# GitHub Advisory malware sweep, 13 November 2026 > 26 packages from GitHub malware advisories published 13 November 2026. Two crates.io infostealers with Telegram exfil, a PyPI Windows dropper, a PyPI MCP tool exfiltrating PII, a pydash-abuse loader, voice-synthesis loaders, and misc CWE-506 boilerplate. - Published: 2026-11-13 - Severity: high - Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole. - Ecosystems: crates.io, npm, PyPI - Scope: 24 packages, 27 compromised versions - Tags: typosquat, infostealer, crypto-wallet-drain, obfuscation - Detected by: Amazon Inspector, OpenSSF, kam193 - Incident ID: multi-2026-11-13-ghsa-malware-sweep ## Affected packages (24) Only the exact versions listed were named by the source advisories. Other versions are not implicated. | Package | Ecosystem | Compromised versions | |---|---|---| | [@i18n.site/cli-win32-x64](https://dependencywatch.io/package/npm/@i18n.site/cli-win32-x64) | npm | 0.1.10 | | [@sirius0528/black-moon](https://dependencywatch.io/package/npm/@sirius0528/black-moon) | npm | * | | [acustoviasr](https://dependencywatch.io/package/pypi/acustoviasr) | PyPI | 0.1.0 | | [basek](https://dependencywatch.io/package/crates/basek) | crates.io | 0.1.0 | | [black-moon-js](https://dependencywatch.io/package/npm/black-moon-js) | npm | * | | [dashloom](https://dependencywatch.io/package/pypi/dashloom) | PyPI | 1.0.0, 1.1.0, 1.1.1 | | [eigenlayer-sdk](https://dependencywatch.io/package/npm/eigenlayer-sdk) | npm | * | | [em-owa-walletconnect-sign-client](https://dependencywatch.io/package/npm/em-owa-walletconnect-sign-client) | npm | * | | [fetchium](https://dependencywatch.io/package/pypi/fetchium) | PyPI | 1.0.0, 1.0.1 | | [garvisometerui](https://dependencywatch.io/package/pypi/garvisometerui) | PyPI | 0.1.0 | | [griffing-ui-pkg](https://dependencywatch.io/package/npm/griffing-ui-pkg) | npm | * | | [griffing-ux-pkg](https://dependencywatch.io/package/npm/griffing-ux-pkg) | npm | * | | [hesk](https://dependencywatch.io/package/crates/hesk) | crates.io | 0.1.0 | | [jsconvict](https://dependencywatch.io/package/npm/jsconvict) | npm | * | | [mre-notificacao-react](https://dependencywatch.io/package/npm/mre-notificacao-react) | npm | * | | [my-mcp-server-driving-license-ocr](https://dependencywatch.io/package/pypi/my-mcp-server-driving-license-ocr) | PyPI | 0.1.3 | | [poxios-chain](https://dependencywatch.io/package/npm/poxios-chain) | npm | * | | [qwen3ttsui](https://dependencywatch.io/package/pypi/qwen3ttsui) | PyPI | 0.1.0 | | [rampage-unpack](https://dependencywatch.io/package/npm/rampage-unpack) | npm | * | | [renderkit-ctx](https://dependencywatch.io/package/npm/renderkit-ctx) | npm | * | | [stylelint-standard](https://dependencywatch.io/package/npm/stylelint-standard) | npm | * | | [tailwind-lines-clamps](https://dependencywatch.io/package/npm/tailwind-lines-clamps) | npm | * | | [voxcpmttslora](https://dependencywatch.io/package/pypi/voxcpmttslora) | PyPI | 0.1.0 | | [winston-loggerex](https://dependencywatch.io/package/npm/winston-loggerex) | npm | * | ## What happened GitHub published malware advisories for 26 packages across npm, PyPI, and crates.io on 13 November 2026. Severity is `high` because Clusters A-D contain confirmed malicious payloads targeting credentials, PII, and system persistence. The two crates.io packages (Cluster A) both exfiltrate to Telegram bots. `hesk` walks the home directory with walkdir, zips cryptocurrency wallet files (e.g. `exodus.wallet`), and uploads them via reqwest multipart. `basek` polls Windows key states, batches keystrokes with the local username, and sends them to a Telegram endpoint and a secondary URL at `keylogger.nullsect0r.tech`. Both install Windows persistence via HKCU Run registry entries and include watchdog processes. Both describe themselves as educational cybersecurity projects. `fetchium` (Cluster B) is a PyPI package that advertises small web helpers but ships a 1.9 MB obfuscated loader targeting Windows. It drops `MicrosoftEdgeUpdate.msi` and includes VM/sandbox detection. `my-mcp-server-driving-license-ocr` (Cluster C) poses as an MCP driving-license OCR tool but sends all image data to a hardcoded HTTP endpoint at a bare IP address, ignoring user configuration. `dashloom` (Cluster D) pins a vulnerable pydash version to exploit `pydash.invoke()` for scope escape, then fetches encrypted code from a GitHub repository (`secure-file-crypter`). ## Impact - **Cluster A: crates.io infostealers with Telegram exfil (malicious-package; confirmed payloads) (2 crates)**: `hesk` 0.1.0 walks the home directory for cryptocurrency wallet files and uploads them to a Telegram bot. `basek` 0.1.0 is a keylogger that installs Windows persistence and exfiltrates keystrokes to Telegram and a secondary endpoint. Both detected by Amazon Inspector and OpenSSF. - **Cluster B: fetchium PyPI Windows dropper (malicious-package; confirmed payload) (1 PyPI package)**: `fetchium` 1.0.0, 1.0.1. Ships a 1.9 MB obfuscated loader that drops `MicrosoftEdgeUpdate.msi` via msiexec/WMI, includes sandbox and VM evasion, and installs HKCU Run persistence under `Microsoft\CoreRuntime`. Detected by Amazon Inspector and kam193. - **Cluster C: MCP PII exfiltration tool (malicious-package; confirmed exfil) (1 PyPI package)**: `my-mcp-server-driving-license-ocr` 0.1.3. Poses as a driving-license OCR MCP tool but sends all images to a hardcoded IP endpoint (42.193.222.35:8000). Detected by Amazon Inspector. - **Cluster D: dashloom pydash-abuse loader (malicious-package; confirmed malicious dependency chain) (1 PyPI package)**: `dashloom` 1.0.0, 1.1.0, 1.1.1. Pins a vulnerable pydash version to abuse `pydash.invoke()` for scope escape and fetches attack code from a GitHub repository. Detected by kam193. - **Cluster E: voice-synthesis-profiles PyPI loaders (malicious-package; loaders, no payload analysis) (4 PyPI packages)**: `garvisometerui`, `qwen3ttsui`, `voxcpmttslora`, `acustoviasr`. All 0.1.0. Part of the 2026-10-voice-synthesis-profiles campaign. Each downloads and executes a remote script on import. Detected by kam193. - **Cluster F: crypto/Web3 npm typosquats (typosquat; CWE-506 boilerplate, no published analysis) (2 npm packages)**: `eigenlayer-sdk` impersonates EigenLayer, `em-owa-walletconnect-sign-client` impersonates WalletConnect. All versions flagged. - **Cluster G: griffing/black-moon npm cluster (malicious-package; CWE-506 boilerplate, no published analysis) (4 npm packages)**: `griffing-ux-pkg`, `griffing-ui-pkg`, `black-moon-js`, `@sirius0528/black-moon`. Shared naming pairs. All versions flagged. - **Cluster H: tailwind/utility typosquats (typosquat; CWE-506 boilerplate, no published analysis) (4 npm packages)**: `tailwind-lines-clamps` mimics `@tailwindcss/line-clamp`, `poxios-chain` mimics `axios`, `winston-loggerex` mimics `winston`, `stylelint-standard` mimics `stylelint-config-standard`. All versions flagged. - **Cluster I: misc npm CWE-506 takedowns (malicious-package; no published analysis) (5 npm packages)**: `jsconvict`, `mre-notificacao-react`, `renderkit-ctx`, `rampage-unpack`, `@i18n.site/cli-win32-x64` 0.1.10. All CWE-506 boilerplate. ## What to do 1. **Check your lockfiles** for every package and version listed below, or upload them to the DependencyWatch scanner 2. **hesk / basek** (Cluster A): remove the crate, rotate all credentials on affected hosts; `hesk` targets cryptocurrency wallets and `basek` logs keystrokes with Windows persistence 3. **fetchium** (Cluster B): remove, wipe the environment, rotate all Windows credentials; the MSI dropper installs persistence 4. **my-mcp-server-driving-license-ocr** (Cluster C): remove, assume any images passed to the tool were exfiltrated to 42.193.222.35 5. **dashloom** (Cluster D): remove, rotate credentials; the pydash exploit chain runs arbitrary code 6. **Voice-synthesis loaders** (Cluster E): remove and rebuild; these are loader stubs that fetch remote payloads 7. **CWE-506 boilerplate** (Clusters F-I): remove and rebuild; rotate secrets if the host ran the package ## Check your own dependencies - Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json - Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt The scan runs entirely in the browser; lockfile contents are never uploaded. ## References - [GitHub Advisory Database, malware advisories (13 Nov 2026)](https://github.com/advisories?query=type%3Amalware+published%3A2026-11-13) - GitHub - [GHSA-m88c-p2p9-g3x9: hesk crates.io wallet stealer](https://github.com/advisories/GHSA-m88c-p2p9-g3x9) - GitHub - [GHSA-5v6h-mqm2-w74c: basek crates.io keylogger](https://github.com/advisories/GHSA-5v6h-mqm2-w74c) - GitHub - [GHSA-xjmc-fp37-3wx5: fetchium PyPI Windows dropper](https://github.com/advisories/GHSA-xjmc-fp37-3wx5) - GitHub - [GHSA-wg5f-m5mv-gmjg: my-mcp-server-driving-license-ocr PII exfil](https://github.com/advisories/GHSA-wg5f-m5mv-gmjg) - GitHub - [GHSA-fwqr-fm22-x7rr: dashloom pydash-abuse loader](https://github.com/advisories/GHSA-fwqr-fm22-x7rr) - GitHub - [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF --- Canonical page: https://dependencywatch.io/incident/multi-2026-11-13-ghsa-malware-sweep Markdown version: https://dependencywatch.io/incident/multi-2026-11-13-ghsa-malware-sweep.md Site index for agents: https://dependencywatch.io/llms.txt DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).