated hostname which rotates per redeploy). Add is-it-ai AND the three wrapper slugs to the PyPI denylist; expect a wave-2 under additional wrapper slugs pinning the same is-it-ai versions
  3. For Cluster B PyPI doctreelstm kam193 pentest probe (CONFIRMED install-time + import-time host-fingerprint exfil): grep requirements files for doctreelstm and the versions 1.0.0 / 10.0.0 (the version-10.0.0 pattern is a kam193 operator fingerprint to force resolver-first-match on anyone pinning >=0). On any hit: fingerprint-only leak event (host info, user, platform), harmless beyond the identification leak; remove, rebuild, add to denylist. Note the stdid-nyxprobe sibling (2026-10-31 Cluster C on the 2026-10-31 sweep) is also still live - include both slugs in any audit sweep
  4. For Cluster C npm @mamans2973/maman + local-commander-agent CWE-506 takedown: grep manifests for @mamans2973/maman and local-commander-agent. On any hit, remove, rebuild, add to denylist. The local-commander-agent slug reads as a developer-tool lure - alert any team that uses local commander / CLI remote-agent tooling. No published analysis bytes for either slug at advisory time; watch for a captured payload hash to post
  5. Standing egress-denylist carry-forward from prior sweeps (keep in place): continue to block paleasbest.top (todays carve-out IOC), cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app + broader Google Cloud Run .a.run.app on build hosts (today Cluster A), bad-packages.kam193.eu (OSSF tracker reference for kam193 batches), webhook.site/d6092bdc-05c0-45da-a280-c343ea6d6156 (2026-10-30 Cluster A spectral-core AWS-metadata infostealer), nobody-johnston-with-enabling.trycloudflare.com + imaging-amazing-trunk-surgeons.trycloudflare.com + 154.57.164.64:30664 (2026-10-30 spectral-net-probe file-exfil beacon), 38.242.235.206/depconf/ (2026-10-30 amahrou1w dep-confusion trio), webhook.site/f52af355-4783-4acb-9de1-5e44b5963025 + www.hinny.shop apex (2026-10-30 @zmtcdn pair), webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary (2026-10-30 Coinbase lure), webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0 (2026-10-30 HTB probe), .ngrok-free.app on CI/build hosts (2026-10-30 black-spindle-2), networkservicesupp.flashhub.net:8443 (XMRig Monero pool, 2026-10-22 + 2026-10-26 + 2026-10-29 + 2026-10-30 DSH waves), cdn-status.mulderitsme.net (2026-10-29 csvflow-schema), 13.140.137.222:8787 + /_ah/dc + 185.158.107.175:8787 (2026-10-29 @webapp-shared operator), api.github.com/repos/jerryjohnston91/ + codeload.github.com/jerryjohnston91/ (2026-10-27 netweavex), c2-worker.crawlnet-claim.workers.dev apex, 34.143.131.27:18080 + /x-VA-1/main.js, webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/, 75.119.137.232:31337 + /depconfuse, transfer.archivete.am apex + /H2Uxm/fabdeploycheck-config.json, realwbx.com apex, artifacts.creditslib.com apex, login.fromthehotel.com apex, googleforum.pythonanywhere.com, space-z.ai, dxpoc.gt.tc, raw.githubusercontent.com/anonrider404/pypl/, api-bsx.pages.dev + /download, 177.7.60.239:48080 + oob.recon.dev, uncoder.eu.org, accenture-npm.azurewebsites.net, limbomail.com, collector.oob.s4yhii.com + .oob.s4yhii.com + s4yhii.com, 64.181.165.115/dc, 167.88.172.33:8087 + jsonspack.com, goxtools.shop, minhdong.site, 45.138.12.177:8089, ltidi.storage.googleapis.com/depenconf/, oob.s4yhii.com:9999/native, .oast.pro/.oast.me/.oast.fun/.oast.site/.oastify.com, frjmzbjbhwvtdnsuodmu.supabase.co, api.npoint.io, tele.metry.orgin.net, morroncr0w.io, api.telegram.org on untrusted CI/build hosts, appsecc.com, generic webhook.site/ paths, nfjbill.ren, storage.googleapis.com/depenconf/, 10.0.19.0/24 + 10.0.49.0/24, api.nm-streetwear.space, Discord webhook URLs, ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, chinazhangsan.ccwu.cc, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil patterns, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com, 45.138.0.0/16 RubyGems wgkit CIDRs, apexaccs.org apex + subdomains, arenapex.cloud, apexfdn.xyz apex + subdomains, fdn4apex.com, router-apex.com apex + subdomains, ccmihr.com, 0auth-chromium.com, ehegisnightmare.icu, cloudmain365duo.top, www.litellm.dev/healthcheck, raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt, SSH relay services srv.us, .devtunnels.ms, .devtunnels.visualstudio.com, .ngrok-free.dev/canary, 109.94.169.196:8443 + .sslip.io:8443, api.github.com/gists/3775fd9235aa6ef29e96eb96274a0e34, 115.190.210.22`. New operator identities today*: Miasma family PyPI variant C2 paleasbest.top (carve-out), kam193 2026-10-is-it-ai hidden-dep operator C2 cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app (Cluster A), kam193 continuation under GENERIC-standard-pypi-install-pentest adds doctreelstm (Cluster B). Add Bun-1.3.13-linux-x64.zip download + any new .pth files appearing under site-packages on hosts to the standing watchlist (Miasma PyPI family signatures)
References

Sources

multi-2026-11-01-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents