DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory PyPI malware sweep, 18 October 2026

HighAdvisory sweepPyPI

GHSA 2026-10-17/18 PyPI-only batch (10 advisories, 0 npm). leakdeep ships a 5-version Windows browser-credential and Discord-token stealer with XOR-obfuscated webhook C2. ukraine69 ships an 8-version destructive payload that hijacks saved Telegram vault credentials and calls account.deleteAccount on the victim. Eight TTS/ASR lures continue the 2026-10-voxeval cryptominer campaign under a new 2026-10-emberlytts slug.

Published 18 Oct 2026

Check your requirements.txtSource advisory
At a glancepypi-2026-10-18-ghsa-malware-sweep
10
Packages tracked21 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
18 Oct 2026
Ecosystems
PyPI
Detected by
GitHub Advisory Database, OpenSSF malicious-packages, kam193/bad-packages, Amazon Inspector, PyPI security
Also known as
2026-10-18 GHSA PyPI sweep, leakdeep PyPI Windows credential + Discord stealer, 2026-10-ukraine69 destructive Telegram campaign

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

Between 2026-10-17 06:00 UTC (yesterdays sweep cutoff) and 2026-10-18 06:00 UTC (todays ingest-window start), the GitHub Advisory Database and OpenSSF malicious-packages published 10 fresh PyPI malware advisories not already in yesterday`s sweep. No new npm, RubyGems, Go, Packagist, NuGet, Crates, or GitHub Actions malware advisories were published in this window - the first PyPI-only 24h sweep since the daily cadence began.

Headlines

leakdeep multi-version Windows infostealer (Cluster A): a self-described OSINT and credential-leak intelligence tool, 5 live versions on PyPI (2.5.0, 2.5.2, 2.6.0, 2.6.4, 2.6.6), ships a Windows background harvester that decrypts Chrome / Edge / Brave browser-saved credentials, cookies, autofill data, Discord authentication and MFA tokens from leveldb, grabs a desktop screenshot, correlates installer host public IP via ipify, and uploads the archive to an XOR-obfuscated webhook URL in leakdeep/config.py. Confirmed by Amazon Inspector.

ukraine69 multi-version destructive Telegram account deletion payload (Cluster B): 8 live versions on PyPI (1.2.0 through 1.2.8 excluding 1.2.4), presents a benign Ukrainian-locale API, imports to spawn detached Python agents that walk ~/.hotaru/** + ~/.local/share/hotaru/** + ~/**/*.vault for Telegram vault files, decrypts them with embedded helpers, connects to Telegram data-centre IPs, and calls account.deleteAccount under the harvested MTProto credentials. A _gc_script waits 45 seconds and removes the package itself to cover tracks. The package self-describes as a "Hotaru sandbox-escape payload". Cross-confirmed by kam193 and Amazon Inspector.

2026-10-emberlytts campaign (Cluster C): 8 fresh single-version lure packages (driftwavets, emberlytts, glassbeakasr, novalithtts, pyrechoasr, quasitonnts, tonemaptts, voltswannts), all 0.1.0, all with "audio-analysis profiles" placeholder marketing and a single remote-script-download-and-execute function body with the URL deliberately not embedded. OSSF explicitly links the wave to the earlier 2026-10-voxeval Monero cryptominer campaign (12 slugs catalogued across our 2026-10-03 and 2026-10-04 sweeps) based on identical wording and the same kam193 reporter.

Classification

sweep. Severity high taken as a whole, driven by Cluster A (confirmed multi-vector browser-credential and Discord-token stealer, five live versions) and Cluster B (confirmed destructive Telegram account-deletion payload, eight live versions). Cluster C is medium on its own (confirmed remote-script primitive but URL not embedded means specific payload is unverified at analysis time) and does not raise sweep severity above high. No cluster today would independently merit critical - all three are first-publish lures without hijack of an existing legitimate upstream and without confirmed worm propagation beyond their single lure names.

Discovery

GitHub Advisory Database, OpenSSF malicious-packages, kam193/bad-packages (Clusters B and C, cross-confirmed as reporter), Amazon Inspector (Clusters A and B, source hashes).

infostealercredential-theftobfuscation
Affected packages

10 packages 21 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check requirements.txt →
Impact

What it does if you installed it

  • Cluster A - PyPI leakdeep multi-version Windows browser-credential and Discord-token infostealer (malicious-package, confirmed install-time + CLI-time credential-stealing payload, 5 versions published across the 2.5.x and 2.6.x branches, Amazon Inspector finder): leakdeep@2.5.0, leakdeep@2.5.2, leakdeep@2.6.0, leakdeep@2.6.4, leakdeep@2.6.6 (GHSA-4pw5-gqh4-v2pj, MAL-2026-17921). The package self-describes as an OSINT and credential-leak intelligence tool and ships a stub SearchEngine.search that always returns an empty list. Every CLI invocation calls SystemInfo.initialize_background_process, which spawns a background Windows-only harvester: iterates Chrome, Edge, and Brave profile stores, decrypts saved passwords, cookies, and autofill data, writes plaintext to a temp directory, then zips and uploads the archive to an attacker-controlled webhook URL. The webhook URL is stored XOR-encoded (key 0x5A) in leakdeep/config.py and reassembled at runtime by get_webhook(). The harvester also walks %APPDATA%\discord*\Local Storage\leveldb for Discord authentication and MFA tokens, grabs a desktop screenshot, and fetches the installer host public IP via ipify. Evidence file hashes: leakdeep/core/system.py sha256 0634ec699de39d30fdd902c9b64c4c1587b2ec6d063e071093d7ae206af10dc8, leakdeep/config.py sha256 fe0752ff79816a2f2150da9ba2458e761e49019cfa4c421b63e161e57cb8fee6, leakdeep/cli.py sha256 abae927c786a194318cc4203a118a24b9c1107ddff22d52b61de2413d19e9054. Per-version wheel/sdist integrity in MAL-2026-17921. Severity high for this cluster (confirmed multi-vector credential-stealing primitive, five live versions, but reach limited to Windows installers who run the CLI; no evidence of self-propagation or hijack of an existing legitimate upstream)
  • Cluster B - PyPI ukraine69 multi-version destructive Telegram account deletion payload (malicious-package, confirmed destructive-actions + covering-tracks OSSF reasons, 8 versions published across the 1.2.x branch, kam193 reporter + Amazon Inspector cross-confirmation): ukraine69@1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.5, 1.2.6, 1.2.7, 1.2.8 (GHSA-j83x-9pxh-rrgp, MAL-2026-17919, campaign 2026-10-ukraine69). The package presents a benign Ukrainian-locale API (transliterate, flag, month_name, format_date). On import, ukraine69/__init__.py (sha256 6b36b90468c442a02d0cc6aaf3b401a96d54d34d85f6aac49b2bcb074aea44e6) spawns detached Python agents via sys.executable -I -c + start_new_session=True that search the installer filesystem for Telegram *.vault files at ~/.hotaru/**, ~/.local/share/hotaru/**, ~/**/*.vault, decrypt them, and extract MTProto credentials. The agents then connect to Telegram data-centre IPs (149.154.175.53, 149.154.167.51, 149.154.175.100, 149.154.167.91, 91.108.56.130) and call account.deleteAccount against the victims Telegram account under those credentials. A follow-up _gc_script waits 45 seconds and removes the packages own site-packages and cache files to cover tracks. The package self-describes as a "Hotaru sandbox-escape payload" that "executes at import time". Severity high for this cluster (confirmed destructive payload against a real target product (Telegram accounts), eight live versions, Hotaru is the vault-storage client the campaign specifically targets so reach extends to anyone running the Hotaru client with saved credentials and happens to install the package; no evidence of worm propagation beyond the single lure name)
  • Cluster C - PyPI 8-package audio TTS/ASR lure wave extending the 2026-10-voxeval cryptominer campaign under a new 2026-10-emberlytts slug (malicious-package, confirmed Downloads and executes a remote malicious script OSSF reason, remote-script URL deliberately not embedded in the package so the payload cannot be IOC-matched at analysis time, kam193 reporter): driftwavets@0.1.0 (GHSA-fm3q-3w2v-hcmf, MAL-2026-17912), emberlytts@0.1.0 (GHSA-h24x-x3hv-v34p, MAL-2026-17913), glassbeakasr@0.1.0 (GHSA-8g3x-4h23-v3xp, MAL-2026-17914), novalithtts@0.1.0 (GHSA-xf3f-g2fj-wr92, MAL-2026-17915), pyrechoasr@0.1.0 (GHSA-xvjf-fj8r-fjcf, MAL-2026-17916), quasitonnts@0.1.0 (GHSA-ghmx-wq8v-9683, MAL-2026-17917), tonemaptts@0.1.0 (GHSA-22rf-pvvq-mghv, MAL-2026-17918), voltswannts@0.1.0 (GHSA-r8cm-478x-h626, MAL-2026-17920). All 8 published to PyPI between 2026-10-16 and 2026-10-17 with placeholder "audio-analysis profiles" loader marketing and a single-function body that downloads and executes a remote script whose URL is reassembled at import time (not embedded in the sdist). OSSF explicitly notes the campaign is likely linked to the earlier 2026-10-voxeval cryptominer wave (voxeval + 11 siblings voxcpmruntime/voxcpmui4/voxcpmkit/voxcpmintel/voxcpmeval/voxcpmui3/voxcpmtts3/voxel-tts/caoxiltts/infrabench, catalogued across our 2026-10-03 + 2026-10-04 sweeps), based on identical wording in the package marketing and the same reporter (kam193). This wave uses an -asr / -tts / -ts naming suffix that targets audio speech-recognition and text-to-speech tooling. Severity medium for this cluster (confirmed install-time remote-script execution primitive but no embedded URL means the specific payload is unverified at analysis time; the earlier 2026-10-voxeval wave had a confirmed Monero cryptominer so the operator`s baseline deliverable is cryptomining with upgrade path to anything the remote server returns; 8-package single-version first-publish lures means reach is limited to developers tricked into installing a specific slug)
  • Operator continuity: this sweep continues the week-running 2026-10-voxeval cryptominer campaign (12 slugs catalogued 2026-10-02 through 2026-10-03 under the voxeval family) into a 2026-10-16/17 wave of 8 new slugs under the fresh 2026-10-emberlytts campaign slug (Cluster C). Same reporter (kam193), same remote-script-not-embedded delivery pattern, same single-version 0.1.0 first-publish shape, same AI-adjacent brand-impersonation naming (speech recognition and text-to-speech instead of speech-synthesis-eval). kam193 remains top PyPI reporter - all 10 PyPI advisories in todays batch came through kam193 or were cross-confirmed by Amazon Inspector. **No new npm, RubyGems, Go, Packagist, NuGet, Crates, or GitHub Actions advisories** were published in the GHSA feed between 2026-10-17 06:00 UTC and 2026-10-18 06:00 UTC - the first PyPI-only 24h window since the daily sweep began. **No new activity** from: conx3993 operator (yesterdays wave 2 quiet - realwbx.com C2 unchanged), @flexmr dep-confusion operator (yesterdays wave 2 quiet - artifacts.creditslib.com C2 unchanged), @beloved-lenora/opencode- AI-coding-tool lure (yesterdays 7-package wave quiet), Baileys-lure operator (yesterdays @xatancchii/natabaileys wave 5 quiet), agentaix (py-worm/py-wormgpt/py-sock2 quiet), Wix dep-confusion wave 3, seapy-ops, getpubip, proxyrubika, tailwindcss-form/-uniform` typosquat operator. TensorLake AI maintainer compromise (2026-10-08 carve-out) remains confirmed-recovered; no wave-2 malicious republish. No new disclosed attacker-controlled hosts today* (the leakdeep webhook is XOR-obfuscated and not extractable from the OSSF record; the ukraine69 C2 is Telegram`s own data-centre IPs which cannot be denylisted; the Cluster C remote-script URL is deliberately not embedded)
What to do

Clean-up steps

  1. For Cluster A (leakdeep PyPI Windows browser + Discord stealer, 5 versions): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda env for leakdeep at any of versions 2.5.0, 2.5.2, 2.6.0, 2.6.4, 2.6.6. On ANY hit on a Windows installer host: assume Chrome / Edge / Brave saved passwords, cookies, and autofill data have been decrypted and uploaded to the attackers webhook; assume Discord authentication tokens and MFA tokens from %APPDATA%\discord*\Local Storage\leveldb have been uploaded; assume a desktop screenshot and system fingerprint were captured; assume the host public IP has been correlated via ipify. Rotate ALL browser-saved credentials on the host (every website login), revoke all Discord authentication tokens (log out of all sessions in Discords security settings), rotate any secret that was in the installer process environment, and image the host for forensic review before clean-rebuild. The webhook URL is XOR-encoded with key 0x5A in leakdeep/config.py - decode locally to recover the specific exfiltration host for your IOC feed. Add egress blocks: ipify.org on untrusted CI / build hosts (already in standing denylist - keep it). Report the specific webhook URL to the hosting provider abuse channel. Keep a watch on PyPI for a wave 2 under similar OSINT / credential-intelligence lure names (leakdeep is a credible OSINT tool slug - expect sibling publications under leakcheck, leaklookup, credintel or similar)
  2. For Cluster B (ukraine69 PyPI destructive Telegram account deletion, 8 versions): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, uv.lock for ukraine69 at any of versions 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.5, 1.2.6, 1.2.7, 1.2.8. On ANY hit on a host where the Hotaru Telegram client was installed with saved credentials: assume the Hotaru vault at ~/.hotaru/**, ~/.local/share/hotaru/**, or ~/**/*.vault has been decrypted and MTProto credentials extracted, assume the installer hosts Telegram account has been issued an account.deleteAccount RPC against one of the Telegram data-centre IPs (149.154.175.53, 149.154.167.51, 149.154.175.100, 149.154.167.91, 91.108.56.130) and the account is destroyed. The account-deletion is final once Telegram processes the RPC - any installer who left Hotaru running during the exposure window should verify the Telegram account status (log into app on a different device; if the account is unreachable or shows "Account deleted" it has been destroyed). Preserve any post-45-second host state for forensics before _gc_script finishes removing its own traces: ~/.cache/hotaru/module-deps/<id>/, ~/.cache/pip/wheels, ~/.cache/pip/http-v2, ~/.cache/uv, /tmp/hotaru, /tmp/probe-. Watch environment variables HOTARU_ACCOUNT_ROOT and HOTARU_ACCOUNT_SESSION for lingering references. Rotate every Telegram session on any host where the package ran. If your org runs the Hotaru Telegram client across a dev fleet, scope-pin PyPI installs through an internal mirror that blocks ukraine69` until the campaign cools
  3. For Cluster C (8-package audio TTS/ASR lure wave, 2026-10-emberlytts extension of 2026-10-voxeval cryptominer campaign): grep every requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, conda env for driftwavets, emberlytts, glassbeakasr, novalithtts, pyrechoasr, quasitonnts, tonemaptts, voltswannts (all 0.1.0). On hit: the packages single function body has downloaded and executed a remote script from a URL reassembled at import time. The baseline deliverable in the parent 2026-10-voxeval campaign was a Monero cryptominer, so audit host CPU / GPU utilisation and process trees for mining-pool connections (Monero / XMR / CryptoNight pool domains and ports); image the host if you cannot rule out running processes. Treat the installer host as credential-compromised until a vendor publishes an IOC-level analysis of the specific remote-script content. The campaign naming shape (ts, tts, asr) targets AI speech-recognition and text-to-speech tooling - teach contributors (and any coding-agent that reads this record) that the real speech-tooling packages are published under upstream-known names (openai-whisper, elevenlabs, coqui-tts, piper-tts, vosk, whisper-jax, faster-whisper) and any newly-created -tts / -asr / ts` slug under a maintainer with no prior release history is suspect by default. Watch for a wave 3 under additional AI-speech-brand-impersonation names
  4. NEW outbound denylist entries today: NONE directly disclosable from todays advisories - the leakdeep webhook is XOR-obfuscated and must be decoded from leakdeep/config.py locally per deployment, the ukraine69 C2 is Telegrams own authenticated data-centre IPs which cannot be egress-denied without breaking legitimate Telegram clients, and the Cluster C audio TTS/ASR remote-script URL is deliberately not embedded in the sdist. Keep prior egress blocks in place: realwbx.com apex + /ip.php + /ip paths (2026-10-15 and 2026-10-17), artifacts.creditslib.com apex + /npm/* paths (2026-10-17), login.fromthehotel.com apex + /muse + /api/poems/code + /api/art/downloads/* paths (2026-10-17), googleforum.pythonanywhere.com exact subdomain (2026-10-11), space-z.ai apex + preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai + b196q82k8891-d.space-z.ai subdomains (2026-10-14), dxpoc.gt.tc apex (2026-10-09), raw.githubusercontent.com/anonrider404/pypl/* path (2026-10-16), api-bsx.pages.dev apex + /download path (2026-10-16), 177.7.60.239:48080 + oob.recon.dev (2026-10-16), uncoder.eu.org apex + /cc-checker/api.php path (2026-10-15), accenture-npm.azurewebsites.net, limbomail.com apex + github.com/lunexindonesia/node-net-pool + github.com/trktgq0wbre1/node-net-pool, github.com/unicodeces/font-atlas, collector.oob.s4yhii.com + *.oob.s4yhii.com + s4yhii.com apex, 64.181.165.115/dc, 167.88.172.33:8087 + jsonspack.com, goxtools.shop apex, minhdong.site apex + GitHub user VangBanLaNhat, 45.138.12.177:8089, 185.158.107.175:8787, ltidi.storage.googleapis.com/depenconf/, oob.s4yhii.com:9999/native, *.oast.pro/*.oast.me/*.oast.fun/*.oast.site/*.oastify.com, frjmzbjbhwvtdnsuodmu.supabase.co, api.npoint.io apex, tele.metry.orgin.net, morroncr0w.io, api.telegram.org on untrusted CI/build hosts (does not apply to Cluster B because the operator uses raw Telegram data-centre IPs, not the HTTP bot API), appsecc.com, webhook.site/*, nfjbill.ren, storage.googleapis.com/depenconf/, 10.0.19.0/24 + 10.0.49.0/24, api.nm-streetwear.space, Discord webhook URL pattern, ipify.org + ifconfig.me (relevant to Cluster A), gitflic.ru, api.wagmiwallet.org, backend-cybersecuritydashboard.onrender.com, Monero mining pools (relevant to Cluster C upgrade path from the parent 2026-10-voxeval campaign), Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, chinazhangsan.ccwu.cc, fabric-npm.gm-service.xyz, jsonkeeper.com, npm-canary.aveliscare.com, meta.brs.cx, s3://pkusinski-external/, AWS account 631484165566, Slack bot-token exfil patterns, s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, tuamaeaquelaursa.com, 45.138.0.0/16 RubyGems wgkit CIDRs
References

Sources

pypi-2026-10-18-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your requirements.txtAll incidents