# GitHub Advisory PyPI malware sweep, 18 October 2026

> GHSA 2026-10-17/18 PyPI-only batch (10 advisories, 0 npm). `leakdeep` ships a 5-version Windows browser-credential and Discord-token stealer with XOR-obfuscated webhook C2. `ukraine69` ships an 8-version destructive payload that hijacks saved Telegram vault credentials and calls `account.deleteAccount` on the victim. Eight TTS/ASR lures continue the `2026-10-voxeval` cryptominer campaign under a new `2026-10-emberlytts` slug.

- Published: 2026-10-18
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: PyPI
- Scope: 10 packages, 21 compromised versions
- Tags: infostealer, credential-theft, obfuscation
- Also known as: 2026-10-18 GHSA PyPI sweep, leakdeep PyPI Windows credential + Discord stealer, 2026-10-ukraine69 destructive Telegram campaign, 2026-10-emberlytts campaign (extension of 2026-10-voxeval cryptominer)
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, kam193/bad-packages, Amazon Inspector, PyPI security
- Incident ID: pypi-2026-10-18-ghsa-malware-sweep

## Affected packages (10)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [driftwavets](https://dependencywatch.io/package/pypi/driftwavets) | PyPI | 0.1.0 |
| [emberlytts](https://dependencywatch.io/package/pypi/emberlytts) | PyPI | 0.1.0 |
| [glassbeakasr](https://dependencywatch.io/package/pypi/glassbeakasr) | PyPI | 0.1.0 |
| [leakdeep](https://dependencywatch.io/package/pypi/leakdeep) | PyPI | 2.5.0, 2.5.2, 2.6.0, 2.6.4, 2.6.6 |
| [novalithtts](https://dependencywatch.io/package/pypi/novalithtts) | PyPI | 0.1.0 |
| [pyrechoasr](https://dependencywatch.io/package/pypi/pyrechoasr) | PyPI | 0.1.0 |
| [quasitonnts](https://dependencywatch.io/package/pypi/quasitonnts) | PyPI | 0.1.0 |
| [tonemaptts](https://dependencywatch.io/package/pypi/tonemaptts) | PyPI | 0.1.0 |
| [ukraine69](https://dependencywatch.io/package/pypi/ukraine69) | PyPI | 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.5, 1.2.6, 1.2.7, 1.2.8 |
| [voltswannts](https://dependencywatch.io/package/pypi/voltswannts) | PyPI | 0.1.0 |

## What happened

Between 2026-10-17 06:00 UTC (yesterday`s sweep cutoff) and 2026-10-18 06:00 UTC (today`s ingest-window start), the GitHub Advisory Database and OpenSSF `malicious-packages` published 10 fresh PyPI malware advisories not already in yesterday`s sweep. **No new npm, RubyGems, Go, Packagist, NuGet, Crates, or GitHub Actions malware advisories** were published in this window - the first PyPI-only 24h sweep since the daily cadence began.

## Headlines

**`leakdeep` multi-version Windows infostealer** (Cluster A): a self-described OSINT and credential-leak intelligence tool, 5 live versions on PyPI (`2.5.0`, `2.5.2`, `2.6.0`, `2.6.4`, `2.6.6`), ships a Windows background harvester that decrypts Chrome / Edge / Brave browser-saved credentials, cookies, autofill data, Discord authentication and MFA tokens from leveldb, grabs a desktop screenshot, correlates installer host public IP via `ipify`, and uploads the archive to an XOR-obfuscated webhook URL in `leakdeep/config.py`. Confirmed by Amazon Inspector.

**`ukraine69` multi-version destructive Telegram account deletion payload** (Cluster B): 8 live versions on PyPI (`1.2.0` through `1.2.8` excluding `1.2.4`), presents a benign Ukrainian-locale API, imports to spawn detached Python agents that walk `~/.hotaru/**` + `~/.local/share/hotaru/**` + `~/**/*.vault` for Telegram vault files, decrypts them with embedded helpers, connects to Telegram data-centre IPs, and calls `account.deleteAccount` under the harvested MTProto credentials. A `_gc_script` waits 45 seconds and removes the package itself to cover tracks. The package self-describes as a "Hotaru sandbox-escape payload". Cross-confirmed by kam193 and Amazon Inspector.

**`2026-10-emberlytts` campaign** (Cluster C): 8 fresh single-version lure packages (`driftwavets`, `emberlytts`, `glassbeakasr`, `novalithtts`, `pyrechoasr`, `quasitonnts`, `tonemaptts`, `voltswannts`), all `0.1.0`, all with "audio-analysis profiles" placeholder marketing and a single remote-script-download-and-execute function body with the URL deliberately not embedded. OSSF explicitly links the wave to the earlier `2026-10-voxeval` Monero cryptominer campaign (12 slugs catalogued across our [2026-10-03](https://dependencywatch.io/incident/multi-2026-10-03-ghsa-malware-sweep) and [2026-10-04](https://dependencywatch.io/incident/multi-2026-10-04-ghsa-malware-sweep) sweeps) based on identical wording and the same `kam193` reporter.

## Classification

`sweep`. Severity `high` taken as a whole, driven by Cluster A (confirmed multi-vector browser-credential and Discord-token stealer, five live versions) and Cluster B (confirmed destructive Telegram account-deletion payload, eight live versions). Cluster C is `medium` on its own (confirmed remote-script primitive but URL not embedded means specific payload is unverified at analysis time) and does not raise sweep severity above `high`. No cluster today would independently merit `critical` - all three are first-publish lures without hijack of an existing legitimate upstream and without confirmed worm propagation beyond their single lure names.

## Discovery

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `kam193/bad-packages` (Clusters B and C, cross-confirmed as reporter), `Amazon Inspector` (Clusters A and B, source hashes).

## Impact

- **Cluster A - PyPI `leakdeep` multi-version Windows browser-credential and Discord-token infostealer (malicious-package, confirmed install-time + CLI-time credential-stealing payload, 5 versions published across the 2.5.x and 2.6.x branches, Amazon Inspector finder)**: `leakdeep@2.5.0`, `leakdeep@2.5.2`, `leakdeep@2.6.0`, `leakdeep@2.6.4`, `leakdeep@2.6.6` (GHSA-4pw5-gqh4-v2pj, MAL-2026-17921). The package self-describes as an OSINT and credential-leak intelligence tool and ships a stub `SearchEngine.search` that always returns an empty list. Every CLI invocation calls `SystemInfo.initialize_background_process`, which spawns a background Windows-only harvester: iterates Chrome, Edge, and Brave profile stores, decrypts saved passwords, cookies, and autofill data, writes plaintext to a temp directory, then zips and uploads the archive to an attacker-controlled webhook URL. The webhook URL is stored XOR-encoded (key `0x5A`) in `leakdeep/config.py` and reassembled at runtime by `get_webhook()`. The harvester also walks `%APPDATA%\discord*\Local Storage\leveldb` for Discord authentication and MFA tokens, grabs a desktop screenshot, and fetches the installer host public IP via `ipify`. Evidence file hashes: `leakdeep/core/system.py` sha256 `0634ec699de39d30fdd902c9b64c4c1587b2ec6d063e071093d7ae206af10dc8`, `leakdeep/config.py` sha256 `fe0752ff79816a2f2150da9ba2458e761e49019cfa4c421b63e161e57cb8fee6`, `leakdeep/cli.py` sha256 `abae927c786a194318cc4203a118a24b9c1107ddff22d52b61de2413d19e9054`. Per-version wheel/sdist integrity in MAL-2026-17921. Severity `high` for this cluster (confirmed multi-vector credential-stealing primitive, five live versions, but reach limited to Windows installers who run the CLI; no evidence of self-propagation or hijack of an existing legitimate upstream)
- **Cluster B - PyPI `ukraine69` multi-version destructive Telegram account deletion payload (malicious-package, confirmed `destructive-actions` + `covering-tracks` OSSF reasons, 8 versions published across the 1.2.x branch, kam193 reporter + Amazon Inspector cross-confirmation)**: `ukraine69@1.2.0`, `1.2.1`, `1.2.2`, `1.2.3`, `1.2.5`, `1.2.6`, `1.2.7`, `1.2.8` (GHSA-j83x-9pxh-rrgp, MAL-2026-17919, campaign `2026-10-ukraine69`). The package presents a benign Ukrainian-locale API (`transliterate`, `flag`, `month_name`, `format_date`). On import, `ukraine69/__init__.py` (sha256 `6b36b90468c442a02d0cc6aaf3b401a96d54d34d85f6aac49b2bcb074aea44e6`) spawns detached Python agents via `sys.executable -I -c` + `start_new_session=True` that search the installer filesystem for Telegram `*.vault` files at `~/.hotaru/**`, `~/.local/share/hotaru/**`, `~/**/*.vault`, decrypt them, and extract MTProto credentials. The agents then connect to Telegram data-centre IPs (`149.154.175.53`, `149.154.167.51`, `149.154.175.100`, `149.154.167.91`, `91.108.56.130`) and call `account.deleteAccount` against the victim`s Telegram account under those credentials. A follow-up `_gc_script` waits 45 seconds and removes the package`s own site-packages and cache files to cover tracks. The package self-describes as a "Hotaru sandbox-escape payload" that "executes at import time". Severity `high` for this cluster (confirmed destructive payload against a real target product (Telegram accounts), eight live versions, Hotaru is the vault-storage client the campaign specifically targets so reach extends to anyone running the Hotaru client with saved credentials and happens to install the package; no evidence of worm propagation beyond the single lure name)
- **Cluster C - PyPI 8-package audio TTS/ASR lure wave extending the `2026-10-voxeval` cryptominer campaign under a new `2026-10-emberlytts` slug (malicious-package, confirmed `Downloads and executes a remote malicious script` OSSF reason, remote-script URL deliberately not embedded in the package so the payload cannot be IOC-matched at analysis time, kam193 reporter)**: `driftwavets@0.1.0` (GHSA-fm3q-3w2v-hcmf, MAL-2026-17912), `emberlytts@0.1.0` (GHSA-h24x-x3hv-v34p, MAL-2026-17913), `glassbeakasr@0.1.0` (GHSA-8g3x-4h23-v3xp, MAL-2026-17914), `novalithtts@0.1.0` (GHSA-xf3f-g2fj-wr92, MAL-2026-17915), `pyrechoasr@0.1.0` (GHSA-xvjf-fj8r-fjcf, MAL-2026-17916), `quasitonnts@0.1.0` (GHSA-ghmx-wq8v-9683, MAL-2026-17917), `tonemaptts@0.1.0` (GHSA-22rf-pvvq-mghv, MAL-2026-17918), `voltswannts@0.1.0` (GHSA-r8cm-478x-h626, MAL-2026-17920). All 8 published to PyPI between 2026-10-16 and 2026-10-17 with placeholder "audio-analysis profiles" loader marketing and a single-function body that downloads and executes a remote script whose URL is reassembled at import time (not embedded in the sdist). OSSF explicitly notes the campaign is likely linked to the earlier `2026-10-voxeval` cryptominer wave (`voxeval` + 11 siblings `voxcpmruntime/voxcpmui4/voxcpmkit/voxcpmintel/voxcpmeval/voxcpmui3/voxcpmtts3/voxel-tts/caoxiltts/infrabench`, catalogued across our [2026-10-03](https://dependencywatch.io/incident/multi-2026-10-03-ghsa-malware-sweep) + [2026-10-04](https://dependencywatch.io/incident/multi-2026-10-04-ghsa-malware-sweep) sweeps), based on identical wording in the package marketing and the same reporter (`kam193`). This wave uses an `-asr` / `-tts` / `-ts` naming suffix that targets audio speech-recognition and text-to-speech tooling. Severity `medium` for this cluster (confirmed install-time remote-script execution primitive but no embedded URL means the specific payload is unverified at analysis time; the earlier `2026-10-voxeval` wave had a confirmed Monero cryptominer so the operator`s baseline deliverable is cryptomining with upgrade path to anything the remote server returns; 8-package single-version first-publish lures means reach is limited to developers tricked into installing a specific slug)
- **Operator continuity**: this sweep continues the week-running **`2026-10-voxeval` cryptominer campaign** (12 slugs catalogued 2026-10-02 through 2026-10-03 under the `voxeval` family) into a 2026-10-16/17 wave of 8 new slugs under the fresh `2026-10-emberlytts` campaign slug (Cluster C). Same reporter (`kam193`), same remote-script-not-embedded delivery pattern, same single-version 0.1.0 first-publish shape, same AI-adjacent brand-impersonation naming (speech recognition and text-to-speech instead of speech-synthesis-eval). **`kam193` remains top PyPI reporter** - all 10 PyPI advisories in today`s batch came through kam193 or were cross-confirmed by Amazon Inspector. **No new npm, RubyGems, Go, Packagist, NuGet, Crates, or GitHub Actions advisories** were published in the GHSA feed between 2026-10-17 06:00 UTC and 2026-10-18 06:00 UTC - the first PyPI-only 24h window since the daily sweep began. **No new activity** from: `conx3993` operator (yesterday`s wave 2 quiet - `realwbx.com` C2 unchanged), `@flexmr` dep-confusion operator (yesterday`s wave 2 quiet - `artifacts.creditslib.com` C2 unchanged), `@beloved-lenora/opencode-*` AI-coding-tool lure (yesterday`s 7-package wave quiet), Baileys-lure operator (yesterday`s `@xatancchii/natabaileys` wave 5 quiet), `agentaix` (`py-worm`/`py-wormgpt`/`py-sock2` quiet), Wix dep-confusion wave 3, `seapy-ops`, `getpubip`, `proxyrubika`, `tailwindcss-form`/`-uniform` typosquat operator. **TensorLake AI maintainer compromise** (2026-10-08 carve-out) remains confirmed-recovered; no wave-2 malicious republish. **No new disclosed attacker-controlled hosts today** (the `leakdeep` webhook is XOR-obfuscated and not extractable from the OSSF record; the `ukraine69` C2 is Telegram`s own data-centre IPs which cannot be denylisted; the Cluster C remote-script URL is deliberately not embedded)

## What to do

1. **For Cluster A (`leakdeep` PyPI Windows browser + Discord stealer, 5 versions)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, `conda env` for `leakdeep` at any of versions `2.5.0`, `2.5.2`, `2.6.0`, `2.6.4`, `2.6.6`. On ANY hit on a Windows installer host: assume Chrome / Edge / Brave saved passwords, cookies, and autofill data have been decrypted and uploaded to the attacker`s webhook; assume Discord authentication tokens and MFA tokens from `%APPDATA%\discord*\Local Storage\leveldb` have been uploaded; assume a desktop screenshot and system fingerprint were captured; assume the host public IP has been correlated via `ipify`. Rotate ALL browser-saved credentials on the host (every website login), revoke all Discord authentication tokens (log out of all sessions in Discord`s security settings), rotate any secret that was in the installer process environment, and image the host for forensic review before clean-rebuild. The webhook URL is XOR-encoded with key `0x5A` in `leakdeep/config.py` - decode locally to recover the specific exfiltration host for your IOC feed. Add egress blocks: `ipify.org` on untrusted CI / build hosts (already in standing denylist - keep it). Report the specific webhook URL to the hosting provider abuse channel. Keep a watch on PyPI for a wave 2 under similar OSINT / credential-intelligence lure names (`leakdeep` is a credible OSINT tool slug - expect sibling publications under `leakcheck`, `leaklookup`, `credintel` or similar)
2. **For Cluster B (`ukraine69` PyPI destructive Telegram account deletion, 8 versions)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`, `uv.lock` for `ukraine69` at any of versions `1.2.0`, `1.2.1`, `1.2.2`, `1.2.3`, `1.2.5`, `1.2.6`, `1.2.7`, `1.2.8`. On ANY hit on a host where the Hotaru Telegram client was installed with saved credentials: assume the Hotaru vault at `~/.hotaru/**`, `~/.local/share/hotaru/**`, or `~/**/*.vault` has been decrypted and MTProto credentials extracted, assume the installer host`s Telegram account has been issued an `account.deleteAccount` RPC against one of the Telegram data-centre IPs (`149.154.175.53`, `149.154.167.51`, `149.154.175.100`, `149.154.167.91`, `91.108.56.130`) and the account is destroyed. The account-deletion is final once Telegram processes the RPC - any installer who left Hotaru running during the exposure window should verify the Telegram account status (log into app on a different device; if the account is unreachable or shows "Account deleted" it has been destroyed). Preserve any post-45-second host state for forensics before `_gc_script` finishes removing its own traces: `~/.cache/hotaru/module-deps/<id>/`, `~/.cache/pip/wheels`, `~/.cache/pip/http-v2`, `~/.cache/uv`, `/tmp/hotaru*`, `/tmp/probe-*`. Watch environment variables `HOTARU_ACCOUNT_ROOT` and `HOTARU_ACCOUNT_SESSION` for lingering references. Rotate every Telegram session on any host where the package ran. If your org runs the Hotaru Telegram client across a dev fleet, scope-pin PyPI installs through an internal mirror that blocks `ukraine69` until the campaign cools
3. **For Cluster C (8-package audio TTS/ASR lure wave, `2026-10-emberlytts` extension of `2026-10-voxeval` cryptominer campaign)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `pdm.lock`, `conda env` for `driftwavets`, `emberlytts`, `glassbeakasr`, `novalithtts`, `pyrechoasr`, `quasitonnts`, `tonemaptts`, `voltswannts` (all `0.1.0`). On hit: the package`s single function body has downloaded and executed a remote script from a URL reassembled at import time. The baseline deliverable in the parent `2026-10-voxeval` campaign was a Monero cryptominer, so audit host CPU / GPU utilisation and process trees for mining-pool connections (Monero / XMR / CryptoNight pool domains and ports); image the host if you cannot rule out running processes. Treat the installer host as credential-compromised until a vendor publishes an IOC-level analysis of the specific remote-script content. The campaign naming shape (`*ts`, `*tts`, `*asr`) targets AI speech-recognition and text-to-speech tooling - teach contributors (and any coding-agent that reads this record) that the real speech-tooling packages are published under upstream-known names (`openai-whisper`, `elevenlabs`, `coqui-tts`, `piper-tts`, `vosk`, `whisper-jax`, `faster-whisper`) and any newly-created `*-tts` / `*-asr` / `*ts` slug under a maintainer with no prior release history is suspect by default. Watch for a wave 3 under additional AI-speech-brand-impersonation names
4. **NEW outbound denylist entries today**: NONE directly disclosable from today`s advisories - the `leakdeep` webhook is XOR-obfuscated and must be decoded from `leakdeep/config.py` locally per deployment, the `ukraine69` C2 is Telegram`s own authenticated data-centre IPs which cannot be egress-denied without breaking legitimate Telegram clients, and the Cluster C audio TTS/ASR remote-script URL is deliberately not embedded in the sdist. Keep prior egress blocks in place: `realwbx.com` apex + `/ip.php` + `/ip` paths (2026-10-15 and 2026-10-17), `artifacts.creditslib.com` apex + `/npm/*` paths (2026-10-17), `login.fromthehotel.com` apex + `/muse` + `/api/poems/code` + `/api/art/downloads/*` paths (2026-10-17), `googleforum.pythonanywhere.com` exact subdomain (2026-10-11), `space-z.ai` apex + `preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai` + `b196q82k8891-d.space-z.ai` subdomains (2026-10-14), `dxpoc.gt.tc` apex (2026-10-09), `raw.githubusercontent.com/anonrider404/pypl/*` path (2026-10-16), `api-bsx.pages.dev` apex + `/download` path (2026-10-16), `177.7.60.239:48080` + `oob.recon.dev` (2026-10-16), `uncoder.eu.org` apex + `/cc-checker/api.php` path (2026-10-15), `accenture-npm.azurewebsites.net`, `limbomail.com` apex + `github.com/lunexindonesia/node-net-pool` + `github.com/trktgq0wbre1/node-net-pool`, `github.com/unicodeces/font-atlas`, `collector.oob.s4yhii.com` + `*.oob.s4yhii.com` + `s4yhii.com` apex, `64.181.165.115/dc`, `167.88.172.33:8087` + `jsonspack.com`, `goxtools.shop` apex, `minhdong.site` apex + GitHub user `VangBanLaNhat`, `45.138.12.177:8089`, `185.158.107.175:8787`, `ltidi.storage.googleapis.com/depenconf/`, `oob.s4yhii.com:9999/native`, `*.oast.pro`/`*.oast.me`/`*.oast.fun`/`*.oast.site`/`*.oastify.com`, `frjmzbjbhwvtdnsuodmu.supabase.co`, `api.npoint.io` apex, `tele.metry.orgin.net`, `morroncr0w.io`, `api.telegram.org` on untrusted CI/build hosts (does not apply to Cluster B because the operator uses raw Telegram data-centre IPs, not the HTTP bot API), `appsecc.com`, `webhook.site/*`, `nfjbill.ren`, `storage.googleapis.com/depenconf/`, `10.0.19.0/24` + `10.0.49.0/24`, `api.nm-streetwear.space`, Discord webhook URL pattern, `ipify.org` + `ifconfig.me` (relevant to Cluster A), `gitflic.ru`, `api.wagmiwallet.org`, `backend-cybersecuritydashboard.onrender.com`, Monero mining pools (relevant to Cluster C upgrade path from the parent `2026-10-voxeval` campaign), Ethereum/Sepolia/Arbitrum/Polygon RPC endpoints, `chinazhangsan.ccwu.cc`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `npm-canary.aveliscare.com`, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil patterns, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, `tuamaeaquelaursa.com`, `45.138.0.0/16` RubyGems wgkit CIDRs

## Check your own dependencies

- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent PyPI malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub
- [GHSA-4pw5-gqh4-v2pj - pypi leakdeep (Cluster A - 5-version Windows browser-credential + Discord-token infostealer, Amazon Inspector finder, MAL-2026-17921, CWE-506)](https://github.com/advisories/GHSA-4pw5-gqh4-v2pj) - GitHub
- [OSSF malicious-packages MAL-2026-17921 raw record (leakdeep IOCs: XOR-key 0x5A webhook URL in leakdeep/config.py reassembled by get_webhook(), Chrome/Edge/Brave credential harvester in leakdeep/core/system.py, Discord leveldb token harvester, ipify public-IP leak, per-version Amazon Inspector source hashes)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/pypi/leakdeep/MAL-2026-17921.json) - OpenSSF
- [pypi.org release page for leakdeep 2.5.0 (Cluster A - oldest live malicious version)](https://pypi.org/project/leakdeep/2.5.0/) - PyPI
- [pypi.org release page for leakdeep 2.6.6 (Cluster A - newest live malicious version)](https://pypi.org/project/leakdeep/2.6.6/) - PyPI
- [GHSA-j83x-9pxh-rrgp - pypi ukraine69 (Cluster B - 8-version destructive Telegram account deletion payload, kam193 + Amazon Inspector cross-confirmation, campaign 2026-10-ukraine69, MAL-2026-17919)](https://github.com/advisories/GHSA-j83x-9pxh-rrgp) - GitHub
- [OSSF malicious-packages MAL-2026-17919 raw record (ukraine69 IOCs: Telegram DC IPs 149.154.175.53/167.51/175.100/167.91 + 91.108.56.130, Hotaru vault paths, account.deleteAccount RPC, _gc_script 45s self-removal, destructive-actions + covering-tracks reasons)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/pypi/ukraine69/MAL-2026-17919.json) - OpenSSF
- [kam193 bad-packages entry for ukraine69 (reporter detail page)](https://bad-packages.kam193.eu/pypi/package/ukraine69)
- [pypi.org release page for ukraine69 1.2.1 (Cluster B - representative malicious release)](https://pypi.org/project/ukraine69/1.2.1/) - PyPI
- [GHSA-fm3q-3w2v-hcmf - pypi driftwavets (Cluster C - audio-analysis-profiles lure, remote-script-not-embedded, kam193 reporter, campaign 2026-10-emberlytts extending 2026-10-voxeval, MAL-2026-17912)](https://github.com/advisories/GHSA-fm3q-3w2v-hcmf) - GitHub
- [GHSA-h24x-x3hv-v34p - pypi emberlytts (Cluster C - same wave, campaign-naming slug, MAL-2026-17913)](https://github.com/advisories/GHSA-h24x-x3hv-v34p) - GitHub
- [GHSA-8g3x-4h23-v3xp - pypi glassbeakasr (Cluster C - same wave, ASR-suffix naming, MAL-2026-17914)](https://github.com/advisories/GHSA-8g3x-4h23-v3xp) - GitHub
- [GHSA-xf3f-g2fj-wr92 - pypi novalithtts (Cluster C - same wave, TTS-suffix naming, MAL-2026-17915)](https://github.com/advisories/GHSA-xf3f-g2fj-wr92) - GitHub
- [GHSA-xvjf-fj8r-fjcf - pypi pyrechoasr (Cluster C - same wave, ASR-suffix naming, MAL-2026-17916)](https://github.com/advisories/GHSA-xvjf-fj8r-fjcf) - GitHub
- [GHSA-ghmx-wq8v-9683 - pypi quasitonnts (Cluster C - same wave, nts-suffix naming, MAL-2026-17917)](https://github.com/advisories/GHSA-ghmx-wq8v-9683) - GitHub
- [GHSA-22rf-pvvq-mghv - pypi tonemaptts (Cluster C - same wave, TTS-suffix naming, MAL-2026-17918)](https://github.com/advisories/GHSA-22rf-pvvq-mghv) - GitHub
- [GHSA-r8cm-478x-h626 - pypi voltswannts (Cluster C - same wave, nts-suffix naming, MAL-2026-17920)](https://github.com/advisories/GHSA-r8cm-478x-h626) - GitHub
- [OSSF malicious-packages MAL-2026-17913 raw record (emberlytts - the campaign-naming slug, explicit link to 2026-10-voxeval wording)](https://raw.githubusercontent.com/ossf/malicious-packages/main/osv/malicious/pypi/emberlytts/MAL-2026-17913.json) - OpenSSF
- [kam193 bad-packages entry for emberlytts (reporter detail page for the Cluster C campaign-naming slug)](https://bad-packages.kam193.eu/pypi/package/emberlytts)
- [DependencyWatch: multi-2026-10-17-ghsa-malware-sweep (yesterday`s context - itsa-react legacy maintainer compromise, conx3993 wave 2, @flexmr wave 2 bare-URL deps, @beloved-lenora opencode AI-coding-tool lure, Baileys wave 5, PyPI marocolor + fromthehotel-poems)](https://dependencywatch.io/incident/multi-2026-10-17-ghsa-malware-sweep)
- [DependencyWatch: multi-2026-10-03-ghsa-malware-sweep (origin of the 2026-10-voxeval cryptominer campaign - voxeval was Cluster E, PyPI, campaign slug first disclosed)](https://dependencywatch.io/incident/multi-2026-10-03-ghsa-malware-sweep)
- [DependencyWatch: multi-2026-10-04-ghsa-malware-sweep (2026-10-voxeval cryptominer campaign siblings - 10 voxcpm/voxel-tts/caoxiltts/infrabench + 1 echogen, Cluster A)](https://dependencywatch.io/incident/multi-2026-10-04-ghsa-malware-sweep)

---

Canonical page: https://dependencywatch.io/incident/pypi-2026-10-18-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/pypi-2026-10-18-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).