GitHub Advisory malware sweep, 12 November 2026

HighAdvisory sweepnpmPyPIRubyGems

73 packages from GitHub malware advisories published 12 November 2026. Amazon Inspector droppers, tailwindcss typosquats, a PyPI RAT dropper, a Baileys/WhatsApp impersonation cluster, crypto/DeFi typosquats, a voice-synthesis loader campaign, and misc CWE-506 takedowns.

Published 12 Nov 2026 · Updated 13 Nov 2026

Check your package-lock.json Source advisory

At a glancemulti-2026-11-12-ghsa-malware-sweep

Packages tracked81 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity: High
Type: Advisory sweep
Published: 12 Nov 2026
Last updated: 13 Nov 2026
Ecosystems: npmPyPIRubyGems
Detected by: Amazon Inspector, OpenSSF, kam193
Source: github.com

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

GitHub published malware advisories for 73 packages across npm, PyPI, and RubyGems on 12 November 2026. Severity is high because Cluster A contains confirmed multi-stage droppers with filesystem-scanning payloads, Cluster B has a confirmed obfuscated payload, and Cluster H is a confirmed RAT.

The Amazon Inspector droppers (Cluster A) use a variety of evasion techniques: teahy-znrpz-util and fcefi-wdojs-util embed compressed payloads in package.json fields and decode them at runtime; strutil-helpers-core ships native binaries for Linux and Windows with anti-sandbox checks; mock-data-sdk hides base64 payloads in data-file mark fields and scans the filesystem for sensitive files.

The tailwindcss-hook-forms typosquat (Cluster B) impersonates the official @tailwindcss/forms plugin and wraps a real plugin API around an obfuscated dropper.

The PyPI aurum-pay package (Cluster H) fetches a command from aurum-casino.com on first import and installs a platform-specific RAT with persistence. humbility-shared (Cluster I) is a low-severity pentest probe that exfiltrates only hostname information.

Cluster J is a ten-package Baileys/WhatsApp impersonation wave spanning multiple scopes (@budetzz, diezy*, @ruthless-imperium, @ndikagantengg). Cluster K adds 15 PyPI loader packages from the 2026-10-voice-synthesis-profiles campaign, all at version 0.1.0, each downloading and executing a remote script. Clusters L-P contain additional tailwind CSS, crypto/DeFi, MCP/CLI, and miscellaneous CWE-506 boilerplate takedowns published later on 12 November.

typosquatinfostealerobfuscationdependency-confusion

Affected packages

76 packages 81 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →

Impact

What it does if you installed it

Cluster A: Amazon Inspector multi-stage droppers (malicious-package; confirmed payloads) (4 npm packages): teahy-znrpz-util, fcefi-wdojs-util, strutil-helpers-core, mock-data-sdk. All detected by Amazon Inspector. Payloads include zlib-compressed byte-array execution, hex-encoded encrypted second stages, native binaries with anti-sandbox checks, and filesystem scanning for passwords, wallets, seed phrases and .env files.
Cluster B: tailwindcss-hook-forms typosquat (typosquat; confirmed obfuscated payload) (1 npm package): tailwindcss-hook-forms 0.5.2. Impersonates @tailwindcss/forms. Contains a string-permutation decoder and obfuscated Function() execution behind a real plugin API facade. Detected by Amazon Inspector.
Cluster C: Redis/ioredis impersonators (typosquat; CWE-506 boilerplate, no published analysis) (2 npm packages): ioredis-xyz, ioredis-om-typed. Names mimic the ioredis ecosystem. All versions flagged.
Cluster D: Logging/utility typosquats (malicious-package; CWE-506 boilerplate, no published analysis) (4 npm packages): gloglet, verboset, selparsecss-selector, netspeedutil. Generic utility names. All versions flagged.
*Cluster E: bits family (malicious-package; CWE-506 boilerplate, no published analysis) (3 npm packages)**: flowbits, cronbits, csvbits. Shared naming pattern. All versions flagged.
Cluster F: misc CWE-506 takedowns (malicious-package; no published analysis) (5 npm packages): reactlogo-load, aurelia-type, helmify, shraps, textmark-engine. Unrelated packages. All versions flagged.
Cluster G: chai-as-spy and express-helmet typosquats (typosquat; CWE-506 boilerplate, no published analysis) (2 npm packages): chai-as-spy mimics chai-as-promised, express-helmet mimics helmet. All versions flagged.
Cluster H: PyPI aurum-pay RAT dropper (malicious-package; confirmed RAT payload) (1 PyPI package): aurum-pay 1.2.0. Fetches and executes a shell command from aurum-casino.com on import. Downloads a next-stage binary on Linux, an obfuscated Python payload on Windows. Detected by Amazon Inspector and kam193.
Cluster I: PyPI humbility-shared pentest probe (dependency-confusion; beacon only) (1 PyPI package): humbility-shared 0.0.1, 0.0.2. Exfiltrates basic host info (IP, username) on install. Classified as PROBABLY_PENTEST by OpenSSF. Detected by kam193.
Cluster J: Baileys/WhatsApp impersonation cluster (typosquat; CWE-506 boilerplate, no published analysis) (10 npm packages): @budetzz/baileys, budetzz, @budetzz/libsignal-node, @budetzz/eslint-config, diezy-libsignal-node, diezyxalya-baileys, diezyxalisa-baileys, diezyxhao-baileys, @ruthless-imperium/baileys, @ndikagantengg/baileys. All impersonate the Baileys WhatsApp Web API library. All versions flagged.
Cluster K: voice-synthesis-profiles PyPI loader campaign (malicious-package; loaders, no payload analysis) (15 PyPI packages): inframetric, spectrova, garvisuite, flowmetry, garviscope, stackvane, wavforge, voxgramasr, lumitts, melstagen, phoneliasr, voxrelitts, evalometer, ferrotts, eulaliatts. All 0.1.0. Part of the 2026-10-voice-synthesis-profiles campaign. Each downloads and executes a remote script. Detected by kam193.
Cluster L: tailwind CSS typosquats (typosquat; CWE-506 boilerplate, no published analysis) (3 npm packages): tailwind-lineclamp, tailwind-motion-css, tailwindcss-form-ui. All mimic tailwindcss plugins. All versions flagged.
Cluster M: crypto/DeFi npm typosquats (typosquat; CWE-506 boilerplate, no published analysis) (5 npm packages): uniswa-v2-sdk-holesky (Uniswap), cosmjs-types-sovid (CosmJS), soid-wallet, royal-rusd, decoder-params-sha256. All versions flagged.
Cluster N: MCP/CLI impersonators (malicious-package; CWE-506 boilerplate, no published analysis) (3 npm packages): @go-gost/mcp-darwin-x64, @rfewqa-fes/mnm-doc-mcp, @rclaude/darwin-x64 0.2.1 (impersonates Claude CLI). All CWE-506 boilerplate.
Cluster O: misc npm CWE-506 takedowns, late batch (malicious-package; no published analysis) (14 npm packages): otto-git-cli, depfix-ai, @hesxo/viro-cli, @hesxo/forge-cli, @brunosps00/dev-workflow, future-scripts, @csp-frontend/dashboard, @csp-frontend/auth, showdownxss, @theguyswithaball/color-utils, @theguyswithaball/scrambler, tgnotify-bite, electfile, npm-builderio-qwik-poc. All versions flagged.
Cluster P: RubyGems CWE-506 takedowns (malicious-package; no published analysis) (3 RubyGems packages): cheesebox, buffer-code-exercise-api, pentest-copilot. All versions flagged.

What to do

Clean-up steps

Check your lockfiles for every package and version listed below, or upload them to the DependencyWatch scanner
Cluster A droppers: remove, wipe node_modules, rotate all secrets on the host; the filesystem-scanning payload targets passwords, wallets and .env files
tailwindcss-hook-forms (Cluster B): remove, rotate secrets; replace with @tailwindcss/forms
aurum-pay (Cluster H): remove, rotate secrets; the RAT installs persistence and remote control
CWE-506 boilerplate (Clusters C-G): remove and rebuild; rotate secrets if the host ran the package
humbility-shared (Cluster I): uninstall; low-severity beacon only
Baileys impersonators (Cluster J): remove and replace with the official @whiskeysockets/baileys
Voice-synthesis loaders (Cluster K): remove and rebuild; these are loader stubs that fetch remote payloads
CWE-506 boilerplate (Clusters L-P): remove and rebuild; rotate secrets if the host ran the package

References

Sources

multi-2026-11-12-ghsa-malware-sweepBack to incidents Submit a correction

Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.json All incidents