GitHub Advisory npm malware sweep, 29 October 2026

The full picture

20 packages 33 versions

• npm@atlisp/mcp1.12.14→
• npm@testsecuiitytestme/cache-helper1.0.11.0.21.0.3→
• npm@walknpm/todo-cli2.0.1→
• npm@webapp-shared/login-vmok1.0.01.0.11.1.02.0.13.0.099.0.1→
• npm@zaip-ai/cli6.4.06.5.07.0.07.1.07.2.07.3.07.4.0→
• npmb20miner0.3.1→
• npmblack-spindle999.0.0→
• npmcamelotlabs-config0.0.0→
• npmcamelotlabs-core0.0.0→
• npmcamelotlabs-sdk0.0.0→
• npmcamelotlabs-utils0.0.0→
• npmcamelotlabs-worker0.0.0→
• npmcsvflow-schema1.0.0→
• npmdsh-plugin-blender-3d0.2.1→
• npmdsh-redteam-mode0.15.2→
• npmitsa-react-checkbox16.0.5→
• npmitsa-utils1.4.2→
• npmmock-transactions-sdk0.0.0→
• npmmy-empty-package1.0.0→
• npmtransaction-info-generate-sdk0.0.0→

What it does if you installed it

• Cluster A - npm @testsecuiitytestme/cache-helper Shai-Hulud wave-2 shaped loader (malicious-package; 1 package / 3 versions, publisher testsecuiitytestme, package created 2026-10-27 12:08 UTC): @testsecuiitytestme/cache-helper@1.0.1, 1.0.2, 1.0.3 (GHSA-4g45-28rv-vq9q, OSSF MAL-2026-18358, published to GHSA 2026-10-28). Versions published 1.0.1 at 12:28 UTC, 1.0.2 at 15:33 UTC, 1.0.3 at 16:24 UTC on 2026-10-27 - rapid-iteration shape consistent with an operator refining the loader as they publish. Static analysis in the OSSF advisory describes an install-time native-addon loader that first sniffs for CI, sandbox, container and debugger environments, then decodes and executes a second-stage program under the Bun runtime (downloading Bun 1.2.18 if the host does not already have it). The second stage targets credentials for npm, GitHub, cloud providers, password managers, SSH, and env-file secrets, and attempts self-propagation via further npm publishes, CI workflow edits, and modifications to AI-assistant configuration files - the exact TTP shape of the May 2026 Shai-Hulud wave-2 TanStack worm. Tarball SHA-256: 1.0.1 a9c98033ac14fced8376bb8ba32bd92426b3729e16f5cd3852c5a97fc3503002, 1.0.2 067a1350278fd1ae4fcc261eaca98964dd23a3c7940988ec43f95758480cf113, 1.0.3 0e99f9a2eb7abcfe65278ca87a8e11dce25f39de2ff4bd77035e2bf01d26f0ed. File SHA-256 inside 1.0.2: prebuilds/linux-x64/node.napi.node 2547686f86fe6994bcf79558fcce441edc67aa734e255acf79870d5f47de7bbf, prebuilds/win32-x64/node.napi.node 620d2489e18b5a5f8840e96b90673d72db4c4c54d555ad66d179b3a5833e7763, .napi_cache 463dda65ebceeca6f5590dcdeae6c1d06ffadb2380a85b613deb2923af5557e7; inside 1.0.3: linux 1fdd50b1bf66c4fd0e94f2be3db1f2f0fd77921136867022ad7e65e21220ad03, win32 5b7a0f53f2eca2dd4bf21e6df7d34e751b6cdf70b2f0a6f1f13edfb5caa9570b, .napi_cache c14dae9325f451c524cf858ecdae5fa68d2c645ee0981c6f42ef913c7ef34a57. The exfil endpoints are encoded in the second-stage program and were not decoded in the static-only OSSF analysis. Severity high for this cluster (confirmed Shai-Hulud wave-2 shaped payload with real credential-theft and worm-propagation capability; nothing legitimate depends on @testsecuiitytestme/* so reach is limited to anyone who installed it in error, but any host that ran it is fully compromised, and this is the first wave-2-shaped loader to post to GHSA since the May 2026 TanStack burst)
• Cluster B - npm confirmed-beacon installs (malicious-package + dependency-confusion; 2 packages, both published 2026-10-26 to 2026-10-27, GHSA 2026-10-28): csvflow-schema@1.0.0 (GHSA-mhx4-6f72-5vf7, OSSF MAL-2026-18357, published 2026-10-26 by npm identity f0x_mulder, taken down by npm security ~17 minutes after publication) presents as a CSV schema validation helper. Postinstall collects host and user details, writes marker file csvflow_schema/pi_2c75177b.ok to the system temp directory, launches a Windows process and sends an HTTPS request to https://cdn-status.mulderitsme.net/pi/2c75177b. A 0.0.0-stage placeholder was published about a minute before 1.0.0. @webapp-shared/login-vmok@1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0, 99.0.1 (GHSA-cmqx-q58q-9m8p, OSSF MAL-2026-18356, published 2026-10-27) is a @webapp-shared scope dep-confusion probe. Postinstall runs node beacon.cjs which POSTs host fingerprint (package name, hostname, install directory, cwd, Node.js version) to http://13.140.137.222:8787/_ah/dc; the same beacon code runs again each time the package is loaded via index.js. The advisory cross-references MAL-2026-18276, which POSTed to http://185.158.107.175:8787/_ah/dc - same beacon operator, rotated IP. Versions 0.0.0-stage and 0.1.0 are not affected (classic sentinel-version-mesh pattern). Severity medium for this cluster (confirmed beacon-only exfil of host fingerprint; no post-exfil payload captured, but any CI/build host that installed either package has leaked identifying metadata; @webapp-shared/* dep-confusion probe additionally succeeded against any org with that internal scope)
• Cluster C - npm OSSF Package Analysis flagged black-spindle@999.0.0 (malicious-package; 1 package, 1 version, GHSA 2026-10-28): black-spindle@999.0.0 (GHSA-9939-65w7-25v2, OSSF MAL-2026-18359, 999.0.0 sentinel version shape). OSSF Package Analysis flagged two concrete malicious behaviours: "The package communicates with a domain associated with malicious activity" and "The package executes one or more commands associated with malicious behavior". Specific domain and command strings were not published in the GHSA advisory text. Source identifier logged by OSSF: c5ef30c4ec24f78fa57d10f6bd8e7fb7be307fc23e833428af785b2013bf2fab. Severity medium (OSSF confirmed-malicious flag with specific behaviours noted but no captured IOCs beyond the OSSF record; the 999.0.0 sentinel marks this as a dep-confusion / lure attempt rather than a reach into legitimate dependents)
• Cluster D - @sudobility/walknpm/dsh- XMRig cluster wave-3 continuity (compromise / malicious-package; 3 packages, 2026-10-28 and 2026-10-29 publishes): @walknpm/todo-cli@2.0.1 (GHSA-p6gj-69gx-r376, GHSA 2026-10-28), dsh-plugin-blender-3d@0.2.1 (GHSA-hw9g-f63g-4c8x, GHSA 2026-10-28, note unscoped - the 2026-10-26 version was scoped @sudobility/dsh-plugin-blender-3d, so the same operator has moved to a bare slug), dsh-redteam-mode@0.15.2 (GHSA-r4m9-8735-g966, GHSA 2026-10-29, first live-today listing). All three are CWE-506 boilerplate on todays GHSA advisories without captured payload bytes, but the slug continuity (@walknpm/ from the 2026-10-26 XMRig cluster; dsh- continuing the DeepSeek-Harness-themed lure family) and the 2026-10-28 sweeps explicit "@sudobility XMRig cluster is idle today" note being contradicted the very next day confirm the operator is active again. Working assumption is the same networkservicesupp.flashhub.net:8443 XMRig Monero pool + preinstall-script shape as the 2026-10-22 / 2026-10-26 waves, pending Socket/StepSecurity post-mortem. Severity medium for the cluster (operator continuity with the 10-22 / 10-26 XMRig family; nothing legitimate depends on these slugs, but any machine that installed any of them should be hunted for XMRig processes and egress to the networkservicesupp.flashhub.net Monero pool)
• *Cluster E - npm `camelotlabs- 5-pack typosquat mesh (typosquat; 5 packages, all versions, all 2026-10-28 GHSA advisories)**: camelotlabs-core (GHSA-pf82-f9wr-54vx), camelotlabs-sdk (GHSA-wx8x-c4rg-8rg7), camelotlabs-worker (GHSA-4mgg-vrvh-32xg), camelotlabs-config (GHSA-7972-958m-rqjg), camelotlabs-utils (GHSA-2j2p-88v8-7xrm) - each at >= 0 (all versions). GHSA advisory text is CWE-506 boilerplate without captured payload bytes. The 5-pack naming mesh (-core / -sdk / -worker / -config / -utils on the same camelotlabs stem) is a coordinated operator pattern; the "camelotlabs" slug most plausibly impersonates [Camelot DEX / Camelot Protocol](https://camelot.exchange/) (an Arbitrum DeFi exchange and infrastructure provider branded "Camelot") whose developers would plausibly reach for a camelotlabs-sdk npm package. **Severity medium** for the cluster (CWE-506-only on todays advisories but the mesh pattern + the credible DeFi-brand impersonation make this a coordinated typosquat; any Arbitrum/Camelot DEX developer should audit their lockfiles)
• *Cluster F - npm `itsa- paired typosquat (typosquat; 2 packages, 2026-10-28 GHSA advisories)**: itsa-utils@1.4.2 (GHSA-x788-rmcm-4x49), itsa-react-checkbox@16.0.5 (GHSA-46r9-rx5f-hqqf). The itsa- prefix matches an npm scope-less slug used historically for a few small React utility packages; the single-version-each pattern plus the shared prefix matches a coordinated typosquat (someone reserved both slugs at specific plausible pin versions - 1.4.2 for utils, 16.0.5 for a React 16-compatible checkbox - to catch an organisation that pins both in the same manifest). CWE-506 boilerplate on both without captured payload. **Severity medium** (coordinated typosquat without captured payload; any manifest pinning both slugs together was the operators intended target)
• Cluster G - npm @zaip-ai/cli 7-version maintainer-compromise shape (compromise; 1 package / 7 versions, 2026-10-28 GHSA advisory): @zaip-ai/cli@6.4.0, 6.5.0, 7.0.0, 7.1.0, 7.2.0, 7.3.0, 7.4.0 (GHSA-ffq4-h5jm-8pqr). The 7-contiguous-version takedown with no older versions flagged matches the maintainer-compromise shape (an operator with publish rights iterated bumps as the loader was refined). CWE-506 boilerplate on the GHSA advisory without captured payload bytes. The @zaip-ai/* scope is an AI-assistant / coding-agent tooling scope, so a compromised maintainer here has downstream reach into AI-coding-tool integrators. Severity medium for the cluster (maintainer-compromise-shaped without captured payload or vendor post-mortem; any downstream pin on @zaip-ai/cli 6.4.0 or newer should be rolled back to <= 6.3.x pending a clean release and vendor comment)
• Cluster H - npm CWE-506 boilerplate long tail (malicious-package; 5 packages, 2026-10-28 GHSA advisories): b20miner@0.3.1 (GHSA-fw7x-6chc-4244, slug self-identifies as a cryptominer), transaction-info-generate-sdk@>= 0 (GHSA-23j5-jj88-v9f3), mock-transactions-sdk@>= 0 (GHSA-357r-x5jp-3p8f, paired with the prior slug, both reading as blockchain/crypto SDKs), my-empty-package@1.0.0 (GHSA-39q9-338w-8vhv, test-slug boilerplate), @atlisp/mcp@1.12.14 (GHSA-65cr-mcfq-59hh, MCP-themed slug targeting the AI Model-Context-Protocol developer audience). CWE-506 boilerplate on all five without captured payload bytes, URLs, hashes, or operator identity. Severity medium per package
• Operator continuity: @sudobility XMRig cluster is BACK - the 2026-10-28 sweeps "idle today" claim was reversed within 24 hours by three new slugs (@walknpm/todo-cli, bare-slug dsh-plugin-blender-3d, dsh-redteam-mode). The move from a @sudobility/` scope to a bare-slug publish is a classic scanner-evasion step. kam193 cadence is quiet today after yesterdays 3-item burst - no new trajmetrics/numprint/h13t0ry-hello-demo` siblings on the feed. New operator identity: testsecuiitytestme (Cluster A @testsecuiitytestme/cache-helper Shai-Hulud wave-2 loader; the npm identity has only this one scope and the account was created the same day as the first publish, so it is a throwaway operator identity). New operator identity: f0x_mulder (Cluster B csvflow-schema beacon; the mulderitsme.net beacon domain and the f0x_mulder npm identity cross-reference). Beacon operator (MAL-2026-18276 lineage)*: Cluster B @webapp-shared/login-vmok reuses the _ah/dc HTTP-POST beacon code from MAL-2026-18276, confirming the same operator rotated the beacon IP from 185.158.107.175:8787 to 13.140.137.222:8787 - add both to the standing block. Carve-outs LiteLLM 1.107.0, Tailwind Animate.css fake-interview, Apex Accelerator REF8801, TensorLake AI, hridoy FB credential stealer, anthropic-sdk PyPI typosquat, the 2026-10-27 netweavex NetworkX typosquat and the 2026-10-28 kam193 PyPI trio + camera.ui NVR compromise all remain confirmed-recovered with no wave-2 malicious republish observed today

Clean-up steps

1. 1For Cluster A (@testsecuiitytestme/cache-helper Shai-Hulud wave-2 loader - CONFIRMED PAYLOAD): grep every package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, Dockerfile, and container image manifest for the literal string @testsecuiitytestme/cache-helper. On ANY hit on a host that ran npm install or yarn install during the 2026-10-27 12:28 UTC → 2026-10-28 (GHSA takedown) window: treat the host as fully compromised, rotate every credential reachable from it (npm publish tokens, GitHub PATs, cloud provider access keys, password-manager master credentials, SSH private keys, env files), audit the npm publish history for every maintainer identity that touched that host for unexpected releases, audit CI workflow files on every repo pushed from that host for unauthorised edits, and audit AI-assistant configuration files (Claude Code, Cursor, Copilot, Aider etc.) for unexpected modifications. Hunt tarball hashes against your registry mirror and your node_modules/@testsecuiitytestme/cache-helper/ directory: 1.0.1 a9c98033ac14fced8376bb8ba32bd92426b3729e16f5cd3852c5a97fc3503002, 1.0.2 067a1350278fd1ae4fcc261eaca98964dd23a3c7940988ec43f95758480cf113, 1.0.3 0e99f9a2eb7abcfe65278ca87a8e11dce25f39de2ff4bd77035e2bf01d26f0ed. Hunt file hashes against unpacked packages: linux native addon 2547686f86fe6994bcf79558fcce441edc67aa734e255acf79870d5f47de7bbf (1.0.2) / 1fdd50b1bf66c4fd0e94f2be3db1f2f0fd77921136867022ad7e65e21220ad03 (1.0.3), win32 native addon 620d2489e18b5a5f8840e96b90673d72db4c4c54d555ad66d179b3a5833e7763 (1.0.2) / 5b7a0f53f2eca2dd4bf21e6df7d34e751b6cdf70b2f0a6f1f13edfb5caa9570b (1.0.3). Alert on any host-wide Bun 1.2.18 install that cannot be explained by a developer-initiated install (the loader downloads Bun if not already present, so a surprise Bun installation on a non-Bun developer machine is a strong IOC). Add @testsecuiitytestme/* to the npm registry mirror`s manual-approval list and the npm denylist
2. 2For Cluster B (confirmed-beacon installs - csvflow-schema, @webapp-shared/login-vmok): grep every manifest for exact matches. For csvflow-schema: on any hit, check the system temp directory for the marker file csvflow_schema/pi_2c75177b.ok - its presence is strong evidence the postinstall actually ran. Block egress to cdn-status.mulderitsme.net apex + all subdomains on every host. Audit all npm publishes by f0x_mulder and add that identity to a watchlist. For @webapp-shared/login-vmok: on any hit against versions 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0, 99.0.1 (note 0.0.0-stage and 0.1.0 are NOT affected and are the legitimate placeholder shape), block egress to 13.140.137.222:8787 AND 185.158.107.175:8787 (both IPs host the same operators _ah/dc beacon per MAL-2026-18276 cross-reference) on build/CI hosts. Audit internal-registry resolution for the @webapp-shared/ scope - that is the operators intended internal name, confirm the internal registry wins ahead of public resolution. Add `@webapp-shared/ to the npm registry mirrors manual-approval list
3. 3For Cluster C (black-spindle@999.0.0): grep every manifest for exact slug + 999.0.0. On any hit (999.0.0 is sentinel-version so it is a dep-confusion probe target): remove, audit node_modules/black-spindle/ for postinstall bytes, rebuild from a clean mirror, and watch for the operators next slug. Add black-spindle` to the npm denylist
4. 4For Cluster D (@sudobility/walknpm/dsh- XMRig cluster wave-3): grep every manifest for @walknpm/todo-cli@2.0.1, dsh-plugin-blender-3d@0.2.1 (bare slug, NOT the earlier scoped @sudobility/dsh-plugin-blender-3d), and dsh-redteam-mode@0.15.2. On any hit, assume same networkservicesupp.flashhub.net:8443 XMRig Monero-pool shape as prior waves - hunt for XMRig processes (xmrig, xmr-stak, or any Monero-pool-connecting worker), block egress to networkservicesupp.flashhub.net:8443 on every host (should already be in place from the 2026-10-22 / 2026-10-26 sweepss standing denylist). Add @walknpm/, dsh- (bare prefix), and the broader @sudobility/* scope to the npm registry mirrors manual-approval list, since the operator has demonstrated willingness to pivot between a scoped and a bare-slug publish strategy
5. 5*For Cluster E (`camelotlabs- 5-pack typosquat mesh)**: grep every manifest for exact slugs camelotlabs-core, camelotlabs-sdk, camelotlabs-worker, camelotlabs-config, camelotlabs-utils. Camelot DEX / Camelot Protocol developers (Arbitrum DeFi) and anyone integrating with Camelot APIs are the plausible target audience; audit for any pin on these slugs. On any hit, remove, audit node_modules/<pkg>/ for postinstall bytes, rebuild. Add the camelotlabs- prefix (and the adjacent camelot-` prefix for sibling waves) to the npm denylist. Alert the developer who introduced the dependency so the slug is retired from AI-assistant prompts and internal docs
6. 6*For Cluster F (`itsa- paired typosquat)**: grep every manifest for itsa-utils@1.4.2 and itsa-react-checkbox@16.0.5. On any hit, remove, audit, rebuild. Add itsa-* prefix to the npm denylist and watch for the operators next slug (the paired-at-plausible-pin pattern suggests more siblings pre-published at other plausible pin versions)
7. 7For Cluster G (@zaip-ai/cli 7-version maintainer-compromise shape): on any pin to @zaip-ai/cli@>=6.4.0, roll back to <= 6.3.x pending a clean upstream release and vendor comment. The 7-contiguous-version flag with no older versions flagged is the classic maintainer-compromise iterative-bump shape. Contact the maintainer / project via their GitHub to request a public post-mortem and watch for an 8.x clean release. Audit any downstream project pinned to this package - AI-coding-tool integrators are the most plausible exposure path
8. 8For Cluster H (CWE-506 long tail - b20miner, transaction-info-generate-sdk, mock-transactions-sdk, my-empty-package, @atlisp/mcp): grep every manifest for exact slugs. On any hit, remove, audit, rebuild. Add exact slugs to the npm denylist. Note b20miner self-identifies as a cryptominer in its slug, and @atlisp/mcp targets the AI Model-Context-Protocol developer audience - alert the developer who introduced these so the slugs are retired from AI-assistant prompts
9. 9Standing egress-denylist carry-forward from prior sweeps (keep in place): continue to block networkservicesupp.flashhub.net:8443 (XMRig Monero pool, 2026-10-22 + 2026-10-26 + todays wave-3), api.github.com/repos/jerryjohnston91/ + codeload.github.com/jerryjohnston91/ (2026-10-27 netweavex), c2-worker.crawlnet-claim.workers.dev apex + /dl/pyupd, 34.143.131.27:18080 + /x-VA-1/main.js, webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/, 75.119.137.232:31337 + /depconfuse, transfer.archivete.am apex + /H2Uxm/fabdeploycheck-config.json, realwbx.com apex + /ip.php + /ip, artifacts.creditslib.com apex + /npm/, login.fromthehotel.com apex, googleforum.pythonanywhere.com, space-z.ai, dxpoc.gt.tc, raw.githubusercontent.com/anonrider404/pypl/, api-bsx.pages.dev + /download, 177.7.60.239:48080 + oob.recon.dev, uncoder.eu.org + /cc-checker/api.php, accenture-npm.azurewebsites.net, limbomail.com, collector.oob.s4yhii.com + .oob.s4yhii.com + s4yhii.com, 64.181.165.115/dc, 167.88.172.33:8087 + jsonspack.com, goxtools.shop, minhdong.site, 45.138.12.177:8089, 185.158.107.175:8787 + /_ah/dc path (MAL-2026-18276 beacon operator - keep sharp), ltidi.storage.googleapis.com/depenconf/, oob.s4yhii.com:9999/native, .oast.pro/.oast.me/.oast.fun/.oast.site/.oastify.com, frjmzbjbhwvtdnsuodmu.supabase.co, api.npoint.io, tele.metry.orgin.net, morroncr0w.io, api.telegram.org on untrusted CI/build hosts, appsecc.com, generic webhook.site/ paths, nfjbill.ren, storage.googleapis.com/depenconf/, 10.0.19.0/24 + 10.0.49.0/24, api.nm-streetwear.space, Discord webhook URLs, ipify.org + ifconfig.me, gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, chinazhangsan.ccwu.cc, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil patterns, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com, 45.138.0.0/16 RubyGems wgkit CIDRs, apexaccs.org apex + subdomains, arenapex.cloud, apexfdn.xyz apex + subdomains, fdn4apex.com, router-apex.com apex + subdomains, ccmihr.com, 0auth-chromium.com, ehegisnightmare.icu, cloudmain365duo.top, www.litellm.dev/healthcheck, raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt, SSH relay services srv.us, .devtunnels.ms, .devtunnels.visualstudio.com, .ngrok-free.dev/canary, 109.94.169.196:8443 + .sslip.io:8443 (2026-10-28 kam193 Cluster A), api.github.com/gists/3775fd9235aa6ef29e96eb96274a0e34 (2026-10-28 kam193 Cluster A numprint), 115.190.210.22` (2026-10-28 kam193 Cluster A h13t0ry-hello-demo). New-sharp today: 13.140.137.222:8787 + /_ah/dc path (Cluster B @webapp-shared/login-vmok beacon; same operator as prior 185.158.107.175:8787 beacon - keep both IPs blocked), cdn-status.mulderitsme.net apex + all subdomains (Cluster B csvflow-schema beacon via f0x_mulder), surprise Bun 1.2.18 installs on non-Bun developer machines (Cluster A loader downloads Bun if absent - alert on any new ~/.bun/ or /root/.bun/ directory outside dev workflow). New operator identities to watch*: npm testsecuiitytestme (Cluster A Shai-Hulud loader throwaway identity), npm f0x_mulder (Cluster B csvflow-schema beacon operator - mulderitsme.net cross-reference)

Sources

• GitHub Advisory Database - recent malware advisoriesgithub.comGitHub
• GHSA-4g45-28rv-vq9q - npm @testsecuiitytestme/cache-helper@1.0.1-1.0.3 (Cluster A - Shai-Hulud wave-2 shaped native-addon loader, Bun 1.2.18 second stage, OSSF MAL-2026-18358, publisher testsecuiitytestme)github.comGitHub
• ossf/malicious-packages record for @testsecuiitytestme/cache-helper (MAL-2026-18358)github.comOpenSSF
• GHSA-mhx4-6f72-5vf7 - npm csvflow-schema@1.0.0 (Cluster B - cdn-status.mulderitsme.net beacon, OSSF MAL-2026-18357, publisher f0x_mulder)github.comGitHub
• ossf/malicious-packages record for csvflow-schema (MAL-2026-18357)github.comOpenSSF
• GHSA-cmqx-q58q-9m8p - npm @webapp-shared/login-vmok (Cluster B - 6 versions, 13.140.137.222:8787/_ah/dc beacon, OSSF MAL-2026-18356, same operator as MAL-2026-18276)github.comGitHub
• ossf/malicious-packages record for @webapp-shared/login-vmok (MAL-2026-18356)github.comOpenSSF
• GHSA-9939-65w7-25v2 - npm black-spindle@999.0.0 (Cluster C - OSSF Package Analysis flagged malicious domain + command execution, MAL-2026-18359)github.comGitHub
• GHSA-p6gj-69gx-r376 - npm @walknpm/todo-cli@2.0.1 (Cluster D - @walknpm scope continuity with 2026-10-26 XMRig cluster)github.comGitHub
• GHSA-hw9g-f63g-4c8x - npm dsh-plugin-blender-3d@0.2.1 (Cluster D - bare-slug pivot from 2026-10-26 scoped @sudobility/dsh-plugin-blender-3d)github.comGitHub
• GHSA-r4m9-8735-g966 - npm dsh-redteam-mode@0.15.2 (Cluster D - 2026-10-29 first live-today listing, dsh- prefix continuity)github.comGitHub
• GHSA-pf82-f9wr-54vx - npm camelotlabs-core (Cluster E - Camelot DEX/Arbitrum DeFi brand typosquat mesh)github.comGitHub
• GHSA-wx8x-c4rg-8rg7 - npm camelotlabs-sdk (Cluster E)github.comGitHub
• GHSA-4mgg-vrvh-32xg - npm camelotlabs-worker (Cluster E)github.comGitHub
• GHSA-7972-958m-rqjg - npm camelotlabs-config (Cluster E)github.comGitHub
• GHSA-2j2p-88v8-7xrm - npm camelotlabs-utils (Cluster E)github.comGitHub
• GHSA-x788-rmcm-4x49 - npm itsa-utils@1.4.2 (Cluster F)github.comGitHub
• GHSA-46r9-rx5f-hqqf - npm itsa-react-checkbox@16.0.5 (Cluster F)github.comGitHub
• GHSA-ffq4-h5jm-8pqr - npm @zaip-ai/cli@6.4.0-7.4.0 (Cluster G - 7-contiguous-version maintainer-compromise shape, AI-coding-agent scope)github.comGitHub
• GHSA-fw7x-6chc-4244 - npm b20miner@0.3.1 (Cluster H - self-identifies as cryptominer in slug)github.comGitHub
• GHSA-23j5-jj88-v9f3 - npm transaction-info-generate-sdk (Cluster H - blockchain/crypto SDK lure)github.comGitHub
• GHSA-357r-x5jp-3p8f - npm mock-transactions-sdk (Cluster H - paired with transaction-info-generate-sdk)github.comGitHub
• GHSA-39q9-338w-8vhv - npm my-empty-package@1.0.0 (Cluster H - test-slug boilerplate)github.comGitHub
• GHSA-65cr-mcfq-59hh - npm @atlisp/mcp@1.12.14 (Cluster H - MCP-themed slug targeting AI Model-Context-Protocol audience)github.comGitHub
• DependencyWatch: multi-2026-10-28-ghsa-malware-sweep (prior day - kam193 PyPI trio + camera.ui NVR compromise)dependencywatch.io
• DependencyWatch: multi-2026-10-27-ghsa-malware-sweep (netweavex NetworkX typosquat, @sudobility XMRig wave 2)dependencywatch.io