# GitHub Advisory malware sweep, 12 November 2026

> 73 packages from GitHub malware advisories published 12 November 2026. Amazon Inspector droppers, tailwindcss typosquats, a PyPI RAT dropper, a Baileys/WhatsApp impersonation cluster, crypto/DeFi typosquats, a voice-synthesis loader campaign, and misc CWE-506 takedowns.

- Published: 2026-11-12
- Last updated: 2026-11-13
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI, RubyGems
- Scope: 76 packages, 81 compromised versions
- Tags: typosquat, infostealer, obfuscation, dependency-confusion
- Detected by: Amazon Inspector, OpenSSF, kam193
- Incident ID: multi-2026-11-12-ghsa-malware-sweep

## Affected packages (76)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@brunosps00/dev-workflow](https://dependencywatch.io/package/npm/@brunosps00/dev-workflow) | npm | * |
| [@budetzz/baileys](https://dependencywatch.io/package/npm/@budetzz/baileys) | npm | * |
| [@budetzz/eslint-config](https://dependencywatch.io/package/npm/@budetzz/eslint-config) | npm | * |
| [@budetzz/libsignal-node](https://dependencywatch.io/package/npm/@budetzz/libsignal-node) | npm | * |
| [@csp-frontend/auth](https://dependencywatch.io/package/npm/@csp-frontend/auth) | npm | * |
| [@csp-frontend/dashboard](https://dependencywatch.io/package/npm/@csp-frontend/dashboard) | npm | * |
| [@go-gost/mcp-darwin-x64](https://dependencywatch.io/package/npm/@go-gost/mcp-darwin-x64) | npm | * |
| [@hesxo/forge-cli](https://dependencywatch.io/package/npm/@hesxo/forge-cli) | npm | * |
| [@hesxo/viro-cli](https://dependencywatch.io/package/npm/@hesxo/viro-cli) | npm | * |
| [@ndikagantengg/baileys](https://dependencywatch.io/package/npm/@ndikagantengg/baileys) | npm | * |
| [@rclaude/darwin-x64](https://dependencywatch.io/package/npm/@rclaude/darwin-x64) | npm | 0.2.1 |
| [@rfewqa-fes/mnm-doc-mcp](https://dependencywatch.io/package/npm/@rfewqa-fes/mnm-doc-mcp) | npm | * |
| [@ruthless-imperium/baileys](https://dependencywatch.io/package/npm/@ruthless-imperium/baileys) | npm | * |
| [@theguyswithaball/color-utils](https://dependencywatch.io/package/npm/@theguyswithaball/color-utils) | npm | * |
| [@theguyswithaball/scrambler](https://dependencywatch.io/package/npm/@theguyswithaball/scrambler) | npm | * |
| [aurelia-type](https://dependencywatch.io/package/npm/aurelia-type) | npm | * |
| [aurum-pay](https://dependencywatch.io/package/pypi/aurum-pay) | PyPI | 1.2.0 |
| [budetzz](https://dependencywatch.io/package/npm/budetzz) | npm | * |
| [buffer-code-exercise-api](https://dependencywatch.io/package/rubygems/buffer-code-exercise-api) | RubyGems | * |
| [chai-as-spy](https://dependencywatch.io/package/npm/chai-as-spy) | npm | * |
| [cheesebox](https://dependencywatch.io/package/rubygems/cheesebox) | RubyGems | * |
| [cosmjs-types-sovid](https://dependencywatch.io/package/npm/cosmjs-types-sovid) | npm | * |
| [cronbits](https://dependencywatch.io/package/npm/cronbits) | npm | * |
| [csvbits](https://dependencywatch.io/package/npm/csvbits) | npm | * |
| [decoder-params-sha256](https://dependencywatch.io/package/npm/decoder-params-sha256) | npm | * |
| [depfix-ai](https://dependencywatch.io/package/npm/depfix-ai) | npm | * |
| [diezy-libsignal-node](https://dependencywatch.io/package/npm/diezy-libsignal-node) | npm | * |
| [diezyxalisa-baileys](https://dependencywatch.io/package/npm/diezyxalisa-baileys) | npm | * |
| [diezyxalya-baileys](https://dependencywatch.io/package/npm/diezyxalya-baileys) | npm | * |
| [diezyxhao-baileys](https://dependencywatch.io/package/npm/diezyxhao-baileys) | npm | * |
| [electfile](https://dependencywatch.io/package/npm/electfile) | npm | * |
| [eulaliatts](https://dependencywatch.io/package/pypi/eulaliatts) | PyPI | 0.1.0 |
| [evalometer](https://dependencywatch.io/package/pypi/evalometer) | PyPI | 0.1.0 |
| [express-helmet](https://dependencywatch.io/package/npm/express-helmet) | npm | * |
| [fcefi-wdojs-util](https://dependencywatch.io/package/npm/fcefi-wdojs-util) | npm | 1.0.0 |
| [ferrotts](https://dependencywatch.io/package/pypi/ferrotts) | PyPI | 0.1.0 |
| [flowbits](https://dependencywatch.io/package/npm/flowbits) | npm | * |
| [flowmetry](https://dependencywatch.io/package/pypi/flowmetry) | PyPI | 0.1.0 |
| [future-scripts](https://dependencywatch.io/package/npm/future-scripts) | npm | * |
| [garviscope](https://dependencywatch.io/package/pypi/garviscope) | PyPI | 0.1.0 |
| [garvisuite](https://dependencywatch.io/package/pypi/garvisuite) | PyPI | 0.1.0 |
| [gloglet](https://dependencywatch.io/package/npm/gloglet) | npm | * |
| [helmify](https://dependencywatch.io/package/npm/helmify) | npm | * |
| [humbility-shared](https://dependencywatch.io/package/pypi/humbility-shared) | PyPI | 0.0.1, 0.0.2 |
| [inframetric](https://dependencywatch.io/package/pypi/inframetric) | PyPI | 0.1.0 |
| [ioredis-om-typed](https://dependencywatch.io/package/npm/ioredis-om-typed) | npm | * |
| [ioredis-xyz](https://dependencywatch.io/package/npm/ioredis-xyz) | npm | * |
| [lumitts](https://dependencywatch.io/package/pypi/lumitts) | PyPI | 0.1.0 |
| [melstagen](https://dependencywatch.io/package/pypi/melstagen) | PyPI | 0.1.0 |
| [mock-data-sdk](https://dependencywatch.io/package/npm/mock-data-sdk) | npm | 1.0.1 |
| [netspeedutil](https://dependencywatch.io/package/npm/netspeedutil) | npm | * |
| [npm-builderio-qwik-poc](https://dependencywatch.io/package/npm/npm-builderio-qwik-poc) | npm | * |
| [otto-git-cli](https://dependencywatch.io/package/npm/otto-git-cli) | npm | * |
| [pentest-copilot](https://dependencywatch.io/package/rubygems/pentest-copilot) | RubyGems | * |
| [phoneliasr](https://dependencywatch.io/package/pypi/phoneliasr) | PyPI | 0.1.0 |
| [reactlogo-load](https://dependencywatch.io/package/npm/reactlogo-load) | npm | * |
| [royal-rusd](https://dependencywatch.io/package/npm/royal-rusd) | npm | * |
| [selparsecss-selector](https://dependencywatch.io/package/npm/selparsecss-selector) | npm | * |
| [showdownxss](https://dependencywatch.io/package/npm/showdownxss) | npm | * |
| [shraps](https://dependencywatch.io/package/npm/shraps) | npm | * |
| [soid-wallet](https://dependencywatch.io/package/npm/soid-wallet) | npm | * |
| [spectrova](https://dependencywatch.io/package/pypi/spectrova) | PyPI | 0.1.0 |
| [stackvane](https://dependencywatch.io/package/pypi/stackvane) | PyPI | 0.1.0 |
| [strutil-helpers-core](https://dependencywatch.io/package/npm/strutil-helpers-core) | npm | 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 |
| [tailwind-lineclamp](https://dependencywatch.io/package/npm/tailwind-lineclamp) | npm | * |
| [tailwind-motion-css](https://dependencywatch.io/package/npm/tailwind-motion-css) | npm | * |
| [tailwindcss-form-ui](https://dependencywatch.io/package/npm/tailwindcss-form-ui) | npm | * |
| [tailwindcss-hook-forms](https://dependencywatch.io/package/npm/tailwindcss-hook-forms) | npm | 0.5.2 |
| [teahy-znrpz-util](https://dependencywatch.io/package/npm/teahy-znrpz-util) | npm | 1.0.0 |
| [textmark-engine](https://dependencywatch.io/package/npm/textmark-engine) | npm | * |
| [tgnotify-bite](https://dependencywatch.io/package/npm/tgnotify-bite) | npm | * |
| [uniswa-v2-sdk-holesky](https://dependencywatch.io/package/npm/uniswa-v2-sdk-holesky) | npm | * |
| [verboset](https://dependencywatch.io/package/npm/verboset) | npm | * |
| [voxgramasr](https://dependencywatch.io/package/pypi/voxgramasr) | PyPI | 0.1.0 |
| [voxrelitts](https://dependencywatch.io/package/pypi/voxrelitts) | PyPI | 0.1.0 |
| [wavforge](https://dependencywatch.io/package/pypi/wavforge) | PyPI | 0.1.0 |

## What happened

GitHub published malware advisories for 73 packages across npm, PyPI, and RubyGems on 12 November 2026. Severity is `high` because Cluster A contains confirmed multi-stage droppers with filesystem-scanning payloads, Cluster B has a confirmed obfuscated payload, and Cluster H is a confirmed RAT.

The Amazon Inspector droppers (Cluster A) use a variety of evasion techniques: `teahy-znrpz-util` and `fcefi-wdojs-util` embed compressed payloads in package.json fields and decode them at runtime; `strutil-helpers-core` ships native binaries for Linux and Windows with anti-sandbox checks; `mock-data-sdk` hides base64 payloads in data-file `mark` fields and scans the filesystem for sensitive files.

The `tailwindcss-hook-forms` typosquat (Cluster B) impersonates the official `@tailwindcss/forms` plugin and wraps a real plugin API around an obfuscated dropper.

The PyPI `aurum-pay` package (Cluster H) fetches a command from `aurum-casino.com` on first import and installs a platform-specific RAT with persistence. `humbility-shared` (Cluster I) is a low-severity pentest probe that exfiltrates only hostname information.

Cluster J is a ten-package Baileys/WhatsApp impersonation wave spanning multiple scopes (`@budetzz`, `diezy*`, `@ruthless-imperium`, `@ndikagantengg`). Cluster K adds 15 PyPI loader packages from the 2026-10-voice-synthesis-profiles campaign, all at version 0.1.0, each downloading and executing a remote script. Clusters L-P contain additional tailwind CSS, crypto/DeFi, MCP/CLI, and miscellaneous CWE-506 boilerplate takedowns published later on 12 November.

## Impact

- **Cluster A: Amazon Inspector multi-stage droppers (malicious-package; confirmed payloads) (4 npm packages)**: `teahy-znrpz-util`, `fcefi-wdojs-util`, `strutil-helpers-core`, `mock-data-sdk`. All detected by Amazon Inspector. Payloads include zlib-compressed byte-array execution, hex-encoded encrypted second stages, native binaries with anti-sandbox checks, and filesystem scanning for passwords, wallets, seed phrases and .env files.
- **Cluster B: tailwindcss-hook-forms typosquat (typosquat; confirmed obfuscated payload) (1 npm package)**: `tailwindcss-hook-forms` 0.5.2. Impersonates `@tailwindcss/forms`. Contains a string-permutation decoder and obfuscated Function() execution behind a real plugin API facade. Detected by Amazon Inspector.
- **Cluster C: Redis/ioredis impersonators (typosquat; CWE-506 boilerplate, no published analysis) (2 npm packages)**: `ioredis-xyz`, `ioredis-om-typed`. Names mimic the ioredis ecosystem. All versions flagged.
- **Cluster D: Logging/utility typosquats (malicious-package; CWE-506 boilerplate, no published analysis) (4 npm packages)**: `gloglet`, `verboset`, `selparsecss-selector`, `netspeedutil`. Generic utility names. All versions flagged.
- **Cluster E: *bits family (malicious-package; CWE-506 boilerplate, no published analysis) (3 npm packages)**: `flowbits`, `cronbits`, `csvbits`. Shared naming pattern. All versions flagged.
- **Cluster F: misc CWE-506 takedowns (malicious-package; no published analysis) (5 npm packages)**: `reactlogo-load`, `aurelia-type`, `helmify`, `shraps`, `textmark-engine`. Unrelated packages. All versions flagged.
- **Cluster G: chai-as-spy and express-helmet typosquats (typosquat; CWE-506 boilerplate, no published analysis) (2 npm packages)**: `chai-as-spy` mimics `chai-as-promised`, `express-helmet` mimics `helmet`. All versions flagged.
- **Cluster H: PyPI aurum-pay RAT dropper (malicious-package; confirmed RAT payload) (1 PyPI package)**: `aurum-pay` 1.2.0. Fetches and executes a shell command from `aurum-casino.com` on import. Downloads a next-stage binary on Linux, an obfuscated Python payload on Windows. Detected by Amazon Inspector and kam193.
- **Cluster I: PyPI humbility-shared pentest probe (dependency-confusion; beacon only) (1 PyPI package)**: `humbility-shared` 0.0.1, 0.0.2. Exfiltrates basic host info (IP, username) on install. Classified as PROBABLY_PENTEST by OpenSSF. Detected by kam193.
- **Cluster J: Baileys/WhatsApp impersonation cluster (typosquat; CWE-506 boilerplate, no published analysis) (10 npm packages)**: `@budetzz/baileys`, `budetzz`, `@budetzz/libsignal-node`, `@budetzz/eslint-config`, `diezy-libsignal-node`, `diezyxalya-baileys`, `diezyxalisa-baileys`, `diezyxhao-baileys`, `@ruthless-imperium/baileys`, `@ndikagantengg/baileys`. All impersonate the Baileys WhatsApp Web API library. All versions flagged.
- **Cluster K: voice-synthesis-profiles PyPI loader campaign (malicious-package; loaders, no payload analysis) (15 PyPI packages)**: `inframetric`, `spectrova`, `garvisuite`, `flowmetry`, `garviscope`, `stackvane`, `wavforge`, `voxgramasr`, `lumitts`, `melstagen`, `phoneliasr`, `voxrelitts`, `evalometer`, `ferrotts`, `eulaliatts`. All 0.1.0. Part of the 2026-10-voice-synthesis-profiles campaign. Each downloads and executes a remote script. Detected by kam193.
- **Cluster L: tailwind CSS typosquats (typosquat; CWE-506 boilerplate, no published analysis) (3 npm packages)**: `tailwind-lineclamp`, `tailwind-motion-css`, `tailwindcss-form-ui`. All mimic tailwindcss plugins. All versions flagged.
- **Cluster M: crypto/DeFi npm typosquats (typosquat; CWE-506 boilerplate, no published analysis) (5 npm packages)**: `uniswa-v2-sdk-holesky` (Uniswap), `cosmjs-types-sovid` (CosmJS), `soid-wallet`, `royal-rusd`, `decoder-params-sha256`. All versions flagged.
- **Cluster N: MCP/CLI impersonators (malicious-package; CWE-506 boilerplate, no published analysis) (3 npm packages)**: `@go-gost/mcp-darwin-x64`, `@rfewqa-fes/mnm-doc-mcp`, `@rclaude/darwin-x64` 0.2.1 (impersonates Claude CLI). All CWE-506 boilerplate.
- **Cluster O: misc npm CWE-506 takedowns, late batch (malicious-package; no published analysis) (14 npm packages)**: `otto-git-cli`, `depfix-ai`, `@hesxo/viro-cli`, `@hesxo/forge-cli`, `@brunosps00/dev-workflow`, `future-scripts`, `@csp-frontend/dashboard`, `@csp-frontend/auth`, `showdownxss`, `@theguyswithaball/color-utils`, `@theguyswithaball/scrambler`, `tgnotify-bite`, `electfile`, `npm-builderio-qwik-poc`. All versions flagged.
- **Cluster P: RubyGems CWE-506 takedowns (malicious-package; no published analysis) (3 RubyGems packages)**: `cheesebox`, `buffer-code-exercise-api`, `pentest-copilot`. All versions flagged.

## What to do

1. **Check your lockfiles** for every package and version listed below, or upload them to the DependencyWatch scanner
2. **Cluster A droppers**: remove, wipe node_modules, rotate all secrets on the host; the filesystem-scanning payload targets passwords, wallets and .env files
3. **tailwindcss-hook-forms** (Cluster B): remove, rotate secrets; replace with `@tailwindcss/forms`
4. **aurum-pay** (Cluster H): remove, rotate secrets; the RAT installs persistence and remote control
5. **CWE-506 boilerplate** (Clusters C-G): remove and rebuild; rotate secrets if the host ran the package
6. **humbility-shared** (Cluster I): uninstall; low-severity beacon only
7. **Baileys impersonators** (Cluster J): remove and replace with the official `@whiskeysockets/baileys`
8. **Voice-synthesis loaders** (Cluster K): remove and rebuild; these are loader stubs that fetch remote payloads
9. **CWE-506 boilerplate** (Clusters L-P): remove and rebuild; rotate secrets if the host ran the package

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database, malware advisories (12 Nov 2026)](https://github.com/advisories?query=type%3Amalware+published%3A2026-11-12) - GitHub
- [GHSA-53gf-4wh9-g7vw: teahy-znrpz-util](https://github.com/advisories/GHSA-53gf-4wh9-g7vw) - GitHub
- [GHSA-m3gw-5w3q-v32p: fcefi-wdojs-util](https://github.com/advisories/GHSA-m3gw-5w3q-v32p) - GitHub
- [GHSA-g68m-qwg7-9x3m: strutil-helpers-core](https://github.com/advisories/GHSA-g68m-qwg7-9x3m) - GitHub
- [GHSA-gg8j-9pc8-w9fm: mock-data-sdk](https://github.com/advisories/GHSA-gg8j-9pc8-w9fm) - GitHub
- [GHSA-7xfw-m762-wqw5: tailwindcss-hook-forms](https://github.com/advisories/GHSA-7xfw-m762-wqw5) - GitHub
- [GHSA-3rfx-vc65-vf5v: aurum-pay PyPI RAT dropper](https://github.com/advisories/GHSA-3rfx-vc65-vf5v) - GitHub
- [GHSA-79v2-94f6-j483: humbility-shared PyPI pentest probe](https://github.com/advisories/GHSA-79v2-94f6-j483) - GitHub
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF

---

Canonical page: https://dependencywatch.io/incident/multi-2026-11-12-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-11-12-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).