GitHub Advisory malware sweep, 7 November 2026
27 packages from GitHub malware advisories published 6–7 November 2026 (after the previous sweep’s 06:00 UTC cutoff). Headlines: PyPI reqnest-campaign typosquats exfiltrating Telegram files, a PyPI RAT dropper, 2 more Baileys WhatsApp forks, and 20 npm CWE-506 takedowns.
Published 7 Nov 2026
Every version named by the advisory is in the scanner, so a lockfile check finds it directly.
- Severity
- High
- Type
- Advisory sweep
- Published
- 7 Nov 2026
- Ecosystems
- npmPyPI
- Detected by
- OpenSSF
- Source
- github.com
Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
The full picture
GitHub published malware advisories for 27 packages between 6 November 2026 (after the previous sweep’s 06:00 UTC window) and 7 November 2026. Severity is high for the confirmed Telegram infostealer campaign and the RAT dropper.
The 2026-11-reqnest campaign (Cluster A) targets Telegram desktop users via PyPI typosquats of the requests library. All four packages were flagged by OpenSSF for files-exfiltration targeting Telegram.
The Baileys WhatsApp fork wave (Cluster C) continues with two more names; the pattern matches the PhantomSub campaign already in the catalogue. The remaining 20 npm packages (Cluster D) received only boilerplate CWE-506 notices with no published analysis.
27 packages 30 versions
- npm@cherrydotfun/miniapp-sdk0.1.220.1.23→
- npm@needsaudit/n*→
- npm@needsaudit/nexport*→
- npm@noinheritdoc/n*→
- npm@sideeffects/n*→
- npm@site-cms/ssr*→
- npm@smart-dev-wa/baileys*→
- npm@ts-expect-error/n*→
- PyPIajfhiuqhfqgwerhuqnfqh0.1.0→
- npmarc-contracts*→
- npmautomic-style-engine*→
- npmccb-app-ui-service*→
- npmevmos-contracts*→
- PyPIfhqiouhq0.1.0→
- PyPIhello-bat-fwi90.1.00.1.1→
- npmkampodine*→
- npmkc-kline-chart*→
- npmmodelsdesk0.4.2→
- npmmonobomber*→
- npmmonopw*→
- PyPIreqnest0.1.0→
- PyPIreqnests0.1.00.1.1→
- npmsecuredrop-app*→
- npmtailwind-animationfound*→
- npmtw-motion-css*→
- npmwisdomtreetest*→
- npmzero2-baileys*→
These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.
What it does if you installed it
- Cluster A: Telegram file exfiltration typosquats (malicious-package; advisory analysis published) (4 packages):
reqnest,reqnests,ajfhiuqhfqgwerhuqnfqh,fhqiouhq. PyPI packages in the 2026-11-reqnest campaign. On import each silently exfiltrates Telegram session and data files to a remote server.reqnest/reqnestsmimic the popularrequestslibrary. - Cluster B: RAT via obfuscated .bat dropper (malicious-package; advisory analysis published) (1 package):
hello-bat-fwi9. PyPI package that ships an obfuscated .bat file installing a remote access trojan via its own Python runtime and .pth persistence. Linked to the 2026-11-filipt campaign. - Cluster C: trojanised Baileys WhatsApp library forks (malicious-package; CWE-506 boilerplate) (2 packages):
@smart-dev-wa/baileys,zero2-baileys. Continuation of the PhantomSub Baileys fork campaign from previous sweeps. Use the official@whiskeysockets/baileysonly. - Cluster D: CWE-506 takedowns with no published analysis (malicious-package; likely probes or lures) (20 packages):
@cherrydotfun/miniapp-sdk,@needsaudit/n,@needsaudit/nexport,@noinheritdoc/n,@sideeffects/n,@site-cms/ssr,@ts-expect-error/n,arc-contracts,automic-style-engine,ccb-app-ui-service,evmos-contracts,kampodine,kc-kline-chart,modelsdesk,monobomber,monopw,securedrop-app,tailwind-animationfound,tw-motion-css,wisdomtreetest. GitHub published only its standard "treat the host as compromised" notice, with no payload analysis.
Clean-up steps
- Check your lockfiles for every package and version listed below, or upload them to the DependencyWatch scanner
- Telegram theft (Cluster A): uninstall, revoke all active Telegram sessions from the machine, rotate any API keys or bot tokens stored alongside Telegram data
- RAT (Cluster B): isolate the host, rebuild from a clean image, rotate every credential the machine could reach
- WhatsApp forks (Cluster C): remove the fork, review which channels the bot account follows, switch to
@whiskeysockets/baileys - CWE-506 boilerplate (Cluster D): remove the package and rebuild; rotate secrets if the host ran the package
Sources
- GitHub Advisory Database, malware advisoriesgithub.com
- GHSA-xmqc-r2gw-32q8: reqnest Telegram exfiltrationgithub.com
- GHSA-v3cx-96jw-mv99: hello-bat-fwi9 RAT droppergithub.com
- OpenSSF malicious-packages repositorygithub.com
Check your lockfile against this and every other incident.
Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.
