DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 4 November 2026

HighAdvisory sweepnpmPyPIRubyGems

127 packages from GitHub malware advisories published between 3 and 4 November 2026 (06:00 UTC). Headlines: PyPI packages carrying the Overlord RAT and an infostealer executable, 25 dependency-confusion probes in lookalike GoParrot scopes, game-cheat spam, and a large batch of CWE-506 takedowns.

Published 4 Nov 2026 · Updated 6 Nov 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-11-04-ghsa-malware-sweep
127
Packages tracked164 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
4 Nov 2026
Last updated
6 Nov 2026
Ecosystems
npmPyPIRubyGems
Detected by
GitHub Advisory Database, OpenSSF Package Analysis, kam193
Also known as
GHSA 2026-11-04 batch

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

GitHub published malware advisories for 127 packages in this window across npm, PyPI and RubyGems. Severity is high for the confirmed RAT and infostealer payloads in the PyPI loader cluster.

The CWE-506 cluster is large but unanalysed: random six-character names, Solana jito-bundle lookalikes, Tailwind form-kit names and passwordcracker lures. Similar Tailwind-themed names appear in earlier sweeps and in the Tailwind fake-interview campaign, but these advisories do not link them to it.

Indicators named in the advisories

  • 38.242.235.206 (probe callback)
  • *.oastify.com and *.oast.fun (probe callbacks)
infostealercredential-theftdependency-confusion
Affected packages

127 packages 164 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • Cluster: droppers, RATs and remote-code loaders (malicious-package; advisory analysis published) (5 packages): @atedone/workspace-context, filipt, ln9qw38745g, protecteda, zyto. filipt runs the Overlord RAT during install; protecteda runs an embedded infostealer; zyto and ln9qw38745g ship executables flagged by antivirus vendors as preparation for a RAT. @atedone/workspace-context installs shell start-up files and a hidden background process when imported.
  • Cluster: trojanised Baileys WhatsApp library forks (malicious-package; advisory analysis published) (6 packages): @corexium/xbails, @lynnidoffc/baileys, @lynnidoffc/libsignal-node, @systemzero/baileys, @vanzxy/baileys, luna-baileys. Forks of the Baileys WhatsApp Web library republished under new names. Advisories report they silently subscribe the user's WhatsApp account to channels chosen by the publisher, or pull an unpinned libsignal dependency from a third-party source that can change at any time. Use the official @whiskeysockets/baileys only.
  • Cluster: dependency-confusion and pentest probes (dependency-confusion; beacon only) (29 packages): @goparrot-dashboard-api/orchestration, @goparrot-dashboard-api/role-v2, @goparrot-dashboard-api/shared, @goparrot-dashboard-api/store, @goparrot-dashboard-api/users, @goparrot-dashboard/analytics, @goparrot-dashboard/app, @goparrot-dashboard/auth and 21 more. Mostly names in @goparrot-dashboard and @goparrot-dashboard-api, scopes created next to GoParrot's real @goparrot scope, plus service-roles-registry@99.0.2 and RubyGems probes. They send host details only.
  • Cluster: game cheat and hack-generator spam lures (malicious-package; CWE-506, no published analysis) (17 packages): code-resour-ces-new-app-cloner-premium-9upyk2, gene-rator-new-hearthstone-h-a-c-k-gen-erat-or-9wy4b5, gene-rator-new-rope-hero-h-a-c-k-gen-erat-or-azkrvc, latest-update-my-talking-angela-h-a-c-k-gen-erat-or-q8z42f, more-resour-ces-gen-daylio-h-a-c-k-gen-erat-or-qvi0r6, more-resour-ces-gen-disney-mirrorverse-h-a-c-k-gen-erat-or-gulnxl and 11 more. SEO spam packages advertising game cheats and free premium apps. GitHub published only its standard CWE-506 notice.
  • Cluster: CWE-506 takedowns with no published analysis (malicious-package; likely probes or lures) (70 packages): 1b67v5, 2tyegs, 3zqth8, 5df897, 7un7kh, 9ct8bi, @mntv-analysis/ui, @mntv-analysis/ui-components, @mntv-analysis/workspaces-components, @shein-risk/si_verify and 60 more. GitHub published only its standard "treat the host as compromised" notice for these, with no payload analysis.
What to do

Clean-up steps

  1. Check your lockfiles - search package-lock.json, yarn.lock, pnpm-lock.yaml, requirements*.txt, poetry.lock, uv.lock and Gemfile.lock for every package and version listed below, or upload them to the DependencyWatch scanner
  2. Stealers, loaders and RATs - on any hit, isolate the host, rebuild it from a clean image, and rotate every credential it could reach from a different machine
  3. Probes and spam - remove the package, rebuild, and check whether your registry configuration lets public packages shadow internal or scoped names
  4. GoParrot users - make sure @goparrot* scopes resolve only from your own registry
  5. Block - 38.242.235.206 (RubyGems dopc-client probe callback)
References

Sources

multi-2026-11-04-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents