DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 13 November 2026

HighAdvisory sweepcrates.ionpmPyPI

26 packages from GitHub malware advisories published 13 November 2026. Two crates.io infostealers with Telegram exfil, a PyPI Windows dropper, a PyPI MCP tool exfiltrating PII, a pydash-abuse loader, voice-synthesis loaders, and misc CWE-506 boilerplate.

Published 13 Nov 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-11-13-ghsa-malware-sweep
24
Packages tracked27 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
13 Nov 2026
Ecosystems
crates.ionpmPyPI
Detected by
Amazon Inspector, OpenSSF, kam193

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

GitHub published malware advisories for 26 packages across npm, PyPI, and crates.io on 13 November 2026. Severity is high because Clusters A-D contain confirmed malicious payloads targeting credentials, PII, and system persistence.

The two crates.io packages (Cluster A) both exfiltrate to Telegram bots. hesk walks the home directory with walkdir, zips cryptocurrency wallet files (e.g. exodus.wallet), and uploads them via reqwest multipart. basek polls Windows key states, batches keystrokes with the local username, and sends them to a Telegram endpoint and a secondary URL at keylogger.nullsect0r.tech. Both install Windows persistence via HKCU Run registry entries and include watchdog processes. Both describe themselves as educational cybersecurity projects.

fetchium (Cluster B) is a PyPI package that advertises small web helpers but ships a 1.9 MB obfuscated loader targeting Windows. It drops MicrosoftEdgeUpdate.msi and includes VM/sandbox detection.

my-mcp-server-driving-license-ocr (Cluster C) poses as an MCP driving-license OCR tool but sends all image data to a hardcoded HTTP endpoint at a bare IP address, ignoring user configuration.

dashloom (Cluster D) pins a vulnerable pydash version to exploit pydash.invoke() for scope escape, then fetches encrypted code from a GitHub repository (secure-file-crypter).

typosquatinfostealercrypto-wallet-drainobfuscation
Affected packages

24 packages 27 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • Cluster A: crates.io infostealers with Telegram exfil (malicious-package; confirmed payloads) (2 crates): hesk 0.1.0 walks the home directory for cryptocurrency wallet files and uploads them to a Telegram bot. basek 0.1.0 is a keylogger that installs Windows persistence and exfiltrates keystrokes to Telegram and a secondary endpoint. Both detected by Amazon Inspector and OpenSSF.
  • Cluster B: fetchium PyPI Windows dropper (malicious-package; confirmed payload) (1 PyPI package): fetchium 1.0.0, 1.0.1. Ships a 1.9 MB obfuscated loader that drops MicrosoftEdgeUpdate.msi via msiexec/WMI, includes sandbox and VM evasion, and installs HKCU Run persistence under Microsoft\CoreRuntime. Detected by Amazon Inspector and kam193.
  • Cluster C: MCP PII exfiltration tool (malicious-package; confirmed exfil) (1 PyPI package): my-mcp-server-driving-license-ocr 0.1.3. Poses as a driving-license OCR MCP tool but sends all images to a hardcoded IP endpoint (42.193.222.35:8000). Detected by Amazon Inspector.
  • Cluster D: dashloom pydash-abuse loader (malicious-package; confirmed malicious dependency chain) (1 PyPI package): dashloom 1.0.0, 1.1.0, 1.1.1. Pins a vulnerable pydash version to abuse pydash.invoke() for scope escape and fetches attack code from a GitHub repository. Detected by kam193.
  • Cluster E: voice-synthesis-profiles PyPI loaders (malicious-package; loaders, no payload analysis) (4 PyPI packages): garvisometerui, qwen3ttsui, voxcpmttslora, acustoviasr. All 0.1.0. Part of the 2026-10-voice-synthesis-profiles campaign. Each downloads and executes a remote script on import. Detected by kam193.
  • Cluster F: crypto/Web3 npm typosquats (typosquat; CWE-506 boilerplate, no published analysis) (2 npm packages): eigenlayer-sdk impersonates EigenLayer, em-owa-walletconnect-sign-client impersonates WalletConnect. All versions flagged.
  • Cluster G: griffing/black-moon npm cluster (malicious-package; CWE-506 boilerplate, no published analysis) (4 npm packages): griffing-ux-pkg, griffing-ui-pkg, black-moon-js, @sirius0528/black-moon. Shared naming pairs. All versions flagged.
  • Cluster H: tailwind/utility typosquats (typosquat; CWE-506 boilerplate, no published analysis) (4 npm packages): tailwind-lines-clamps mimics @tailwindcss/line-clamp, poxios-chain mimics axios, winston-loggerex mimics winston, stylelint-standard mimics stylelint-config-standard. All versions flagged.
  • Cluster I: misc npm CWE-506 takedowns (malicious-package; no published analysis) (5 npm packages): jsconvict, mre-notificacao-react, renderkit-ctx, rampage-unpack, @i18n.site/cli-win32-x64 0.1.10. All CWE-506 boilerplate.
What to do

Clean-up steps

  1. Check your lockfiles for every package and version listed below, or upload them to the DependencyWatch scanner
  2. hesk / basek (Cluster A): remove the crate, rotate all credentials on affected hosts; hesk targets cryptocurrency wallets and basek logs keystrokes with Windows persistence
  3. fetchium (Cluster B): remove, wipe the environment, rotate all Windows credentials; the MSI dropper installs persistence
  4. my-mcp-server-driving-license-ocr (Cluster C): remove, assume any images passed to the tool were exfiltrated to 42.193.222.35
  5. dashloom (Cluster D): remove, rotate credentials; the pydash exploit chain runs arbitrary code
  6. Voice-synthesis loaders (Cluster E): remove and rebuild; these are loader stubs that fetch remote payloads
  7. CWE-506 boilerplate (Clusters F-I): remove and rebuild; rotate secrets if the host ran the package
References

Sources

multi-2026-11-13-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents