# GitHub Advisory malware sweep, 8 November 2026

> 12 packages from GitHub malware advisories published 7–8 November 2026. Headlines: PyPI qzc backdoor cluster opening persistent shell servers, PyPI package clones downloading remote code, and dependency-confusion pentest probes.

- Published: 2026-11-08
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 12 packages, 35 compromised versions
- Tags: typosquat, dependency-confusion, obfuscation
- Detected by: OpenSSF, amazon-inspector, kam193
- Incident ID: multi-2026-11-08-ghsa-malware-sweep

## Affected packages (12)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [dsh-notify-focus](https://dependencywatch.io/package/npm/dsh-notify-focus) | npm | 0.5.0, 0.7.0, 0.7.1 |
| [gcp-log-poc](https://dependencywatch.io/package/pypi/gcp-log-poc) | PyPI | 0.0.1, 0.0.2, 0.0.3 |
| [genblaze-atlascloud](https://dependencywatch.io/package/pypi/genblaze-atlascloud) | PyPI | 0.1.0 |
| [genblaze-fal](https://dependencywatch.io/package/pypi/genblaze-fal) | PyPI | 0.1.0 |
| [pulumi-doppler](https://dependencywatch.io/package/pypi/pulumi-doppler) | PyPI | 0.0.0, 1.0.0 |
| [pyuserfox](https://dependencywatch.io/package/pypi/pyuserfox) | PyPI | 0.0.2 |
| [pyuserox](https://dependencywatch.io/package/pypi/pyuserox) | PyPI | 0.0.2 |
| [qzc690382](https://dependencywatch.io/package/pypi/qzc690382) | PyPI | 1.0.0 |
| [qzc690383](https://dependencywatch.io/package/pypi/qzc690383) | PyPI | 1.0.0 |
| [qzc690384](https://dependencywatch.io/package/pypi/qzc690384) | PyPI | 1.0.0 |
| [qzc690385](https://dependencywatch.io/package/pypi/qzc690385) | PyPI | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.1.0, 1.1.1, 1.1.2, 1.1.3 |
| [twitch-stream-py](https://dependencywatch.io/package/pypi/twitch-stream-py) | PyPI | 1.0.2rc0, 1.0.3rc0, 1.0.4rc0, 1.0.4rc2, 1.0.5rc2, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0, 1.1.1, 1.1.2 |

## What happened

GitHub published malware advisories for 12 packages between 7 November 2026 (after the previous sweep’s cutoff) and 8 November 2026. Severity is `high` for the confirmed backdoor cluster and the remote-code-download cluster.

The qzc cluster (Cluster A) is notable: four PyPI packages open persistent HTTP shell servers on multiple ports, gated only by a hardcoded token file. Some variants also abuse the Xinference model-registration API to exfiltrate host reconnaissance data. The source was reported by amazon-inspector.

Cluster B arrived on 8 November: `twitch-stream-py` is a clone of a legitimate Twitch streaming package, with injected code that fetches and runs a remote script. `pyuserfox` and `pyuserox` do the same on import. All three were discovered by Threx-code and reported via OpenSSF.

The three dependency-confusion probes (Cluster D) follow the standard pentest-beacon pattern, exfiltrating only basic host info. `pulumi-doppler` uses sentinel versions 0.0.0 and 1.0.0, typical of internal-name squatting.

## Impact

- **Cluster A: qzc backdoor and host-reconnaissance cluster (malicious-package; published analysis, confirmed backdoor) (4 packages)**: `qzc690382`, `qzc690383`, `qzc690384`, `qzc690385`. PyPI packages in the 2026-11-qzc campaign reported by amazon-inspector. Each opens a persistent HTTP server listening on all interfaces and executes shell commands received via GET requests. Some variants also fingerprint the host and exfiltrate data via Xinference model-registration API calls.
- **Cluster B: Package clones downloading remote code (typosquat / malicious-package; published analysis) (3 packages)**: `twitch-stream-py`, `pyuserfox`, `pyuserox`. PyPI packages published 8 November. `twitch-stream-py` clones a legitimate package with injected code that downloads and executes a remote script. `pyuserfox` and `pyuserox` silently download and execute remote code on import. Campaigns: 2026-11-old-twitch-stream-py and 2026-11-old-pyuserfox.
- **Cluster C: Environment variable exfiltration (malicious-package; published analysis) (1 package)**: `gcp-log-poc`. PyPI package that exfiltrates environment variables including potentially sensitive ones on import. Campaign: 2026-11-gcp-log-poc.
- **Cluster D: Dependency-confusion / pentest beacons (dependency-confusion; beacon only, no payload beyond basic system info) (3 packages)**: `genblaze-atlascloud`, `genblaze-fal`, `pulumi-doppler`. PyPI packages classified as PROBABLY_PENTEST. Each exfiltrates basic host info (IP, username) via overridden setup.py install command. `pulumi-doppler` squats at sentinel versions 0.0.0 and 1.0.0.
- **Cluster E: npm CWE-506 boilerplate takedown (malicious-package; no published analysis) (1 package)**: `dsh-notify-focus`. GitHub published only the standard "treat the host as compromised" notice with no payload analysis.

## What to do

1. **Check your lockfiles** for every package and version listed below, or upload them to the DependencyWatch scanner
2. **Backdoor** (Cluster A): isolate the host immediately, check for processes listening on ports 9998/9999/8089/8099/8899, rebuild from a clean image, rotate every credential the host could reach
3. **Remote code download** (Cluster B): uninstall, rotate credentials, check for unexpected processes or persistence mechanisms
4. **Env exfiltration** (Cluster C): uninstall, rotate any secrets that were in environment variables on the affected host
5. **Pentest probes** (Cluster D): uninstall; if installed only in CI, review whether internal package names leaked
6. **CWE-506 boilerplate** (Cluster E): remove the package and rebuild; rotate secrets if the host ran the package

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database, malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-4h5h-42vv-83c5: qzc690382 backdoor](https://github.com/advisories/GHSA-4h5h-42vv-83c5) - GitHub
- [GHSA-q95f-rr76-j36f: twitch-stream-py malicious clone](https://github.com/advisories/GHSA-q95f-rr76-j36f) - GitHub
- [GHSA-x5mc-3hph-2r64: pulumi-doppler dependency-confusion probe](https://github.com/advisories/GHSA-x5mc-3hph-2r64) - GitHub
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF

---

Canonical page: https://dependencywatch.io/incident/multi-2026-11-08-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-11-08-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).