# GitHub Advisory malware sweep, 6 November 2026

> 65 packages from GitHub malware advisories published between 5 and 6 November 2026 (06:00 UTC). Headlines: 28 more trojanised Baileys WhatsApp forks, new names for known npm dropper families posing as Solidity and pino tools, fake TeamViewer MCP servers on PyPI, and dependency-confusion probes.

- Published: 2026-11-06
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 65 packages, 103 compromised versions
- Tags: obfuscation, dependency-confusion, credential-theft
- Also known as: GHSA 2026-11-06 batch
- Detected by: GitHub Advisory Database, OpenSSF Package Analysis, OX Security
- Incident ID: multi-2026-11-06-ghsa-malware-sweep

## Affected packages (65)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@alannxds/baileys](https://dependencywatch.io/package/npm/@alannxds/baileys) | npm | 6.2.10 |
| [@axo_cuy/baileyss](https://dependencywatch.io/package/npm/@axo_cuy/baileyss) | npm | 1.0.0, 1.0.1, 3.0.1 |
| [@bellaxchan/bailtech](https://dependencywatch.io/package/npm/@bellaxchan/bailtech) | npm | 1.1.0 |
| [@bellaxchan/eleventech](https://dependencywatch.io/package/npm/@bellaxchan/eleventech) | npm | 0.0.8 |
| [@bellaxchan/sixtech](https://dependencywatch.io/package/npm/@bellaxchan/sixtech) | npm | 1.1.5 |
| [@bellaxchan/techxatz](https://dependencywatch.io/package/npm/@bellaxchan/techxatz) | npm | 0.1.2 |
| [@db-tools/main-app](https://dependencywatch.io/package/npm/@db-tools/main-app) | npm | * |
| [@denzz221/baileys](https://dependencywatch.io/package/npm/@denzz221/baileys) | npm | 2.0.0, 7.0.0, 8.0.5, 8.0.6, 8.0.8, 8.1.1, 8.1.2, 8.1.3, 8.1.5, 8.1.6, 8.1.7 |
| [@dyllxnn/baileys](https://dependencywatch.io/package/npm/@dyllxnn/baileys) | npm | 1.0.0 |
| [@exclipz/baileys](https://dependencywatch.io/package/npm/@exclipz/baileys) | npm | * |
| [@exclipz/bails](https://dependencywatch.io/package/npm/@exclipz/bails) | npm | * |
| [@gemshell/win32-x64](https://dependencywatch.io/package/npm/@gemshell/win32-x64) | npm | 1.2.1 |
| [@k.vict1999/pino-std-serializers](https://dependencywatch.io/package/npm/@k.vict1999/pino-std-serializers) | npm | 7.2.0 |
| [@kora20030101/test-pkg-delete-me](https://dependencywatch.io/package/npm/@kora20030101/test-pkg-delete-me) | npm | * |
| [@lekzox/baileys](https://dependencywatch.io/package/npm/@lekzox/baileys) | npm | 0.0.1 |
| [@monze1239/baileys](https://dependencywatch.io/package/npm/@monze1239/baileys) | npm | 1.0.0, 1.0.1 |
| [@nuri.yavuz.tr.2/my-unique-pinger](https://dependencywatch.io/package/npm/@nuri.yavuz.tr.2/my-unique-pinger) | npm | 1.0.2 |
| [@raffnotdev/baileys](https://dependencywatch.io/package/npm/@raffnotdev/baileys) | npm | 1.0.0 |
| [@sakataa/baileys](https://dependencywatch.io/package/npm/@sakataa/baileys) | npm | 1.0.0, 2.0.0, 3.0.0 |
| [@wanzforme/bails](https://dependencywatch.io/package/npm/@wanzforme/bails) | npm | 1.0.0, 2.0.0 |
| [@zaxius/baileys](https://dependencywatch.io/package/npm/@zaxius/baileys) | npm | 1.0.1 |
| [@zyrennofficiall/baileys](https://dependencywatch.io/package/npm/@zyrennofficiall/baileys) | npm | 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.5.0 |
| [aemeath-baileys](https://dependencywatch.io/package/npm/aemeath-baileys) | npm | 1.1.13 |
| [cs-core-api-phoenix](https://dependencywatch.io/package/npm/cs-core-api-phoenix) | npm | 5.1.0 |
| [dbt-adapter](https://dependencywatch.io/package/pypi/dbt-adapter) | PyPI | 0.0.0, 0.1.0a2 |
| [dependent-final](https://dependencywatch.io/package/npm/dependent-final) | npm | 1.0.3 |
| [dian-peyek23-miaww](https://dependencywatch.io/package/npm/dian-peyek23-miaww) | npm | 1.1.3 |
| [dsh-purge](https://dependencywatch.io/package/npm/dsh-purge) | npm | 1.2.1 |
| [ichigokurosaki-baileys](https://dependencywatch.io/package/npm/ichigokurosaki-baileys) | npm | 1.0.0 |
| [itc-actors-api](https://dependencywatch.io/package/npm/itc-actors-api) | npm | * |
| [kevinx-baileys](https://dependencywatch.io/package/npm/kevinx-baileys) | npm | 1.2.0, 1.2.1, 1.2.2 |
| [kurobails](https://dependencywatch.io/package/npm/kurobails) | npm | * |
| [loader-utils-kit](https://dependencywatch.io/package/npm/loader-utils-kit) | npm | 4.2.1, 4.3.5 |
| [low_hummingbird_replicate_automation](https://dependencywatch.io/package/npm/low_hummingbird_replicate_automation) | npm | 2.2.1 |
| [lunaaa-baileys](https://dependencywatch.io/package/npm/lunaaa-baileys) | npm | 1.1.0, 1.1.1, 9.0.22, 9.0.23 |
| [maila-talijah-alpha-128](https://dependencywatch.io/package/npm/maila-talijah-alpha-128) | npm | 1.1.11 |
| [mcp-teamviewer](https://dependencywatch.io/package/pypi/mcp-teamviewer) | PyPI | 0.0.1 |
| [ndraawzz-baileys](https://dependencywatch.io/package/npm/ndraawzz-baileys) | npm | 1.5.0 |
| [nishiki-bail](https://dependencywatch.io/package/npm/nishiki-bail) | npm | * |
| [oktz-baileys](https://dependencywatch.io/package/npm/oktz-baileys) | npm | * |
| [pearx93qja-notthedevs](https://dependencywatch.io/package/npm/pearx93qja-notthedevs) | npm | 1.1.8 |
| [peas-tea-curut](https://dependencywatch.io/package/npm/peas-tea-curut) | npm | 3.2.2 |
| [pino-std](https://dependencywatch.io/package/npm/pino-std) | npm | 7.2.0 |
| [plain-lang](https://dependencywatch.io/package/npm/plain-lang) | npm | * |
| [quiche-tea-curut](https://dependencywatch.io/package/npm/quiche-tea-curut) | npm | 4.3.4 |
| [rafael-bails](https://dependencywatch.io/package/npm/rafael-bails) | npm | * |
| [rcp-ndcg](https://dependencywatch.io/package/pypi/rcp-ndcg) | PyPI | 9999.0.0 |
| [related_blackbird-toolteadev](https://dependencywatch.io/package/npm/related_blackbird-toolteadev) | npm | 2.1.1 |
| [ruby-baileys](https://dependencywatch.io/package/npm/ruby-baileys) | npm | 1.5.17, 1.5.18 |
| [sickle-wrapper](https://dependencywatch.io/package/npm/sickle-wrapper) | npm | * |
| [solidity-cat](https://dependencywatch.io/package/npm/solidity-cat) | npm | 2.0.1 |
| [solidity-gas-watcher](https://dependencywatch.io/package/npm/solidity-gas-watcher) | npm | 2.21.0 |
| [solidity-map](https://dependencywatch.io/package/npm/solidity-map) | npm | 2.21.0 |
| [talk-lang](https://dependencywatch.io/package/npm/talk-lang) | npm | * |
| [teamviewer-mcp-server](https://dependencywatch.io/package/pypi/teamviewer-mcp-server) | PyPI | 0.0.1 |
| [test1817](https://dependencywatch.io/package/npm/test1817) | npm | * |
| [testtestkjkldfnjdfn](https://dependencywatch.io/package/npm/testtestkjkldfnjdfn) | npm | 1.0.0 |
| [unemployed_xerinae-toolteadev](https://dependencywatch.io/package/npm/unemployed_xerinae-toolteadev) | npm | 1.4.4 |
| [vfat-tools](https://dependencywatch.io/package/npm/vfat-tools) | npm | * |
| [wet_rat_replicate_automation](https://dependencywatch.io/package/npm/wet_rat_replicate_automation) | npm | 2.3.1 |
| [wiasdcxc](https://dependencywatch.io/package/npm/wiasdcxc) | npm | 1.0.1 |
| [wiselllx](https://dependencywatch.io/package/npm/wiselllx) | npm | 0.0.1, 1.0.1 |
| [wisewwasd](https://dependencywatch.io/package/npm/wisewwasd) | npm | 1.0.1 |
| [wxwxtt](https://dependencywatch.io/package/npm/wxwxtt) | npm | 0.0.0, 0.0.1, 0.1.0, 1.0.0, 1.0.1, 1.1.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1 |
| [xzvbailss](https://dependencywatch.io/package/npm/xzvbailss) | npm | 1.0.0 |

## What happened

GitHub published malware advisories for 65 packages in this window across npm and PyPI. Severity is `high` for the dropper families in the loader cluster.

The probe cluster includes four more names (`wxwxtt`, `wisewwasd`, `wiselllx`, `wiasdcxc`) from the campaign GitHub tracks with the `troubleshooting` package, plus `rcp-ndcg@9999.0.0` and `dbt-adapter` on PyPI.

## Indicators named in the advisories

- `nathanaccacio.com` (probe callback)

## Impact

- **Cluster: droppers, RATs and remote-code loaders (malicious-package; advisory analysis published) (7 packages)**: `@k.vict1999/pino-std-serializers`, `loader-utils-kit`, `pino-std`, `solidity-cat`, `solidity-gas-watcher`, `solidity-map` and 1 more. New names for dropper families already in the catalogue: copies of the `hardhat-roof`, `chai-foundry` and `hardhat-hold` payloads (`solidity-*`), the `pino-testkit` payload hidden in pino logger copies, and the `nebulajs-api` payload. Each loads obfuscated code or fetches a second stage at load or install time.
- **Cluster: fake MCP server packages (malicious-package; advisory analysis published) (2 packages)**: `mcp-teamviewer`, `teamviewer-mcp-server`. PyPI packages presented as TeamViewer MCP servers that OpenSSF flagged for contacting a known-malicious domain.
- **Cluster: trojanised Baileys WhatsApp library forks (malicious-package; advisory analysis published) (28 packages)**: `@alannxds/baileys`, `@axo_cuy/baileyss`, `@bellaxchan/bailtech`, `@bellaxchan/eleventech`, `@bellaxchan/sixtech`, `@bellaxchan/techxatz`, `@denzz221/baileys`, `@dyllxnn/baileys` and 20 more. Forks of the Baileys WhatsApp Web library that silently subscribe the user's WhatsApp account to channels chosen by the publisher; the advisories tie them to the campaign OX Security named PhantomSub. Use the official `@whiskeysockets/baileys` only.
- **Cluster: dependency-confusion and pentest probes (dependency-confusion; beacon only) (7 packages)**: `cs-core-api-phoenix`, `dbt-adapter`, `rcp-ndcg`, `wiasdcxc`, `wiselllx`, `wisewwasd` and 1 more. These send only host details (hostname, username, working directory) to a callback host, mostly under internal-looking or squatted names at inflated versions. No payload beyond the beacon was reported, but a hit means your build resolved a public package where you expected a private one.
- **Cluster: self-republishing registry spam (malicious-package; advisory analysis published) (10 packages)**: `dependent-final`, `dian-peyek23-miaww`, `low_hummingbird_replicate_automation`, `maila-talijah-alpha-128`, `pearx93qja-notthedevs`, `peas-tea-curut` and 4 more. Each package republishes itself to npm under new random names. No credential theft was reported; the harm is registry noise, but remove any that reached a lockfile.
- **Cluster: CWE-506 takedowns with no published analysis (malicious-package; likely probes or lures) (11 packages)**: `@db-tools/main-app`, `@gemshell/win32-x64`, `@kora20030101/test-pkg-delete-me`, `@nuri.yavuz.tr.2/my-unique-pinger`, `dsh-purge`, `itc-actors-api`, `plain-lang`, `sickle-wrapper`, `talk-lang`, `test1817` and 1 more. GitHub published only its standard "treat the host as compromised" notice for these, with no payload analysis.

## What to do

1. **Check your lockfiles** - search `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `requirements*.txt`, `poetry.lock`, `uv.lock` and `Gemfile.lock` for every package and version listed below, or upload them to the DependencyWatch scanner
2. **Stealers, loaders and RATs** - on any hit, isolate the host, rebuild it from a clean image, and rotate every credential it could reach from a different machine
3. **Probes and spam** - remove the package, rebuild, and check whether your registry configuration lets public packages shadow internal or scoped names
4. **WhatsApp bots** - if a Baileys fork ran, review which channels the bot account follows and switch to `@whiskeysockets/baileys`
5. **Block** - `nathanaccacio.com` (`cs-core-api-phoenix` probe callback)

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database, malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF
- [GHSA-rgfv-cv82-ppcm - npm solidity-gas-watcher dropper](https://github.com/advisories/GHSA-rgfv-cv82-ppcm) - GitHub
- [GHSA-cc98-qqxc-x7r6 - npm pino-std](https://github.com/advisories/GHSA-cc98-qqxc-x7r6) - GitHub
- [GHSA-h8q9-4jrq-9vfq - npm rafael-bails (PhantomSub)](https://github.com/advisories/GHSA-h8q9-4jrq-9vfq) - GitHub
- [GHSA-v98v-h2h9-7j3h - PyPI teamviewer-mcp-server](https://github.com/advisories/GHSA-v98v-h2h9-7j3h) - GitHub
- [GHSA-5rmp-29vr-6q79 - npm cs-core-api-phoenix probe](https://github.com/advisories/GHSA-5rmp-29vr-6q79) - GitHub
- [DependencyWatch: previous day's sweep](https://dependencywatch.io/incident/multi-2026-11-05-ghsa-malware-sweep)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-11-06-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-11-06-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).