DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 8 November 2026

HighAdvisory sweepnpmPyPI

12 packages from GitHub malware advisories published 7–8 November 2026. Headlines: PyPI qzc backdoor cluster opening persistent shell servers, PyPI package clones downloading remote code, and dependency-confusion pentest probes.

Published 8 Nov 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-11-08-ghsa-malware-sweep
12
Packages tracked35 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
8 Nov 2026
Ecosystems
npmPyPI
Detected by
OpenSSF, amazon-inspector, kam193

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

GitHub published malware advisories for 12 packages between 7 November 2026 (after the previous sweep’s cutoff) and 8 November 2026. Severity is high for the confirmed backdoor cluster and the remote-code-download cluster.

The qzc cluster (Cluster A) is notable: four PyPI packages open persistent HTTP shell servers on multiple ports, gated only by a hardcoded token file. Some variants also abuse the Xinference model-registration API to exfiltrate host reconnaissance data. The source was reported by amazon-inspector.

Cluster B arrived on 8 November: twitch-stream-py is a clone of a legitimate Twitch streaming package, with injected code that fetches and runs a remote script. pyuserfox and pyuserox do the same on import. All three were discovered by Threx-code and reported via OpenSSF.

The three dependency-confusion probes (Cluster D) follow the standard pentest-beacon pattern, exfiltrating only basic host info. pulumi-doppler uses sentinel versions 0.0.0 and 1.0.0, typical of internal-name squatting.

typosquatdependency-confusionobfuscation
Affected packages

12 packages 35 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • Cluster A: qzc backdoor and host-reconnaissance cluster (malicious-package; published analysis, confirmed backdoor) (4 packages): qzc690382, qzc690383, qzc690384, qzc690385. PyPI packages in the 2026-11-qzc campaign reported by amazon-inspector. Each opens a persistent HTTP server listening on all interfaces and executes shell commands received via GET requests. Some variants also fingerprint the host and exfiltrate data via Xinference model-registration API calls.
  • Cluster B: Package clones downloading remote code (typosquat / malicious-package; published analysis) (3 packages): twitch-stream-py, pyuserfox, pyuserox. PyPI packages published 8 November. twitch-stream-py clones a legitimate package with injected code that downloads and executes a remote script. pyuserfox and pyuserox silently download and execute remote code on import. Campaigns: 2026-11-old-twitch-stream-py and 2026-11-old-pyuserfox.
  • Cluster C: Environment variable exfiltration (malicious-package; published analysis) (1 package): gcp-log-poc. PyPI package that exfiltrates environment variables including potentially sensitive ones on import. Campaign: 2026-11-gcp-log-poc.
  • Cluster D: Dependency-confusion / pentest beacons (dependency-confusion; beacon only, no payload beyond basic system info) (3 packages): genblaze-atlascloud, genblaze-fal, pulumi-doppler. PyPI packages classified as PROBABLY_PENTEST. Each exfiltrates basic host info (IP, username) via overridden setup.py install command. pulumi-doppler squats at sentinel versions 0.0.0 and 1.0.0.
  • Cluster E: npm CWE-506 boilerplate takedown (malicious-package; no published analysis) (1 package): dsh-notify-focus. GitHub published only the standard "treat the host as compromised" notice with no payload analysis.
What to do

Clean-up steps

  1. Check your lockfiles for every package and version listed below, or upload them to the DependencyWatch scanner
  2. Backdoor (Cluster A): isolate the host immediately, check for processes listening on ports 9998/9999/8089/8099/8899, rebuild from a clean image, rotate every credential the host could reach
  3. Remote code download (Cluster B): uninstall, rotate credentials, check for unexpected processes or persistence mechanisms
  4. Env exfiltration (Cluster C): uninstall, rotate any secrets that were in environment variables on the affected host
  5. Pentest probes (Cluster D): uninstall; if installed only in CI, review whether internal package names leaked
  6. CWE-506 boilerplate (Cluster E): remove the package and rebuild; rotate secrets if the host ran the package
References

Sources

multi-2026-11-08-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents