DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
HighPublished 19 Aug 2026Updated 20 Aug 202629 packages · 42 versions

GitHub Advisory malware sweep - 2026-08-19 batch (Sui `@mysten/*` typosquat continuation day 6 `sui-graphql-rpc`+`sui-gql-rpc` targeted git-config allowlist, Chinese exam-cheat surveillance suite `sysc1`+`syjoy`+`syboy`+`sysdo`, pino/jsonspack revival `chai-as-gateway`+`chaikit`+`solidity-hold`, Streak sibling typosquat `streak-key-lib`+`streak-cal-core` ELF dropper, txs SDK Caesar loader pair `txs-runner-sdk`+`txs-lib-sdk`, `@sarex-team/*` DNS exfil pair, deepface Telegram-session PyPI typosquat `deepface-weight`+`deepface-weights`, `reqcrypt` HTTP-response backdoor)

Summary

28 GHSA CWE-506 advisories in the 24h ending 2026-08-19 06:00 UTC. Headline: *Sui `@mysten/ typosquat day 6** (sui-graphql-rpc, sui-gql-rpc) with a **targeted git-config allowlist** payload - dormant in CI, only fires for hardcoded developer identities. Also: 4-package Chinese exam-cheat surveillance, jsonspack` pino-typosquat revival, and a PyPI deepface Telegram-session stealer.

typosquatdependency-confusioncrypto-wallet-draininfostealercredential-theftobfuscationdns-exfiltration
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis · Amazon Inspector · kam193
Also known as
2026-08-19 GHSA sweep · Sui @mysten typosquat register day 6 · jsonspack pino-typosquat revival · Chinese exam-cheat surveillance suite · PyPI deepface Telegram-session stealer
Ecosystems
npmPyPI
Packages tracked
29

What happened

The 24-hour window ending 2026-08-19 06:00 UTC published 28 new GHSA CWE-506 advisories (25 npm, 3 PyPI). This is one of the busiest daily sweeps of the month, and the day the multi-week Sui @mysten/* typosquat register stops being boilerplate and turns targeted.

Cluster A - Sui @mysten/* typosquat continuation day 6, TARGETED (2 npm packages)

| Package | Versions | GHSA | OSV | Payload | |---|---|---|---|---| | sui-graphql-rpc | 1.0.1 | GHSA-rr7f-8h2g-c8rc | MAL-2026-14210 | Reads ~/.gitconfig, derives encryption key from git identity, only runs payload for hardcoded developer allowlist | | sui-gql-rpc | 1.0.1 | GHSA-4c65-5fr5-9xq3 | MAL-2026-14209 | Same shape: dormant in CI/sandboxes; conditional payload keyed on git identity |

This is a material change from the day-4/5 boilerplate packages (08-18 sweep Cluster A): those five carried the generic GHSA "assume host fully compromised" boilerplate with no per-package IOC, indicating either an early-warning takedown before the operator could deploy real payloads OR unfinished pre-staging packages. Days 6's two packages carry a finished, targeted payload: a git-config-based allowlist ensures the malware only executes for developers on the operator's target list, so:

  • CI runners get nothing (no ~/.gitconfig or an identity that does not match) — CI-scoped scanners miss it entirely.
  • Sandboxes miss it — sandbox images typically have no git identity or a generic one.
  • Untargeted developer workstations get nothing — the branch is dormant.
  • Only hosts whose developer git identity matches the operator's target list execute the payload.

Because the target list is opaque, treat all install hosts as if in-scope until proven otherwise. This is the same pattern the TrapDoor Sui/Move campaign used in May: wallet keystore theft, Cursor/Claude Code credential exfil, and prompt-injection artifacts planted in CLAUDE.md / .cursorrules.

Multi-day Sui typosquat register timeline:

  • 2026-08-11 (day 1): sui-gql-client, sui-bcs-codec
  • 2026-08-12 (day 2): sui-gql, bcs-compact
  • 2026-08-17 (day 4): sui-move-rpc, sui-gql-core, bcs-core, bucket-protocol-sdk-v2
  • 2026-08-18 (day 5): sui-move-graphql
  • 2026-08-19 (day 6): sui-graphql-rpc, sui-gql-rpc — this file, targeted

Cluster B - Chinese exam-cheat surveillance suite (4 npm packages)

| Package | GHSA | C2 endpoint | Behavior | |---|---|---|---| | sysc1 | GHSA-w7f3-qj9q-xjcv | new-pointer.vercel.app/api | Silent Python 3.12 install, invisible overlay window, hidden hotkeys, screen capture, clipboard read, browser-content extraction | | syjoy | GHSA-h63h-46qm-72xr | new-pointer.vercel.app/api | Same shape - full keyboard hook + screenshot + UI tree; C2 responds with commands executed via keyboard automation | | syboy | GHSA-wwj3-8g39-3vf8 | (author-controlled, not per-advisory published) | VBS launcher, elevated Python install, clipboard + screenshot + accessibility tree exfil | | sysdo | GHSA-h93v-w5cq-82r4 | iq-sec.vercel.app/api | Same as sibling - VBS launcher, silent Python 3.12.3 install, pyperclip/keyboard/mss/pyautogui payload, hidden console |

The four packages share a distinctive install shape: silently install Python 3.12 via Windows package managers with elevated privileges, deploy VBS launcher with hidden console, run global keyboard hooks + clipboard + screenshot + UI accessibility-tree extraction. Two C2 endpoints observed: new-pointer.vercel.app/api and iq-sec.vercel.app/api — both .vercel.app subdomains, cheap to rotate.

The combination of Windows package-manager installer, hidden overlay hotkey UI, keyboard automation-driven command execution, and UI-tree scraping matches the pattern of online-proctored-exam cheating tools (silently reads exam question text from the invigilator window into the operator agent, gets the answer, types it back via keyboard automation to make it look like the student typed it). The sysc1 advisory explicitly calls out the "coordinated surveillance payload" characterization, and internal identifiers in the OpenSSF sample match the "exam" vocabulary.

Cluster C - Pino logger typosquat / jsonspack revival (3 npm packages)

| Package | Versions | GHSA | Payload | |---|---|---|---| | chai-as-gateway | <= 7.1.5 | GHSA-qwfr-cq2f-mc9p | ~4 MB obfuscator.io blob + RC4 decoder + 23k entries; import-time execution; AWS credential harvester over axios; publisher hello@jsonspack.com | | chaikit | <= 2.3.5 | GHSA-f9xv-p7pq-vmvg | Same shape - pino badges + 4 MB obfuscator blob; axios exfil | | solidity-hold | 2.0.1 | GHSA-pv28-2qrf-2v4m | Same shape - pino README/badges + 4 MB obfuscator blob; axios in deps |

All three copy the pino README, badges, and metadata; all three carry an identical ~4 MB obfuscator.io payload with an RC4 decoder over 23,000+ encoded entries; publisher email hello@jsonspack.com matches the chai-as-persisted / jsonspack cluster catalogued 2026-06-27 exactly. The operator is back after ~7 weeks, running the same playbook with fresh package names.

Because the payload triggers on import (not postinstall), npm install --ignore-scripts does NOT block it - the moment any downstream code requires the fake logger, the obfuscator blob runs. Payload traverses $HOME for AWS credentials and exfils via HTTPS.

Cluster D - Streak calendar sibling typosquat with ELF dropper (2 npm packages)

| Package | Versions | GHSA | Payload | |---|---|---|---| | streak-key-lib | 1.0.0 | GHSA-5vjc-7v47-9rh7 | ~65 KB obfuscated JS blob with RC4/XOR decoder; misleading header directs users to install "companion" packages | | streak-cal-core | 1.0.0 | GHSA-8rg4-mc43-9c6p | ~500 KB base64-encoded x86-64 ELF binary written to disk and spawned via child_process; Linux-only via ELF, dropper falls through on macOS/Windows |

Internal file headers reference streak-larq-hydration and svelte-insight-hydration; README points to svelte-streak-cal. The mismatched-name shape is a fingerprint of a template-based typosquat family: the operator has a template with a placeholder name and is minting sibling packages with slight variations. Expect further variants over the next few days (e.g. streak-day-lib, streak-cal-hydration).

Cluster E - txs SDK Caesar loader pair (2 npm packages)

| Package | Versions | GHSA | Payload | |---|---|---|---| | txs-runner-sdk | <= 1.0.1 | GHSA-4wc6-fvwc-gvqh | Payload hidden as mark field in JSON "product catalog" record; base64 + per-byte Caesar shift; indirect constructor lookup; axios + python-shell deps | | txs-lib-sdk | 1.0.2 | GHSA-2p34-9h9g-7wf4 | Same shape - reads database.js disguised as product catalog, extracts mark field, base64 + Caesar, arbitrary Node.js execution with full fs/network/child_process capability |

Naming (txs-*-sdk) targets Web3/Solana transaction-tooling developers who search for a "transactions SDK". Both use the same Caesar-cipher + indirect-constructor-lookup obfuscation technique - likely one operator, likely more txs-*-sdk siblings to come.

Cluster F - @sarex-team DNS-exfil pair (2 npm packages)

| Package | Versions | GHSA | Payload | |---|---|---|---| | @sarex-team/viewer | <= 9.9.11 | GHSA-xgp4-2rxm-62fh | Postinstall + on every require(): dns.resolve4(<hex-encoded-recon>.oob.sl4x0.xyz); API names stored as hex byte arrays and reassembled with String.fromCharCode | | @sarex-team/sdk-js | <= 9.9.11 | GHSA-44g3-f495-wrr5 | Same shape, same destination host, same hex-reassembly trick |

The @sarex-team/* scope has no legitimate publishing history on public npm - the operator registered it recently and pushed straight to v9.9.11. That version stamp on a fresh scope reads as prepared dep-confusion bait against a private @sarex-team/* scope somewhere; any org whose .npmrc scope precedence misresolved a @sarex-team/* install to the public registry would have pulled these.

DNS exfil to oob.sl4x0.xyz resolves via the host resolver, so egress-only firewalls do NOT block it - a host with no direct outbound HTTP but a functioning DNS resolver still leaks username + hostname + cwd + package-id + timestamp to the operator on install and on every require().

Cluster G - Miscellaneous single-purpose npm (10 packages)

| Package | Versions | GHSA | Behavior | |---|---|---|---| | twapfetch | 1.1.0, 1.1.1 | GHSA-2p2j-mgv3-82vj | Polymarket Chainlink TWAP TwapClient/fetchTwapOnce typosquat; postinstall downloads unverified tarball from env-var URL and evals; ships fake "Kelly-stake math helpers" | | tfjs-custom-module | 1.0.0 | GHSA-4ccr-vjmw-rf6f | @tensorflow/tfjs typosquat; postinstall recon (hostname, platform, arch, node version) to 8xq4kw5d.instances.poc.jchunt.top | | table-ui-new | 2.7.1, 2.7.2, 2.7.4, 2.7.5 | GHSA-q6w5-mpgv-mc26 | React table typosquat; dist/config.js has module-level HASHES array of base64 strings that unconditionally fetch() from everydaynodechecker-39147n.vercel.app and eval() the response | | chameleon-src | 6.6.29 | GHSA-4mhp-g6gh-v4q8 | Preinstall verify.js fetches host IP via Cloudflare trace, uploads to attacker Sentry project with sendDefaultPii:true (Sentry auto-captures IP/hostname/user under PII) | | system-performance-helper | 1.0.0 | GHSA-fhpw-32cw-j76m | Reverse-shell backdoor via postinstall install.js: TCP socket + OS shell over HOST="YOUR_PUBLIC_IP":PORT=4444 with auto-reconnect and keep-alive. Placeholder unfilled at publish - weaponized on next republish | | sw-pluginer | 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.2.0 | GHSA-wp99-p72h-8pq6 | Tailwind service-worker plugin typosquat; reads URL from staged node_modules/.bin/manifest.json, HTTP GET, eval - build-time RCE | | timed-assess | 1.0.0, 1.0.1 | GHSA-pw97-8f4h-8j38 | Postinstall reads bundled file, DES-decrypts with hardcoded key, pipes plaintext to detached spawn stdin - executes attacker JavaScript silently | | tailwind-custom-templates | <= 0.7.2 | GHSA-7fqm-rw2q-w45v | Tailwind Forms verbatim + appended obfuscator.io payload; hardcoded ETH wallet 0xa322E5f3…; Ethereum RPC + block-explorer refs - wallet-drain or clipper C2 | | @lilsccott6x9/devpipe-connector | 1.0.0 | GHSA-98w6-6qqf-q39g | Base64 postinstall via child_process.execSync writes WebMCP-RCE-CANARY to Desktop on Windows + Unix - shape is a research canary but a weaponizable postinstall RCE if repurposed | | ssb-test-package | 1.0.0 | GHSA-395g-xx9j-mgx7 | Dep-confusion PoC; preinstall collects OS user + hostname + platform + network interfaces and writes JSON locally (no network exfil yet, but preinstall RCE confirmed) |

Cluster H - PyPI (3 packages)

| Package | Versions | GHSA | Payload | |---|---|---|---| | deepface-weight | 0.1.4 | GHSA-5j48-33h2-gvwg | deepface face-recognition typosquat; background daemon polls for data/telethon_market_userbot.session and other Telegram sessions, exfils to Telegram Bot API webhook - Telegram account takeover | | deepface-weights | 0.1.0, 0.1.1, 0.1.2 | GHSA-2cw8-w83p-pj7v | Sibling typosquat, same behavior; polls every 10s for the same telethon session file | | reqcrypt | 0.1.0 | GHSA-m6gg-ffj5-fxqh | HTTP-client backdoor; _process_response on every HTTP verb decodes payloaddd/payload_gz/payload_zlib response fields and exec()s them - any attacker-controlled HTTP response = RCE; campaign 2026-08-reqcrypt | | reqcrypt-dev | 0.1.0 | GHSA-f4gc-vf6c-945w | Sibling added 2026-08-20; same 2026-08-reqcrypt campaign, same HTTP-response exec() backdoor; hash 8e66755912...f3e4 - operator re-registered under -dev suffix to survive the reqcrypt takedown |

deepface-weight and deepface-weights share the same publisher metadata pattern (placeholder author asdqwdasdqwdasd, disposable email); both target ML/computer-vision developers importing what they think is a weight-file bundle. The Telegram-session-file focus (telethon_market_userbot.session) suggests a specific downstream operator running a Telegram-based market/trading bot that they want to hijack.

reqcrypt is the standout: because the backdoor triggers on HTTP response content (not on install, not on import - on the response to any call made using the library), it turns any downstream service that uses reqcrypt as an HTTP client into a remote-exec target for anyone who controls or can influence an endpoint that service calls. A Man-in-the-Middle or a compromised upstream = full RCE on every reqcrypt consumer.

Registry state

All 28 packages yanked from their respective registries (npm, PyPI) during the takedown windows on 2026-08-19. httpz-requests PyPI simple index is empty (quarantined) - private mirrors that cached tarballs before takedown will keep serving them.

Related tracked activity

  • Sui/Move typosquat multi-day campaign (Cluster A): now on day 6, with a targeted git-config allowlist payload replacing earlier boilerplate. See 08-18 sweep Cluster A for days 4-5 and TrapDoor for the upstream Sui/Move wallet-keystore stealer.
  • jsonspack pino-typosquat operator (Cluster C): return after ~7 weeks; the 2026-06-27 chai-as-persisted / jsonspack file has the operator's publisher fingerprint.
  • Chinese exam-cheat surveillance (Cluster B): first appearance of this shape in the ingest run - Windows PM install + VBS launcher + hidden overlay + accessibility-tree scraping is a distinctive fingerprint.
  • Telegram-based exfil / RAT (Cluster H deepface-*): continues the pattern of the 08-18 PyPI Telegram-RAT trio (Cluster E: socks5901, infogram-bot, httpz-requests). Different targets (Android files vs Telegram session files) but same channel choice - api.telegram.org egress being allow-listed almost everywhere.
  • Discovery credits: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193. No named threat actor.

Affected packages (29)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.jsonCheck requirements.txt

Impact

  • *Cluster A - Sui `@mysten/ typosquat continuation day 6, TARGETED (2 npm packages, 2026-08-19)**: sui-graphql-rpc@1.0.1 (GHSA-rr7f-8h2g-c8rc, OpenSSF hash ba4994f544d3df11fa82980f25dc29e379f25a3e03fdbf9a448e995a75ac76a7, OSV MAL-2026-14210) and sui-gql-rpc@1.0.1 (GHSA-4c65-5fr5-9xq3, hash 12074ac469d8426297f5f8bb3dd28fd48424a71348b2c16590fd4b41e4e6ad33, MAL-2026-14209). Unlike the boilerplate day-4/5 packages, these two carry a **git-config allowlist payload**: on import, the malware reads ~/.gitconfig, derives an encryption key from the developer's git identity, and only decrypts + runs its second-stage payload when the identity matches a hardcoded target list. **Dormant in CI, sandboxes, and untargeted developer hosts** - detection scanners that only run in CI will not fire. Continues the multi-day Sui typosquat register: day 1 (08-11: sui-gql-client, sui-bcs-codec), day 2 (08-12: sui-gql, bcs-compact), days 4-5 (08-17/18: sui-move-rpc, sui-gql-core, bcs-core, bucket-protocol-sdk-v2, sui-move-graphql`)
  • Cluster B - Chinese exam-cheat surveillance suite (4 npm packages, 2026-08-19): sysc1@1.0.0,1.0.1 (GHSA-w7f3-qj9q-xjcv, hash 2246c45afa73830233fa107ca0b97d96b10b59169599d248f7327d4e5317ff9f), syjoy@1.0.0 (GHSA-h63h-46qm-72xr, hash d09a5d503a9a198f34720bcec601970125f514b666820b7a3b814e5d21bf1529), syboy@1.0.0 (GHSA-wwj3-8g39-3vf8, hash f53c03163c0e0b47e20d28751745a66ecd1c9aadda7e96d648e8390ba49506f7), sysdo@1.0.0 (GHSA-h93v-w5cq-82r4, hash bb784f77e0ba034d13e3ca39aa5f3f401ab659deaafbb0b28d880c21293bde33). All four silently install Python 3.12 via Windows package managers with elevated privileges, deploy VBS launchers, then run a hidden overlay window with global keyboard hooks, clipboard monitoring, screenshot capture, and UI-tree accessibility scraping. Two C2 endpoints observed: new-pointer.vercel.app/api (sysc1, syjoy) and iq-sec.vercel.app/api (sysdo). The Windows package-manager installer choice, hidden-overlay hotkey UI, and UI-tree scraping match the pattern of Chinese online-proctored-exam cheating tools (surreptitiously reads exam question text from the invigilator window and pastes prepared answers). Impact: keystroke exfil, credential harvest, remote input injection
  • Cluster C - Pino logger typosquat / jsonspack revival (3 npm packages, 2026-08-19): chai-as-gateway@<=7.1.5 (GHSA-qwfr-cq2f-mc9p, hash f90afdde9240783f1f869b875b7967490cf579e1bae0986861498f8c98c0d973), chaikit@<=2.3.5 (GHSA-f9xv-p7pq-vmvg, hash a4711ba83393e8da11ab4368f9b38dac3de00bc523946cc27e4e47f38a51b9c4), solidity-hold@2.0.1 (GHSA-pv28-2qrf-2v4m, hash 39144e822a0964821b92859c04cbe7311ac13a889c585465ac0533c831f1904f). All three carry a ~4 MB obfuscator.io blob with an RC4 decoder and 23,000+ encoded entries; publisher email hello@jsonspack.com matches the chai-as-persisted / jsonspack cluster catalogued 2026-06-27. Payload traverses $HOME for AWS credentials and exfils via axios to attacker HTTP endpoint. All three copy pino badges and metadata. Because the payload triggers on import (not postinstall), --ignore-scripts does NOT stop this one
  • Cluster D - Streak calendar sibling typosquat with ELF dropper (2 npm packages, 2026-08-19): streak-key-lib@1.0.0 (GHSA-5vjc-7v47-9rh7, hash c569633a277a8a3374b8ca058ec451a726d110cca3599f429bfe72d6d2b7a7b6, ~65 KB obfuscated JS payload) and streak-cal-core@1.0.0 (GHSA-8rg4-mc43-9c6p, hash a4e42ea741c3a61878fa72cd8b7ab4547c52f14b69f429129c46edba70771287, ~500 KB base64-encoded x86-64 ELF binary written to disk and spawned via child_process). Internal file headers reference streak-larq-hydration and svelte-insight-hydration; README points to svelte-streak-cal. Sibling naming shape indicates a template-based typosquat family, likely more variants to come. streak-cal-core is Linux-only via the ELF payload; on Windows/macOS the dropper falls through
  • Cluster E - txs SDK Caesar loader pair (2 npm packages, 2026-08-19): txs-runner-sdk@<=1.0.1 (GHSA-4wc6-fvwc-gvqh, hash db9d5d94b7f75bbe8bca33eb382bfb986e68b7f0307cad7e9626da103192f254) and txs-lib-sdk@1.0.2 (GHSA-2p34-9h9g-7wf4, hash 5575013ead36c1ebb523009215200be0a1bf61d21285ca8515573963a63e3aa5). Both hide their payload as a mark field in a JSON "product catalog" record, base64-decode + apply a per-byte Caesar shift, and eval via indirect constructor lookup. Dependencies include axios and python-shell, giving arbitrary Node.js and shell-out capability once triggered. Marketed as "random transaction data generator" (txs-runner-sdk) and "transactions helper" (txs-lib-sdk) - name shape suggests a Web3/Solana adjacent target
  • Cluster F - @sarex-team DNS-exfil pair (2 npm packages, 2026-08-19): @sarex-team/viewer@<=9.9.11 (GHSA-xgp4-2rxm-62fh, hash 04b67de30d08d48f32be517383d6940c8179d2269ea7a1720346eacc2e8c28d5) and @sarex-team/sdk-js@<=9.9.11 (GHSA-44g3-f495-wrr5, hash 3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2). Both scoped under an unfamiliar @sarex-team/* namespace, both exfil username + hostname + cwd + package-id + timestamp via DNS lookups to oob.sl4x0.xyz at install AND on every require(). API names (os, dns, userInfo, hostname, cwd, resolve4) and the destination host are stored as hex byte arrays and reassembled with String.fromCharCode to defeat string-based scanners. The v9.9.11 version stamp on a namespace with no legitimate publishing history reads as prepared dep-confusion bait against a private @sarex-team/* scope
  • Cluster G - Miscellaneous single-purpose npm (10 packages, 2026-08-19): twapfetch@1.1.0,1.1.1 (Polymarket Chainlink TWAP typosquat, postinstall fetches remote tarball unverified and evals), tfjs-custom-module@1.0.0 (TensorFlow.js @tensorflow/tfjs typosquat, postinstall recon to 8xq4kw5d.instances.poc.jchunt.top), table-ui-new@2.7.1,2.7.2,2.7.4,2.7.5 (React table typosquat, HASHES base64 array + eval() from everydaynodechecker-39147n.vercel.app), chameleon-src@6.6.29 (preinstall verify.js collects IP + hostname + uploads to attacker Sentry project with sendDefaultPii:true), system-performance-helper@1.0.0 (reverse-shell backdoor to HOST=YOUR_PUBLIC_IP:4444 - placeholder unfilled at publish, weaponized on next republish), sw-pluginer@1.0.0..1.2.0 (Tailwind service-worker plugin typosquat; reads URL from node_modules/.bin/manifest.json, HTTP GET, eval), timed-assess@1.0.0,1.0.1 (postinstall DES-decrypts bundled payload with hardcoded key, spawns detached), tailwind-custom-templates@<=0.7.2 (Tailwind Forms + obfuscator.io ETH wallet drain payload, hardcoded ETH addr 0xa322E5f3…), @lilsccott6x9/devpipe-connector@1.0.0 (base64 postinstall writes WebMCP-RCE-CANARY to Desktop; looks like a research canary but the shape is a weaponizable PoC), ssb-test-package@1.0.0 (dep-confusion PoC recon via preinstall)
  • Cluster H - PyPI (3 packages, 2026-08-19): deepface-weight@0.1.4 (GHSA-5j48-33h2-gvwg, hashes 6808b9ae…5f1a / 92f87cc2…3e2b) and deepface-weights@0.1.0,0.1.1,0.1.2 (GHSA-2cw8-w83p-pj7v, hashes 9c1cf8a0…0558 / a9b6a125…6fce) both typosquat the popular deepface facial-recognition library; on import they spawn a background daemon that polls every 10s for data/telethon_market_userbot.session and other Telegram session files and exfils them to a Telegram Bot API webhook - stolen sessions grant full Telegram account takeover. reqcrypt@0.1.0 (GHSA-m6gg-ffj5-fxqh, campaign 2026-08-reqcrypt, hashes 152e5cdb…fb39 / 556f2178…4fb39) is an HTTP-client backdoor: _process_response on every get/post/put/delete/patch/download/upload verb inspects the response for payloaddd/payload_gz/payload_zlib fields, decodes and exec()s them - any attacker who can influence any HTTP response the app fetches gets RCE. Sibling added 2026-08-20: reqcrypt-dev@0.1.0 (GHSA-f4gc-vf6c-945w, hash 8e66755912c02a4de1ed6f86b092e2a0dcdadbcaef931cbd07c6d2306619f3e4) is the same 2026-08-reqcrypt campaign under a -dev suffix, same HTTP-response exec() backdoor - registered under a different package name to survive the reqcrypt takedown

What to do

  1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, poetry.lock, uv.lock) for the 28 package names below
  2. 2For Cluster A matches (Sui typosquat continuation day 6): uninstall, correct to @mysten/sui/graphql or the appropriate real @mysten/* package, and rotate as if compromised even if your CI runs never triggered. The git-config allowlist means the operator has a target list you cannot see; if the developer identity on any workstation that installed this matches the operator's list, wallet keystores, Sui / Aptos / Solana keys, Cursor/Claude Code credentials, and browser session cookies are already exfiltrated. Audit for TrapDoor-style hidden CLAUDE.md / .cursorrules prompt-injection artifacts. Review the parallel 08-18 sweep and 08-11 / 08-12 entries for the earlier days of this register
  3. 3For Cluster B matches (Chinese exam-cheat surveillance): uninstall and reimage. Because Python was installed with elevated privileges and a hidden overlay/keyboard-hook agent was deployed, the host cannot be trusted after removal - the agent may auto-restart via VBS shortcut, scheduled task, or Startup folder. Reimage Windows hosts, then re-add missing exam-integrity tooling from vendor-signed installers. Block the domains new-pointer.vercel.app and iq-sec.vercel.app at the perimeter and via DNS RPZ
  4. 4For Cluster C matches (pino/jsonspack revival): uninstall, rotate every AWS credential the host could reach (this is an aggressive credential harvester). Correct to real pino from pinojs/pino. Note that --ignore-scripts does NOT block this cluster - triggers on import, not on postinstall. Any repo that pulled one of these needs a full CI secret rotation. Cross-reference the 2026-06-27 chai-as-persisted / jsonspack cluster - the operator is back after ~7 weeks
  5. 5For Cluster D matches (Streak calendar typosquats): uninstall. On Linux hosts that installed streak-cal-core, check /tmp and the current working directory for the dropped ELF binary and ps -ef for anomalous child processes - reimage build runners on any hit. Correct to the intended real svelte-streak-cal package if it exists; otherwise audit whether the calendar helper is worth the risk
  6. 6For Cluster E matches (txs SDK): uninstall. If any install ran, assume the attacker has full Node capability on the host and rotate credentials the host could reach; python-shell in the dep tree hints at Python-payload staging on the next release, so also audit for stray Python processes
  7. 7*For Cluster F matches (`@sarex-team/)**: uninstall. Because DNS exfil resolves via the host resolver, egress-only firewalls do NOT block it - any host that install-ran these has already leaked its identity to oob.sl4x0.xyz. Rotate anything the leak of username + hostname + cwd + package-id would help an adversary target. If your org uses a private @sarex-team/* scope, correct your .npmrc` scope precedence
  8. 8For Cluster G matches: uninstall each. chameleon-src, system-performance-helper, tailwind-custom-templates, timed-assess, sw-pluginer, twapfetch, tfjs-custom-module, table-ui-new all trigger on install and would have delivered payload; rotate cloud credentials and reimage build runners on any hit. @lilsccott6x9/devpipe-connector is a research canary shape - if it appears in a production lockfile, treat as unauthorized and remove; a real dev-pipe connector should not write to Desktop
  9. 9*For Cluster H matches (deepface + reqcrypt PyPI): uninstall from every virtualenv. For deepface-weight / deepface-weights matches, revoke all Telegram sessions from Telegram Settings → Devices** on any account whose .session file lived on the install host - the exfiltrated session grants full account takeover. For reqcrypt matches, the backdoor is triggered by response content, so any host that installed reqcrypt AND made HTTP calls to any endpoint an attacker could influence is compromised - rotate credentials, reimage the host, and audit outbound traffic for the base64-then-exec payload fingerprint
  10. 10For all npm installs in CI, run with --ignore-scripts as defence-in-depth - but note it does NOT stop Cluster C (import-triggered) or Cluster F (require-triggered) - only postinstall lifecycle. For all pip install runs, prefer --only-binary=:all: where feasible to skip setup.py execution
  11. 11Verify none of the 28 packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

Back to feedSubmit a correction
multi-2026-08-19-ghsa-malware-sweep