GitHub Advisory malware sweep, 3 November 2026

The full picture

52 packages 80 versions

• npm@bigdevin55/calculator-install-demo*→
• npm@bigdevin55/calculator-install-hook*→
• npm@ifasn/md-doc-mcp1.0.31.0.41.0.5→
• npm@ifasn/mdd-doc-mcp1.0.71.0.82.0.6→
• npm@ifasn/mmd-doc-mcp1.0.01.0.2→
• npm@ifasn/mmdd-doc-mcp1.0.11.0.31.0.41.0.4-21.0.51.0.61.1.01.1.11.1.21.1.31.1.51.1.61.1.71.1.81.1.9-22.0.12.0.42.1.1→
• npm@johnruff215-dev/solana-wallet-tracker*→
• npm@levvicode/baileys*→
• npm@levvicode/eslint-config*→
• npm@levvicode/libsignal-node*→
• npm@maulenv/baileys*→
• npm@mobile-platform/magnetic-components0.0.10.0.20.0.3→
• npm@mrlegendbot/baileys*→
• npm@mrlegendbot/libsignal-node*→
• npm@notrainer/nobtrainer-sdk*→
• npm@nuxzofficial/baileys*→
• npm@utilitycraft/tailwindcss-motion-atelier*→
• npmatlassian-wallboard-plugin1*→
• npmaxelarjs-sdk*→
• npmaytidaoffc*→
• npmbfvkjmeikpwhqxc0.0.0-stage1.0.01.0.1→
• npmbigbob22-test1.0.0→
• npmcalculator-preinstall-chain-demo*→
• npmcalculator-preinstall-hook-demo*→
• npmclaims-ac1*→
• npmcontracts-upgradeable*→
• npmcutekitten-test1.0.1→
• npmdependencykfee-21.0.0→
• RubyGemsintercom-react-native-example-e2e-tests1.0.1→
• npminternal-renderers*→
• npmjustinofficial*→
• npmlevvleys*→
• npmlitecore-lib-ltc*→
• npmms-client-portal*→
• npmnachles*→
• npmnuxzofficial*→
• npmpandafortunerush*→
• npmpersona-ai-sdk1.0.0→
• PyPIpyprig1.2.01.2.11.2.2→
• npmscdn-jquery*→
• npmself-v8*→
• RubyGemsshoaib-unity1.0.1→
• npmsol-wallet-adapter*→
• npmtailwind-animate-engine*→
• npmtailwind-animate-final*→
• npmtailwind-animate-test*→
• npmtailwind-animatrix*→
• npmtailwindcss-animate-bridge*→
• npmunjailed*→
• npmwallet-adapter-base*→
• PyPIwallet-tracking*→
• npmzystcdemo1.0.0→

What it does if you installed it

• Cluster: droppers, RATs and remote-code loaders (malicious-package; advisory analysis published) (2 packages): pyprig, scdn-jquery. pyprig is a copy of Pydantic that downloads and runs extra code from a GitHub repository when models initialise; scdn-jquery 0.1.6 ships a browser script that loads remote code from oomcsn.cc into any site that serves it.
• Cluster: information and wallet stealers (malicious-package; advisory analysis published) (5 packages): @johnruff215-dev/solana-wallet-tracker, @notrainer/nobtrainer-sdk, litecore-lib-ltc, self-v8, wallet-tracking. Advisories report these collect cryptocurrency wallet data or other sensitive files and send them to attacker-controlled Discord webhooks. litecore-lib-ltc imitates the legitimate litecore-lib.
• Cluster: fake MCP server packages (malicious-package; advisory analysis published) (4 packages): @ifasn/md-doc-mcp, @ifasn/mdd-doc-mcp, @ifasn/mmd-doc-mcp, @ifasn/mmdd-doc-mcp. Published as Markdown-toolkit MCP servers, but on startup they query cloud instance-metadata services (AWS, GCP, Azure, Alibaba) for role credentials and report the results to 121.199.24.94. Treat any cloud host or CI runner that ran them as having exposed its instance credentials.
• Cluster: trojanised Baileys WhatsApp library forks (malicious-package; advisory analysis published) (6 packages): @levvicode/baileys, @levvicode/libsignal-node, @maulenv/baileys, @mrlegendbot/baileys, @mrlegendbot/libsignal-node, @nuxzofficial/baileys. Forks of the Baileys WhatsApp Web library republished under new names. Advisories report they silently subscribe the user's WhatsApp account to channels chosen by the publisher, or pull an unpinned libsignal dependency from a third-party source that can change at any time. Use the official @whiskeysockets/baileys only.
• Cluster: dependency-confusion and pentest probes (dependency-confusion; beacon only) (11 packages): @mobile-platform/magnetic-components, axelarjs-sdk, bigbob22-test, calculator-preinstall-chain-demo, calculator-preinstall-hook-demo, contracts-upgradeable and 5 more. These send only host details (hostname, username, working directory) to a callback host, mostly under internal-looking or squatted names at inflated versions. No payload beyond the beacon was reported, but a hit means your build resolved a public package where you expected a private one.
• Cluster: CWE-506 takedowns with no published analysis (malicious-package; likely probes or lures) (24 packages): @bigdevin55/calculator-install-demo, @bigdevin55/calculator-install-hook, @levvicode/eslint-config, @utilitycraft/tailwindcss-motion-atelier, atlassian-wallboard-plugin1, aytidaoffc, bfvkjmeikpwhqxc, claims-ac1, dependencykfee-2, intercom-react-native-example-e2e-tests and 14 more. GitHub published only its standard "treat the host as compromised" notice for these, with no payload analysis.

Clean-up steps

1. 1Check your lockfiles - search package-lock.json, yarn.lock, pnpm-lock.yaml, requirements*.txt, poetry.lock, uv.lock and Gemfile.lock for every package and version listed below, or upload them to the DependencyWatch scanner
2. 2Stealers, loaders and RATs - on any hit, isolate the host, rebuild it from a clean image, and rotate every credential it could reach from a different machine
3. 3Probes and spam - remove the package, rebuild, and check whether your registry configuration lets public packages shadow internal or scoped names
4. 4Cloud credentials - if any @ifasn/*-doc-mcp package ran on a cloud VM or CI runner, rotate that host's instance role credentials and review their recent use
5. 5Web front ends - if a site served files from scdn-jquery, remove it and check for injected iframes
6. 6Block - 121.199.24.94, 121.199.24.94.nip.io and oomcsn.cc

Sources

• GitHub Advisory Database, malware advisoriesgithub.comGitHub
• OpenSSF malicious-packages repositorygithub.comOpenSSF
• GHSA-8wmf-9cp5-g5hq - PyPI wallet-tracking wallet stealergithub.comGitHub
• GHSA-9jxw-2pvm-5q9f - npm litecore-lib-ltc typosquatgithub.comGitHub
• GHSA-rvw8-22w3-342v - npm @ifasn/md-doc-mcpgithub.comGitHub
• GHSA-25jm-3g7h-jgf6 - PyPI pypriggithub.comGitHub
• GHSA-543q-wq5f-hmgh - npm scdn-jquerygithub.comGitHub
• GHSA-v7f8-27g9-qx88 - npm contracts-upgradeable name squatgithub.comGitHub
• DependencyWatch: previous day's sweepdependencywatch.io