DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 5 November 2026

HighAdvisory sweepnpmPyPI

64 packages from GitHub malware advisories published between 4 and 5 November 2026 (06:00 UTC). Headlines: an npm reverse shell, a Windows batch-file dropper, PyPI Telegram-file stealers, a self-republishing spam wave, and a disputed flag on screenshot-desktop 1.16.0 that its maintainer reports as a false positive.

Published 5 Nov 2026 · Updated 6 Nov 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-11-05-ghsa-malware-sweep
64
Packages tracked71 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
5 Nov 2026
Last updated
6 Nov 2026
Ecosystems
npmPyPI
Detected by
GitHub Advisory Database, OpenSSF Package Analysis, kam193
Also known as
GHSA 2026-11-05 batch

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

GitHub published malware advisories for 64 packages in this window across npm and PyPI. Severity is high for the confirmed reverse shell, dropper and Telegram stealers.

The CWE-506 cluster includes kvarzo-8f3a2-testmetest, a new name in the *-testmetest family that SafeDep links to the Miasma worm, and a group of packages in the @adminide-stack, @cdmbase and @pubngo-stack scopes.

Indicators named in the advisories

  • *.callback.m0chan.co.uk (probe callback)
infostealercredential-theftdependency-confusionworm
Affected packages

64 packages 71 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • Cluster: droppers, RATs and remote-code loaders (malicious-package; advisory analysis published) (2 packages): babyyodaa, gugodapis. babyyodaa opens a reverse shell on install; gugodapis downloads and runs a Windows batch file from a remote server.
  • Cluster: information and wallet stealers (malicious-package; advisory analysis published) (2 packages): extera-plugin-runtime, extera-runtime. Advisories report these contain code to copy sensitive Telegram files; it does not run automatically, so exposure depends on how the package was used.
  • Cluster: fake MCP server packages (malicious-package; advisory analysis published) (1 package): @ifasn/ms-doc-mcp. Published as MCP servers for AI tools, but the advisories report they contact attacker infrastructure on startup. Install MCP servers only from publishers you can verify.
  • Disputed: flagged version of an established package (likely false positive) (1 package): screenshot-desktop 1.16.0 (GHSA-q2mc-9hgr-vmx2, MAL-2026-18624) is a widely used package, and GitHub flagged only this one version, with its standard CWE-506 notice and no analysis. The maintainer reports the published tarball matches the v1.16.0 release source and that JFrog found no malware; both false-positive reports were still open on 6 November. Pin 1.15.8 until the advisory is resolved. This is not treated as a confirmed compromise.
  • Cluster: trojanised Baileys WhatsApp library forks (malicious-package; advisory analysis published) (6 packages): @fyxzpediaa/baileys, @fyxzpediaa/libsignal, @pasqua-baileys/baileys, @realvare/baileys, @ubedsockets/baileys, canta-baileys. Forks of the Baileys WhatsApp Web library republished under new names. Advisories report they silently subscribe the user's WhatsApp account to channels chosen by the publisher, or pull an unpinned libsignal dependency from a third-party source that can change at any time. Use the official @whiskeysockets/baileys only.
  • Cluster: dependency-confusion and pentest probes (dependency-confusion; beacon only) (5 packages): @atfm/atfm-material-ui, @atfm/utils, @signals-notebook/annotation-editor, msgpackrpc, strands-aidr. These send only host details (hostname, username, working directory) to a callback host, mostly under internal-looking or squatted names at inflated versions. No payload beyond the beacon was reported, but a hit means your build resolved a public package where you expected a private one.
  • Cluster: self-republishing registry spam (malicious-package; advisory analysis published) (16 packages): colossal_wallaby_pink-87, hollow_wildebeest_silver-94, hushed_zebra_green-81, inadequate_earwig_magenta-66, intimate_ostrich_amethyst-45, itchy_gecko_magenta-98 and 10 more. Each package republishes itself to npm under new random names. No credential theft was reported; the harm is registry noise, but remove any that reached a lockfile.
  • Cluster: CWE-506 takedowns with no published analysis (malicious-package; likely probes or lures) (31 packages): @adminide-stack/client-redux, @adminide-stack/forms-core, @adminide-stack/health-api-server, @adminide-stack/user-activity-browser, @adminide-stack/utils, @adminide-stack/yantra-help-browser, @ai-ecoverse/slicc-windows-amd64, @cdmbase/wiki-browser, @pubngo-stack/help-browser, @realvare/based and 21 more. GitHub published only its standard "treat the host as compromised" notice for these, with no payload analysis.
What to do

Clean-up steps

  1. Check your lockfiles - search package-lock.json, yarn.lock, pnpm-lock.yaml, requirements*.txt, poetry.lock, uv.lock and Gemfile.lock for every package and version listed below, or upload them to the DependencyWatch scanner
  2. Stealers, loaders and RATs - on any hit, isolate the host, rebuild it from a clean image, and rotate every credential it could reach from a different machine
  3. Probes and spam - remove the package, rebuild, and check whether your registry configuration lets public packages shadow internal or scoped names
  4. screenshot-desktop - pin to 1.15.8 (the current latest tag) until GitHub resolves the advisory; no host action is needed unless a vendor confirms a payload
  5. Block - *.callback.m0chan.co.uk (scoped @atfm/* probe callback)
References

Sources

multi-2026-11-05-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents