# GitHub Advisory malware sweep, 1 November 2026

> Eight fresh GHSA malware advisories in the 2026-10-31 → 2026-11-01 window. Headlines are the carved-out PyPI `pystr-codec` first-PyPI Miasma worm variant (own record), a four-package PyPI `2026-10-is-it-ai` kam193 campaign (hidden-dep remote-executable loader, confirmed C2 at `cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app`), a kam193 PyPI pentest probe `doctreelstm`, and two CWE-506 npm takedowns `@mamans2973/maman` + `local-commander-agent`.

- Published: 2026-11-01
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 7 packages, 23 compromised versions
- Tags: infostealer, credential-theft, dependency-confusion, obfuscation, persistence
- Also known as: GHSA 2026-10-31 → 2026-11-01 batch, kam193 2026-10-is-it-ai hidden-dep campaign, Miasma PyPI variant pystr-codec (carve-out), doctreelstm kam193 pentest probe
- Detected by: GitHub Advisory Database, OpenSSF Package Analysis, OpenSSF malicious-packages, kam193, SafeDep
- Incident ID: multi-2026-11-01-ghsa-malware-sweep

## Affected packages (7)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@mamans2973/maman](https://dependencywatch.io/package/npm/@mamans2973/maman) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3 |
| [doctreelstm](https://dependencywatch.io/package/pypi/doctreelstm) | PyPI | 1.0.0, 10.0.0 |
| [is-it-ai](https://dependencywatch.io/package/pypi/is-it-ai) | PyPI | 0.1.0, 0.1.1, 0.1.3 |
| [local-commander-agent](https://dependencywatch.io/package/npm/local-commander-agent) | npm | 0.3.52 |
| [md-to-slides](https://dependencywatch.io/package/pypi/md-to-slides) | PyPI | 0.1.0, 0.1.1, 0.1.2, 0.1.3 |
| [multi-convert](https://dependencywatch.io/package/pypi/multi-convert) | PyPI | 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5 |
| [skills-analyzer](https://dependencywatch.io/package/pypi/skills-analyzer) | PyPI | 0.1.0, 0.1.1, 0.1.2 |

## What happened

Between 2026-10-31 06:00 UTC (yesterday`s sweep cut-off) and 2026-11-01 06:00 UTC (today`s ingest-window start) the GitHub Advisory Database published eight malware advisories. The headline is the carved-out PyPI `pystr-codec` first-PyPI Miasma worm variant (full detail on its [own record](https://dependencywatch.io/incident/pypi-2026-11-01-pystr-codec-miasma-worm)). The sweep catches four PyPI kam193 slugs under a new `2026-10-is-it-ai` hidden-dependency remote-executable-loader campaign, a kam193 PyPI pentest probe `doctreelstm`, and two CWE-506 boilerplate npm takedowns.

## Headlines

**pystr-codec Miasma PyPI variant** (carved out): kam193 and OpenSSF published MAL-2026-18432 on 2026-11-01 flagging `pystr-codec@0.1.0, 0.1.1, 0.1.2` as a Miasma-family worm variant - the first observed PyPI incarnation of the June-2026 npm Miasma worm (SafeDep alias `testmetest`). The `.pth` on-startup hook, Bun-runtime payload, GitHub-dead-drop exfil, worm propagation via publish tokens, and conditional-wiper destructive-actions trigger are all preserved from the npm family TTP. See the [carve-out record](https://dependencywatch.io/incident/pypi-2026-11-01-pystr-codec-miasma-worm) for IOCs, remediation sequence (IMAGE BEFORE ROTATING - credential rotation itself detonates the wiper), and attribution linkage to the npm `-testmetest` slug family across the 2026-10-22 through 2026-10-26 sweeps.

**kam193 `2026-10-is-it-ai` hidden-dep campaign** (Cluster A): 4 PyPI packages / 13 versions under a new campaign shape for kam193. The three "wrapper" slugs (`skills-analyzer`, `md-to-slides`, `multi-convert`) each pin `is-it-ai` as a dependency at the specific version that carries the malicious payload; the payload fingerprints the environment, contacts a Google Cloud Run C2 at `cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app/v1/session/info`, and if the server replies with a URL downloads and executes whatever is at that URL. Server-side victim filtering ("targetted-attack" OSSF tag) means sandbox resolution gets a null reply and looks clean while real victims get the second stage. The cover-release pattern (publishing several versions where only one triggers) is explicit scanner evasion.

**kam193 `doctreelstm` pentest probe** (Cluster B): single-slug sibling of yesterday`s `stdid-nyxprobe` under the same `GENERIC-standard-pypi-install-pentest` campaign. Install-time + import-time host-fingerprint exfil via a custom `setup.py install` cmdclass override.

**npm CWE-506 boilerplate takedown** (Cluster C): `@mamans2973/maman` (personal scope, 4-version pre-staged iteration) and `local-commander-agent@0.3.52` (developer-tool-lure-shaped slug). No published analysis bytes at advisory time.

## Classification

`sweep`. Severity `high` (above the sweep baseline `medium`) because the carved-out pystr-codec Miasma variant is `critical` on its own record, Cluster A carries a confirmed install-time remote-executable loader with server-side victim filtering across four real PyPI slugs, and Cluster B carries confirmed install-time host-fingerprint exfil. Cluster C is `medium` CWE-506 boilerplate without captured payload. No cluster inside the sweep itself clears the `critical` threshold - the critical finding was pulled out into its own named incident file per the authoring policy for critical-severity items inside a sweep.

## Discovery

`GitHub Advisory Database`, `OpenSSF Package Analysis`, `OpenSSF malicious-packages` (MAL-2026-18426 through MAL-2026-18432 range), kam193 operator-controlled tracker `bad-packages.kam193.eu` (Clusters A + B and the carve-out), SafeDep (carve-out attribution to Miasma family).

## Impact

- **Carve-out: PyPI `pystr-codec` first-PyPI Miasma worm variant (malicious-package; 1 package / 3 versions, 2026-11-01, kam193 campaign `2026-11-pystr-codec`, MAL-2026-18432, OSSF reasons `obfuscation`+`abuses-pth`+`infostealer`+`worm`+`backdoor`+`persistence`+`exfiltration-credentials`+`destructive-actions`)**: tracked on its [own named record](https://dependencywatch.io/incident/pypi-2026-11-01-pystr-codec-miasma-worm) and NOT duplicated here. Headline-worthy enough to pull out of the sweep because it is the first observed PyPI incarnation of the June-2026 Miasma self-propagating credential worm (SafeDep alias `testmetest`) with confirmed `.pth` persistence, Bun-runtime payload, `paleasbest.top` C2, and destructive-actions-on-credential-invalidation primitive. The SafeDep + OSSF cross-attribution upgrades the previously-logged npm `*-testmetest` slug family (2026-10-22 batch of 9 slugs, 2026-10-25 `event-bus-lite-testmetest@0.0.6` Bun loader, 2026-10-26 `path-stream-utils-testmetest`) from "research / canary" to **confirmed Miasma variant** - treat historical hits on any `-testmetest` suffix slug accordingly
- **Cluster A - PyPI kam193 `2026-10-is-it-ai` hidden-dependency remote-executable loader campaign (malicious-package; 4 packages / 13 versions total, 2026-10-31, OSSF campaign tag `2026-10-is-it-ai`, OSSF reasons `targetted-attack`+`action-hidden-in-lib-usage`+`downloads-executes-remote-executable`)**: `is-it-ai@0.1.0, 0.1.1, 0.1.3` (GHSA-76h8-w3px-47hx / MAL-2026-18426, the actual payload carrier), `skills-analyzer@0.1.0, 0.1.1, 0.1.2` (GHSA-r92r-m9r8-78vj / MAL-2026-18427, trigger in 0.1.1 - other versions exist as cover), `md-to-slides@0.1.0, 0.1.1, 0.1.2, 0.1.3` (GHSA-7p4v-mm6f-8g5c / MAL-2026-18428, trigger in 0.1.1), `multi-convert@0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5` (GHSA-vh26-86vj-f72g / MAL-2026-18429, trigger in 0.1.4). The campaign shape is **hidden-dependency malware**: the three "wrapper" packages (`skills-analyzer`, `md-to-slides`, `multi-convert`) each present as a benign utility and pin `is-it-ai` as a dependency at the specific version that carries the malicious payload. The payload fingerprints the install environment, contacts `https://cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app/v1/session/info`, and if the server responds with a URL, downloads and executes whatever is at that URL - a two-stage dropper with the second stage controlled server-side at install time, so the actual malicious payload varies by target. The "targetted-attack" OSSF tag indicates server-side victim filtering (the C2 only returns a payload URL for interesting hosts, so sandbox resolution gets a null reply and looks clean). The campaign tags all four packages under `2026-10-is-it-ai` and the shared C2 apex confirms single-operator attribution. The cover-release pattern (uploading several versions where only one is actually malicious) is a scanner-evasion technique: a scanner that spot-checks `is-it-ai@0.1.0` sees nothing and clears the slug; the targeted-attack pin on `0.1.3` fires only on real victims. **Severity `high`** for the whole cluster (confirmed remote-executable loader with server-side victim filtering on real PyPI slugs; reach limited to anyone who installed one of the wrapper packages but every host that did ran attacker-chosen code at install time with the hidden-dep slug `is-it-ai` as the actual payload carrier)
- **Cluster B - PyPI kam193 `GENERIC-standard-pypi-install-pentest` `doctreelstm` pentest-shape host-exfil probe (malicious-package; 1 package / 2 versions, 2026-10-31, GHSA-5fxv-5qc2-53g8 / MAL-2026-18430, OSSF classification `PROBABLY_PENTEST`)**: `doctreelstm@1.0.0, 10.0.0`. OSSF analysis note: "Installing the package or importing the module exfiltrates basic information about the host" via a custom `setup.py install` cmdclass override that runs at `pip install` time. The pentest classification plus the `doctreelstm` slug (plausibly reads as a doc-tree LSTM Python package - targeting ML / NLP researchers) is consistent with a bug-bounty / internal-pentest discovery probe rather than a payload-carrying infostealer. **Sibling continuity**: this slug follows yesterday`s `stdid-nyxprobe@0.0.1, 0.0.2` (2026-10-31 Cluster C on the 2026-10-31 sweep) under the same `GENERIC-standard-pypi-install-pentest` campaign. **Severity `medium`** (pentest probe with confirmed install-time + import-time host-fingerprint exfil; harmless beyond the fingerprint leak but any CI host that resolved it leaked host identification)
- **Cluster C - npm CWE-506 boilerplate takedown (malicious-package; 2 packages, 2026-10-31)**: `@mamans2973/maman@1.0.0, 1.0.1, 1.0.2, 1.0.3` (GHSA-fg5w-8hhw-8j6h) and `local-commander-agent@0.3.52` (GHSA-7j62-5j84-72fv). Both are CWE-506 boilerplate on the GHSA advisories without captured payload bytes - the standard "Any computer that has this package installed or running should be considered fully compromised" language. The `@mamans2973/maman` slug reads as a personal-scope test / lure (Arabic name, 4-version pre-staged iteration pattern); the `local-commander-agent` slug reads plausibly as a developer-adjacent lure targeting people searching for a local commander agent / CLI tool. No analysis bytes published, no C2 or IOC captured at advisory time. **Severity `medium`** per package (no analysis bytes published; brand-adjacent slugs make these plausible operator payloads but no second-tool corroboration yet)
- **Operator continuity signals**: **kam193 PyPI operator is still active** - 2026-10-28 trio (`trajmetrics` / `numprint` / `h13t0ry-hello-demo`), 2026-10-30 pair (`bq-helix-recon` + `test-01-rafamarrara-learning-dc`), 2026-10-31 pair (`log-utils-sdk` + `stdid-nyxprobe`), today`s 5 slugs under `2026-10-is-it-ai` (4 packages) + `GENERIC-standard-pypi-install-pentest` (`doctreelstm`). The `2026-10-is-it-ai` campaign is a new TTP shape for kam193 - the hidden-dependency pattern with cover versions is distinct from the operator`s usual direct install-time infostealer. Watch for a wave-2 under additional slugs pinning `is-it-ai` as a dependency. **testmetest / Miasma family** - today upgrades the previously-logged npm `-testmetest` slug family to confirmed Miasma variant, with `pystr-codec` as the first PyPI variant. **Nodveta/Torre.ai fake-interview operator** is idle today (no new wave-N republishes beyond yesterday`s wave-3). **baileys WhatsApp Web typosquat operator** (yesterday`s `ourin-baileys` + `grizzly-baileys` + prior `@chatunitycenter/baileys`) is idle today. **SiriusXM-shaped `vas-tops2-*` / `@tops2` dep-confusion operator** (yesterday`s 12-slug dump) is idle today. Carve-outs [pystr-codec Miasma PyPI variant](https://dependencywatch.io/incident/pypi-2026-11-01-pystr-codec-miasma-worm) (today`s own named incident), [LiteLLM 1.107.0](https://dependencywatch.io/incident/pypi-2026-10-21-litellm-infostealer-rat), [Tailwind Animate.css fake-interview](https://dependencywatch.io/incident/npm-2026-10-20-tailwind-animatecss-fake-interview-campaign), [Apex Accelerator REF8801](https://dependencywatch.io/incident/npm-2026-10-19-apex-accelerator-malicious-npm-packages), [TensorLake AI](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise), [hridoy FB credential stealer](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer), [anthropic-sdk PyPI typosquat](https://dependencywatch.io/incident/pypi-2026-10-05-anthropic-sdk-typosquat), [netweavex NetworkX typosquat](https://dependencywatch.io/incident/multi-2026-10-27-ghsa-malware-sweep), [kam193 PyPI trio + camera.ui NVR compromise](https://dependencywatch.io/incident/multi-2026-10-28-ghsa-malware-sweep), [@testsecuiitytestme Shai-Hulud wave-2 shaped loader](https://dependencywatch.io/incident/npm-2026-10-29-ghsa-malware-sweep), [spectral-core AWS-metadata infostealer + kam193 bq-helix-recon + black-spindle-2](https://dependencywatch.io/incident/multi-2026-10-30-ghsa-malware-sweep), and the [2026-10-31 SiriusXM-shaped vas-tops2 dep-confusion dump + log-utils-sdk kam193 second-stage downloader + baileys wave-2](https://dependencywatch.io/incident/multi-2026-10-31-ghsa-malware-sweep) all remain confirmed-recovered with no new wave-N malicious republish observed today

## What to do

1. **For the carved-out pystr-codec Miasma PyPI variant** see the [own record`s recommendation list](https://dependencywatch.io/incident/pypi-2026-11-01-pystr-codec-miasma-worm) in full - immediate egress block on `paleasbest.top`, image hosts BEFORE rotating credentials (destructive-actions trigger fires on credential invalidation), audit PyPI publish history and GitHub exfil dead-drop repos
2. **For Cluster A PyPI `2026-10-is-it-ai` hidden-dep campaign (CONFIRMED remote-executable loader with server-side victim filtering)**: grep every `requirements.txt`, `Pipfile`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, Dockerfile and container-image manifest for ANY of the four slugs AND their dependency `is-it-ai`: `is-it-ai@0.1.0, 0.1.1, 0.1.3`, `skills-analyzer@0.1.0, 0.1.1, 0.1.2`, `md-to-slides@0.1.0, 0.1.1, 0.1.2, 0.1.3`, `multi-convert@0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5`. On any hit on a host that EVER ran `pip install` or `import` of the slug: assume the two-stage dropper fired (if the C2 picked the host as a target - sandboxes and uninteresting hosts likely got the null-reply path and look clean, but a null reply at install time does not prove the host was uninteresting at the second visit, so treat every hit as compromised); rotate every credential reachable from the host (cloud, Vault, Kubernetes, package registries, GitHub PATs); image for forensics before rebuild. **Egress block** `cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app` apex AND the broader Google Cloud Run `*.a.run.app` pattern (operator used a Google Cloud Run auto-generated hostname which rotates per redeploy). Add `is-it-ai` AND the three wrapper slugs to the PyPI denylist; expect a wave-2 under additional wrapper slugs pinning the same `is-it-ai` versions
3. **For Cluster B PyPI `doctreelstm` kam193 pentest probe (CONFIRMED install-time + import-time host-fingerprint exfil)**: grep requirements files for `doctreelstm` and the versions `1.0.0` / `10.0.0` (the version-10.0.0 pattern is a kam193 operator fingerprint to force resolver-first-match on anyone pinning `>=0`). On any hit: fingerprint-only leak event (host info, user, platform), harmless beyond the identification leak; remove, rebuild, add to denylist. Note the `stdid-nyxprobe` sibling (2026-10-31 Cluster C on the 2026-10-31 sweep) is also still live - include both slugs in any audit sweep
4. **For Cluster C npm `@mamans2973/maman` + `local-commander-agent` CWE-506 takedown**: grep manifests for `@mamans2973/maman` and `local-commander-agent`. On any hit, remove, rebuild, add to denylist. The `local-commander-agent` slug reads as a developer-tool lure - alert any team that uses local commander / CLI remote-agent tooling. No published analysis bytes for either slug at advisory time; watch for a captured payload hash to post
5. **Standing egress-denylist carry-forward from prior sweeps** (keep in place): continue to block `paleasbest.top` (today`s carve-out IOC), `cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app` + broader Google Cloud Run `*.a.run.app` on build hosts (today Cluster A), `bad-packages.kam193.eu` (OSSF tracker reference for kam193 batches), `webhook.site/d6092bdc-05c0-45da-a280-c343ea6d6156` (2026-10-30 Cluster A spectral-core AWS-metadata infostealer), `nobody-johnston-with-enabling.trycloudflare.com` + `imaging-amazing-trunk-surgeons.trycloudflare.com` + `154.57.164.64:30664` (2026-10-30 spectral-net-probe file-exfil beacon), `38.242.235.206/depconf/*` (2026-10-30 amahrou1w dep-confusion trio), `webhook.site/f52af355-4783-4acb-9de1-5e44b5963025` + `www.hinny.shop` apex (2026-10-30 @zmtcdn pair), `webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary` (2026-10-30 Coinbase lure), `webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0` (2026-10-30 HTB probe), `*.ngrok-free.app` on CI/build hosts (2026-10-30 black-spindle-2), `networkservicesupp.flashhub.net:8443` (XMRig Monero pool, 2026-10-22 + 2026-10-26 + 2026-10-29 + 2026-10-30 DSH waves), `cdn-status.mulderitsme.net` (2026-10-29 csvflow-schema), `13.140.137.222:8787` + `/_ah/dc` + `185.158.107.175:8787` (2026-10-29 @webapp-shared operator), `api.github.com/repos/jerryjohnston91/*` + `codeload.github.com/jerryjohnston91/*` (2026-10-27 netweavex), `c2-worker.crawlnet-claim.workers.dev` apex, `34.143.131.27:18080` + `/x-VA-1/main.js`, `webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/`, `75.119.137.232:31337` + `/depconfuse`, `transfer.archivete.am` apex + `/H2Uxm/fabdeploycheck-config.json`, `realwbx.com` apex, `artifacts.creditslib.com` apex, `login.fromthehotel.com` apex, `googleforum.pythonanywhere.com`, `space-z.ai`, `dxpoc.gt.tc`, `raw.githubusercontent.com/anonrider404/pypl/*`, `api-bsx.pages.dev` + `/download`, `177.7.60.239:48080` + `oob.recon.dev`, `uncoder.eu.org`, `accenture-npm.azurewebsites.net`, `limbomail.com`, `collector.oob.s4yhii.com` + `*.oob.s4yhii.com` + `s4yhii.com`, `64.181.165.115/dc`, `167.88.172.33:8087` + `jsonspack.com`, `goxtools.shop`, `minhdong.site`, `45.138.12.177:8089`, `ltidi.storage.googleapis.com/depenconf/`, `oob.s4yhii.com:9999/native`, `*.oast.pro`/`*.oast.me`/`*.oast.fun`/`*.oast.site`/`*.oastify.com`, `frjmzbjbhwvtdnsuodmu.supabase.co`, `api.npoint.io`, `tele.metry.orgin.net`, `morroncr0w.io`, `api.telegram.org` on untrusted CI/build hosts, `appsecc.com`, generic `webhook.site/*` paths, `nfjbill.ren`, `storage.googleapis.com/depenconf/`, `10.0.19.0/24` + `10.0.49.0/24`, `api.nm-streetwear.space`, Discord webhook URLs, `ipify.org` + `ifconfig.me`, `gitflic.ru`, `api.wagmiwallet.org`, `backend-cybersecuritydashboard.onrender.com`, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, `chinazhangsan.ccwu.cc`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `npm-canary.aveliscare.com`, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil patterns, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, `tuamaeaquelaursa.com`, `45.138.0.0/16` RubyGems wgkit CIDRs, `apexaccs.org` apex + subdomains, `arenapex.cloud`, `apexfdn.xyz` apex + subdomains, `fdn4apex.com`, `router-apex.com` apex + subdomains, `ccmihr.com`, `0auth-chromium.com`, `ehegisnightmare.icu`, `cloudmain365duo.top`, `www.litellm.dev/healthcheck`, `raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt`, SSH relay services `srv.us`, `*.devtunnels.ms`, `*.devtunnels.visualstudio.com`, `*.ngrok-free.dev/canary`, `109.94.169.196:8443` + `*.sslip.io:8443`, `api.github.com/gists/3775fd9235aa6ef29e96eb96274a0e34`, `115.190.210.22`. **New operator identities today**: Miasma family PyPI variant C2 `paleasbest.top` (carve-out), kam193 `2026-10-is-it-ai` hidden-dep operator C2 `cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app` (Cluster A), kam193 continuation under `GENERIC-standard-pypi-install-pentest` adds `doctreelstm` (Cluster B). Add `Bun-1.3.13-linux-x64.zip` download + any new `.pth` files appearing under site-packages on hosts to the standing watchlist (Miasma PyPI family signatures)

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [DependencyWatch: pypi-2026-11-01-pystr-codec-miasma-worm (carved-out critical first-PyPI Miasma worm variant with full IOCs, remediation sequence, and family attribution)](https://dependencywatch.io/incident/pypi-2026-11-01-pystr-codec-miasma-worm)
- [GHSA-f93h-mc69-274w - PyPI pystr-codec Miasma worm variant (MAL-2026-18432, carve-out root reference)](https://github.com/advisories/GHSA-f93h-mc69-274w) - GitHub
- [GHSA-76h8-w3px-47hx - PyPI is-it-ai (Cluster A - kam193 2026-10-is-it-ai hidden-dependency malicious payload carrier, MAL-2026-18426)](https://github.com/advisories/GHSA-76h8-w3px-47hx) - GitHub
- [GHSA-r92r-m9r8-78vj - PyPI skills-analyzer (Cluster A - wrapper pinning is-it-ai, MAL-2026-18427)](https://github.com/advisories/GHSA-r92r-m9r8-78vj) - GitHub
- [GHSA-7p4v-mm6f-8g5c - PyPI md-to-slides (Cluster A - wrapper pinning is-it-ai, MAL-2026-18428)](https://github.com/advisories/GHSA-7p4v-mm6f-8g5c) - GitHub
- [GHSA-vh26-86vj-f72g - PyPI multi-convert (Cluster A - wrapper pinning is-it-ai, trigger in 0.1.4, MAL-2026-18429)](https://github.com/advisories/GHSA-vh26-86vj-f72g) - GitHub
- [OSSF malicious-packages MAL-2026-18426 (is-it-ai OSV record with C2 IOC and campaign tag)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/is-it-ai/MAL-2026-18426.json) - OpenSSF
- [GHSA-5fxv-5qc2-53g8 - PyPI doctreelstm (Cluster B - kam193 GENERIC-standard-pypi-install-pentest sibling of yesterday`s stdid-nyxprobe, MAL-2026-18430)](https://github.com/advisories/GHSA-5fxv-5qc2-53g8) - GitHub
- [GHSA-fg5w-8hhw-8j6h - npm @mamans2973/maman (Cluster C - CWE-506 boilerplate, personal-scope pre-staged 4-version iteration)](https://github.com/advisories/GHSA-fg5w-8hhw-8j6h) - GitHub
- [GHSA-7j62-5j84-72fv - npm local-commander-agent (Cluster C - CWE-506 boilerplate, developer-tool-lure-shaped slug)](https://github.com/advisories/GHSA-7j62-5j84-72fv) - GitHub
- [DependencyWatch: multi-2026-10-31-ghsa-malware-sweep (prior day - SiriusXM-shaped vas-tops2 dep-confusion dump + log-utils-sdk kam193 second-stage downloader + baileys wave-2 + wrangler-deploy typosquat)](https://dependencywatch.io/incident/multi-2026-10-31-ghsa-malware-sweep)
- [DependencyWatch: npm-2026-06-24-leo-platform-miasma-hades (June 2026 reference incident for Miasma family TTP)](https://dependencywatch.io/incident/npm-2026-06-24-leo-platform-miasma-hades)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-11-01-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-11-01-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).