# GitHub Advisory npm malware sweep, 29 October 2026

> Late 2026-10-28 GHSA batch plus the first 2026-10-29 npm advisory. Headline is `@testsecuiitytestme/cache-helper` 1.0.1/1.0.2/1.0.3 (MAL-2026-18358), a Shai-Hulud wave-2 shaped native-addon loader that invokes Bun 1.2.18 and scrapes npm/GitHub/cloud/password-manager/SSH/env secrets. Also two confirmed-beacon installs (`csvflow-schema@1.0.0`, `@webapp-shared/login-vmok` 6-version dep-confusion), OSSF-flagged `black-spindle@999.0.0`, `@sudobility`/`walknpm` XMRig wave-3 continuity, and a `camelotlabs-*` 5-pack mesh.

- Published: 2026-10-29
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 20 packages, 33 compromised versions
- Tags: typosquat, dependency-confusion, infostealer, credential-theft, maintainer-takeover, worm, ci-cd-compromise, obfuscation, prompt-injection
- Also known as: GHSA 2026-10-28 late batch + 2026-10-29 first wave, @testsecuiitytestme Shai-Hulud wave-2 shaped loader, @sudobility XMRig wave 3, camelotlabs typosquat mesh
- Detected by: GitHub Advisory Database, OpenSSF Package Analysis
- Incident ID: npm-2026-10-29-ghsa-malware-sweep

## Affected packages (20)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@atlisp/mcp](https://dependencywatch.io/package/npm/@atlisp/mcp) | npm | 1.12.14 |
| [@testsecuiitytestme/cache-helper](https://dependencywatch.io/package/npm/@testsecuiitytestme/cache-helper) | npm | 1.0.1, 1.0.2, 1.0.3 |
| [@walknpm/todo-cli](https://dependencywatch.io/package/npm/@walknpm/todo-cli) | npm | 2.0.1 |
| [@webapp-shared/login-vmok](https://dependencywatch.io/package/npm/@webapp-shared/login-vmok) | npm | 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0, 99.0.1 |
| [@zaip-ai/cli](https://dependencywatch.io/package/npm/@zaip-ai/cli) | npm | 6.4.0, 6.5.0, 7.0.0, 7.1.0, 7.2.0, 7.3.0, 7.4.0 |
| [b20miner](https://dependencywatch.io/package/npm/b20miner) | npm | 0.3.1 |
| [black-spindle](https://dependencywatch.io/package/npm/black-spindle) | npm | 999.0.0 |
| [camelotlabs-config](https://dependencywatch.io/package/npm/camelotlabs-config) | npm | 0.0.0 |
| [camelotlabs-core](https://dependencywatch.io/package/npm/camelotlabs-core) | npm | 0.0.0 |
| [camelotlabs-sdk](https://dependencywatch.io/package/npm/camelotlabs-sdk) | npm | 0.0.0 |
| [camelotlabs-utils](https://dependencywatch.io/package/npm/camelotlabs-utils) | npm | 0.0.0 |
| [camelotlabs-worker](https://dependencywatch.io/package/npm/camelotlabs-worker) | npm | 0.0.0 |
| [csvflow-schema](https://dependencywatch.io/package/npm/csvflow-schema) | npm | 1.0.0 |
| [dsh-plugin-blender-3d](https://dependencywatch.io/package/npm/dsh-plugin-blender-3d) | npm | 0.2.1 |
| [dsh-redteam-mode](https://dependencywatch.io/package/npm/dsh-redteam-mode) | npm | 0.15.2 |
| [itsa-react-checkbox](https://dependencywatch.io/package/npm/itsa-react-checkbox) | npm | 16.0.5 |
| [itsa-utils](https://dependencywatch.io/package/npm/itsa-utils) | npm | 1.4.2 |
| [mock-transactions-sdk](https://dependencywatch.io/package/npm/mock-transactions-sdk) | npm | 0.0.0 |
| [my-empty-package](https://dependencywatch.io/package/npm/my-empty-package) | npm | 1.0.0 |
| [transaction-info-generate-sdk](https://dependencywatch.io/package/npm/transaction-info-generate-sdk) | npm | 0.0.0 |

## What happened

Between 2026-10-28 06:00 UTC (yesterday`s sweep cut-off) and 2026-10-29 06:00 UTC (today`s ingest-window start), the GitHub Advisory Database published ~22 fresh npm malware advisories (plus the already-covered pypi `trajmetrics` and npm `glyphmatrix-fixture` that landed in yesterday`s sweep). The headline is a confirmed Shai-Hulud wave-2 shaped npm loader - the first such loader to post to GHSA since the May 2026 TanStack burst - plus two confirmed-beacon installs, OSSF-flagged behaviour on a sentinel-version package, a wave-3 revival of the `@sudobility` XMRig cluster that was declared idle only yesterday, a `camelotlabs-*` 5-pack typosquat mesh plausibly targeting the Camelot DEX / Arbitrum DeFi developer audience, a paired `itsa-*` typosquat, and a 7-contiguous-version maintainer-compromise-shaped batch against `@zaip-ai/cli`.

## Headlines

**Shai-Hulud wave-2 shaped loader** (Cluster A): `@testsecuiitytestme/cache-helper@1.0.1, 1.0.2, 1.0.3` is published by throwaway npm identity `testsecuiitytestme` on 2026-10-27 across the span 12:28 → 16:24 UTC. OSSF Package Analysis (MAL-2026-18358) describes an install-time native-addon loader that evades CI/sandbox/container/debugger detection, downloads Bun 1.2.18 if absent, and runs a second-stage program under Bun that steals npm/GitHub/cloud/password-manager/SSH/env credentials and propagates via further npm publishes, CI workflow edits, and modifications to AI-assistant configuration files - the exact TTP shape of the May 2026 Shai-Hulud wave-2 TanStack worm. Captured tarball and inner-file SHA-256 hashes for all three versions are listed in impact Cluster A.

**Two confirmed-beacon installs** (Cluster B): `csvflow-schema@1.0.0` (published 2026-10-26 by `f0x_mulder`, taken down ~17 min later) is a CSV-schema lure that writes a marker file to the system temp directory and HTTPS-POSTs host details to `cdn-status.mulderitsme.net`. `@webapp-shared/login-vmok` (6 versions in a sentinel-version-mesh pattern, excluding the untouched `0.0.0-stage` / `0.1.0` placeholders) is a dep-confusion probe against the `@webapp-shared` scope that POSTs host fingerprint to `13.140.137.222:8787/_ah/dc`; the beacon code matches MAL-2026-18276 which used `185.158.107.175:8787`, so same operator and rotated IP.

**OSSF-flagged `black-spindle@999.0.0`** (Cluster C): Package Analysis flagged two concrete malicious behaviours ("communicates with a domain associated with malicious activity" and "executes one or more commands associated with malicious behavior") but the specific IOCs are only in the OSSF record (`c5ef30c4ec24f78fa57d10f6bd8e7fb7be307fc23e833428af785b2013bf2fab`).

**`@sudobility` XMRig cluster wave-3** (Cluster D): the 2026-10-28 sweep`s "idle today" claim was reversed within 24 hours by three new slugs - `@walknpm/todo-cli@2.0.1`, bare-slug `dsh-plugin-blender-3d@0.2.1` (note the pivot from a `@sudobility/*` scope to a bare publish - classic scanner-evasion), and today`s first live-29 listing `dsh-redteam-mode@0.15.2`. All three are CWE-506 boilerplate on GHSA, but the slug continuity confirms the operator.

**`camelotlabs-*` 5-pack typosquat mesh** (Cluster E): five npm packages (`-core`, `-sdk`, `-worker`, `-config`, `-utils`) on the same `camelotlabs` stem, each affected at all versions, all CWE-506 boilerplate without captured payload. The "camelotlabs" slug plausibly impersonates the [Camelot DEX / Camelot Protocol](https://camelot.exchange/) Arbitrum DeFi brand - a developer there would reach for `camelotlabs-sdk` without critical review.

**`itsa-*` paired typosquat** (Cluster F): `itsa-utils@1.4.2` and `itsa-react-checkbox@16.0.5` share the `itsa-` prefix and are published at specific plausible pin versions (React 16-compatible, utils 1.4.x) - a coordinated typosquat targeting an org that pins both in the same manifest.

**`@zaip-ai/cli` 7-contiguous-version maintainer-compromise shape** (Cluster G): seven consecutive versions (6.4.0 → 7.4.0) all flagged as CWE-506 without any older version touched - the classic iterative-bump shape of a compromised maintainer refining a loader as they publish. The `@zaip-ai/*` scope is an AI-coding-agent tooling scope, so downstream pins should roll back to `<= 6.3.x` pending a clean upstream release.

## Classification

`sweep`. Severity `high` (upgraded from the sweep baseline `medium`) because Cluster A carries a confirmed Shai-Hulud wave-2 shaped payload with real credential-theft and worm-propagation capability (captured tarball and inner-file hashes, static-analysed TTP matching May 2026 TanStack burst), Cluster B carries two confirmed-beacon installs with captured network IOCs, and Cluster C carries an OSSF-confirmed malicious-behaviour flag. Clusters D-H are `medium` - CWE-506 boilerplate, operator-continuity signals, typosquats, dep-confusion probes, or maintainer-compromise-shaped iterations without captured payload bytes. No cluster reaches `critical` - Cluster A`s payload has limited reach (nothing legitimate depends on `@testsecuiitytestme/*`, the identity is throwaway, and the slug does not match any legitimate pin), and none of the other clusters hit the "already-widely-depended-on name" / "active self-propagating worm against legitimate packages" bar that would warrant a named critical incident file.

## Discovery

`GitHub Advisory Database`, `OpenSSF malicious-packages` (Cluster A MAL-2026-18358, Cluster B MAL-2026-18356 + MAL-2026-18357, Cluster C MAL-2026-18359), MAL-2026-18276 cross-reference for the shared Cluster B beacon code.

## Impact

- **Cluster A - npm `@testsecuiitytestme/cache-helper` Shai-Hulud wave-2 shaped loader (malicious-package; 1 package / 3 versions, publisher `testsecuiitytestme`, package created 2026-10-27 12:08 UTC)**: `@testsecuiitytestme/cache-helper@1.0.1, 1.0.2, 1.0.3` (GHSA-4g45-28rv-vq9q, OSSF MAL-2026-18358, published to GHSA 2026-10-28). Versions published 1.0.1 at 12:28 UTC, 1.0.2 at 15:33 UTC, 1.0.3 at 16:24 UTC on 2026-10-27 - rapid-iteration shape consistent with an operator refining the loader as they publish. Static analysis in the OSSF advisory describes an install-time native-addon loader that first sniffs for CI, sandbox, container and debugger environments, then decodes and executes a second-stage program under the Bun runtime (downloading Bun 1.2.18 if the host does not already have it). The second stage targets credentials for npm, GitHub, cloud providers, password managers, SSH, and env-file secrets, and attempts self-propagation via further npm publishes, CI workflow edits, and modifications to AI-assistant configuration files - the exact TTP shape of the May 2026 Shai-Hulud wave-2 TanStack worm. Tarball SHA-256: 1.0.1 `a9c98033ac14fced8376bb8ba32bd92426b3729e16f5cd3852c5a97fc3503002`, 1.0.2 `067a1350278fd1ae4fcc261eaca98964dd23a3c7940988ec43f95758480cf113`, 1.0.3 `0e99f9a2eb7abcfe65278ca87a8e11dce25f39de2ff4bd77035e2bf01d26f0ed`. File SHA-256 inside 1.0.2: `prebuilds/linux-x64/node.napi.node` `2547686f86fe6994bcf79558fcce441edc67aa734e255acf79870d5f47de7bbf`, `prebuilds/win32-x64/node.napi.node` `620d2489e18b5a5f8840e96b90673d72db4c4c54d555ad66d179b3a5833e7763`, `.napi_cache` `463dda65ebceeca6f5590dcdeae6c1d06ffadb2380a85b613deb2923af5557e7`; inside 1.0.3: linux `1fdd50b1bf66c4fd0e94f2be3db1f2f0fd77921136867022ad7e65e21220ad03`, win32 `5b7a0f53f2eca2dd4bf21e6df7d34e751b6cdf70b2f0a6f1f13edfb5caa9570b`, `.napi_cache` `c14dae9325f451c524cf858ecdae5fa68d2c645ee0981c6f42ef913c7ef34a57`. The exfil endpoints are encoded in the second-stage program and were not decoded in the static-only OSSF analysis. **Severity `high`** for this cluster (confirmed Shai-Hulud wave-2 shaped payload with real credential-theft and worm-propagation capability; nothing legitimate depends on `@testsecuiitytestme/*` so reach is limited to anyone who installed it in error, but any host that ran it is fully compromised, and this is the first wave-2-shaped loader to post to GHSA since the May 2026 TanStack burst)
- **Cluster B - npm confirmed-beacon installs (malicious-package + dependency-confusion; 2 packages, both published 2026-10-26 to 2026-10-27, GHSA 2026-10-28)**: `csvflow-schema@1.0.0` (GHSA-mhx4-6f72-5vf7, OSSF MAL-2026-18357, published 2026-10-26 by npm identity `f0x_mulder`, taken down by npm security ~17 minutes after publication) presents as a CSV schema validation helper. Postinstall collects host and user details, writes marker file `csvflow_schema/pi_2c75177b.ok` to the system temp directory, launches a Windows process and sends an HTTPS request to `https://cdn-status.mulderitsme.net/pi/2c75177b`. A `0.0.0-stage` placeholder was published about a minute before 1.0.0. `@webapp-shared/login-vmok@1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0, 99.0.1` (GHSA-cmqx-q58q-9m8p, OSSF MAL-2026-18356, published 2026-10-27) is a `@webapp-shared` scope dep-confusion probe. Postinstall runs `node beacon.cjs` which POSTs host fingerprint (package name, hostname, install directory, cwd, Node.js version) to `http://13.140.137.222:8787/_ah/dc`; the same beacon code runs again each time the package is loaded via `index.js`. The advisory cross-references MAL-2026-18276, which POSTed to `http://185.158.107.175:8787/_ah/dc` - same beacon operator, rotated IP. Versions `0.0.0-stage` and `0.1.0` are **not** affected (classic sentinel-version-mesh pattern). **Severity `medium`** for this cluster (confirmed beacon-only exfil of host fingerprint; no post-exfil payload captured, but any CI/build host that installed either package has leaked identifying metadata; `@webapp-shared/*` dep-confusion probe additionally succeeded against any org with that internal scope)
- **Cluster C - npm OSSF Package Analysis flagged `black-spindle@999.0.0` (malicious-package; 1 package, 1 version, GHSA 2026-10-28)**: `black-spindle@999.0.0` (GHSA-9939-65w7-25v2, OSSF MAL-2026-18359, 999.0.0 sentinel version shape). OSSF Package Analysis flagged two concrete malicious behaviours: "The package communicates with a domain associated with malicious activity" and "The package executes one or more commands associated with malicious behavior". Specific domain and command strings were not published in the GHSA advisory text. Source identifier logged by OSSF: `c5ef30c4ec24f78fa57d10f6bd8e7fb7be307fc23e833428af785b2013bf2fab`. **Severity `medium`** (OSSF confirmed-malicious flag with specific behaviours noted but no captured IOCs beyond the OSSF record; the 999.0.0 sentinel marks this as a dep-confusion / lure attempt rather than a reach into legitimate dependents)
- **Cluster D - `@sudobility`/`walknpm`/`dsh-` XMRig cluster wave-3 continuity (compromise / malicious-package; 3 packages, 2026-10-28 and 2026-10-29 publishes)**: `@walknpm/todo-cli@2.0.1` (GHSA-p6gj-69gx-r376, GHSA 2026-10-28), `dsh-plugin-blender-3d@0.2.1` (GHSA-hw9g-f63g-4c8x, GHSA 2026-10-28, note **unscoped** - the 2026-10-26 version was scoped `@sudobility/dsh-plugin-blender-3d`, so the same operator has moved to a bare slug), `dsh-redteam-mode@0.15.2` (GHSA-r4m9-8735-g966, GHSA 2026-10-29, first live-today listing). All three are CWE-506 boilerplate on today`s GHSA advisories without captured payload bytes, but the slug continuity (`@walknpm/*` from the 2026-10-26 XMRig cluster; `dsh-*` continuing the DeepSeek-Harness-themed lure family) and the 2026-10-28 sweep`s explicit "`@sudobility` XMRig cluster is idle today" note being contradicted the very next day confirm the operator is active again. Working assumption is the same `networkservicesupp.flashhub.net:8443` XMRig Monero pool + preinstall-script shape as the 2026-10-22 / 2026-10-26 waves, pending Socket/StepSecurity post-mortem. **Severity `medium`** for the cluster (operator continuity with the 10-22 / 10-26 XMRig family; nothing legitimate depends on these slugs, but any machine that installed any of them should be hunted for XMRig processes and egress to the networkservicesupp.flashhub.net Monero pool)
- **Cluster E - npm `camelotlabs-*` 5-pack typosquat mesh (typosquat; 5 packages, all versions, all 2026-10-28 GHSA advisories)**: `camelotlabs-core` (GHSA-pf82-f9wr-54vx), `camelotlabs-sdk` (GHSA-wx8x-c4rg-8rg7), `camelotlabs-worker` (GHSA-4mgg-vrvh-32xg), `camelotlabs-config` (GHSA-7972-958m-rqjg), `camelotlabs-utils` (GHSA-2j2p-88v8-7xrm) - each at `>= 0` (all versions). GHSA advisory text is CWE-506 boilerplate without captured payload bytes. The 5-pack naming mesh (`-core` / `-sdk` / `-worker` / `-config` / `-utils` on the same `camelotlabs` stem) is a coordinated operator pattern; the "camelotlabs" slug most plausibly impersonates [Camelot DEX / Camelot Protocol](https://camelot.exchange/) (an Arbitrum DeFi exchange and infrastructure provider branded "Camelot") whose developers would plausibly reach for a `camelotlabs-sdk` npm package. **Severity `medium`** for the cluster (CWE-506-only on today`s advisories but the mesh pattern + the credible DeFi-brand impersonation make this a coordinated typosquat; any Arbitrum/Camelot DEX developer should audit their lockfiles)
- **Cluster F - npm `itsa-*` paired typosquat (typosquat; 2 packages, 2026-10-28 GHSA advisories)**: `itsa-utils@1.4.2` (GHSA-x788-rmcm-4x49), `itsa-react-checkbox@16.0.5` (GHSA-46r9-rx5f-hqqf). The `itsa-` prefix matches an npm scope-less slug used historically for a few small React utility packages; the single-version-each pattern plus the shared prefix matches a coordinated typosquat (someone reserved both slugs at specific plausible pin versions - `1.4.2` for utils, `16.0.5` for a React 16-compatible checkbox - to catch an organisation that pins both in the same manifest). CWE-506 boilerplate on both without captured payload. **Severity `medium`** (coordinated typosquat without captured payload; any manifest pinning both slugs together was the operator`s intended target)
- **Cluster G - npm `@zaip-ai/cli` 7-version maintainer-compromise shape (compromise; 1 package / 7 versions, 2026-10-28 GHSA advisory)**: `@zaip-ai/cli@6.4.0, 6.5.0, 7.0.0, 7.1.0, 7.2.0, 7.3.0, 7.4.0` (GHSA-ffq4-h5jm-8pqr). The 7-contiguous-version takedown with no older versions flagged matches the maintainer-compromise shape (an operator with publish rights iterated bumps as the loader was refined). CWE-506 boilerplate on the GHSA advisory without captured payload bytes. The `@zaip-ai/*` scope is an AI-assistant / coding-agent tooling scope, so a compromised maintainer here has downstream reach into AI-coding-tool integrators. **Severity `medium`** for the cluster (maintainer-compromise-shaped without captured payload or vendor post-mortem; any downstream pin on `@zaip-ai/cli` 6.4.0 or newer should be rolled back to `<= 6.3.x` pending a clean release and vendor comment)
- **Cluster H - npm CWE-506 boilerplate long tail (malicious-package; 5 packages, 2026-10-28 GHSA advisories)**: `b20miner@0.3.1` (GHSA-fw7x-6chc-4244, slug self-identifies as a cryptominer), `transaction-info-generate-sdk@>= 0` (GHSA-23j5-jj88-v9f3), `mock-transactions-sdk@>= 0` (GHSA-357r-x5jp-3p8f, paired with the prior slug, both reading as blockchain/crypto SDKs), `my-empty-package@1.0.0` (GHSA-39q9-338w-8vhv, test-slug boilerplate), `@atlisp/mcp@1.12.14` (GHSA-65cr-mcfq-59hh, MCP-themed slug targeting the AI Model-Context-Protocol developer audience). CWE-506 boilerplate on all five without captured payload bytes, URLs, hashes, or operator identity. **Severity `medium`** per package
- **Operator continuity**: **`@sudobility` XMRig cluster is BACK** - the 2026-10-28 sweep`s "idle today" claim was reversed within 24 hours by three new slugs (`@walknpm/todo-cli`, bare-slug `dsh-plugin-blender-3d`, `dsh-redteam-mode`). The move from a `@sudobility/*` scope to a bare-slug publish is a classic scanner-evasion step. **kam193 cadence** is quiet today after yesterday`s 3-item burst - no new `trajmetrics`/`numprint`/`h13t0ry-hello-demo` siblings on the feed. **New operator identity**: `testsecuiitytestme` (Cluster A `@testsecuiitytestme/cache-helper` Shai-Hulud wave-2 loader; the npm identity has only this one scope and the account was created the same day as the first publish, so it is a throwaway operator identity). **New operator identity**: `f0x_mulder` (Cluster B `csvflow-schema` beacon; the `mulderitsme.net` beacon domain and the `f0x_mulder` npm identity cross-reference). **Beacon operator (MAL-2026-18276 lineage)**: Cluster B `@webapp-shared/login-vmok` reuses the `_ah/dc` HTTP-POST beacon code from MAL-2026-18276, confirming the same operator rotated the beacon IP from `185.158.107.175:8787` to `13.140.137.222:8787` - add both to the standing block. Carve-outs [LiteLLM 1.107.0](https://dependencywatch.io/incident/pypi-2026-10-21-litellm-infostealer-rat), [Tailwind Animate.css fake-interview](https://dependencywatch.io/incident/npm-2026-10-20-tailwind-animatecss-fake-interview-campaign), [Apex Accelerator REF8801](https://dependencywatch.io/incident/npm-2026-10-19-apex-accelerator-malicious-npm-packages), [TensorLake AI](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise), [hridoy FB credential stealer](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer), [anthropic-sdk PyPI typosquat](https://dependencywatch.io/incident/pypi-2026-10-05-anthropic-sdk-typosquat), the [2026-10-27 netweavex NetworkX typosquat](https://dependencywatch.io/incident/multi-2026-10-27-ghsa-malware-sweep) and the [2026-10-28 kam193 PyPI trio + camera.ui NVR compromise](https://dependencywatch.io/incident/multi-2026-10-28-ghsa-malware-sweep) all remain confirmed-recovered with no wave-2 malicious republish observed today

## What to do

1. **For Cluster A (`@testsecuiitytestme/cache-helper` Shai-Hulud wave-2 loader - CONFIRMED PAYLOAD)**: grep every `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, Dockerfile, and container image manifest for the literal string `@testsecuiitytestme/cache-helper`. On ANY hit on a host that ran `npm install` or `yarn install` during the 2026-10-27 12:28 UTC → 2026-10-28 (GHSA takedown) window: treat the host as fully compromised, rotate every credential reachable from it (npm publish tokens, GitHub PATs, cloud provider access keys, password-manager master credentials, SSH private keys, env files), audit the npm publish history for every maintainer identity that touched that host for unexpected releases, audit CI workflow files on every repo pushed from that host for unauthorised edits, and audit AI-assistant configuration files (Claude Code, Cursor, Copilot, Aider etc.) for unexpected modifications. Hunt tarball hashes against your registry mirror and your `node_modules/@testsecuiitytestme/cache-helper/` directory: 1.0.1 `a9c98033ac14fced8376bb8ba32bd92426b3729e16f5cd3852c5a97fc3503002`, 1.0.2 `067a1350278fd1ae4fcc261eaca98964dd23a3c7940988ec43f95758480cf113`, 1.0.3 `0e99f9a2eb7abcfe65278ca87a8e11dce25f39de2ff4bd77035e2bf01d26f0ed`. Hunt file hashes against unpacked packages: linux native addon `2547686f86fe6994bcf79558fcce441edc67aa734e255acf79870d5f47de7bbf` (1.0.2) / `1fdd50b1bf66c4fd0e94f2be3db1f2f0fd77921136867022ad7e65e21220ad03` (1.0.3), win32 native addon `620d2489e18b5a5f8840e96b90673d72db4c4c54d555ad66d179b3a5833e7763` (1.0.2) / `5b7a0f53f2eca2dd4bf21e6df7d34e751b6cdf70b2f0a6f1f13edfb5caa9570b` (1.0.3). Alert on any host-wide Bun 1.2.18 install that cannot be explained by a developer-initiated install (the loader downloads Bun if not already present, so a surprise Bun installation on a non-Bun developer machine is a strong IOC). Add `@testsecuiitytestme/*` to the npm registry mirror`s manual-approval list and the npm denylist
2. **For Cluster B (confirmed-beacon installs - `csvflow-schema`, `@webapp-shared/login-vmok`)**: grep every manifest for exact matches. For `csvflow-schema`: on any hit, check the system temp directory for the marker file `csvflow_schema/pi_2c75177b.ok` - its presence is strong evidence the postinstall actually ran. Block egress to `cdn-status.mulderitsme.net` apex + all subdomains on every host. Audit all npm publishes by `f0x_mulder` and add that identity to a watchlist. For `@webapp-shared/login-vmok`: on any hit against versions `1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0, 99.0.1` (note `0.0.0-stage` and `0.1.0` are NOT affected and are the legitimate placeholder shape), block egress to `13.140.137.222:8787` AND `185.158.107.175:8787` (both IPs host the same operator`s `_ah/dc` beacon per MAL-2026-18276 cross-reference) on build/CI hosts. Audit internal-registry resolution for the `@webapp-shared/*` scope - that is the operator`s intended internal name, confirm the internal registry wins ahead of public resolution. Add `@webapp-shared/*` to the npm registry mirror`s manual-approval list
3. **For Cluster C (`black-spindle@999.0.0`)**: grep every manifest for exact slug + 999.0.0. On any hit (999.0.0 is sentinel-version so it is a dep-confusion probe target): remove, audit `node_modules/black-spindle/` for postinstall bytes, rebuild from a clean mirror, and watch for the operator`s next slug. Add `black-spindle` to the npm denylist
4. **For Cluster D (`@sudobility`/`walknpm`/`dsh-` XMRig cluster wave-3)**: grep every manifest for `@walknpm/todo-cli@2.0.1`, `dsh-plugin-blender-3d@0.2.1` (bare slug, NOT the earlier scoped `@sudobility/dsh-plugin-blender-3d`), and `dsh-redteam-mode@0.15.2`. On any hit, assume same `networkservicesupp.flashhub.net:8443` XMRig Monero-pool shape as prior waves - hunt for XMRig processes (`xmrig`, `xmr-stak`, or any Monero-pool-connecting worker), block egress to `networkservicesupp.flashhub.net:8443` on every host (should already be in place from the 2026-10-22 / 2026-10-26 sweeps`s standing denylist). Add `@walknpm/*`, `dsh-*` (bare prefix), and the broader `@sudobility/*` scope to the npm registry mirror`s manual-approval list, since the operator has demonstrated willingness to pivot between a scoped and a bare-slug publish strategy
5. **For Cluster E (`camelotlabs-*` 5-pack typosquat mesh)**: grep every manifest for exact slugs `camelotlabs-core`, `camelotlabs-sdk`, `camelotlabs-worker`, `camelotlabs-config`, `camelotlabs-utils`. Camelot DEX / Camelot Protocol developers (Arbitrum DeFi) and anyone integrating with Camelot APIs are the plausible target audience; audit for any pin on these slugs. On any hit, remove, audit `node_modules/<pkg>/` for postinstall bytes, rebuild. Add the `camelotlabs-*` prefix (and the adjacent `camelot-*` prefix for sibling waves) to the npm denylist. Alert the developer who introduced the dependency so the slug is retired from AI-assistant prompts and internal docs
6. **For Cluster F (`itsa-*` paired typosquat)**: grep every manifest for `itsa-utils@1.4.2` and `itsa-react-checkbox@16.0.5`. On any hit, remove, audit, rebuild. Add `itsa-*` prefix to the npm denylist and watch for the operator`s next slug (the paired-at-plausible-pin pattern suggests more siblings pre-published at other plausible pin versions)
7. **For Cluster G (`@zaip-ai/cli` 7-version maintainer-compromise shape)**: on any pin to `@zaip-ai/cli@>=6.4.0`, roll back to `<= 6.3.x` pending a clean upstream release and vendor comment. The 7-contiguous-version flag with no older versions flagged is the classic maintainer-compromise iterative-bump shape. Contact the maintainer / project via their GitHub to request a public post-mortem and watch for an 8.x clean release. Audit any downstream project pinned to this package - AI-coding-tool integrators are the most plausible exposure path
8. **For Cluster H (CWE-506 long tail - `b20miner`, `transaction-info-generate-sdk`, `mock-transactions-sdk`, `my-empty-package`, `@atlisp/mcp`)**: grep every manifest for exact slugs. On any hit, remove, audit, rebuild. Add exact slugs to the npm denylist. Note `b20miner` self-identifies as a cryptominer in its slug, and `@atlisp/mcp` targets the AI Model-Context-Protocol developer audience - alert the developer who introduced these so the slugs are retired from AI-assistant prompts
9. **Standing egress-denylist carry-forward from prior sweeps** (keep in place): continue to block `networkservicesupp.flashhub.net:8443` (XMRig Monero pool, 2026-10-22 + 2026-10-26 + today`s wave-3), `api.github.com/repos/jerryjohnston91/*` + `codeload.github.com/jerryjohnston91/*` (2026-10-27 netweavex), `c2-worker.crawlnet-claim.workers.dev` apex + `/dl/pyupd`, `34.143.131.27:18080` + `/x-VA-1/main.js`, `webhook.site/553dad0e-c841-46a8-b07d-213b52a24686/`, `75.119.137.232:31337` + `/depconfuse`, `transfer.archivete.am` apex + `/H2Uxm/fabdeploycheck-config.json`, `realwbx.com` apex + `/ip.php` + `/ip`, `artifacts.creditslib.com` apex + `/npm/*`, `login.fromthehotel.com` apex, `googleforum.pythonanywhere.com`, `space-z.ai`, `dxpoc.gt.tc`, `raw.githubusercontent.com/anonrider404/pypl/*`, `api-bsx.pages.dev` + `/download`, `177.7.60.239:48080` + `oob.recon.dev`, `uncoder.eu.org` + `/cc-checker/api.php`, `accenture-npm.azurewebsites.net`, `limbomail.com`, `collector.oob.s4yhii.com` + `*.oob.s4yhii.com` + `s4yhii.com`, `64.181.165.115/dc`, `167.88.172.33:8087` + `jsonspack.com`, `goxtools.shop`, `minhdong.site`, `45.138.12.177:8089`, `185.158.107.175:8787` + `/_ah/dc` path (MAL-2026-18276 beacon operator - keep sharp), `ltidi.storage.googleapis.com/depenconf/`, `oob.s4yhii.com:9999/native`, `*.oast.pro`/`*.oast.me`/`*.oast.fun`/`*.oast.site`/`*.oastify.com`, `frjmzbjbhwvtdnsuodmu.supabase.co`, `api.npoint.io`, `tele.metry.orgin.net`, `morroncr0w.io`, `api.telegram.org` on untrusted CI/build hosts, `appsecc.com`, generic `webhook.site/*` paths, `nfjbill.ren`, `storage.googleapis.com/depenconf/`, `10.0.19.0/24` + `10.0.49.0/24`, `api.nm-streetwear.space`, Discord webhook URLs, `ipify.org` + `ifconfig.me`, `gitflic.ru`, `api.wagmiwallet.org`, `backend-cybersecuritydashboard.onrender.com`, Monero mining pools, Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, `chinazhangsan.ccwu.cc`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `npm-canary.aveliscare.com`, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil patterns, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, `tuamaeaquelaursa.com`, `45.138.0.0/16` RubyGems wgkit CIDRs, `apexaccs.org` apex + subdomains, `arenapex.cloud`, `apexfdn.xyz` apex + subdomains, `fdn4apex.com`, `router-apex.com` apex + subdomains, `ccmihr.com`, `0auth-chromium.com`, `ehegisnightmare.icu`, `cloudmain365duo.top`, `www.litellm.dev/healthcheck`, `raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt`, SSH relay services `srv.us`, `*.devtunnels.ms`, `*.devtunnels.visualstudio.com`, `*.ngrok-free.dev/canary`, `109.94.169.196:8443` + `*.sslip.io:8443` (2026-10-28 kam193 Cluster A), `api.github.com/gists/3775fd9235aa6ef29e96eb96274a0e34` (2026-10-28 kam193 Cluster A numprint), `115.190.210.22` (2026-10-28 kam193 Cluster A h13t0ry-hello-demo). **New-sharp today**: `13.140.137.222:8787` + `/_ah/dc` path (Cluster B `@webapp-shared/login-vmok` beacon; same operator as prior `185.158.107.175:8787` beacon - keep both IPs blocked), `cdn-status.mulderitsme.net` apex + all subdomains (Cluster B `csvflow-schema` beacon via `f0x_mulder`), surprise Bun 1.2.18 installs on non-Bun developer machines (Cluster A loader downloads Bun if absent - alert on any new `~/.bun/` or `/root/.bun/` directory outside dev workflow). **New operator identities to watch**: npm `testsecuiitytestme` (Cluster A Shai-Hulud loader throwaway identity), npm `f0x_mulder` (Cluster B `csvflow-schema` beacon operator - mulderitsme.net cross-reference)

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-4g45-28rv-vq9q - npm @testsecuiitytestme/cache-helper@1.0.1-1.0.3 (Cluster A - Shai-Hulud wave-2 shaped native-addon loader, Bun 1.2.18 second stage, OSSF MAL-2026-18358, publisher testsecuiitytestme)](https://github.com/advisories/GHSA-4g45-28rv-vq9q) - GitHub
- [ossf/malicious-packages record for @testsecuiitytestme/cache-helper (MAL-2026-18358)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@testsecuiitytestme/cache-helper/MAL-2026-18358.json) - OpenSSF
- [GHSA-mhx4-6f72-5vf7 - npm csvflow-schema@1.0.0 (Cluster B - cdn-status.mulderitsme.net beacon, OSSF MAL-2026-18357, publisher f0x_mulder)](https://github.com/advisories/GHSA-mhx4-6f72-5vf7) - GitHub
- [ossf/malicious-packages record for csvflow-schema (MAL-2026-18357)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/csvflow-schema/MAL-2026-18357.json) - OpenSSF
- [GHSA-cmqx-q58q-9m8p - npm @webapp-shared/login-vmok (Cluster B - 6 versions, 13.140.137.222:8787/_ah/dc beacon, OSSF MAL-2026-18356, same operator as MAL-2026-18276)](https://github.com/advisories/GHSA-cmqx-q58q-9m8p) - GitHub
- [ossf/malicious-packages record for @webapp-shared/login-vmok (MAL-2026-18356)](https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@webapp-shared/login-vmok/MAL-2026-18356.json) - OpenSSF
- [GHSA-9939-65w7-25v2 - npm black-spindle@999.0.0 (Cluster C - OSSF Package Analysis flagged malicious domain + command execution, MAL-2026-18359)](https://github.com/advisories/GHSA-9939-65w7-25v2) - GitHub
- [GHSA-p6gj-69gx-r376 - npm @walknpm/todo-cli@2.0.1 (Cluster D - @walknpm scope continuity with 2026-10-26 XMRig cluster)](https://github.com/advisories/GHSA-p6gj-69gx-r376) - GitHub
- [GHSA-hw9g-f63g-4c8x - npm dsh-plugin-blender-3d@0.2.1 (Cluster D - bare-slug pivot from 2026-10-26 scoped @sudobility/dsh-plugin-blender-3d)](https://github.com/advisories/GHSA-hw9g-f63g-4c8x) - GitHub
- [GHSA-r4m9-8735-g966 - npm dsh-redteam-mode@0.15.2 (Cluster D - 2026-10-29 first live-today listing, dsh- prefix continuity)](https://github.com/advisories/GHSA-r4m9-8735-g966) - GitHub
- [GHSA-pf82-f9wr-54vx - npm camelotlabs-core (Cluster E - Camelot DEX/Arbitrum DeFi brand typosquat mesh)](https://github.com/advisories/GHSA-pf82-f9wr-54vx) - GitHub
- [GHSA-wx8x-c4rg-8rg7 - npm camelotlabs-sdk (Cluster E)](https://github.com/advisories/GHSA-wx8x-c4rg-8rg7) - GitHub
- [GHSA-4mgg-vrvh-32xg - npm camelotlabs-worker (Cluster E)](https://github.com/advisories/GHSA-4mgg-vrvh-32xg) - GitHub
- [GHSA-7972-958m-rqjg - npm camelotlabs-config (Cluster E)](https://github.com/advisories/GHSA-7972-958m-rqjg) - GitHub
- [GHSA-2j2p-88v8-7xrm - npm camelotlabs-utils (Cluster E)](https://github.com/advisories/GHSA-2j2p-88v8-7xrm) - GitHub
- [GHSA-x788-rmcm-4x49 - npm itsa-utils@1.4.2 (Cluster F)](https://github.com/advisories/GHSA-x788-rmcm-4x49) - GitHub
- [GHSA-46r9-rx5f-hqqf - npm itsa-react-checkbox@16.0.5 (Cluster F)](https://github.com/advisories/GHSA-46r9-rx5f-hqqf) - GitHub
- [GHSA-ffq4-h5jm-8pqr - npm @zaip-ai/cli@6.4.0-7.4.0 (Cluster G - 7-contiguous-version maintainer-compromise shape, AI-coding-agent scope)](https://github.com/advisories/GHSA-ffq4-h5jm-8pqr) - GitHub
- [GHSA-fw7x-6chc-4244 - npm b20miner@0.3.1 (Cluster H - self-identifies as cryptominer in slug)](https://github.com/advisories/GHSA-fw7x-6chc-4244) - GitHub
- [GHSA-23j5-jj88-v9f3 - npm transaction-info-generate-sdk (Cluster H - blockchain/crypto SDK lure)](https://github.com/advisories/GHSA-23j5-jj88-v9f3) - GitHub
- [GHSA-357r-x5jp-3p8f - npm mock-transactions-sdk (Cluster H - paired with transaction-info-generate-sdk)](https://github.com/advisories/GHSA-357r-x5jp-3p8f) - GitHub
- [GHSA-39q9-338w-8vhv - npm my-empty-package@1.0.0 (Cluster H - test-slug boilerplate)](https://github.com/advisories/GHSA-39q9-338w-8vhv) - GitHub
- [GHSA-65cr-mcfq-59hh - npm @atlisp/mcp@1.12.14 (Cluster H - MCP-themed slug targeting AI Model-Context-Protocol audience)](https://github.com/advisories/GHSA-65cr-mcfq-59hh) - GitHub
- [DependencyWatch: multi-2026-10-28-ghsa-malware-sweep (prior day - kam193 PyPI trio + camera.ui NVR compromise)](https://dependencywatch.io/incident/multi-2026-10-28-ghsa-malware-sweep)
- [DependencyWatch: multi-2026-10-27-ghsa-malware-sweep (netweavex NetworkX typosquat, @sudobility XMRig wave 2)](https://dependencywatch.io/incident/multi-2026-10-27-ghsa-malware-sweep)

---

Canonical page: https://dependencywatch.io/incident/npm-2026-10-29-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-10-29-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).