DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
HighPublished 18 Aug 202611 packages · 13 versions

GitHub Advisory malware sweep - 2026-08-17 / 2026-08-18 batch (Sui blockchain `@mysten/*` typosquat days 4-5 continuation `sui-move-graphql`+`sui-move-rpc`+`sui-gql-core`+`bcs-core`+`bucket-protocol-sdk-v2`, Tinkoff BNPL dep-confusion tail `bnpl-blocks-independent-bnpl-search`, LEB128 encoding typosquat pair `leb128x`+`ulebkit`, generic CWE-506 boilerplate `blastradar`+`runtime-health`, PyPI `socks5901` Android `/sdcard/` Telegram-bot exfiltrator)

Summary

11 GHSA CWE-506 advisories across npm + PyPI in the 24h ending 2026-08-18 06:00 UTC. Headline: five-package Sui blockchain typosquat continuation (sui-move-graphql, sui-move-rpc, sui-gql-core, bcs-core, bucket-protocol-sdk-v2) extends the sui-gql-client/sui-bcs-codec (08-11) and sui-gql/bcs-compact (08-12) @mysten/* typosquat register into day-4/5. Also: bnpl-blocks-independent-bnpl-search (Tinkoff dep-confusion tail), leb128x+ulebkit LEB128 typosquat pair, blastradar+runtime-health generic boilerplate, and PyPI socks5901 Android-target Telegram-bot exfiltrator.

typosquatdependency-confusioncrypto-wallet-drainobfuscationinfostealer
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis
Also known as
2026-08-17 GHSA sweep · 2026-08-18 GHSA sweep · Sui @mysten typosquat register day 4-5 · Tinkoff BNPL dep-confusion tail
Ecosystems
npmPyPI
Packages tracked
11

What happened

The 24-hour window ending 2026-08-18 06:00 UTC published 11 new GHSA CWE-506 advisories across npm and PyPI. The 08-17 quiet-tail sweep noted only 2 advisories in the first half of the window (@ai-vertical/ai-agent, kb-ai); this file covers the remaining 11 that landed later 08-17 and into 08-18, which reintroduces coordinated-campaign activity absent from the quiet-tail window.

Cluster A - Sui blockchain @mysten/* typosquat continuation days 4-5 (5 npm packages)

| Package | Versions | GHSA | Published | Impersonation target | |---|---|---|---|---| | sui-move-graphql | >= 0 (all) | GHSA-xgmm-vq93-f5vx | 2026-08-18 | @mysten/sui/graphql GraphQL client | | sui-move-rpc | >= 0 (all) | GHSA-342c-493g-f389 | 2026-08-17 | @mysten/sui/client JSON-RPC client | | sui-gql-core | >= 0 (all) | GHSA-rg66-wjvq-h8xm | 2026-08-17 | @mysten/sui/graphql core | | bcs-core | >= 0 (all) | GHSA-5w7j-92p9-p5h4 | 2026-08-17 | @mysten/bcs Binary Canonical Serialization | | bucket-protocol-sdk-v2 | >= 0 (all) | GHSA-23pf-2cqf-xh64 | 2026-08-17 | @Bucket-Protocol/bucket-protocol-sdk Sui DeFi SDK |

All five carry the generic GHSA malware boilerplate: "Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer." No per-package source, IOC, or C2 published.

This is the fourth and fifth day of a coordinated Sui/Move typosquat register, following:

  • 2026-08-11 (day 1): sui-gql-client, sui-bcs-codec — see 08-11 sweep Cluster H
  • 2026-08-12 (day 2): sui-gql, bcs-compact — see 08-12 sweep Cluster D
  • 2026-08-17 (day 4): sui-move-rpc, sui-gql-core, bcs-core, bucket-protocol-sdk-v2 — this file
  • 2026-08-18 (day 5): sui-move-graphql — this file

The operator is systematically enumerating the Sui developer install-flow: BCS codec (bcs-core, bcs-compact, sui-bcs-codec), GraphQL client (sui-gql-core, sui-gql, sui-gql-client, sui-move-graphql), JSON-RPC (sui-move-rpc), and now a specific DeFi protocol SDK (bucket-protocol-sdk-v2). Bucket Protocol is a real Sui-based CDP / stablecoin project; the -v2 suffix is a plausible-but-fake successor naming shape.

Given the pattern, treat these as capable of the same wallet-key theft / credential-exfil / postinstall dropper behavior seen in the adjacent Sui-targeted TrapDoor campaign catalogued 2026-05-22 (see TrapDoor incident), which specifically exfiltrated Sui / Move / Solana / Aptos wallet keystores and planted hidden prompt-injection instructions in CLAUDE.md / .cursorrules.

Cluster B - Tinkoff Bank / Dolyame BNPL dep-confusion tail (1 npm package)

| Package | Versions | GHSA | Published | Behavior | |---|---|---|---|---| | bnpl-blocks-independent-bnpl-search | >= 0 (all) | GHSA-v43r-98qv-2v96 | 2026-08-17 | Generic CWE-506 boilerplate; continuation of Tinkoff BNPL internal-namespace enumeration |

Continues the massive Tinkoff Bank internal-namespace dep-confusion burst first catalogued on 2026-08-05 (25+ Tinkoff-adjacent packages including bnpl-blocks-atom-bnpl-*, dolyame-boxy-*, tramvai-*, tinkoff-statist-*) and continued on 2026-08-06 and 2026-08-08 (bnpl-blocks-desktop-bnpl-anchor-title). The bnpl-blocks-independent-bnpl-* sub-namespace matches the internal Tinkoff Dolyame BNPL React component library shape. The operator is running a slow enumeration burst against Tinkoff's internal npm scope, publishing one or two new squats every few days.

Cluster C - LEB128 encoding typosquat pair (2 npm packages)

| Package | Versions | GHSA | Published | Behavior | |---|---|---|---|---| | leb128x | >= 0 (all) | GHSA-p98p-7p39-8v79 | 2026-08-17 | Generic CWE-506 boilerplate | | ulebkit | >= 0 (all) | GHSA-w4vj-4cxr-299x | 2026-08-18 | Generic CWE-506 boilerplate |

LEB128 (Little Endian Base 128) is a variable-length integer encoding used in WebAssembly binary format, DWARF debug info, and — critically — the Move / Sui BCS (Binary Canonical Serialization) codec. ulebkit targets the ULEB128 (unsigned) variant. The same-week overlap with Cluster A's Sui typosquat continuation is suggestive: LEB128 sits directly under BCS in the Sui codec stack, so an operator running a Move / BCS naming sweep would naturally extend to LEB128 primitives.

Cluster D - Generic CWE-506 boilerplate misc (2 npm packages)

| Package | Versions | GHSA | Published | Behavior | |---|---|---|---|---| | blastradar | >= 0 (all) | GHSA-pp9x-4g56-7322 | 2026-08-18 | Generic CWE-506 boilerplate | | runtime-health | 1.0.1, 1.0.2, 1.0.4 | GHSA-fg74-5f33-c553 | 2026-08-18 | OpenSSF Package Analysis: "executes one or more commands associated with malicious behavior"; source hash 947c67500453c29daa330afc7d05e5ab5eb6405c4da235d1d0b408b247489832; OSV ref MAL-2026-14116 |

blastradar shares its name with a legitimate production-risk scanner tool (BlastRadar, a diff-analysis service) - the operator is likely trying to intercept developers searching for that tool. The versioning fingerprint on runtime-health (1.0.1, 1.0.2, then skipping to 1.0.4) suggests a mid-cycle takedown-and-republish loop before final removal.

Cluster E - PyPI socks5901 Android /sdcard/ Telegram-bot exfiltrator (1 PyPI package)

| Package | Versions | GHSA | Published | Behavior | |---|---|---|---|---| | socks5901 | 1.0.0 | GHSA-3rcw-hq5f-gvrg | 2026-08-18 | Exfiltrates ALL files from /sdcard/ at import time via Telegram Bot API webhook; targets Android hosts (Termux/QPython/Pydroid); source hash e6184fc1c33621ffa99f06b96ac94f05944bc3c7b431243e50ede0bb396e7dd3; OpenSSF campaign 2026-08-socks5901; OSV ref MAL-2026-14100 |

The first Android-targeting PyPI package we've seen in the 2026 ingest run. The /sdcard/ path is Android internal-storage convention, so the operator specifically targeted developers running Python on Android via Termux, QPython, or Pydroid. The name masquerades as a SOCKS5 proxy library.

Telegram Bot API as the exfiltration channel is a nasty choice: api.telegram.org is allow-listed on most home ISPs and mobile carriers, and the operator can rotate the bot token / channel without republishing the package. The exfil targets (photos, downloaded PDFs, screenshots, chat backups) can be highly sensitive on a personal Android device — including exported wallet KeyStores, mnemonic-phrase screenshots, and 2FA-recovery snapshots.

Registry state

All 11 packages yanked from their respective registries (npm, PyPI) during the takedown windows on 2026-08-17 / 2026-08-18. Private mirrors that cached tarballs before takedown will keep serving the malicious versions.

Related tracked activity

  • Sui/Move typosquat multi-day campaign (Cluster A): continues the 08-11 sui-gql-client/sui-bcs-codec pair and 08-12 sui-gql/bcs-compact pair into day-4/5. Related upstream: TrapDoor Sui/Move wallet-keystore stealer from May.
  • Tinkoff Bank multi-day dep-confusion burst (Cluster B): continues the 08-05 25+ package burst covering bnpl-blocks-atom-*, dolyame-boxy-*, tramvai-*, and tinkoff-statist-*.
  • LEB128/Move-adjacent typosquat register (Cluster C): new pattern this week; may indicate the Sui operator extending to sub-primitive namespaces or a sibling operator riding the same target-list.
  • Android-target PyPI exfiltrator (Cluster E): first in the current ingest run; Android developer targeting via Termux/QPython/Pydroid is a small-but-real subset of the PyPI attack surface.
  • Discovery credits: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis. No named threat actor.

Affected packages (11)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.jsonCheck requirements.txt

Impact

  • Cluster A - Sui blockchain typosquat continuation days 4-5 (5 npm packages, 2026-08-17/18): sui-move-graphql@>=0 (GHSA-xgmm-vq93-f5vx, 08-18), sui-move-rpc@>=0 (GHSA-342c-493g-f389, 08-17), sui-gql-core@>=0 (GHSA-rg66-wjvq-h8xm, 08-17), bcs-core@>=0 (GHSA-5w7j-92p9-p5h4, 08-17), bucket-protocol-sdk-v2@>=0 (GHSA-23pf-2cqf-xh64, 08-17) all carry the generic CWE-506 boilerplate. Names shadow the official @mysten/sui, @mysten/sui/graphql, @mysten/bcs, and @Bucket-Protocol/bucket-protocol-sdk libraries. Continues the coordinated Sui/Move typosquat register begun 2026-08-11 (sui-gql-client, sui-bcs-codec) and continued 2026-08-12 (sui-gql, bcs-compact). No IOC published per package - treat as capable of the same wallet-key theft, credential-exfil, or postinstall dropper behavior seen in adjacent Web3 typosquat campaigns (TrapDoor, @mysten/* prior waves)
  • Cluster B - Tinkoff BNPL Dolyame dep-confusion tail (1 npm package, 2026-08-17): bnpl-blocks-independent-bnpl-search@>=0 (GHSA-v43r-98qv-2v96) continues the massive Tinkoff Bank (JSC Tinkoff, one of Russia's largest banks) internal-namespace dep-confusion burst catalogued 2026-08-05 (bnpl-blocks-atom-bnpl-*, dolyame-boxy-*, tramvai-*, tinkoff-statist-*), 2026-08-06, and 2026-08-08 (bnpl-blocks-desktop-bnpl-anchor-title). The bnpl-blocks-independent-bnpl-* sub-cluster matches the pattern of the internal Tinkoff Dolyame BNPL React component library. Any Tinkoff developer or CI runner whose .npmrc scope precedence misresolved to the public registry could have pulled the malicious version
  • Cluster C - LEB128 encoding typosquat pair (2 npm packages, 2026-08-17/18): leb128x@>=0 (GHSA-p98p-7p39-8v79, 08-17) and ulebkit@>=0 (GHSA-w4vj-4cxr-299x, 08-18) both target the LEB128 (Little Endian Base 128) variable-length integer encoding namespace used in WebAssembly, DWARF debug info, and the Move / Sui BCS serialization stack. ulebkit is the ULEB128 (unsigned LEB128) variant. The same-week overlap with the Sui typosquat cluster suggests one operator running a coordinated Move/WASM-adjacent naming sweep - LEB128 is a foundational primitive imported by BCS codecs and Move VM tooling
  • Cluster D - Generic CWE-506 boilerplate misc (2 npm packages, 2026-08-18): blastradar@>=0 (GHSA-pp9x-4g56-7322) and runtime-health@versions 1.0.1, 1.0.2, 1.0.4 (GHSA-fg74-5f33-c553, OpenSSF-flagged with source hash 947c67500453c29daa330afc7d05e5ab5eb6405c4da235d1d0b408b247489832). blastradar name may confuse with the legitimate BlastRadar production-risk scanner (unrelated npm package). runtime-health executes commands associated with malicious behavior per OpenSSF Package Analysis - the version fingerprint (1.0.1/1.0.2/1.0.4 with 1.0.3 missing) suggests a mid-cycle takedown / re-publish loop
  • Cluster E - PyPI socks5901 Android /sdcard/ Telegram-bot exfiltrator (1 PyPI package, 2026-08-18): socks5901@1.0.0 (GHSA-3rcw-hq5f-gvrg) exfiltrates ALL files from /sdcard/ at import time via a Telegram Bot API webhook. The package explicitly targets Android hosts running Python (Termux, QPython, Pydroid) - the /sdcard/ path is Android internal-storage convention. Campaign tag 2026-08-socks5901, OpenSSF source hash e6184fc1c33621ffa99f06b96ac94f05944bc3c7b431243e50ede0bb396e7dd3. Impact scoped to Android install hosts but the exfiltrated files (photos, downloaded PDFs, screenshots, chat backups) can be highly sensitive. Name masquerades as a SOCKS5 proxy library

What to do

  1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, poetry.lock, uv.lock) for the 11 package names below
  2. 2For Cluster A matches (Sui typosquats): uninstall each match, correct to the real @mysten/sui, @mysten/sui/graphql, @mysten/bcs, or @Bucket-Protocol/bucket-protocol-sdk package. Given the multi-day Sui typosquat continuation (08-11, 08-12, and now 08-17/18), any Sui / Move / DeFi developer host that installed any of these should have wallet keystores, Sui / Aptos / Solana keys, and Cursor/Claude Code credentials rotated. Audit for TrapDoor-style hidden CLAUDE.md / .cursorrules prompt-injection artifacts left behind by adjacent Sui-targeted campaigns
  3. 3For Cluster B match (bnpl-blocks-independent-bnpl-search): Tinkoff Bank / Dolyame BNPL / adjacent-scope developers - audit .npmrc scope precedence; internal packages should resolve exclusively via the private registry. Rotate any credential shipped through a CI runner that installed this. Review the full 08-05 / 08-06 / 08-08 Tinkoff cluster (bnpl-blocks-atom-*, dolyame-boxy-*, tramvai-*, tinkoff-statist-*) for any additional local matches
  4. 4For Cluster C matches (LEB128 typosquats): uninstall and correct to the intended real package (leb128, @thi.ng/leb128, or the built-in BCS codec from @mysten/bcs). If used in a BCS/Move codepath alongside a Sui project, treat as high-priority - the operator overlap with Cluster A is likely deliberate
  5. 5For Cluster D matches (blastradar, runtime-health): uninstall. For runtime-health matches, the OpenSSF-published source hash 947c67500453c29daa330afc7d05e5ab5eb6405c4da235d1d0b408b247489832 can be used to identify the malicious tarball in caches or CI logs. Because the payload description is only "executes commands associated with malicious behavior" without specifics, rotate anything the install host could reach and reimage build runners
  6. 6For Cluster E match (socks5901 PyPI): uninstall from any Python virtualenv - importantly, check Termux / QPython / Pydroid installations on Android devices as well as standard Linux/Windows/macOS installs. If the package was ever imported on an Android device, assume all files in /sdcard/ have been leaked to a third party (photos, backups, downloaded documents). No credential rotation is triggered by the exfil itself (host telemetry only from the file listing perspective), but any secret files stored in /sdcard/ (e.g. mnemonic backups, exported KeyStore files, screenshots of 2FA codes) must be considered compromised. The Telegram Bot API webhook may be findable in the OpenSSF sample for takedown reporting to Telegram's abuse team
  7. 7For all npm installs in CI, run with --ignore-scripts as defence-in-depth. For all pip install runs, prefer --only-binary=:all: where feasible to skip setup.py execution
  8. 8Verify none of the 11 packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

Back to feedSubmit a correction
multi-2026-08-18-ghsa-malware-sweep