# GitHub Advisory malware sweep, 5 November 2026

> 64 packages from GitHub malware advisories published between 4 and 5 November 2026 (06:00 UTC). Headlines: an npm reverse shell, a Windows batch-file dropper, PyPI Telegram-file stealers, a self-republishing spam wave, and a disputed flag on screenshot-desktop 1.16.0 that its maintainer reports as a false positive.

- Published: 2026-11-05
- Last updated: 2026-11-06
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 64 packages, 71 compromised versions
- Tags: infostealer, credential-theft, dependency-confusion, worm
- Also known as: GHSA 2026-11-05 batch
- Detected by: GitHub Advisory Database, OpenSSF Package Analysis, kam193
- Incident ID: multi-2026-11-05-ghsa-malware-sweep

## Affected packages (64)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@adminide-stack/client-redux](https://dependencywatch.io/package/npm/@adminide-stack/client-redux) | npm | 0.0.16-18 |
| [@adminide-stack/forms-core](https://dependencywatch.io/package/npm/@adminide-stack/forms-core) | npm | 5.1.9-alpha.3 |
| [@adminide-stack/health-api-server](https://dependencywatch.io/package/npm/@adminide-stack/health-api-server) | npm | 0.0.18-alpha.465 |
| [@adminide-stack/user-activity-browser](https://dependencywatch.io/package/npm/@adminide-stack/user-activity-browser) | npm | 0.0.16-129, 1.1.3-alpha.114 |
| [@adminide-stack/utils](https://dependencywatch.io/package/npm/@adminide-stack/utils) | npm | 0.0.16-130 |
| [@adminide-stack/yantra-help-browser](https://dependencywatch.io/package/npm/@adminide-stack/yantra-help-browser) | npm | 12.0.194 |
| [@ai-ecoverse/slicc-windows-amd64](https://dependencywatch.io/package/npm/@ai-ecoverse/slicc-windows-amd64) | npm | 1.46.4 |
| [@atfm/atfm-material-ui](https://dependencywatch.io/package/npm/@atfm/atfm-material-ui) | npm | 99.99.99 |
| [@atfm/utils](https://dependencywatch.io/package/npm/@atfm/utils) | npm | 99.99.99 |
| [@cdmbase/wiki-browser](https://dependencywatch.io/package/npm/@cdmbase/wiki-browser) | npm | 12.0.18-alpha.53 |
| [@fyxzpediaa/baileys](https://dependencywatch.io/package/npm/@fyxzpediaa/baileys) | npm | * |
| [@fyxzpediaa/libsignal](https://dependencywatch.io/package/npm/@fyxzpediaa/libsignal) | npm | * |
| [@ifasn/ms-doc-mcp](https://dependencywatch.io/package/npm/@ifasn/ms-doc-mcp) | npm | 2.0.9, 2.1.1 |
| [@pasqua-baileys/baileys](https://dependencywatch.io/package/npm/@pasqua-baileys/baileys) | npm | * |
| [@pubngo-stack/help-browser](https://dependencywatch.io/package/npm/@pubngo-stack/help-browser) | npm | 12.0.23-alpha.3 |
| [@realvare/baileys](https://dependencywatch.io/package/npm/@realvare/baileys) | npm | * |
| [@realvare/based](https://dependencywatch.io/package/npm/@realvare/based) | npm | * |
| [@saidddddddddd/ggsgg](https://dependencywatch.io/package/npm/@saidddddddddd/ggsgg) | npm | * |
| [@saidddddddddd/somethingelse](https://dependencywatch.io/package/npm/@saidddddddddd/somethingelse) | npm | * |
| [@secaudita10x/sec-test-a1](https://dependencywatch.io/package/npm/@secaudita10x/sec-test-a1) | npm | * |
| [@secauditb20y/sec-test-b1](https://dependencywatch.io/package/npm/@secauditb20y/sec-test-b1) | npm | * |
| [@secauditb20y/sec-test-r3b](https://dependencywatch.io/package/npm/@secauditb20y/sec-test-r3b) | npm | * |
| [@signals-notebook/annotation-editor](https://dependencywatch.io/package/npm/@signals-notebook/annotation-editor) | npm | 2.2.60-630109c |
| [@ubedsockets/baileys](https://dependencywatch.io/package/npm/@ubedsockets/baileys) | npm | * |
| [babyyodaa](https://dependencywatch.io/package/npm/babyyodaa) | npm | 1.1.0 |
| [canta-baileys](https://dependencywatch.io/package/npm/canta-baileys) | npm | * |
| [cdeops](https://dependencywatch.io/package/npm/cdeops) | npm | 13.5.31 |
| [colossal_wallaby_pink-87](https://dependencywatch.io/package/npm/colossal_wallaby_pink-87) | npm | 1.2.1 |
| [data-sync-utils](https://dependencywatch.io/package/npm/data-sync-utils) | npm | * |
| [doghack-afterglow](https://dependencywatch.io/package/npm/doghack-afterglow) | npm | * |
| [dogmans-afterglow](https://dependencywatch.io/package/npm/dogmans-afterglow) | npm | * |
| [et_phone_home](https://dependencywatch.io/package/npm/et_phone_home) | npm | 0.0.5 |
| [exnesss](https://dependencywatch.io/package/npm/exnesss) | npm | * |
| [extera-plugin-runtime](https://dependencywatch.io/package/pypi/extera-plugin-runtime) | PyPI | 1.0.0, 1.0.1 |
| [extera-runtime](https://dependencywatch.io/package/pypi/extera-runtime) | PyPI | 1.1.0 |
| [filipt](https://dependencywatch.io/package/npm/filipt) | npm | * |
| [gugodapis](https://dependencywatch.io/package/npm/gugodapis) | npm | 1.0.0 |
| [heheheshsds](https://dependencywatch.io/package/npm/heheheshsds) | npm | * |
| [hollow_wildebeest_silver-94](https://dependencywatch.io/package/npm/hollow_wildebeest_silver-94) | npm | 1.1.2 |
| [hushed_zebra_green-81](https://dependencywatch.io/package/npm/hushed_zebra_green-81) | npm | 2.4.2 |
| [inadequate_earwig_magenta-66](https://dependencywatch.io/package/npm/inadequate_earwig_magenta-66) | npm | 3.4.3 |
| [intimate_ostrich_amethyst-45](https://dependencywatch.io/package/npm/intimate_ostrich_amethyst-45) | npm | 3.1.4 |
| [itchy_gecko_magenta-98](https://dependencywatch.io/package/npm/itchy_gecko_magenta-98) | npm | 2.3.4 |
| [kvarzo-8f3a2-testmetest](https://dependencywatch.io/package/npm/kvarzo-8f3a2-testmetest) | npm | * |
| [mock-datas-lib](https://dependencywatch.io/package/npm/mock-datas-lib) | npm | * |
| [motionless_mandrill_blush-51](https://dependencywatch.io/package/npm/motionless_mandrill_blush-51) | npm | 2.2.3 |
| [msgpackrpc](https://dependencywatch.io/package/pypi/msgpackrpc) | PyPI | 0.0.0, 0.1.0 |
| [nannnnnnnnn](https://dependencywatch.io/package/npm/nannnnnnnnn) | npm | * |
| [nminer](https://dependencywatch.io/package/npm/nminer) | npm | 3.0.0 |
| [noon-contracts](https://dependencywatch.io/package/npm/noon-contracts) | npm | * |
| [pure_opossum_amaranth-54](https://dependencywatch.io/package/npm/pure_opossum_amaranth-54) | npm | 2.3.2 |
| [screenshot-desktop](https://dependencywatch.io/package/npm/screenshot-desktop) | npm | 1.16.0 |
| [smooth_angelfish_emerald-54](https://dependencywatch.io/package/npm/smooth_angelfish_emerald-54) | npm | 2.2.2 |
| [sound_deer_apricot-15](https://dependencywatch.io/package/npm/sound_deer_apricot-15) | npm | 2.1.4 |
| [southern_duck_tan-16](https://dependencywatch.io/package/npm/southern_duck_tan-16) | npm | 2.4.3 |
| [specific_sheep_violet-22](https://dependencywatch.io/package/npm/specific_sheep_violet-22) | npm | 2.4.1 |
| [strands-aidr](https://dependencywatch.io/package/pypi/strands-aidr) | PyPI | 9999.0.0 |
| [synapse-hub](https://dependencywatch.io/package/npm/synapse-hub) | npm | 3.1.0, 3.1.1, 3.1.2, 3.2.0 |
| [temporary_smelt_lavender-81](https://dependencywatch.io/package/npm/temporary_smelt_lavender-81) | npm | 3.3.1 |
| [that-fetch](https://dependencywatch.io/package/npm/that-fetch) | npm | * |
| [thththtbhthhth](https://dependencywatch.io/package/npm/thththtbhthhth) | npm | * |
| [unfortunate_crawdad_emerald-79](https://dependencywatch.io/package/npm/unfortunate_crawdad_emerald-79) | npm | 3.3.1 |
| [valid_antlion_amber-50](https://dependencywatch.io/package/npm/valid_antlion_amber-50) | npm | 4.1.3 |
| [xenacious_kangaroo_blush-47](https://dependencywatch.io/package/npm/xenacious_kangaroo_blush-47) | npm | 4.3.3 |

## What happened

GitHub published malware advisories for 64 packages in this window across npm and PyPI. Severity is `high` for the confirmed reverse shell, dropper and Telegram stealers.

The CWE-506 cluster includes `kvarzo-8f3a2-testmetest`, a new name in the `*-testmetest` family that SafeDep links to the [Miasma worm](https://dependencywatch.io/incident/pypi-2026-11-01-pystr-codec-miasma-worm), and a group of packages in the `@adminide-stack`, `@cdmbase` and `@pubngo-stack` scopes.

## Indicators named in the advisories

- `*.callback.m0chan.co.uk` (probe callback)

## Impact

- **Cluster: droppers, RATs and remote-code loaders (malicious-package; advisory analysis published) (2 packages)**: `babyyodaa`, `gugodapis`. `babyyodaa` opens a reverse shell on install; `gugodapis` downloads and runs a Windows batch file from a remote server.
- **Cluster: information and wallet stealers (malicious-package; advisory analysis published) (2 packages)**: `extera-plugin-runtime`, `extera-runtime`. Advisories report these contain code to copy sensitive Telegram files; it does not run automatically, so exposure depends on how the package was used.
- **Cluster: fake MCP server packages (malicious-package; advisory analysis published) (1 package)**: `@ifasn/ms-doc-mcp`. Published as MCP servers for AI tools, but the advisories report they contact attacker infrastructure on startup. Install MCP servers only from publishers you can verify.
- **Disputed: flagged version of an established package (likely false positive) (1 package)**: `screenshot-desktop` 1.16.0 (GHSA-q2mc-9hgr-vmx2, MAL-2026-18624) is a widely used package, and GitHub flagged only this one version, with its standard CWE-506 notice and no analysis. The maintainer reports the published tarball matches the v1.16.0 release source and that JFrog found no malware; both false-positive reports were still open on 6 November. Pin `1.15.8` until the advisory is resolved. This is not treated as a confirmed compromise.
- **Cluster: trojanised Baileys WhatsApp library forks (malicious-package; advisory analysis published) (6 packages)**: `@fyxzpediaa/baileys`, `@fyxzpediaa/libsignal`, `@pasqua-baileys/baileys`, `@realvare/baileys`, `@ubedsockets/baileys`, `canta-baileys`. Forks of the Baileys WhatsApp Web library republished under new names. Advisories report they silently subscribe the user's WhatsApp account to channels chosen by the publisher, or pull an unpinned `libsignal` dependency from a third-party source that can change at any time. Use the official `@whiskeysockets/baileys` only.
- **Cluster: dependency-confusion and pentest probes (dependency-confusion; beacon only) (5 packages)**: `@atfm/atfm-material-ui`, `@atfm/utils`, `@signals-notebook/annotation-editor`, `msgpackrpc`, `strands-aidr`. These send only host details (hostname, username, working directory) to a callback host, mostly under internal-looking or squatted names at inflated versions. No payload beyond the beacon was reported, but a hit means your build resolved a public package where you expected a private one.
- **Cluster: self-republishing registry spam (malicious-package; advisory analysis published) (16 packages)**: `colossal_wallaby_pink-87`, `hollow_wildebeest_silver-94`, `hushed_zebra_green-81`, `inadequate_earwig_magenta-66`, `intimate_ostrich_amethyst-45`, `itchy_gecko_magenta-98` and 10 more. Each package republishes itself to npm under new random names. No credential theft was reported; the harm is registry noise, but remove any that reached a lockfile.
- **Cluster: CWE-506 takedowns with no published analysis (malicious-package; likely probes or lures) (31 packages)**: `@adminide-stack/client-redux`, `@adminide-stack/forms-core`, `@adminide-stack/health-api-server`, `@adminide-stack/user-activity-browser`, `@adminide-stack/utils`, `@adminide-stack/yantra-help-browser`, `@ai-ecoverse/slicc-windows-amd64`, `@cdmbase/wiki-browser`, `@pubngo-stack/help-browser`, `@realvare/based` and 21 more. GitHub published only its standard "treat the host as compromised" notice for these, with no payload analysis.

## What to do

1. **Check your lockfiles** - search `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `requirements*.txt`, `poetry.lock`, `uv.lock` and `Gemfile.lock` for every package and version listed below, or upload them to the DependencyWatch scanner
2. **Stealers, loaders and RATs** - on any hit, isolate the host, rebuild it from a clean image, and rotate every credential it could reach from a different machine
3. **Probes and spam** - remove the package, rebuild, and check whether your registry configuration lets public packages shadow internal or scoped names
4. **screenshot-desktop** - pin to `1.15.8` (the current `latest` tag) until GitHub resolves the advisory; no host action is needed unless a vendor confirms a payload
5. **Block** - `*.callback.m0chan.co.uk` (scoped `@atfm/*` probe callback)

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database, malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF
- [GHSA-x23x-7rrv-ffw6 - npm babyyodaa reverse shell](https://github.com/advisories/GHSA-x23x-7rrv-ffw6) - GitHub
- [GHSA-8f66-hgpp-j732 - npm gugodapis dropper](https://github.com/advisories/GHSA-8f66-hgpp-j732) - GitHub
- [GHSA-f44g-4vc7-5crw - PyPI extera-runtime](https://github.com/advisories/GHSA-f44g-4vc7-5crw) - GitHub
- [GHSA-q2mc-9hgr-vmx2 - npm screenshot-desktop 1.16.0 (disputed)](https://github.com/advisories/GHSA-q2mc-9hgr-vmx2) - GitHub
- [False-positive report for GHSA-q2mc-9hgr-vmx2 (screenshot-desktop)](https://github.com/github/advisory-database/issues/10904)
- [False-positive report for MAL-2026-18624 (screenshot-desktop)](https://github.com/ossf/malicious-packages/issues/1745)
- [GHSA-rp9h-2jgp-qrpx - self-republishing spam example](https://github.com/advisories/GHSA-rp9h-2jgp-qrpx) - GitHub
- [DependencyWatch: previous day's sweep](https://dependencywatch.io/incident/multi-2026-11-04-ghsa-malware-sweep)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-11-05-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-11-05-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).