# GitHub Advisory malware sweep, 7 November 2026 > 27 packages from GitHub malware advisories published 6–7 November 2026 (after the previous sweep’s 06:00 UTC cutoff). Headlines: PyPI reqnest-campaign typosquats exfiltrating Telegram files, a PyPI RAT dropper, 2 more Baileys WhatsApp forks, and 20 npm CWE-506 takedowns. - Published: 2026-11-07 - Severity: high - Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole. - Ecosystems: npm, PyPI - Scope: 27 packages, 30 compromised versions - Tags: typosquat, infostealer - Detected by: OpenSSF - Incident ID: multi-2026-11-07-ghsa-malware-sweep ## Affected packages (27) Only the exact versions listed were named by the source advisories. Other versions are not implicated. | Package | Ecosystem | Compromised versions | |---|---|---| | [@cherrydotfun/miniapp-sdk](https://dependencywatch.io/package/npm/@cherrydotfun/miniapp-sdk) | npm | 0.1.22, 0.1.23 | | [@needsaudit/n](https://dependencywatch.io/package/npm/@needsaudit/n) | npm | * | | [@needsaudit/nexport](https://dependencywatch.io/package/npm/@needsaudit/nexport) | npm | * | | [@noinheritdoc/n](https://dependencywatch.io/package/npm/@noinheritdoc/n) | npm | * | | [@sideeffects/n](https://dependencywatch.io/package/npm/@sideeffects/n) | npm | * | | [@site-cms/ssr](https://dependencywatch.io/package/npm/@site-cms/ssr) | npm | * | | [@smart-dev-wa/baileys](https://dependencywatch.io/package/npm/@smart-dev-wa/baileys) | npm | * | | [@ts-expect-error/n](https://dependencywatch.io/package/npm/@ts-expect-error/n) | npm | * | | [ajfhiuqhfqgwerhuqnfqh](https://dependencywatch.io/package/pypi/ajfhiuqhfqgwerhuqnfqh) | PyPI | 0.1.0 | | [arc-contracts](https://dependencywatch.io/package/npm/arc-contracts) | npm | * | | [automic-style-engine](https://dependencywatch.io/package/npm/automic-style-engine) | npm | * | | [ccb-app-ui-service](https://dependencywatch.io/package/npm/ccb-app-ui-service) | npm | * | | [evmos-contracts](https://dependencywatch.io/package/npm/evmos-contracts) | npm | * | | [fhqiouhq](https://dependencywatch.io/package/pypi/fhqiouhq) | PyPI | 0.1.0 | | [hello-bat-fwi9](https://dependencywatch.io/package/pypi/hello-bat-fwi9) | PyPI | 0.1.0, 0.1.1 | | [kampodine](https://dependencywatch.io/package/npm/kampodine) | npm | * | | [kc-kline-chart](https://dependencywatch.io/package/npm/kc-kline-chart) | npm | * | | [modelsdesk](https://dependencywatch.io/package/npm/modelsdesk) | npm | 0.4.2 | | [monobomber](https://dependencywatch.io/package/npm/monobomber) | npm | * | | [monopw](https://dependencywatch.io/package/npm/monopw) | npm | * | | [reqnest](https://dependencywatch.io/package/pypi/reqnest) | PyPI | 0.1.0 | | [reqnests](https://dependencywatch.io/package/pypi/reqnests) | PyPI | 0.1.0, 0.1.1 | | [securedrop-app](https://dependencywatch.io/package/npm/securedrop-app) | npm | * | | [tailwind-animationfound](https://dependencywatch.io/package/npm/tailwind-animationfound) | npm | * | | [tw-motion-css](https://dependencywatch.io/package/npm/tw-motion-css) | npm | * | | [wisdomtreetest](https://dependencywatch.io/package/npm/wisdomtreetest) | npm | * | | [zero2-baileys](https://dependencywatch.io/package/npm/zero2-baileys) | npm | * | ## What happened GitHub published malware advisories for 27 packages between 6 November 2026 (after the previous sweep’s 06:00 UTC window) and 7 November 2026. Severity is `high` for the confirmed Telegram infostealer campaign and the RAT dropper. The 2026-11-reqnest campaign (Cluster A) targets Telegram desktop users via PyPI typosquats of the `requests` library. All four packages were flagged by OpenSSF for files-exfiltration targeting Telegram. The Baileys WhatsApp fork wave (Cluster C) continues with two more names; the pattern matches the PhantomSub campaign already in the catalogue. The remaining 20 npm packages (Cluster D) received only boilerplate CWE-506 notices with no published analysis. ## Impact - **Cluster A: Telegram file exfiltration typosquats (malicious-package; advisory analysis published) (4 packages)**: `reqnest`, `reqnests`, `ajfhiuqhfqgwerhuqnfqh`, `fhqiouhq`. PyPI packages in the 2026-11-reqnest campaign. On import each silently exfiltrates Telegram session and data files to a remote server. `reqnest`/`reqnests` mimic the popular `requests` library. - **Cluster B: RAT via obfuscated .bat dropper (malicious-package; advisory analysis published) (1 package)**: `hello-bat-fwi9`. PyPI package that ships an obfuscated .bat file installing a remote access trojan via its own Python runtime and .pth persistence. Linked to the 2026-11-filipt campaign. - **Cluster C: trojanised Baileys WhatsApp library forks (malicious-package; CWE-506 boilerplate) (2 packages)**: `@smart-dev-wa/baileys`, `zero2-baileys`. Continuation of the PhantomSub Baileys fork campaign from previous sweeps. Use the official `@whiskeysockets/baileys` only. - **Cluster D: CWE-506 takedowns with no published analysis (malicious-package; likely probes or lures) (20 packages)**: `@cherrydotfun/miniapp-sdk`, `@needsaudit/n`, `@needsaudit/nexport`, `@noinheritdoc/n`, `@sideeffects/n`, `@site-cms/ssr`, `@ts-expect-error/n`, `arc-contracts`, `automic-style-engine`, `ccb-app-ui-service`, `evmos-contracts`, `kampodine`, `kc-kline-chart`, `modelsdesk`, `monobomber`, `monopw`, `securedrop-app`, `tailwind-animationfound`, `tw-motion-css`, `wisdomtreetest`. GitHub published only its standard "treat the host as compromised" notice, with no payload analysis. ## What to do 1. **Check your lockfiles** for every package and version listed below, or upload them to the DependencyWatch scanner 2. **Telegram theft** (Cluster A): uninstall, revoke all active Telegram sessions from the machine, rotate any API keys or bot tokens stored alongside Telegram data 3. **RAT** (Cluster B): isolate the host, rebuild from a clean image, rotate every credential the machine could reach 4. **WhatsApp forks** (Cluster C): remove the fork, review which channels the bot account follows, switch to `@whiskeysockets/baileys` 5. **CWE-506 boilerplate** (Cluster D): remove the package and rebuild; rotate secrets if the host ran the package ## Check your own dependencies - Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json - Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt The scan runs entirely in the browser; lockfile contents are never uploaded. ## References - [GitHub Advisory Database, malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub - [GHSA-xmqc-r2gw-32q8: reqnest Telegram exfiltration](https://github.com/advisories/GHSA-xmqc-r2gw-32q8) - GitHub - [GHSA-v3cx-96jw-mv99: hello-bat-fwi9 RAT dropper](https://github.com/advisories/GHSA-v3cx-96jw-mv99) - GitHub - [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF --- Canonical page: https://dependencywatch.io/incident/multi-2026-11-07-ghsa-malware-sweep Markdown version: https://dependencywatch.io/incident/multi-2026-11-07-ghsa-malware-sweep.md Site index for agents: https://dependencywatch.io/llms.txt DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).