GitHub Advisory malware sweep - 2026-08-27 batch (npm `hydration-vli-ui` ELF-in-JS Linux RAT + npm `commonjs-code-token` remote-eval C2 + npm `spotify-url-resolvers` Telegram-C2 project-dir exfil + npm `octopus-action` Burp Collaborator preinstall exfil + npm `chai-plus` `taskforge-9xv` second-stage installer + PyPI `pybitjs` Lazarus/PolinRider PTH-injection + PyPI `trongridet` TRX private-key exfil + PyPI PROBABLY_PENTEST cluster (4) + npm CWE-506 boilerplate (14))

What happened

The 24-hour window ending 2026-08-27 06:00 UTC published 24 new GHSA malware advisories on npm and PyPI. Unusually high substantive-payload density: five npm entries and two PyPI entries ship real IOCs (source hashes, C2 endpoints, campaign attributions), the rest are boilerplate CWE-506 fills.

Cluster A - npm hydration-vli-ui@1.0.0 ELF-in-JS Linux RAT (highest severity)

| Package | Version | GHSA | Source hash | C2 | |---|---|---|---|---| | hydration-vli-ui | 1.0.0 | GHSA-8p96-6q9p-xvw5 | 44daff58…7d0480 | 217.60.77.63 |

Linux x86_64 ELF binary disguised as JavaScript. On import / require(), drops and executes the ELF; the RAT opens a command shell over /bin/sh and /bin/bash, SOCKS/port-forwarding tunnelling, arbitrary file drop-and-execute, in-memory execution via memfd_create, and persistence through systemd user units. Exfiltrates SSH private keys, saved credentials, local database files, clipboard contents, environment variables. No authentication required to open the C2.

The hydration-vli-ui name extends the same "hydration-*ui" naming burst first seen in the 2026-08-25 sweep (hydration-ui-cls, dim-hydration-ui, hydration-cls-ui) but the ELF-in-JS payload is a categorically bigger threat than the boilerplate CWE-506 siblings in that cluster.

Cluster B - npm commonjs-code-token remote-eval postinstall C2

| Package | Versions | GHSA | Source hash | C2 | |---|---|---|---|---| | commonjs-code-token | 1.0.0, 1.0.1 | GHSA-wq3w-3cqf-rjjj | c6ab469a…4883ad | access-token-delta.vercel.app |

Postinstall runs index.js, which fetches JSON from https://access-token-delta.vercel.app and passes the returned token field directly to eval(). Cover README copied from node-cache-multithread. The eval() channel means the operator can serve anything - one hour it is credential theft, the next it is a wallet-drain, the next it is a worm to publish under the maintainer's npm token.

Cluster C - npm spotify-url-resolvers Telegram-C2 project-dir exfil

| Package | Versions | GHSA | Source hash | C2 | |---|---|---|---|---| | spotify-url-resolvers | <= 3.4.2 | GHSA-mg73-v34h-w9f9 | 7318f0d7…b1cea | Telegram bot 8837512876:AAHXFLvmJBEYmVhXgjVNgdzx8s_eilP4RsM, chat 7549282259 |

On module load, starts an hourly loop that ZIPs the project directory (node_modules and .git excluded, .env included) and exfiltrates each archive to the Telegram bot. README carries Arabic-language instructions telling the reader to require() the module - a social hook rather than a lifecycle-script auto-execute. Any project that landed this package has had every .env in the tree captured hourly for the duration of exposure.

Cluster D - npm octopus-action Burp Collaborator preinstall exfil

| Package | Versions | GHSA | Source hash | C2 | |---|---|---|---|---| | octopus-action | <= 1.0.1 | GHSA-xp3r-4585-7gx2 | 6968c2a1…4c637f2 | dfwvktnc563cparn1p88c8051w7ovej3.oastify.com |

Preinstall lifecycle script POSTs hostname, OS username, home directory, DNS configuration, package metadata, /etc/passwd, and /etc/hosts to a Burp Collaborator endpoint over HTTPS. Whether the operator is a scoped bounty-hunter or an actor abusing Collaborator as throwaway C2 infrastructure is unknowable from the artefact alone; the leak is the same either way.

Cluster E - npm chai-plus taskforge-9xv second-stage installer

| Package | Versions | GHSA | Source hash | Stage-2 C2 | |---|---|---|---|---| | chai-plus | 6.2.3, 6.2.4, 6.2.5 | GHSA-m5q5-4fx8-hh2m (+ umbrella GHSA-2r27-f59g-4hcx) | b91b2220…b020d9 | taskforge-9xv@1.3.0 -> http://coolblast.zapto.org:8888 |

On import, bootstraps by running npm install --global taskforge-9xv@1.3.0 and immediately executes it with hardcoded arguments pointing at http://coolblast.zapto.org:8888 (unencrypted; dynamic-DNS via zapto.org) with an embedded token. The chai typosquat surface is enormous - chai is the default assertion library for Mocha and one of the most-downloaded testing packages on npm.

Cluster F - PyPI pybitjs Lazarus/PolinRider blockchain-C2

| Package | Version | GHSA | Source hash | Campaign | |---|---|---|---|---| | pybitjs | 0.1.0 | GHSA-wv93-5fvj-96j3 | 8cf3b727…23c8 | 2026-08-pybitjs (Lazarus / PolinRider) |

Obfuscated JavaScript-based malware inside a PyPI wheel; downloads additional stages from a blockchain-based C2 channel (delivery resolved on-chain to defeat static block-listing). Persistence via PTH file injection re-detonates at every Python startup. Attribution aligned to Lazarus APT / PolinRider based on payload characteristics and embedded indicators - continues the year-long pattern of Lazarus-tagged PyPI wallet-theft waves.

Cluster G - PyPI trongridet TRX (Tron) private-key exfil

| Package | Version | GHSA | Source hash | Campaign | |---|---|---|---|---| | trongridet | 0.0.1 | GHSA-6q35-8j6x-jx75 | d37e7917…5a3483 | 2025-04-tronix |

Designed for Tron (TRX) private-key exfiltration. README lifted from a legitimate crypto library. Repeated PyPI uploads under variant names indicate an organised campaign against Tron users.

Cluster H - PyPI PROBABLY_PENTEST setup.py IP+username exfil (4 packages)

| Package | Versions | GHSA | Source hash | |---|---|---|---| | bigquery-agent-analytics-tracing | 0.0.0, 0.0.1 | GHSA-3757-66f7-2vxg | 08fbff35…02ad99 | | 0xfighter3 | 0.1 | GHSA-w8cx-q6rx-qfj2 | 5a97978…ff36f | | syntaxerror-package-12345 | 0.1 | GHSA-pg4p-fr45-wfxc | ede434c…171d9 | | rce-test | 0.1 | GHSA-5j7w-88pp-6hpr | c27b8e5…0fa2d |

All follow the same shape: setup.py override runs at install, exfiltrates host IP and OS username to a bounty / pentest endpoint. OpenSSF PA classifies as PROBABLY_PENTEST / GENERIC-standard-pypi-install-pentest. bigquery-agent-analytics-tracing reads as a legitimate Google BigQuery integration and is the highest-risk of the four for accidental transitive resolution in a CI job.

Cluster I - npm 2026-08-27 boilerplate CWE-506 (3 packages)

| Package | GHSA | Note | |---|---|---| | node-pino | GHSA-w294-7cjj-7mvg | pino typosquat (highest priority - pino is one of the most-downloaded loggers on npm) | | parallely | GHSA-rmhx-v9xh-x4jv | Generic name | | bnotify-web-sdk | GHSA-h2p9-v9rw-px6c | Browser-notify SDK lookalike |

Cluster J - npm 2026-08-26 boilerplate / lookalike tail (11 packages)

| Package | Versions | GHSA | Note | |---|---|---|---| | svelte-vli-ui | >= 0 | GHSA-hxqf-cq68-wh37 | Extends 2026-08-25 Svelte/hydration lookalike burst | | hydration-vli-ui (umbrella) | >= 0 | GHSA-v229-xfmv-q98w | Umbrella; 1.0.0 is the ELF RAT above | | chai-plus (umbrella) | >= 0 | GHSA-2r27-f59g-4hcx | Umbrella; 6.2.3-6.2.5 are the typosquat above | | self-certificates | >= 0 | GHSA-rwg4-cx82-h5hq | Cert-tooling probe (paired with self-sign) | | self-sign | >= 0 | GHSA-9jvg-g3cg-g557 | Cert-tooling probe (paired with self-certificates) | | shai_hulululud | >= 0 | GHSA-c83w-r5p2-qhmj | Anti-AI-scanner protestware first catalogued 2026-06-16; GHSA is new, package is not - updated in the existing module rather than duplicated here | | dumb-binding-gyp-package | >= 0 | GHSA-p8h8-j624-2qhc | Native-module probe | | model-poc-suhail | >= 0 | GHSA-cpqg-wgv2-g29r | Researcher-named PoC | | zenntechinc-cli | 1.6.4, 1.6.6 | GHSA-6wh9-pcqw-jp9j | Specific versions only (1.6.5 clean) - consistent with maintainer-account-takeover injection | | the_tax_free_cashier_is_at_9f | >= 0 | GHSA-4hc4-fpvc-7chp | Throwaway themed name | | grandfather_of_the_desert | >= 0 | GHSA-fjvc-xq44-gq59 | Throwaway themed name | | tset_racie | >= 0 | GHSA-7978-5fh2-74q2 | Throwaway themed name |

Registry state

All 24 packages yanked from npm / PyPI during the 2026-08-26 / 2026-08-27 takedown windows. shai_hulululud@1.0.48596 remained resolvable at last check (protestware, not yanked) - the new GHSA formalises it as malware for tooling that reads GHSA.

Related tracked activity

• Extended Vue/Svelte/Vite hydration lookalike burst (Cluster A hydration-vli-ui, Cluster J svelte-vli-ui): continuation of the 2026-08-25 burst catalogued in multi-2026-08-26-ghsa-malware-sweep Cluster F. The vli-ui sub-namespace is a new twist; watch for further <framework>-<any3>-ui publishes.
• Lazarus / PolinRider PyPI wallet-theft (Cluster F pybitjs): continues the pattern last seen in common-stack-generate-plugin / PolinRider and multiple 2026 PyPI Lazarus waves.
• chai typosquat surface (Cluster E chai-plus): the chai assertion library is one of the highest-download testing packages on npm; verify chai resolves to the canonical package on every install.
• Burp Collaborator abuse as throwaway supply-chain C2 (Cluster D octopus-action): the *.oastify.com domain family has legitimate bug-bounty use but no benign inbound-egress reason from production infrastructure; consider a blanket egress block for CI runners.
• Dynamic-DNS second-stage C2 (Cluster E taskforge-9xv -> coolblast.zapto.org): *.zapto.org and similar dynamic-DNS providers (ddns.net, hopto.org, no-ip.org) show up repeatedly as stage-2 C2 - a blanket egress block from CI is a low-cost, high-value control.
• Discovery credits: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector (Cluster E credit), Lazarus / PolinRider attribution for Cluster F.

Affected packages (24)

Impact

• Cluster A - npm hydration-vli-ui@1.0.0 ELF-in-JS Linux RAT (2026-08-26, 1 package, 1 version): hydration-vli-ui@1.0.0 (GHSA-8p96-6q9p-xvw5, source hash 44daff58b8bb4bd4dfad78141323781dc5972c3b5e5a4506834c2e69ff7d0480, C2 217.60.77.63). The package contains a Linux x86_64 ELF binary disguised as a JavaScript file. On require() / import, the wrapper drops and executes the ELF, which opens a full-featured RAT: command shell over /bin/sh and /bin/bash; SOCKS / port-forwarding tunnelling; arbitrary file drop-and-execute; in-memory execution via memfd_create (leaves no on-disk artefact after load); persistence through systemd user units; exfiltration of SSH private keys, saved credentials, local database files, clipboard contents, and environment variables. No authentication is required to open the C2 - activation is on import alone. This is the highest-severity entry in the batch: any Linux host that installed hydration-vli-ui@1.0.0 should be treated as root-compromised at the level of "attacker has an interactive shell right now"; systemd user-unit persistence survives casual reinstall of the developer tree
• Cluster B - npm commonjs-code-token remote-eval postinstall C2 (2026-08-26, 1 package, 2 versions): commonjs-code-token@1.0.0, 1.0.1 (GHSA-wq3w-3cqf-rjjj, source hash c6ab469a55ec3f0650bc2185b91e884304cf1e370b1e17992a328479ce4883ad, C2 access-token-delta.vercel.app). The postinstall hook runs index.js, which fetches JSON from https://access-token-delta.vercel.app and passes the returned token field directly to eval(). Whatever the operator chooses to serve at that endpoint is what runs on the installing host, with full node privileges. The README is copied from node-cache-multithread as cover story; the package has no legitimate functionality. Any host that ran npm install commonjs-code-token (either version) is a live remote-command channel until the operator lets go of the Vercel deployment. Rotate everything the install user had access to; the eval() return is unbounded so this is credential-theft, wallet-theft, or worm-propagation depending on what the operator served that hour
• Cluster C - npm spotify-url-resolvers Telegram-C2 project-directory exfil (2026-08-26, 1 package): spotify-url-resolvers <= 3.4.2 (GHSA-mg73-v34h-w9f9, source hash 7318f0d70d44a05847fe3363f59c4e1465df1ecab43fc87757c324397e2b1cea). On module load the package starts an hourly loop that archives the installer's project directory into a ZIP (excluding node_modules / .git, but including .env) and exfiltrates each archive to a Telegram bot (8837512876:AAHXFLvmJBEYmVhXgjVNgdzx8s_eilP4RsM, chat 7549282259). The README carries Arabic-language instructions encouraging the reader to require() the module - a social hook targeting Arabic-speaking developers. Any project that landed this package has had every source file plus every .env file in the working tree hourly-uploaded to the operator; assume every secret in every .env file is compromised and rotate now. Block the Telegram bot token and chat ID at the egress proxy if you have one
• Cluster D - npm octopus-action Burp Collaborator preinstall exfil (2026-08-26, 1 package): octopus-action <= 1.0.1 (GHSA-xp3r-4585-7gx2, source hash 6968c2a12f60b671ee163f42c9da14ed51d9b0b29486b4a7d1bf5014b4c637f2, C2 dfwvktnc563cparn1p88c8051w7ovej3.oastify.com). The preinstall lifecycle script runs automatically during npm install and POSTs system information over HTTPS to a Burp Collaborator endpoint on oastify.com: hostname, OS username, home directory, DNS configuration, package metadata, plus the full contents of /etc/passwd and /etc/hosts. This is the classic bug-bounty / red-team reconnaissance package pattern; whether the operator is a bounty-hunter probing scoped programs or an actor using Collaborator as convenient throwaway infrastructure is unknowable from the artefact alone. Any CI runner that resolved this package leaked its /etc/passwd and internal /etc/hosts (which routinely contains internal hostnames not otherwise resolvable). Rotate CI runner secrets and audit /etc/hosts for anything internal-topology-revealing
• Cluster E - npm chai-plus taskforge-9xv second-stage installer (2026-08-26, 1 package, 3 versions): chai-plus@6.2.3, 6.2.4, 6.2.5 (GHSA-m5q5-4fx8-hh2m, source hash b91b222013b099c570003ced5265988a19121921b071ee183cdbe304e2b020d9; a companion GHSA-2r27-f59g-4hcx marks all versions boilerplate-compromised). On module import the bootstrap function npm install --global taskforge-9xv@1.3.0 (silently) and then executes the installed package with hardcoded arguments pointing at http://coolblast.zapto.org:8888 (unencrypted HTTP; dynamic DNS via zapto.org) with an embedded authentication token. Errors are silently swallowed. The name is a chai assertion-library typosquat targeting developers who mistype the ubiquitous test-framework install. Any host that landed chai-plus should assume taskforge-9xv@1.3.0 was installed globally as a stage-2 backdoor; audit npm ls -g for it and remove
• Cluster F - PyPI pybitjs Lazarus/PolinRider blockchain-C2 (2026-08-26, 1 package, 1 version): pybitjs@0.1.0 (GHSA-wv93-5fvj-96j3, source hash 8cf3b72788a1ad482702768ea3b7f958793a0997cf77342578c31bc6dcfd23c8, campaign 2026-08-pybitjs). Ships obfuscated JavaScript-based malware inside a PyPI wheel; downloads additional stages from a blockchain-based C2 channel (delivery is resolved on-chain to defeat static block-listing). Persistence via PTH file injection ensures the payload re-detonates at every Python startup, not just install time. Attribution: aligned to Lazarus APT / PolinRider based on payload characteristics and embedded indicators - the same operator behind the earlier PyPI wallet-theft waves this year. High-confidence targeted infostealer
• Cluster G - PyPI trongridet TRX (Tron) private-key exfil (2026-08-26, 1 package, 1 version): trongridet@0.0.1 (GHSA-6q35-8j6x-jx75, source hash d37e79174370b2dcd44b05ddb583e65d2e0b878033aa0702653294dc965a3483, campaign 2025-04-tronix). Designed for cryptocurrency private-key exfiltration targeting Tron (TRX) users. Repeated PyPI uploads under variant names, README lifted from a legitimate crypto library to blend in. Any host with a Tron wallet that ran pip install trongridet should be considered wallet-compromised; move funds off-chain from a clean device
• Cluster H - PyPI PROBABLY_PENTEST setup.py IP+username exfil cluster (2026-08-26, 4 packages): bigquery-agent-analytics-tracing@0.0.0, 0.0.1 (GHSA-3757-66f7-2vxg, hash 08fbff35384a45aedc39545dd2a174889a1c35f3e6c9d044c2c201905402ad99), 0xfighter3@0.1 (GHSA-w8cx-q6rx-qfj2, hash 5a97978609c71d681a69a2da613c5e52b257a2062d7805b8db25243db50ff36f), syntaxerror-package-12345@0.1 (GHSA-pg4p-fr45-wfxc, hash ede434cf61641064a49939821778e511c3fcf8afab7e443582b8b103e13171d9), rce-test@0.1 (GHSA-5j7w-88pp-6hpr, hash c27b8e593dc0298e09bb4a5fd6acc68dc03bf324bdc7267e87482fdd10b0fa2d). All follow the same shape: setup.py override runs at install time, exfiltrates host IP and OS username. OpenSSF Package Analysis classifies as PROBABLY_PENTEST / GENERIC-standard-pypi-install-pentest. The bigquery-agent-analytics-tracing name is the highest-risk of the four - it reads as a legitimate Google BigQuery integration and an unattended CI job auto-installing on transitive resolve of a "bigquery" search would land it. The others (0xfighter3, syntaxerror-package-12345, rce-test) read as bug-bounty PoCs but the same payload channel could ship arbitrary command execution
• Cluster I - npm 2026-08-27 boilerplate CWE-506 (3 packages): node-pino (GHSA-w294-7cjj-7mvg) - pino logger typosquat, node-<popular> prefix pattern targeting the ubiquitous pino structured logger, highest priority in this cluster; parallely (GHSA-rmhx-v9xh-x4jv) - generic name; bnotify-web-sdk (GHSA-h2p9-v9rw-px6c) - lookalike "browser notify SDK". All >= 0, all CWE-506 boilerplate ("considered fully compromised") with no per-package IOCs published
• Cluster J - npm 2026-08-26 boilerplate/lookalike tail (11 packages): svelte-vli-ui (GHSA-hxqf-cq68-wh37) and hydration-vli-ui >= 0 (GHSA-v229-xfmv-q98w) - continuations of the 2026-08-25 Vue/Svelte/Vite lookalike burst under the new vli-ui sub-namespace (the specific hydration-vli-ui@1.0.0 version is the RAT above; >= 0 boilerplate is the umbrella advisory); chai-plus >= 0 (GHSA-2r27-f59g-4hcx) - umbrella advisory for the chai typosquat above; self-certificates (GHSA-rwg4-cx82-h5hq) and self-sign (GHSA-9jvg-g3cg-g557) - paired probes for self-signed-cert tooling; shai_hulululud (GHSA-c83w-r5p2-qhmj) - the anti-AI-scanner protestware first catalogued 2026-06-16 now has a formal GHSA (same package, no new version, updated in the existing npm-2026-06-16-shai-hulululud-ai-scanner-protestware.ts module); dumb-binding-gyp-package (GHSA-p8h8-j624-2qhc) - native-module probe; model-poc-suhail (GHSA-cpqg-wgv2-g29r) - researcher-named PoC; zenntechinc-cli@1.6.4, 1.6.6 (GHSA-6wh9-pcqw-jp9j) - specific-version compromise of a zenntechinc CLI (odd version pattern - 1.6.4 and 1.6.6 but not 1.6.5, consistent with maintainer-account-takeover injecting into published-but-scattered versions); the_tax_free_cashier_is_at_9f (GHSA-4hc4-fpvc-7chp), grandfather_of_the_desert (GHSA-fjvc-xq44-gq59), tset_racie (GHSA-7978-5fh2-74q2) - throwaway themed names, no per-package IOCs

What to do

1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, poetry.lock, uv.lock) for: hydration-vli-ui, commonjs-code-token, spotify-url-resolvers, octopus-action, chai-plus, pybitjs, trongridet, bigquery-agent-analytics-tracing, 0xfighter3, syntaxerror-package-12345, rce-test, node-pino, parallely, bnotify-web-sdk, svelte-vli-ui, self-certificates, self-sign, shai_hulululud, dumb-binding-gyp-package, model-poc-suhail, zenntechinc-cli, the_tax_free_cashier_is_at_9f, grandfather_of_the_desert, tset_racie
2. 2For Cluster A (hydration-vli-ui@1.0.0 Linux RAT): any Linux host that installed this package should be treated as root-compromised at the level of "attacker has an interactive shell right now". Kill the machine now if it is a shared host or CI runner. Hunt for systemd user units created in the exposure window (systemctl --user list-unit-files --state=enabled + ls -la ~/.config/systemd/user/). Search for the ELF hash 44daff58…7d0480 in EDR retrospective queries. Block C2 IP 217.60.77.63 at egress. Rotate every SSH key on the host and revoke the corresponding public keys from every server that authorized them; rotate every credential harvested from ~/.aws, ~/.docker, ~/.kube, ~/.npmrc, ~/.pypirc, browser profiles. memfd_create-executed payloads leave no on-disk artefact - assume the malware ran even if disk scanning finds nothing
3. 3For Cluster B (commonjs-code-token remote eval): uninstall from every project. Rotate every credential the install user (or the shared CI service account) had access to during the exposure window. Because the eval channel serves arbitrary content and can vary hour-to-hour, "the machine looked fine yesterday" is not a signal. Block access-token-delta.vercel.app at the egress proxy. Push source hash c6ab469a…4883ad to endpoint scanning
4. 4For Cluster C (spotify-url-resolvers Telegram-C2): every .env file on every host that landed this package has been exfiltrated on the hourly loop. Rotate every secret in every .env file in every affected project - assume API keys, DB passwords, cloud credentials, and OAuth tokens are all compromised. Block Telegram bot token 8837512876:AAHXFLvmJBEYmVhXgjVNgdzx8s_eilP4RsM (and if you can, the chat ID 7549282259) at the egress proxy. Also block generic outbound to api.telegram.org from CI runners unless required
5. 5For Cluster D (octopus-action Burp Collaborator exfil): rotate CI runner secrets on any runner that resolved this package. Audit /etc/hosts on the affected host for any internal-topology hostnames leaked to the operator. Block *.oastify.com at egress (Burp Collaborator is a legitimate bug-bounty tool but has no benign inbound-egress reason from production infrastructure)
6. 6For Cluster E (chai-plus typosquat): audit npm ls -g for taskforge-9xv@1.3.0 and remove it - the second-stage payload globally installs itself and survives uninstalling the initial chai-plus typosquat. Block coolblast.zapto.org (and pattern *.zapto.org if practical - dynamic-DNS providers have almost no benign use from production infrastructure)
7. 7For Cluster F (pybitjs Lazarus/PolinRider): any Python interpreter on a host that ran pip install pybitjs==0.1.0 re-detonates the payload at every Python startup via PTH injection. pip uninstall is not sufficient - hunt for injected .pth files under site-packages/ on every affected environment and remove them by hand. Because C2 delivery is on-chain, network-based block-listing of a single domain will not work; the reliable control is to nuke the affected virtual environment and rebuild from a locked, hash-verified requirements file
8. 8For Cluster G (trongridet TRX exfil): any Tron wallet on a host that installed trongridet==0.0.1 should be considered private-key-compromised. Move Tron funds off from a clean host now
9. 9For Cluster H (PyPI PROBABLY_PENTEST): uninstall from every environment. bigquery-agent-analytics-tracing is the highest-risk name - any org running BigQuery integrations should audit CI pip resolves for accidental transitive pulls. Even the "harmless" pentest payload channel could ship anything the operator chooses; treat as low-signal but not zero
10. 10For Cluster I (2026-08-27 npm boilerplate): node-pino is the highest-risk - developers who mistype pino (the ubiquitous structured logger with ~30M weekly downloads) or search for a "node-pino" wrapper will land the malicious variant. Verify every pino install resolves to pino on the @pino scope
11. 11For all pip install runs in CI, prefer --only-binary=:all: and pin to source hashes - Clusters F, G, H all execute at install time via setup.py or wheel side-effects
12. 12For all npm install runs in CI, run with --ignore-scripts where possible - Clusters B, C, D, E all execute via install lifecycle scripts or on require(). --ignore-scripts alone does NOT stop payloads that fire on require() (Clusters A, C, E) - a separate policy is needed to keep the package out of the tree in the first place
13. 13Verify none of these packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

• GHSA-8p96-6q9p-xvw5 - hydration-vli-ui@1.0.0 (npm Linux x86_64 ELF-in-JS RAT with systemd persistence)

  github.com
  GitHub
• GHSA-wq3w-3cqf-rjjj - commonjs-code-token (npm postinstall remote-eval C2 via Vercel)

  github.com
  GitHub
• GHSA-mg73-v34h-w9f9 - spotify-url-resolvers (npm hourly project-dir ZIP exfil to Telegram bot)

  github.com
  GitHub
• GHSA-xp3r-4585-7gx2 - octopus-action (npm preinstall /etc/passwd + /etc/hosts exfil to Burp Collaborator)

  github.com
  GitHub
• GHSA-m5q5-4fx8-hh2m - chai-plus@6.2.3-6.2.5 (npm chai typosquat with taskforge-9xv second-stage installer)

  github.com
  GitHub
• GHSA-2r27-f59g-4hcx - chai-plus umbrella (npm chai typosquat, all versions)

  github.com
  GitHub
• GHSA-wv93-5fvj-96j3 - pybitjs (PyPI Lazarus/PolinRider PTH-injection blockchain-C2)

  github.com
  GitHub
• GHSA-6q35-8j6x-jx75 - trongridet (PyPI Tron TRX private-key exfil)

  github.com
  GitHub
• GHSA-3757-66f7-2vxg - bigquery-agent-analytics-tracing (PyPI PROBABLY_PENTEST setup.py exfil)

  github.com
  GitHub
• GHSA-w8cx-q6rx-qfj2 - 0xfighter3 (PyPI PROBABLY_PENTEST setup.py exfil)

  github.com
  GitHub
• GHSA-pg4p-fr45-wfxc - syntaxerror-package-12345 (PyPI PROBABLY_PENTEST setup.py exfil)

  github.com
  GitHub
• GHSA-5j7w-88pp-6hpr - rce-test (PyPI PROBABLY_PENTEST setup.py exfil)

  github.com
  GitHub
• GHSA-w294-7cjj-7mvg - node-pino (npm pino logger typosquat, CWE-506)

  github.com
  GitHub
• GHSA-rmhx-v9xh-x4jv - parallely (npm CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-h2p9-v9rw-px6c - bnotify-web-sdk (npm CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-hxqf-cq68-wh37 - svelte-vli-ui (npm Svelte lookalike extension)

  github.com
  GitHub
• GHSA-v229-xfmv-q98w - hydration-vli-ui umbrella (npm >= 0)

  github.com
  GitHub
• GHSA-rwg4-cx82-h5hq - self-certificates (npm cert-tooling probe)

  github.com
  GitHub
• GHSA-9jvg-g3cg-g557 - self-sign (npm cert-tooling probe)

  github.com
  GitHub
• GHSA-c83w-r5p2-qhmj - shai_hulululud (npm anti-AI-scanner protestware; formalises the June disclosure)

  github.com
  GitHub
• GHSA-p8h8-j624-2qhc - dumb-binding-gyp-package (npm native-module probe)

  github.com
  GitHub
• GHSA-cpqg-wgv2-g29r - model-poc-suhail (npm researcher-named PoC)

  github.com
  GitHub
• GHSA-6wh9-pcqw-jp9j - zenntechinc-cli@1.6.4, 1.6.6 (npm specific-version compromise)

  github.com
  GitHub
• GHSA-4hc4-fpvc-7chp - the_tax_free_cashier_is_at_9f (npm throwaway CWE-506)

  github.com
  GitHub
• GHSA-fjvc-xq44-gq59 - grandfather_of_the_desert (npm throwaway CWE-506)

  github.com
  GitHub
• GHSA-7978-5fh2-74q2 - tset_racie (npm throwaway CWE-506)

  github.com
  GitHub
• GitHub Advisory Database - recent npm malware advisories

  github.com
  GitHub
• GitHub Advisory Database - recent pip malware advisories

  github.com
  GitHub