DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
HighPublished 2 Sept 20264 packages · 4 versions

GitHub Advisory malware sweep - 2026-09-02 batch (PyPI `syswatch` Snow Stealer - third `2026-08-envprovision` campaign package + npm `eslint-rxjs@1.0.1` typosquat of `eslint-plugin-rxjs` + npm `eyiouss` + `twapfetch` CWE-506 boilerplate takedowns)

Summary

PyPI syswatch@1.0.0 is a third package in the 2026-08-envprovision Snow Stealer campaign (browser + wallet infostealer, sandbox evasion, log wiping on Windows). npm eslint-rxjs@1.0.1 typosquats eslint-plugin-rxjs (OpenSSF flagged: "communicates with a domain associated with malicious activity"). eyiouss and twapfetch are all-versions CWE-506 boilerplate npm takedowns.

typosquatinfostealercredential-theftcrypto-wallet-drainobfuscation
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis · Amazon Inspector
Also known as
2026-09-02 GHSA sweep · 2026-08-envprovision wave 3 (syswatch) · eslint-rxjs eslint-plugin-rxjs typosquat
Ecosystems
npmPyPI
Packages tracked
4

What happened

The 24 hours ending 2026-09-02 published 4 new npm+PyPI malware advisories. Headline: PyPI syswatch is a third package in the 2026-08-envprovision Snow Stealer campaign (browser + wallet infostealer on Windows with sandbox evasion and log wiping - see envprovision 2026-08-24 for the family writeup). The npm side is quieter: one credible eslint-plugin-rxjs typosquat with an OpenSSF "communicates with malicious domain" tag, and two boilerplate CWE-506 takedowns.

Cluster A - PyPI syswatch Snow Stealer (third 2026-08-envprovision wave)

| Package | Version | GHSA | Payload | Campaign | |---|---|---|---|---| | syswatch | 1.0.0 | GHSA-mpch-m5gg-4894 | Snow Stealer | 2026-08-envprovision |

Same operator, same payload family as envprovision. Attack chain (Windows-only):

  1. pip install syswatch → package installs cleanly
  2. On first import syswatch, the package downloads and installs a disguised Windows executable
  3. The dropper cleans logs and deletes the downloaded stager to defeat forensic recovery
  4. Snow Stealer runs: enumerates browser saved-password / cookie / autofill stores (Chrome, Edge, Brave, Firefox), modifies cryptocurrency wallet binaries so future transaction-signing leaks keys, executes sandbox-evasion checks (process list, mouse-heuristics, VM registry-tell keys) to defeat dynamic analysis
  5. Persistent installation: pip uninstall syswatch does NOT remove the dropped Windows binary

Campaign lineage: - envprovision@1.2.0 / 1.3.0 / 1.4.0 - published 2026-08-24, source hash cf3a48b4…d869, VT file hash d49fa539…b878 - envprovision@1.2.0-1.4.0 - re-catalogued 2026-08-26 as 2026-08-envprovision campaign identifier - syswatch@1.0.0 (this file, 2026-09-02)

This is the third distinct package in the same campaign in nine days. Expect a fourth brand within days.

Cluster B - npm eslint-rxjs typosquat of eslint-plugin-rxjs

| Package | Version | GHSA | OpenSSF flag | |---|---|---|---| | eslint-rxjs | 1.0.1 | GHSA-45hh-8cg6-r5qp | communicates with a domain associated with malicious activity |

Typosquats the legitimate eslint-plugin-rxjs (RxJS lint rules maintained by Cartant). The eslint-<name> vs eslint-plugin-<name> naming is a well-known npm dep-confusion vector because a developer editing .eslintrc.js often writes plugins: ['rxjs'] (which resolves to eslint-plugin-rxjs), but when installing npm install eslint-rxjs --save-dev the shortened form is a common muscle-memory typo. Any Angular / NgRx / RxJS-heavy shop is a candidate target.

Cluster C - npm CWE-506 boilerplate

| Package | Versions | GHSA | Note | |---|---|---|---| | eyiouss | all versions (>= 0) | GHSA-h2w3-x32h-cpqq | Keyboard-mash naming, generic RCE | | twapfetch | all versions (>= 0) | GHSA-vfw8-w58v-xv38 | DeFi TWAP-price-fetcher name shape (targeting algo / MEV / market-maker dev environments) |

All-versions CWE-506 takedowns with only the standard "considered fully compromised" advisory boilerplate. Defensive value is name-level.

Registry state

All 4 packages were flagged as malware on their respective registries on 2026-09-02. syswatch has been yanked from PyPI; the three npm packages have been added to the npm quarantine list.

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector. syswatch cross-referenced against bad-packages.kam193.eu/pypi/package/syswatch (Kamil Mańkowski's PyPI malware tracker).

Affected packages (4)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.jsonCheck requirements.txt

Impact

  • Cluster A - PyPI syswatch Snow Stealer (2026-09-02, 1 package, 1 version): syswatch@1.0.0 (GHSA-mpch-m5gg-4894, campaign 2026-08-envprovision). This is the third package tracked in the ongoing 2026-08-envprovision Snow Stealer campaign after envprovision@1.2.0-1.4.0 (2026-08-24 / 2026-08-26). Payload chain: on Windows only, on import, the package downloads and installs a disguised executable, cleans logs to defeat forensic recovery, and drops Snow Stealer - a heavily obfuscated infostealer with sandbox-evasion routines that (a) enumerates browser saved-password / cookie / autofill stores (Chrome, Edge, Brave, Firefox), (b) modifies cryptocurrency wallet application binaries so subsequent transaction-signing flows leak keys, and (c) implements sandbox-evasion checks (process list, mouse-heuristics, VM registry-tell keys) that force dynamic analysis to actively fight the sample. Persistent installation behaviour: even after pip uninstall syswatch, the dropped Windows binary continues to run. Package name (syswatch = "system watcher") targets operators / SREs who might grep PyPI for a Python system-monitoring library. Any Windows host that ran pip install syswatch since 2026-09-02 needs re-imaging plus wallet-key rotation - the dropper cleans its own logs so post-hoc "we did not find IOCs on disk" is not a clean signal
  • Cluster B - npm eslint-rxjs@1.0.1 typosquat (2026-09-02, 1 package, 1 version): eslint-rxjs@1.0.1 (GHSA-45hh-8cg6-r5qp, OpenSSF CWE-506). Typosquats the legitimate eslint-plugin-rxjs (RxJS lint rules maintained by Cartant) - eslint-* shorthand-style names are a well-known npm dep-confusion vector because Node developers routinely omit the -plugin- in imports and configs. OpenSSF Package Analysis flag: "the package communicates with a domain associated with malicious activity". All the highest-fingerprinted eslint config repos (Airbnb, StandardJS, ES bar, RxJS-style guides) are candidate targets. Any Angular / NgRx / RxJS-heavy team that added eslint-rxjs to devDependencies (rather than eslint-plugin-rxjs) should assume dev-workstation compromise
  • Cluster C - npm CWE-506 boilerplate takedowns (2026-09-02, 2 packages, no per-package IOCs): eyiouss (GHSA-h2w3-x32h-cpqq) - keyboard-mash naming, generic RCE; twapfetch (GHSA-vfw8-w58v-xv38) - "twap fetch" reads as a DeFi TWAP-price-fetcher helper (targeting DeFi trader / MEV / algo bots). All-versions CWE-506 takedowns with only the standard "any computer that has this package installed or running should be considered fully compromised" advisory boilerplate - defensive value is name-level: any lockfile hit means uninstall

What to do

  1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, poetry.lock, uv.lock) for: syswatch, eslint-rxjs, eyiouss, twapfetch. Uninstall on any hit and rebuild the lockfile against a clean cache
  2. 2For Cluster A (syswatch Snow Stealer - third 2026-08-envprovision wave): any Windows host that ran pip install syswatch needs to be re-imaged. Rotate every browser saved-password, cookie, autofill entry, MFA seed, VPN / SSH / cloud-CLI credential on the host - all from a separate clean workstation. If the host held any cryptocurrency wallet, assume funds are at risk: transfer remaining balances to a fresh wallet generated on a known-clean machine before doing anything else. The Snow Stealer family also modifies wallet application binaries so any subsequent wallet install on the same host cannot be trusted - reinstall wallet software from the vendor after re-imaging, never restored from backup. Push the campaign hash lineage (see envprovision 2026-08-24 IOCs) to endpoint EDR blocklists. This is the third package in the same campaign in nine days - expect a fourth brand within days
  3. 3For Cluster B (eslint-rxjs typosquat): every package.json and eslint config in the codebase should be audited for "eslint-rxjs" and replaced with "eslint-plugin-rxjs" (the legitimate package). If eslint-rxjs was installed at any point, the dev workstation must be treated as compromised - the malicious variant "communicates with a domain associated with malicious activity" (OpenSSF Package Analysis flag), meaning outbound C2 was in place during the install window. Rotate npm / GitHub / cloud-CLI credentials on the dev workstation
  4. 4For Cluster C (CWE-506 boilerplate): any lockfile hit for eyiouss or twapfetch means uninstall and rebuild. twapfetch is a targeted name for DeFi / TWAP / MEV algo trader dev environments - if the affected workstation held any hot wallet or trading-API key, rotate those first
  5. 5For all pip install runs in CI, prefer --no-build-isolation + explicit --only-binary where possible. Note: syswatch triggers on import (not install-time build), so --only-binary does not stop it - add syswatch (and any envprovision-family variant) to your registry-mirror deny list
  6. 6For all npm install runs in CI, prefer --ignore-scripts - typosquats and dep-confusion pkgs still typically ship postinstall/preinstall hooks even when the primary payload lives in imported code
  7. 7Verify none of the enumerated packages still resolves via your private mirror - internal caches (Nexus / Artifactory / Verdaccio / Sonatype / devpi) routinely keep serving yanked tarballs after the public takedown

References

Back to feedSubmit a correction
multi-2026-09-02-ghsa-malware-sweep