DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
HighPublished 26 Aug 202628 packages · 11 versions

GitHub Advisory malware sweep - 2026-08-26 batch (PyPI `envprovision` Snow Stealer + PyPI `minecraft-ytreceiver` Telegram-C2 webcam/keylogger + PyPI `python-walletlibr-v` Windows install-time dropper + npm `twork-data-services-*` internal-scope dep-confusion + npm `wm-*` dep-confusion + npm Vue/Svelte/Vite lookalike cluster (15) + npm CWE-506 boilerplate (5))

Summary

28 new GHSA CWE-506 advisories in the 48h window ending 2026-08-26. Highlights: PyPI envprovision drops "Snow Stealer" browser/wallet infostealer with sandbox evasion; PyPI minecraft-ytreceiver runs webcam/screenshot/keylogger over Telegram C2; PyPI python-walletlibr-v fires a Windows batch dropper at pip install; npm twork-data-services-* and wm-* clusters look like internal-namespace dep-confusion probes; a 15-package Vue/Svelte/Vite lookalike cluster and 5 CWE-506 boilerplate names round out the batch.

infostealercredential-theftcrypto-wallet-draindependency-confusiontyposquatdns-exfiltrationobfuscation
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis
Also known as
2026-08-26 GHSA sweep · 2026-08-envprovision campaign · 2026-08-minecraft-ytreceiver campaign · Snow Stealer PyPI · twork-data-services dep-confusion · wm-* internal-namespace dep-confusion
Ecosystems
npmPyPI
Packages tracked
28

What happened

The 48-hour window ending 2026-08-26 06:00 UTC published 28 new GHSA CWE-506 advisories: 3 on PyPI (all with substantive infostealer/spyware payloads), 25 on npm (20 dated 2026-08-25 that landed after the previous sweep window closed, 5 dated 2026-08-26). The three PyPI entries are all defender-actionable with source hashes and payload detail; the npm entries include two coherent internal-namespace dep-confusion clusters (twork-data-services-* and wm-*), a 15-package Vue/Svelte/Vite ecosystem lookalike burst, and 5 CWE-506 boilerplate names published today.

Cluster A - PyPI envprovision Snow Stealer (3 versions)

| Package | Versions | GHSA | Source hash | Campaign | |---|---|---|---|---| | envprovision | 1.2.0, 1.3.0, 1.4.0 | GHSA-xr9j-7gjp-x8fg | cf3a48b4…d869 | 2026-08-envprovision |

Exported functions hide the harmful activity from casual inspection. On Windows the package fetches a remote executable disguised as a legitimate system tool; the binary self-identifies as Snow Stealer, an infostealer with sandbox-evasion routines and heavy obfuscation that harvests browser data (saved credentials, cookies, autofill, session tokens) and targets cryptocurrency wallet applications. Post-execution the payload wipes logs and deletes temp files to erase forensic breadcrumbs - so "we did not find IOCs on disk" is not a clean signal on an installing host.

Cluster B - PyPI minecraft-ytreceiver Telegram-C2 surveillance (5 versions)

| Package | Versions | GHSA | Source hash | Campaign | |---|---|---|---|---| | minecraft-ytreceiver | 0.1.0, 0.2.0, 0.3.0, 0.4.0, 0.5.0 | GHSA-cj4w-748x-8w4q | af6c2393…175e | 2026-08-minecraft-ytreceiver |

Full surveillance kit: webcam capture, periodic screenshots, arbitrary-file exfiltration, continuous keystroke logging, all beaconed and controlled via a Telegram bot channel. The minecraft-yt* name targets Minecraft server hobbyists / YouTube-tutorial followers rather than enterprise developers - a Telegram-controlled RAT deployed against home users. Webcam-capable devices in shared spaces should be assumed to have captured footage during the exposure window.

Cluster C - PyPI python-walletlibr-v Windows batch dropper (1 version)

| Package | Versions | GHSA | Source hash | |---|---|---|---| | python-walletlibr-v | 0.7.9 | GHSA-pfrw-v3ch-6m8x | 6783cffe…220c |

Masquerades as wallet software with stub-only user-facing code. On Windows install, writes a batch file to %TEMP%, spawns a new command console, and runs arbitrary system commands (published PoC spawns calc.exe as a harmless indicator; the same channel can execute anything). Name matches the python-wallet*-v pattern used by prior 2026 wallet-theft typosquats.

Cluster D - npm twork-data-services-* internal-scope dep-confusion (2 packages)

| Package | Version | GHSA | |---|---|---| | twork-data-services-proxy-prime-api-v1-account-overdraft-info | = 20.7.4 | GHSA-crw8-m6mj-q6qp | | twork-data-services-sme-operations-authorizations | <= 20.8.9 | GHSA-c4f8-h585-2c73 |

The name pattern (twork-data-services-<internal-service>-<domain>-<endpoint>), the SME / overdraft banking domain vocabulary, and the specific 20.x version numbers that mimic a mature internal-registry version line are the classic dep-confusion sentinel triple: guess an internal name, cover the exact version an internal resolver would look up, publish to public npm and wait for a mis-scoped install.

Cluster E - npm wm-* internal-namespace dep-confusion (3 packages)

| Package | GHSA | |---|---| | wm-eslint-fe | GHSA-59qg-7f2g-4p3c | | wm-idp-sdk | GHSA-hq9q-4jgc-997v | | wm-lib-env-provider | GHSA-54m9-xjx6-pf8x |

wm-<function>-<scope> naming (frontend eslint config, IDP SDK, env-provider library) reads like a private company's internal-package prefix. All >= 0, all CWE-506 boilerplate. No per-package hashes.

Cluster F - npm Vue/Svelte/Vite plugin lookalike burst (15 packages)

| Package | GHSA | Note | |---|---|---| | vue-template-compiler-plugin | GHSA-gvmg-cf54-7769 | Vue toolchain lookalike | | vue-compiler-sfc-plugin | GHSA-v29w-qjvw-fm35 | @vue/compiler-sfc namespace confusion | | svelte-ui-cls | GHSA-q88r-gcjf-c3jc | Svelte CLS/UI namespace | | svelte-cls-ui | GHSA-f6cw-gvwj-gw7f | Svelte CLS/UI namespace | | dim-svelte-ui | GHSA-w5m9-548m-c928 | Svelte CLS/UI namespace | | hydration-ui-cls | GHSA-596w-j9vp-pr5x | hydration/CLS lookalike | | dim-hydration-ui | GHSA-6797-g855-4767 | hydration/CLS lookalike | | hydration-cls-ui | GHSA-q635-2q7j-grxm | hydration/CLS lookalike | | vite-plugin-model | GHSA-p58m-2wrh-74xr | vite-plugin-* namespace | | vite-plugin-logo | GHSA-cw37-h4jm-63xh | vite-plugin-* namespace | | vite-plugin-cleaner | GHSA-rx9h-69c4-qhq5 | vite-plugin-* namespace | | hexdrift | GHSA-4p5f-gmxw-44x3 | Short generic name, same burst | | vortnode | GHSA-c3fw-fh7f-9h58 | Short generic name, same burst | | foldmap | GHSA-q4hh-v9hg-92w7 | Short generic name, same burst | | snapbuf | GHSA-82xg-f5h2-7xf8 | Short generic name, same burst |

All >= 0, all CWE-506 boilerplate ("considered fully compromised"). The cluster shape (Vue + Svelte + Vite hydration ecosystem in one batch, plus 4 generic short names) points to one operator publishing a plausibly-searchable frontend-tooling name burst. vue-template-compiler-plugin and vue-compiler-sfc-plugin read as legitimate build-tool add-ons and are the highest-risk of the 15.

Cluster G - npm CWE-506 boilerplate (2026-08-26, 5 packages)

| Package | GHSA | Note | |---|---|---| | renovate-config-doctolib | GHSA-8327-2h3c-rm8g | Renovate preset lookalike (highest priority in this cluster) | | express-security-policy | GHSA-3hxc-wppf-m25r | Express CSP-middleware lookalike | | array-shuffler-utils-99 | GHSA-22jp-536p-wwgr | 99 trailing token matches sentinel-version dep-confusion pattern | | fivem-tool-helper | GHSA-7jgv-5jq7-38g6 | FiveM (GTA mod) tooling lookalike | | fivem-tool-helper-v2 | GHSA-qgxc-chq8-gvrg | Twin publish, same target |

All >= 0, all CWE-506 boilerplate. renovate-config-doctolib is the highest-priority because Renovate extends: chains routinely pull shared presets from public npm - a mis-scoped resolve puts malicious config into every repo consuming the preset.

Registry state

All 28 packages yanked from their respective registries during the 2026-08-25 / 2026-08-26 takedown windows. Private mirrors that cached tarballs before takedown will keep serving them.

Related tracked activity

  • 99.x.x and trailing-99 sentinel-version dep-confusion pattern (Cluster G array-shuffler-utils-99): continues the pattern from msrcpoc@99.1.9 2026-08-25, stillm4ddpocs-* 2026-08-23, lumen-pages-community@9.9.9 2026-08-22, and fund-list-filter/fund-portfolio@999.9.12 2026-08-24.
  • PyPI infostealer with sandbox evasion + log wiping (Cluster A envprovision Snow Stealer): the "hide inside exported functions + evasion + log cleanup" combo repeats a pattern seen across the 2026-08 PyPI batches; audit any PyPI package added in the last 30 days for the same shape.
  • *Wallet-theft `python-wallet-v PyPI typosquat pattern** (Cluster C): the trailing -v and misspelled -libr- are recurring wallet-theft typosquat tells; verify any python-wallet*` import against the exact expected package name before use.
  • Telegram-bot C2 for Python malware (Cluster B minecraft-ytreceiver): Telegram Bot API is a recurring easy C2 channel because outbound api.telegram.org traffic passes most home / small-office egress filters unnoticed. Any host with unexplained api.telegram.org outbound after a PyPI install deserves a look.
  • Discovery credits: GitHub Advisory Database, OpenSSF malicious-packages (kam193), OpenSSF Package Analysis. No named threat actor.

Affected packages (28)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.jsonCheck requirements.txt

Impact

  • Cluster A - PyPI envprovision Snow Stealer infostealer (2026-08-24 -> published 2026-08-25, 1 package, 3 versions): envprovision@1.2.0, 1.3.0, 1.4.0 (GHSA-xr9j-7gjp-x8fg, source hash cf3a48b407852ec03ead22bb8c16c03f252ba5fafa5c86ed1a739427e7d7d869, campaign 2026-08-envprovision). Attack chain: exported functions hide the harmful activity from casual inspection; on Windows the package downloads and executes a remote binary disguised as a legitimate system tool; the binary self-identifies as Snow Stealer, an infostealer with sandbox-evasion routines and heavy obfuscation that harvests browser data (saved credentials, cookies, autofill, session tokens) and targets cryptocurrency wallet applications; post-execution the payload wipes logs and deletes temp files to erase forensic breadcrumbs. Any Windows host that ran pip install envprovision should be treated as compromised at infostealer level: rotate every browser-saved credential, transfer any hot-wallet funds off from a clean host, and hunt for the remote-executable filename in Windows Defender / EDR history even though the on-disk artifact is likely gone by the time you look
  • Cluster B - PyPI minecraft-ytreceiver Telegram-C2 webcam + keylogger + file-stealer (2026-08-25, 1 package, 5 versions): minecraft-ytreceiver@0.1.0, 0.2.0, 0.3.0, 0.4.0, 0.5.0 (GHSA-cj4w-748x-8w4q, source hash af6c2393210af3735a9353f40789859af7f87c96bcbd00178df62edb2ff7175e, campaign 2026-08-minecraft-ytreceiver). The payload is a full surveillance kit: webcam capture, periodic screenshots, arbitrary-file exfiltration, and continuous keystroke logging, all beaconed and controlled via a Telegram bot channel used for command-and-control and data exfil. The minecraft-yt* name suggests the operator targeted Minecraft server hobbyists / YouTube-tutorial followers rather than enterprise developers, but exposure is the same: any host that installed one of these five versions is a live keylogger with a webcam. Priority-1 remediation - webcam-capable devices in shared spaces (household desktop, streamer rig, shared studio) should be assumed to have footage of everything in front of the camera during the exposure window
  • Cluster C - PyPI python-walletlibr-v Windows batch dropper at install time (2026-08-25, 1 package, 1 version): python-walletlibr-v@0.7.9 (GHSA-pfrw-v3ch-6m8x, source hash 6783cffec9c8f9377babacd1cb4490a278bace564b34861bf49b35258be7220c). The package masquerades as wallet software with stub-only user-facing code; during install on Windows it writes a batch file to %TEMP%, spawns a new command console, and runs arbitrary system commands (the published PoC harmlessly spawns calc.exe as a proof but the same channel can execute anything). The name matches the "python-wallet*-v" pattern used by prior 2026 wallet-theft typosquats. Windows hosts that ran pip install python-walletlibr-v should be treated as running an unknown attacker-chosen command with the installing user's privileges
  • *Cluster D - npm `twork-data-services- internal-namespace dep-confusion cluster (2026-08-25, 2 packages, 2 versions)**: twork-data-services-proxy-prime-api-v1-account-overdraft-info@20.7.4 (GHSA-crw8-m6mj-q6qp) and twork-data-services-sme-operations-authorizations <= 20.8.9 (GHSA-c4f8-h585-2c73). The name pattern (twork-data-services-<internal-service>-<domain>-<endpoint>), the SME / overdraft banking domain vocabulary, and the specific 20.x version numbers (20.7.4 and 20.8.9) that mimic a mature internal-registry version line are the classic dep-confusion sentinel triple: guess an internal name, cover the exact version an internal resolver would look up, publish to public npm and wait for a mis-scoped install. Any org with an internal npm package named twork-* should audit their private registry for accidental hits from public-registry lookups during this window, and audit npm install --loglevel silly` traces for the specific full names
  • *Cluster E - npm `wm- internal-namespace dep-confusion cluster (2026-08-25, 3 packages)**: wm-eslint-fe (GHSA-59qg-7f2g-4p3c), wm-idp-sdk (GHSA-hq9q-4jgc-997v), wm-lib-env-provider (GHSA-54m9-xjx6-pf8x), all >= 0. The wm-<function>-<scope> naming (frontend eslint config, IDP SDK, env-provider library) reads like a private company's internal-package prefix. No per-package hashes published beyond the CWE-506 boilerplate. Orgs whose internal npm registry uses a wm-*` prefix should audit for any accidental public resolution during the exposure window
  • Cluster F - npm Vue / Svelte / Vite plugin lookalike cluster (2026-08-25, 15 packages): vue-template-compiler-plugin (GHSA-gvmg-cf54-7769), vue-compiler-sfc-plugin (GHSA-v29w-qjvw-fm35) - lookalikes of vue-template-compiler and @vue/compiler-sfc; svelte-ui-cls (GHSA-q88r-gcjf-c3jc), svelte-cls-ui (GHSA-f6cw-gvwj-gw7f), dim-svelte-ui (GHSA-w5m9-548m-c928), hydration-ui-cls (GHSA-596w-j9vp-pr5x), dim-hydration-ui (GHSA-6797-g855-4767), hydration-cls-ui (GHSA-q635-2q7j-grxm) - CLS/UI namespace lookalikes riding on the Svelte / hydration ecosystem; vite-plugin-model (GHSA-p58m-2wrh-74xr), vite-plugin-logo (GHSA-cw37-h4jm-63xh), vite-plugin-cleaner (GHSA-rx9h-69c4-qhq5) - vite-plugin-* namespace squatting; hexdrift (GHSA-4p5f-gmxw-44x3), vortnode (GHSA-c3fw-fh7f-9h58), foldmap (GHSA-q4hh-v9hg-92w7), snapbuf (GHSA-82xg-f5h2-7xf8) - short generic-sounding names that fit the same publishing burst. All >= 0, all CWE-506 boilerplate ("considered fully compromised"), no per-package IOCs published. The cluster shape (Vue + Svelte + Vite hydration ecosystem in one batch, plus 4 generic short names) suggests one operator publishing a burst of plausibly-searchable frontend-tooling names hoping a developer typo-installs one instead of the real @vue/* / svelte-* / vite-plugin-* package. Treat as any other CWE-506 pull
  • Cluster G - npm boilerplate CWE-506 (2026-08-26, 5 packages): renovate-config-doctolib (GHSA-8327-2h3c-rm8g) - Renovate shared-config lookalike that could ride into any repo consuming shared Renovate presets; express-security-policy (GHSA-3hxc-wppf-m25r) - Express middleware lookalike, name reads like a legitimate CSP middleware; array-shuffler-utils-99 (GHSA-22jp-536p-wwgr) - trailing 99 matches the 99.x.x sentinel-version dep-confusion pattern seen in prior sweeps; fivem-tool-helper (GHSA-7jgv-5jq7-38g6) and fivem-tool-helper-v2 (GHSA-qgxc-chq8-gvrg) - twin publications targeting the FiveM (GTA multiplayer mod) tooling ecosystem, matching the same pattern as prior game-mod supply-chain lures. All >= 0, no per-package hashes published beyond the standard GHSA boilerplate. renovate-config-doctolib is the highest-priority of the five - any org that consumes Renovate presets from a doctolib scope internally could accidentally resolve the public malicious variant

What to do

  1. 1Grep every lockfile (requirements.txt, Pipfile.lock, poetry.lock, uv.lock, package-lock.json, yarn.lock, pnpm-lock.yaml) for: envprovision, minecraft-ytreceiver, python-walletlibr-v, twork-data-services-proxy-prime-api-v1-account-overdraft-info, twork-data-services-sme-operations-authorizations, wm-eslint-fe, wm-idp-sdk, wm-lib-env-provider, vue-template-compiler-plugin, vue-compiler-sfc-plugin, svelte-ui-cls, svelte-cls-ui, dim-svelte-ui, hydration-ui-cls, dim-hydration-ui, hydration-cls-ui, vite-plugin-model, vite-plugin-logo, vite-plugin-cleaner, hexdrift, vortnode, foldmap, snapbuf, renovate-config-doctolib, express-security-policy, array-shuffler-utils-99, fivem-tool-helper, fivem-tool-helper-v2
  2. 2For Cluster A (envprovision Snow Stealer): any Windows host that installed one of 1.2.0/1.3.0/1.4.0 should be treated as compromised at infostealer level. Rotate all browser saved credentials, cookies, session tokens, and MFA seeds on every profile on that host. Rotate cryptocurrency wallet keys if any wallet application ran on that host. Because the payload wipes logs and deletes temp artifacts, do NOT rely on "we did not find IOCs on disk" as a clean signal - the malware's design is specifically to make that check useless. Push source hash cf3a48b4…d869 to endpoint scanning; hunt for the "Snow Stealer" family in EDR retrospective queries
  3. 3For Cluster B (minecraft-ytreceiver): any host that installed 0.1.0-0.5.0 is a live keylogger with a webcam feed. Webcam-capable devices in shared spaces are the priority-1 concern - a household desktop, streamer rig, or shared studio machine should be assumed to have footage of everything in front of the camera during the install-to-detection window. Rotate credentials for every service accessed from the compromised host (keylogger has captured them). Wipe the host and reinstall from clean media; the Telegram-C2 channel means the operator has arbitrary follow-on execution and simple removal is inadequate. Push source hash af6c2393…175e to endpoint scanning
  4. 4For Cluster C (python-walletlibr-v): any Windows host that ran pip install python-walletlibr-v==0.7.9 should be treated as having run an unknown attacker-chosen command with the installing user's privileges. Rotate any Windows-user-scoped credentials, check %TEMP% history for the batch dropper artifact (likely deleted by now), and hunt for the source hash 6783cffe…220c in EDR retrospective queries. Any wallet software the user installed and unlocked during the same session should have its keys rotated / funds moved from a clean host
  5. 5*For Clusters D and E (`twork-data-services-, wm-` internal-namespace guesses): orgs whose internal npm registry uses a `twork- or wm- prefix should audit private-registry logs for accidental public-registry resolution during the exposure window. The specific 20.7.4 and 20.8.9 versions on twork-data-services- suggest the operator knows or guessed the target's internal versioning line - treat as targeted dep-confusion. Configure npm to resolve internal names via --registry=<internal>` only, or use scoped names to make dep-confusion impossible in the first place
  6. 6For Cluster F (Vue/Svelte/Vite lookalikes): uninstall any that landed and rotate credentials on the installing host. When adding vue-* / svelte-* / vite-plugin-* packages, verify the exact publisher against the real @vue, svelte, or vite-plugin ecosystem publisher before install; small typos and namespace confusion are exactly the failure mode this cluster exploits. vue-template-compiler-plugin and vue-compiler-sfc-plugin in particular read as legitimate build-tool packages
  7. 7For Cluster G (2026-08-26 boilerplate): renovate-config-doctolib is the highest-risk of the batch because Renovate preset resolution can pull the malicious variant into every repo consuming the preset. Any org whose Renovate shared config lives under a doctolib GitHub org or npm scope should audit renovate.json extends: chains for public-registry resolution. express-security-policy reads as a legitimate CSP middleware - developers hand-searching for CSP helpers may install it by mistake; verify against helmet and similar established middleware
  8. 8For all pip install runs in CI, prefer --only-binary=:all: - Clusters A, B, C all execute at install time (either via setup.py/wheel side-effects or through overridden setup commands) and a wheels-only install with hash-pinning to a known-good hash is the reliable block
  9. 9For all npm install runs in CI, run with --ignore-scripts where possible; Cluster F entries publish no per-package IOCs so the specific execution path is unknown and --ignore-scripts alone may not stop a payload that fires on require()/import
  10. 10Verify none of these packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

Back to feedSubmit a correction
multi-2026-08-26-ghsa-malware-sweep