# GitHub Advisory malware sweep, 3 November 2026

> 52 packages from GitHub malware advisories published between 2 and 3 November 2026 (06:00 UTC). Headlines: npm and PyPI wallet stealers sending data to Discord webhooks, four fake MCP servers that probe cloud metadata for credentials, a Pydantic clone that downloads remote code, and a batch of crypto-SDK name squats.

- Published: 2026-11-03
- Last updated: 2026-11-06
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI, RubyGems
- Scope: 52 packages, 80 compromised versions
- Tags: infostealer, crypto-wallet-drain, credential-theft, typosquat, dependency-confusion
- Also known as: GHSA 2026-11-03 batch
- Detected by: GitHub Advisory Database, OpenSSF Package Analysis, Amazon Inspector, kam193
- Incident ID: multi-2026-11-03-ghsa-malware-sweep

## Affected packages (52)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@bigdevin55/calculator-install-demo](https://dependencywatch.io/package/npm/@bigdevin55/calculator-install-demo) | npm | * |
| [@bigdevin55/calculator-install-hook](https://dependencywatch.io/package/npm/@bigdevin55/calculator-install-hook) | npm | * |
| [@ifasn/md-doc-mcp](https://dependencywatch.io/package/npm/@ifasn/md-doc-mcp) | npm | 1.0.3, 1.0.4, 1.0.5 |
| [@ifasn/mdd-doc-mcp](https://dependencywatch.io/package/npm/@ifasn/mdd-doc-mcp) | npm | 1.0.7, 1.0.8, 2.0.6 |
| [@ifasn/mmd-doc-mcp](https://dependencywatch.io/package/npm/@ifasn/mmd-doc-mcp) | npm | 1.0.0, 1.0.2 |
| [@ifasn/mmdd-doc-mcp](https://dependencywatch.io/package/npm/@ifasn/mmdd-doc-mcp) | npm | 1.0.1, 1.0.3, 1.0.4, 1.0.4-2, 1.0.5, 1.0.6, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9-2, 2.0.1, 2.0.4, 2.1.1 |
| [@johnruff215-dev/solana-wallet-tracker](https://dependencywatch.io/package/npm/@johnruff215-dev/solana-wallet-tracker) | npm | * |
| [@levvicode/baileys](https://dependencywatch.io/package/npm/@levvicode/baileys) | npm | * |
| [@levvicode/eslint-config](https://dependencywatch.io/package/npm/@levvicode/eslint-config) | npm | * |
| [@levvicode/libsignal-node](https://dependencywatch.io/package/npm/@levvicode/libsignal-node) | npm | * |
| [@maulenv/baileys](https://dependencywatch.io/package/npm/@maulenv/baileys) | npm | * |
| [@mobile-platform/magnetic-components](https://dependencywatch.io/package/npm/@mobile-platform/magnetic-components) | npm | 0.0.1, 0.0.2, 0.0.3 |
| [@mrlegendbot/baileys](https://dependencywatch.io/package/npm/@mrlegendbot/baileys) | npm | * |
| [@mrlegendbot/libsignal-node](https://dependencywatch.io/package/npm/@mrlegendbot/libsignal-node) | npm | * |
| [@notrainer/nobtrainer-sdk](https://dependencywatch.io/package/npm/@notrainer/nobtrainer-sdk) | npm | * |
| [@nuxzofficial/baileys](https://dependencywatch.io/package/npm/@nuxzofficial/baileys) | npm | * |
| [@utilitycraft/tailwindcss-motion-atelier](https://dependencywatch.io/package/npm/@utilitycraft/tailwindcss-motion-atelier) | npm | * |
| [atlassian-wallboard-plugin1](https://dependencywatch.io/package/npm/atlassian-wallboard-plugin1) | npm | * |
| [axelarjs-sdk](https://dependencywatch.io/package/npm/axelarjs-sdk) | npm | * |
| [aytidaoffc](https://dependencywatch.io/package/npm/aytidaoffc) | npm | * |
| [bfvkjmeikpwhqxc](https://dependencywatch.io/package/npm/bfvkjmeikpwhqxc) | npm | 0.0.0-stage, 1.0.0, 1.0.1 |
| [bigbob22-test](https://dependencywatch.io/package/npm/bigbob22-test) | npm | 1.0.0 |
| [calculator-preinstall-chain-demo](https://dependencywatch.io/package/npm/calculator-preinstall-chain-demo) | npm | * |
| [calculator-preinstall-hook-demo](https://dependencywatch.io/package/npm/calculator-preinstall-hook-demo) | npm | * |
| [claims-ac1](https://dependencywatch.io/package/npm/claims-ac1) | npm | * |
| [contracts-upgradeable](https://dependencywatch.io/package/npm/contracts-upgradeable) | npm | * |
| [cutekitten-test](https://dependencywatch.io/package/npm/cutekitten-test) | npm | 1.0.1 |
| [dependencykfee-2](https://dependencywatch.io/package/npm/dependencykfee-2) | npm | 1.0.0 |
| [intercom-react-native-example-e2e-tests](https://dependencywatch.io/package/rubygems/intercom-react-native-example-e2e-tests) | RubyGems | 1.0.1 |
| [internal-renderers](https://dependencywatch.io/package/npm/internal-renderers) | npm | * |
| [justinofficial](https://dependencywatch.io/package/npm/justinofficial) | npm | * |
| [levvleys](https://dependencywatch.io/package/npm/levvleys) | npm | * |
| [litecore-lib-ltc](https://dependencywatch.io/package/npm/litecore-lib-ltc) | npm | * |
| [ms-client-portal](https://dependencywatch.io/package/npm/ms-client-portal) | npm | * |
| [nachles](https://dependencywatch.io/package/npm/nachles) | npm | * |
| [nuxzofficial](https://dependencywatch.io/package/npm/nuxzofficial) | npm | * |
| [pandafortunerush](https://dependencywatch.io/package/npm/pandafortunerush) | npm | * |
| [persona-ai-sdk](https://dependencywatch.io/package/npm/persona-ai-sdk) | npm | 1.0.0 |
| [pyprig](https://dependencywatch.io/package/pypi/pyprig) | PyPI | 1.2.0, 1.2.1, 1.2.2 |
| [scdn-jquery](https://dependencywatch.io/package/npm/scdn-jquery) | npm | * |
| [self-v8](https://dependencywatch.io/package/npm/self-v8) | npm | * |
| [shoaib-unity](https://dependencywatch.io/package/rubygems/shoaib-unity) | RubyGems | 1.0.1 |
| [sol-wallet-adapter](https://dependencywatch.io/package/npm/sol-wallet-adapter) | npm | * |
| [tailwind-animate-engine](https://dependencywatch.io/package/npm/tailwind-animate-engine) | npm | * |
| [tailwind-animate-final](https://dependencywatch.io/package/npm/tailwind-animate-final) | npm | * |
| [tailwind-animate-test](https://dependencywatch.io/package/npm/tailwind-animate-test) | npm | * |
| [tailwind-animatrix](https://dependencywatch.io/package/npm/tailwind-animatrix) | npm | * |
| [tailwindcss-animate-bridge](https://dependencywatch.io/package/npm/tailwindcss-animate-bridge) | npm | * |
| [unjailed](https://dependencywatch.io/package/npm/unjailed) | npm | * |
| [wallet-adapter-base](https://dependencywatch.io/package/npm/wallet-adapter-base) | npm | * |
| [wallet-tracking](https://dependencywatch.io/package/pypi/wallet-tracking) | PyPI | * |
| [zystcdemo](https://dependencywatch.io/package/npm/zystcdemo) | npm | 1.0.0 |

## What happened

GitHub published malware advisories for 52 packages in this window across npm, PyPI and RubyGems. Severity is `high` because the batch includes confirmed wallet stealers and credential-probing MCP servers; none of it is a hijack of a package people already depend on.

The probe cluster includes unscoped copies of well-known crypto SDK names (`contracts-upgradeable`, `wallet-adapter-base`, `sol-wallet-adapter`, `axelarjs-sdk`) that only send host details on install, plus dependency-confusion names lifted from a Meraki Android app bundle and a health-sector client portal.

## Indicators named in the advisories

- `121.199.24.94` and `121.199.24.94.nip.io` (fake MCP servers)
- `oomcsn.cc` (`scdn-jquery` remote script)
- `dbhmeq71af5395un3p70tujr84cuwuyg7.oast.me` (probe callback)

## Impact

- **Cluster: droppers, RATs and remote-code loaders (malicious-package; advisory analysis published) (2 packages)**: `pyprig`, `scdn-jquery`. `pyprig` is a copy of Pydantic that downloads and runs extra code from a GitHub repository when models initialise; `scdn-jquery` 0.1.6 ships a browser script that loads remote code from `oomcsn.cc` into any site that serves it.
- **Cluster: information and wallet stealers (malicious-package; advisory analysis published) (5 packages)**: `@johnruff215-dev/solana-wallet-tracker`, `@notrainer/nobtrainer-sdk`, `litecore-lib-ltc`, `self-v8`, `wallet-tracking`. Advisories report these collect cryptocurrency wallet data or other sensitive files and send them to attacker-controlled Discord webhooks. `litecore-lib-ltc` imitates the legitimate `litecore-lib`.
- **Cluster: fake MCP server packages (malicious-package; advisory analysis published) (4 packages)**: `@ifasn/md-doc-mcp`, `@ifasn/mdd-doc-mcp`, `@ifasn/mmd-doc-mcp`, `@ifasn/mmdd-doc-mcp`. Published as Markdown-toolkit MCP servers, but on startup they query cloud instance-metadata services (AWS, GCP, Azure, Alibaba) for role credentials and report the results to `121.199.24.94`. Treat any cloud host or CI runner that ran them as having exposed its instance credentials.
- **Cluster: trojanised Baileys WhatsApp library forks (malicious-package; advisory analysis published) (6 packages)**: `@levvicode/baileys`, `@levvicode/libsignal-node`, `@maulenv/baileys`, `@mrlegendbot/baileys`, `@mrlegendbot/libsignal-node`, `@nuxzofficial/baileys`. Forks of the Baileys WhatsApp Web library republished under new names. Advisories report they silently subscribe the user's WhatsApp account to channels chosen by the publisher, or pull an unpinned `libsignal` dependency from a third-party source that can change at any time. Use the official `@whiskeysockets/baileys` only.
- **Cluster: dependency-confusion and pentest probes (dependency-confusion; beacon only) (11 packages)**: `@mobile-platform/magnetic-components`, `axelarjs-sdk`, `bigbob22-test`, `calculator-preinstall-chain-demo`, `calculator-preinstall-hook-demo`, `contracts-upgradeable` and 5 more. These send only host details (hostname, username, working directory) to a callback host, mostly under internal-looking or squatted names at inflated versions. No payload beyond the beacon was reported, but a hit means your build resolved a public package where you expected a private one.
- **Cluster: CWE-506 takedowns with no published analysis (malicious-package; likely probes or lures) (24 packages)**: `@bigdevin55/calculator-install-demo`, `@bigdevin55/calculator-install-hook`, `@levvicode/eslint-config`, `@utilitycraft/tailwindcss-motion-atelier`, `atlassian-wallboard-plugin1`, `aytidaoffc`, `bfvkjmeikpwhqxc`, `claims-ac1`, `dependencykfee-2`, `intercom-react-native-example-e2e-tests` and 14 more. GitHub published only its standard "treat the host as compromised" notice for these, with no payload analysis.

## What to do

1. **Check your lockfiles** - search `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `requirements*.txt`, `poetry.lock`, `uv.lock` and `Gemfile.lock` for every package and version listed below, or upload them to the DependencyWatch scanner
2. **Stealers, loaders and RATs** - on any hit, isolate the host, rebuild it from a clean image, and rotate every credential it could reach from a different machine
3. **Probes and spam** - remove the package, rebuild, and check whether your registry configuration lets public packages shadow internal or scoped names
4. **Cloud credentials** - if any `@ifasn/*-doc-mcp` package ran on a cloud VM or CI runner, rotate that host's instance role credentials and review their recent use
5. **Web front ends** - if a site served files from `scdn-jquery`, remove it and check for injected iframes
6. **Block** - `121.199.24.94`, `121.199.24.94.nip.io` and `oomcsn.cc`

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database, malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF
- [GHSA-8wmf-9cp5-g5hq - PyPI wallet-tracking wallet stealer](https://github.com/advisories/GHSA-8wmf-9cp5-g5hq) - GitHub
- [GHSA-9jxw-2pvm-5q9f - npm litecore-lib-ltc typosquat](https://github.com/advisories/GHSA-9jxw-2pvm-5q9f) - GitHub
- [GHSA-rvw8-22w3-342v - npm @ifasn/md-doc-mcp](https://github.com/advisories/GHSA-rvw8-22w3-342v) - GitHub
- [GHSA-25jm-3g7h-jgf6 - PyPI pyprig](https://github.com/advisories/GHSA-25jm-3g7h-jgf6) - GitHub
- [GHSA-543q-wq5f-hmgh - npm scdn-jquery](https://github.com/advisories/GHSA-543q-wq5f-hmgh) - GitHub
- [GHSA-v7f8-27g9-qx88 - npm contracts-upgradeable name squat](https://github.com/advisories/GHSA-v7f8-27g9-qx88) - GitHub
- [DependencyWatch: previous day's sweep](https://dependencywatch.io/incident/multi-2026-11-02-ghsa-malware-sweep)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-11-03-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-11-03-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).