Late-October 2026 malware advisory flood: 112 GitHub malware advisories for 96 npm and 10 PyPI packages in three days
GitHub published 112 malware advisories for 106 npm and PyPI packages from 26 to 28 Oct 2026: miners, stealers, beacons. Grep lockfiles for the named packages.
- Published
- Updated
- Exploitation
- Unknown. These are malicious uploads, not hijacks of popular packages, and download counts are not published
What happened
Between 26 and 28 October 2026, GitHub’s advisory database published 112 malware advisories covering 106 distinct packages: 96 on npm and 10 on PyPI, with 172 affected version entries. Some uploads are older than their advisories: packages in the @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components scopes went up between 23 and 25 October. 89 of the 112 advisories carry only GitHub’s standard text (Safeguard).
This is a count of advisories, not of confirmed victims. Safeguard says it did not discover the packages; the credited finders are OpenSSF Package Analysis, an independent PyPI researcher and a cloud provider’s inspection service. The OSV records we checked credit Amazon Inspector and OpenSSF (OSV MAL-2026-18321).
What the packages did
From Safeguard unless stated. Versions are from OSV.
| Family | Packages and versions | Behaviour |
|---|---|---|
| Dependency confusion | @greenlake/auth (3.0.0, 0.1.0, 0.0.0-stage), @sxm-web/client-sdk-core (up to 13.3.7), @webapp-shared/login-vmok (up to 99.0.1), and other packages in those scopes | Postinstall sends hostname, install path and working directory over plain HTTP to 185.158.107.175:8787 or 13.140.137.222:8787, path /_ah/dc |
| Monero miner | dsh-plugin-blender-3d@0.2.1, @walknpm/todo-cli@2.0.1, @sudobility/testomniac_client@0.0.131 | Postinstall runs sh scripts/miner.sh, downloads to /tmp/.smh, unpacks to /tmp/.smi, installs XMRig with systemd or @reboot cron persistence as root, otherwise under ~/.local/lib/<random>/, mining to networkservicesupp.flashhub.net:8443 (OSV MAL-2026-18321) |
| Self-publishing | publish-poc-test3 (seven versions from 1.0.15 to 1.0.27), publish-poc-base@1.0.7 | Publishes new packages under whatever npm identity is on the installing machine |
| Credential stealer and worm | @testsecuiitytestme/cache-helper (1.0.1 to 1.0.7), @iobandamwer/cache-helper (0.0.0-stage, 1.0.2 to 1.1.3) | Native addon runs a hidden Bun program on developer machines. It steals npm, GitHub, PyPI, cloud, Vault, Kubernetes, SSH, browser and password manager secrets, spreads to npm, PyPI and RubyGems, and writes hooks into AI coding assistant configs (OSV MAL-2026-18358) |
| PyPI stealers and shells | claudeopusfile (0.1.1, 0.1.2), claudeopuseni (0.1.0, 0.1.1), claudeopusenifile@0.1.3, dictmerge-lite@1.0.0, trajmetrics@0.5.3, numprint@1.2.0, h13t0ry-hello-demo@0.1.0 | Infostealer with blockchain C2 (claudeopus*), wallet theft, file exfiltration, Gist-driven commands, reverse shell |
| Install beacon | csvflow-schema@1.0.0 | Writes a marker file, launches calc.exe, sends an HTTPS GET to cdn-status.mulderitsme.net |
Other names Safeguard lists without detail include camelotlabs-config, camelotlabs-core, camelotlabs-sdk, camelotlabs-utils, camelotlabs-worker, the ccsec-, csec- and ccsseecc- crypto-toolkit and form-validator packages, @s4yhiitestpoc/*, @atlisp/mcp, @zaip-ai/cli, agentenact, ctf-agent, black-spindle, @azure-growth/signup-ux-components, orderly-plugin-liquidity-heatmap, and on PyPI netweavex, zagents-framework and changes-lxc-wrapper. Safeguard does not list all 106.
Am I affected?
Search lockfiles and manifests for the names above:
P='dsh-plugin-blender-3d|@walknpm/todo-cli|@sudobility/testomniac_client|publish-poc-(test3|base)|cache-helper|csvflow-schema|camelotlabs-|(ccsec|csec|ccsseecc)-(crypto-toolkit|form-validator)|@s4yhiitestpoc/|@atlisp/mcp|@zaip-ai/cli|agentenact|ctf-agent|black-spindle|@azure-growth/signup-ux-components|orderly-plugin-liquidity-heatmap|@greenlake/|@sxm-web/|@drone-js-ext/|@ppa-web-components/|@webapp-shared/'
grep -rnE "$P" --include='package.json' --include='package-lock.json' --include='yarn.lock' --include='pnpm-lock.yaml' --include='bun.lock' . 2>/dev/null | grep -v node_modules/
Q='claudeopus(file|eni|enifile)|dictmerge-lite|trajmetrics|numprint|h13t0ry-hello-demo|netweavex|zagents-framework|changes-lxc-wrapper'
grep -rniE "^($Q)\b" --include='requirements*.txt' . ; grep -niE "name = \"($Q)\"" poetry.lock uv.lock 2>/dev/null
pip list 2>/dev/null | grep -iE "^($Q) "The cache-helper match is broad on purpose: check which scope it came from. A hit for @greenlake/, @sxm-web/ or the other internal-looking scopes matters only if it resolved from the public npm registry instead of your private one.
Then check global installs, npx caches and host artifacts:
npm ls -g --depth=0 2>/dev/null | grep -E "$P"
ls ~/.npm/_npx 2>/dev/null && grep -rlE "$P" ~/.npm/_npx/*/package.json 2>/dev/null
ls -la /tmp/.smh /tmp/.smi ~/.sysmond.json /tmp/.sysmond.lock 2>/dev/null
ls ~/.local/lib/ 2>/dev/null
crontab -l 2>/dev/null | grep '@reboot'Search egress logs for 185.158.107.175, 13.140.137.222, networkservicesupp.flashhub.net, cdn-status.mulderitsme.net and amplify-gursha-dev-121835-deployment.s3.amazonaws.com. Safeguard suggests searching from 23 October.
What to do now
- If a listed version was installed, rebuild the machine and rotate its secrets from a different computer. GitHub’s advisory text says removing the package does not guarantee removing what it installed (OSV MAL-2026-18321).
- If the machine could publish to npm and installed
publish-poc-test3, look for packages namedpublish-poc-found-published under your identity, and revoke the npm token (Safeguard). - If a
cache-helperpackage ran on a developer machine, also check AI assistant config files and CI workflow files in repositories you work on for hooks you did not add (OSV MAL-2026-18358). - Close the dependency-confusion path. Map every internal scope to your private registry in
.npmrc(@yourscope:registry=https://...) and do not use pip’s--extra-index-urlfor private packages (Safeguard). - Block the endpoints above on build hosts.