DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 6 November 2026

HighAdvisory sweepnpmPyPI

65 packages from GitHub malware advisories published between 5 and 6 November 2026 (06:00 UTC). Headlines: 28 more trojanised Baileys WhatsApp forks, new names for known npm dropper families posing as Solidity and pino tools, fake TeamViewer MCP servers on PyPI, and dependency-confusion probes.

Published 6 Nov 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-11-06-ghsa-malware-sweep
65
Packages tracked103 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
6 Nov 2026
Ecosystems
npmPyPI
Detected by
GitHub Advisory Database, OpenSSF Package Analysis, OX Security
Also known as
GHSA 2026-11-06 batch

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

GitHub published malware advisories for 65 packages in this window across npm and PyPI. Severity is high for the dropper families in the loader cluster.

The probe cluster includes four more names (wxwxtt, wisewwasd, wiselllx, wiasdcxc) from the campaign GitHub tracks with the troubleshooting package, plus rcp-ndcg@9999.0.0 and dbt-adapter on PyPI.

Indicators named in the advisories

  • nathanaccacio.com (probe callback)
obfuscationdependency-confusioncredential-theft
Affected packages

65 packages 103 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • Cluster: droppers, RATs and remote-code loaders (malicious-package; advisory analysis published) (7 packages): @k.vict1999/pino-std-serializers, loader-utils-kit, pino-std, solidity-cat, solidity-gas-watcher, solidity-map and 1 more. New names for dropper families already in the catalogue: copies of the hardhat-roof, chai-foundry and hardhat-hold payloads (solidity-*), the pino-testkit payload hidden in pino logger copies, and the nebulajs-api payload. Each loads obfuscated code or fetches a second stage at load or install time.
  • Cluster: fake MCP server packages (malicious-package; advisory analysis published) (2 packages): mcp-teamviewer, teamviewer-mcp-server. PyPI packages presented as TeamViewer MCP servers that OpenSSF flagged for contacting a known-malicious domain.
  • Cluster: trojanised Baileys WhatsApp library forks (malicious-package; advisory analysis published) (28 packages): @alannxds/baileys, @axo_cuy/baileyss, @bellaxchan/bailtech, @bellaxchan/eleventech, @bellaxchan/sixtech, @bellaxchan/techxatz, @denzz221/baileys, @dyllxnn/baileys and 20 more. Forks of the Baileys WhatsApp Web library that silently subscribe the user's WhatsApp account to channels chosen by the publisher; the advisories tie them to the campaign OX Security named PhantomSub. Use the official @whiskeysockets/baileys only.
  • Cluster: dependency-confusion and pentest probes (dependency-confusion; beacon only) (7 packages): cs-core-api-phoenix, dbt-adapter, rcp-ndcg, wiasdcxc, wiselllx, wisewwasd and 1 more. These send only host details (hostname, username, working directory) to a callback host, mostly under internal-looking or squatted names at inflated versions. No payload beyond the beacon was reported, but a hit means your build resolved a public package where you expected a private one.
  • Cluster: self-republishing registry spam (malicious-package; advisory analysis published) (10 packages): dependent-final, dian-peyek23-miaww, low_hummingbird_replicate_automation, maila-talijah-alpha-128, pearx93qja-notthedevs, peas-tea-curut and 4 more. Each package republishes itself to npm under new random names. No credential theft was reported; the harm is registry noise, but remove any that reached a lockfile.
  • Cluster: CWE-506 takedowns with no published analysis (malicious-package; likely probes or lures) (11 packages): @db-tools/main-app, @gemshell/win32-x64, @kora20030101/test-pkg-delete-me, @nuri.yavuz.tr.2/my-unique-pinger, dsh-purge, itc-actors-api, plain-lang, sickle-wrapper, talk-lang, test1817 and 1 more. GitHub published only its standard "treat the host as compromised" notice for these, with no payload analysis.
What to do

Clean-up steps

  1. Check your lockfiles - search package-lock.json, yarn.lock, pnpm-lock.yaml, requirements*.txt, poetry.lock, uv.lock and Gemfile.lock for every package and version listed below, or upload them to the DependencyWatch scanner
  2. Stealers, loaders and RATs - on any hit, isolate the host, rebuild it from a clean image, and rotate every credential it could reach from a different machine
  3. Probes and spam - remove the package, rebuild, and check whether your registry configuration lets public packages shadow internal or scoped names
  4. WhatsApp bots - if a Baileys fork ran, review which channels the bot account follows and switch to @whiskeysockets/baileys
  5. Block - nathanaccacio.com (cs-core-api-phoenix probe callback)
References

Sources

multi-2026-11-06-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents