GitHub Advisory malware sweep - 2026-09-04/05 batch (`houdus` Windows sandbox-detection dropper + `timeweave` Windows WinExec dropper + Box internal dep-confusion via `canarytokens.com` DNS + `tailwind-contact-forms` crypto-drainer typosquat + `line-through` + `real-router-telemetry` + `claude-channel-discord` recon + amirgo4496 PyPI dep-confusion campaign)

What happened

The 24-hour window ending 2026-09-05 published 1 new malware advisory (houdus, PyPI) plus a large tail of Sept 4 npm and PyPI advisories that were not covered in the Sept 4 GHSA sweep - GitHub kept publishing through the day after the Sept 4 batch closed. All 30+ new advisories fall into 12 clusters, ranging from a serious Windows sandbox-detection dropper (houdus) and a Windows fetch-and-execute dropper (timeweave) down to the ongoing tea.xyz reward-farming autopublisher flood.

Cluster A - houdus PyPI Windows-only sandbox-detecting shellcode dropper (Sept 5)

| Package | Versions | GHSA | Campaign | |---|---|---|---| | houdus | 1.0.0, 1.0.1 | GHSA-frjq-w86w-r3gr | 2026-09-houdus |

Attack chain:

1. import houdus triggers loading of an obfuscated payload disguised as a .wav file
2. Payload does extensive fingerprinting against analysis sandboxes; silently no-ops if a sandbox is detected
3. On real hardware: downloads and executes heavily obfuscated code from a remote location
4. Establishes persistence via a Windows scheduled task
5. Runs shellcode

The .wav-disguised loader and sandbox-detection stage put this above the average GHSA-listed PyPI malware in effort. Classified as suspected infostealer by OpenSSF malicious-packages. Any Windows workstation that imported houdus must be treated as persistently compromised.

Cluster B - timeweave PyPI Windows WinExec dropper

| Package | Versions | GHSA | Payload host | |---|---|---|---| | timeweave | 1.0.0 - 1.9.0 (10 versions) | GHSA-pjqm-mp65-gqw6 | timezone.api.globaltimedata.com |

Masquerades as a timezone utility. On any advertised API call (timezone detection or conversion) it spawns a background thread deceptively named curls-autoupdate, fetches a JSON manifest from https://timezone.api.globaltimedata.com/latest/db.json, downloads arbitrary files into a temp dir prefixed firebeta_, and executes each via ctypes.windll.kernel32.WinExec.

The C2 server controls the manifest, the payload files, AND their checksums - no attacker-independent integrity check is possible. Because activation is on API-call rather than import, a scan that looks for import timeweave on live processes misses hosts that used it once and cached shellcode.

Cluster C - Box @box/sign-client dep-confusion via canarytokens.com DNS

| Package | Versions | GHSA | Exfil channel | |---|---|---|---| | box-sign-client | 1.0.0 | GHSA-g83p-hr9q-m2pp | iv6mfybhp42k33ysmzi73de5w.canarytokens.com DNS | | box-sign-client-poc | <=1.0.0 | GHSA-33rh-wv8r-6q4r | Same |

Both target Box's internal @box/sign-client namespace. preinstall reads os.hostname() and process.env.USER/USERNAME, embeds them plus a timestamp into a DNS subdomain, and resolves against iv6mfybhp42k33ysmzi73de5w.canarytokens.com (Thinkst Canarytokens beacon).

Why DNS + Canarytokens matters: canarytokens.com is a legitimate defender-side tripwire service - a defender who blocks it likely also blocks legitimate red-team infrastructure the enterprise uses. The operator is deliberately hiding inside noise a defender would hesitate to block. If this fired against a Box CI host, the operator knows Box's internal namespace resolves to public npm and a weaponised follow-up drop is coming.

Cluster D - tailwind-contact-forms crypto-drainer typosquat

| Package | Versions | GHSA | C2 | |---|---|---|---| | tailwind-contact-forms | <=0.5.12 (13 versions) | GHSA-389v-79qp-mvg6 | h.drpc.org, pc.io/eth, stapi.io, ut.com/api |

Impersonates the legitimate @tailwindcss/forms plugin. package.json repository field falsely references Tailwind Labs. Payload in src/index.js is obfuscated, fires on install and require(), and hits crypto infrastructure endpoints with Etherscan-style module=account&action=txlist queries - wallet-address enumeration and likely a follow-on wallet-drain drop.

Cluster E - real-router-telemetry .env credential exfil to webhook.site

| Package | Versions | GHSA | Exfil | |---|---|---|---| | real-router-telemetry | 1.0.1, 1.0.4 | GHSA-cwm2-j3h3-g35f | https://webhook.site/e32d3b8a-a5df-40cc-ae60-7a8343b581e4 |

Obfuscated telemetry.js grabs hostname, username, CWD, platform, arch, memory, CPU info, runs shell commands for OS + process enumeration, and reads .env from CWD - every API key and DB password in the workspace .env is exfiltrated. postinstall hook fires the payload on 1.0.1; on 1.0.4 the postinstall was partially disabled but the code still runs on require().

Cluster F - line-through GitHub Actions env-var exfil

| Package | Versions | GHSA | Exfil | |---|---|---|---| | line-through | 1.0.0 | GHSA-j28f-v2rv-5qxh | webhook.site + *.your-collab-domain.oastify.com |

preinstall script vishu.js grabs public IP, hostname, and GitHub Actions env vars: CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID, ... - deliberately targets CI/CD workflow tokens rather than developer laptops. Dual-channel exfil: HTTPS GET to https://webhook.site/66059630-2030-4b44-b2df-d37e02be0a7d and DNS to <hostname>.your-collab-domain.oastify.com (the literal Burp Collaborator placeholder is either debug leftovers or a real deployment). Any GitHub Actions run that installed line-through compromised every workflow secret visible at that step.

Cluster G - claude-channel-discord pipedream fingerprinter

| Package | Versions | GHSA | Exfil | |---|---|---|---| | claude-channel-discord | 9.9.9 | GHSA-787m-xjf4-8gx6 | https://eo8f3m3ho26a0nm.m.pipedream.net/claude-channel-discord?h=<hostname> |

Low-yield dep-confusion probe. Runs on preinstall, postinstall, and require. 9.9.9 version tag and Anthropic-adjacent naming are the tell. This is a fingerprinter, not the attack. If it resolved, the follow-up drop is coming.

Cluster H - ulid-intel + @crysnovax/* npm minimal-detail malware

| Package | GHSA | Note | |---|---|---| | ulid-intel | GHSA-h48j-674x-299v | Full-compromise boilerplate | | @crysnovax/plug | GHSA-vg98-2r8g-7qw2 | Full-compromise boilerplate | | @crysnovax/baileys | GHSA-c34p-4828-cg5g | Typosquat of @whiskeysockets/baileys | | @crysnovax/baileys-fixed | GHSA-262v-p7h8-9574 | Typosquat of @whiskeysockets/baileys | | @crysnovax/baileys-stable | GHSA-p579-542j-6v98 | Typosquat of @whiskeysockets/baileys |

GHSA metadata is thin. The four @crysnovax/* packages share an operator and specifically target developers building WhatsApp Web automation with @whiskeysockets/baileys - a common target for account-takeover or session-hijack payloads.

Cluster I - amirgo4496 PyPI dep-confusion campaign

| Package | Versions | GHSA | |---|---|---| | tpu-raiden-jax | >=99.99.0 | GHSA-3cvj-xhpg-ggw5 | | pymaas | 99.99.0 | GHSA-9hv8-x7fp-26vw | | olympuslib | >=99.99.0 | GHSA-jjjp-27xc-v3pv |

All three exfiltrate environment variables on import. >=99.99.0 version numbering is classic dep-confusion. Any organisation with an internal tpu-raiden-jax / pymaas / olympuslib pinned below 99.99.0 and no --index-url override will pull the malicious public version. Environment variables in most CI shells include cloud credentials, so the payload is high-value despite the "limited risk" classification in the OpenSSF metadata.

Cluster J - Generic PyPI pentest sweep

| Package | Versions | GHSA | |---|---|---| | chartkit-core | 1.0 | GHSA-qhj3-jww9-gmfc | | metricboxlite | 1.0, 2.0 | GHSA-92qj-f225-g878 |

Both override setup.py install to exfil IP+username on install or import; campaign GENERIC-standard-pypi-install-pentest. Boilerplate pentest artefacts.

Cluster K - astlsi + qoeoe PyPI file-exfil

| Package | Versions | GHSA | Campaign | |---|---|---|---| | astlsi | 0.1.0 | GHSA-mcr6-6rvw-7mg3 | Android-targeting | | qoeoe | 0.1.0 | GHSA-mf95-3h9p-8xpm | 2026-09-asti |

Hidden code exfiltrates files to a remote server. C2 endpoints not disclosed in GHSA metadata.

Cluster L - tea.xyz autopublisher flood tail

~25 new damp_* / damaged_* / dandelion-* / daliuren-* / damradio / danangwijaya / danasah packages, all autopublisher-generated names abusing the tea.xyz protocol's dependency-count-based reward inflation. See npm-2026-07-25-ghsa-tea-xyz-backfill for the pattern write-up. No credential-stealer / wallet-drain payload; near-zero probability of a lockfile hit.

Registry state

All packages listed above were flagged as malware on the npm and PyPI registries between 2026-09-04 and 2026-09-05 and added to the respective quarantine lists. Private mirrors (Verdaccio, Artifactory, Nexus, devpi) that cached tarballs before the takedown will keep serving the malicious versions - blocking the C2 hosts (globaltimedata.com, webhook.site, canarytokens.com from build hosts, oastify.com, pipedream.net beacon subdomains) at the network edge is a durable mitigation independent of registry-side quarantine.

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, bad-packages.kam193.eu.

Affected packages (38)

Impact

• Cluster A - houdus PyPI Windows-only sandbox-detecting shellcode dropper (1 package, 2 versions): houdus@1.0.0+1.0.1 (GHSA-frjq-w86w-r3gr, campaign 2026-09-houdus) loads an obfuscated payload disguised as a .wav file on import. Windows-only, and does extensive fingerprinting against analysis sandboxes before doing anything malicious - if it detects a sandbox it silently no-ops, so a shallow dynamic-analysis pass sees nothing. On real hardware it downloads and executes heavily obfuscated code from a remote location, establishes persistence via Windows scheduled tasks, and runs shellcode. Suspected infostealer per the OSF malicious-packages classification. Any Windows developer workstation that imported houdus must be treated as fully compromised (persistence survives package removal)
• Cluster B - timeweave PyPI Windows fetch-and-execute dropper (1 package, 10 versions): timeweave@1.0.0-1.9.0 (GHSA-pjqm-mp65-gqw6) masquerades as a timezone utility. On any advertised API call (timezone detection or conversion) it spawns a background thread deceptively named curls-autoupdate, fetches a JSON manifest from https://timezone.api.globaltimedata.com/latest/db.json, downloads arbitrary files into a temp dir prefixed firebeta_, and executes them via ctypes.windll.kernel32.WinExec. The C2 server controls both the manifest payload AND its checksums - no integrity check possible. Because activation happens on library use (not just import), --no-deps audits miss it. Any Windows host that ran a timeweave-calling script during the exposure window must be treated as running attacker-supplied code
• Cluster C - Box @box/sign-client dep-confusion via canarytokens.com DNS (2 packages, 2 versions): box-sign-client@1.0.0 (GHSA-g83p-hr9q-m2pp) and box-sign-client-poc@<=1.0.0 (GHSA-33rh-wv8r-6q4r) target Box's internal @box/sign-client namespace. Both run a preinstall script that reads os.hostname() and process.env.USER/USERNAME, embeds the values plus a timestamp into a DNS subdomain, and resolves against iv6mfybhp42k33ysmzi73de5w.canarytokens.com (a Thinkst Canarytokens beacon token). This is fingerprinting for a follow-up drop against confirmed-vulnerable Box installations - a preinstall DNS beacon is deliberately low-noise and slips past HTTPS egress filters that ignore DNS. Box engineers should audit private-registry precedence rules immediately
• Cluster D - tailwind-contact-forms crypto-drainer typosquat (1 package, <=13 versions): tailwind-contact-forms@<=0.5.12 (GHSA-389v-79qp-mvg6) impersonates the legitimate @tailwindcss/forms plugin. Package repository metadata falsely references Tailwind Labs' upstream. On install and require() an obfuscated payload in src/index.js reads hostname and env vars, then contacts cryptocurrency infrastructure: h.drpc.org, pc.io/eth, stapi.io, ut.com/api, and Etherscan-style endpoints with module=account&action=txlist parameters. Behaviour is consistent with a wallet-address enumeration / eventual wallet-drain drop. Any developer who fat-fingered @tailwindcss/forms and pulled tailwind-contact-forms must audit for wallet-address exposure
• Cluster E - real-router-telemetry .env credential exfil to webhook.site (1 package, 2 versions): real-router-telemetry@1.0.1+1.0.4 (GHSA-cwm2-j3h3-g35f) ships an obfuscated telemetry.js that grabs hostname, username, CWD, platform, arch, memory, CPU info, runs shell commands to enumerate OS + running processes, and reads .env from the CWD - so any API key, DB password, or OAuth secret in the workspace .env is exfiltrated. Data is POSTed to https://webhook.site/e32d3b8a-a5df-40cc-ae60-7a8343b581e4. The 1.0.4 version had the postinstall hook partially disabled but the module still runs on import
• Cluster F - line-through webhook.site + oastify.com CI/CD-env exfil (1 package, 1 version): line-through@1.0.0 (GHSA-j28f-v2rv-5qxh) preinstall script vishu.js grabs public IP, hostname, and GitHub Actions env vars (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID, ...) - a targeted CI/CD workflow-token-theft posture rather than developer laptop hunting. Exfil is dual-channel: HTTPS GET to https://webhook.site/66059630-2030-4b44-b2df-d37e02be0a7d and DNS to <hostname>.your-collab-domain.oastify.com (default Burp Collaborator subdomain - either debug leftovers or a real deployment). Any GitHub-Actions workflow that installed line-through should treat every workflow secret visible at that step as compromised
• Cluster G - claude-channel-discord pipedream beacon (1 package, 1 version): claude-channel-discord@9.9.9 (GHSA-787m-xjf4-8gx6) is a low-yield dep-confusion probe. Preinstall+postinstall+require paths all execute node index.js which reads os.hostname() and GETs https://eo8f3m3ho26a0nm.m.pipedream.net/claude-channel-discord?h=<hostname>. The 9.9.9 version tag and Anthropic-adjacent naming (dep-confusion probe against an internal claude-channel-discord-style package) are the fingerprint. Not a payload; a fingerprinter for a follow-up drop
• *Cluster H - ulid-intel + `@crysnovax/ npm minimal-detail malware (5 packages, all versions)**: ulid-intel (GHSA-h48j-674x-299v) and the four @crysnovax/ packages plug (GHSA-vg98-2r8g-7qw2), baileys-fixed (GHSA-262v-p7h8-9574), baileys-stable (GHSA-p579-542j-6v98), baileys (GHSA-c34p-4828-cg5g) - GHSA flags each with the boilerplate "any computer that has this package installed should be considered fully compromised" and no further technical detail. The four @crysnovax/ names cluster under one operator; baileys* are typosquats/rebrands of the popular @whiskeysockets/baileys` WhatsApp Web API library and would be pulled by anyone building WhatsApp automation. Uninstall on any lockfile hit and rotate any credentials on the host
• Cluster I - amirgo4496 PyPI dep-confusion recon campaign (3 packages, versions >=99.99.0): tpu-raiden-jax (GHSA-3cvj-xhpg-ggw5), pymaas@99.99.0 (GHSA-9hv8-x7fp-26vw), and olympuslib (GHSA-jjjp-27xc-v3pv) share campaign id 2026-09-amirgo4496. All exfiltrate environment variables on import; the >=99.99.0 version numbering is the classic dep-confusion trick (any organisation with an internal tpu-raiden-jax/pymaas/olympuslib package pinned below 99.99.0 will resolve the malicious public version instead). Classified as "limited risk" by researchers but the fingerprint they capture (env vars including cloud credentials in most CI shells) is high-value
• Cluster J - Generic PyPI pentest-pattern sweep (2 packages, 3 versions): chartkit-core@1.0 (GHSA-qhj3-jww9-gmfc) and metricboxlite@1.0+2.0 (GHSA-92qj-f225-g878) - both override the setup.py install command to exfil IP and username on install or import; campaign GENERIC-standard-pypi-install-pentest. Boilerplate pentest-tooling artefacts more than targeted attacks, but the same behaviour under a different name is used by real threat actors, so flag anyway
• Cluster K - astlsi + qoeoe PyPI file-exfil (2 packages, 2 versions): astlsi@0.1.0 (GHSA-mcr6-6rvw-7mg3) and qoeoe@0.1.0 (GHSA-mf95-3h9p-8xpm, campaign 2026-09-asti) both contain hidden code that exfiltrates files to a remote server. Advisory metadata tags them Android-targeting. C2 endpoints are not disclosed in the GHSA record but the file-exfil pattern is the payload
• Cluster L - tea.xyz autopublisher flood tail (>=25 npm packages, all versions): damp_* (damp_haddock_requirement, damp_manatee_z3n, damp_coyote_0xrequest, damp_guanaco_z3n, damp_mastodon_z3n, damp_spoonbill_coral-60, damp_wolverine_white-89, damp_vulture_z3n, damp_pelican_z3n, damp_swift-gooddev, damp_dog_z3n, damp_guineafowl_z3n, damp_ermine_z3n, damp_hawk_0xrequest, damp_hippopotamus_z3n, damp_tuna_z3n, damp_gayal_z3n, damp_angelfish_gray-42, damp_sheep_z3n), damaged_*, dandelion-* (dandelion-coral-rpv024-project, dandelion-amber-owt940-project, dandelion-giraffe-mpa122-project, dandelion-dune-cli341-project, dandelion-brook-wuk348-project, dandelion-cliff-atc189-project), daliuren-*, dampradio, danangwijaya, danasah. All autopublisher-generated names abusing tea.xyz protocol reward inflation - see npm-2026-07-25-ghsa-tea-xyz-backfill for the pattern write-up. No credential-stealer / wallet-drain payload; zero practical dependency-audit risk (nobody legitimately depends on damp_wolverine_white-89)

What to do

1. 1Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, Pipfile.lock, uv.lock, and internal registry mirror for the package names below. Uninstall and rebuild the lockfile against a clean cache on any hit
2. 2For Cluster A (houdus Windows dropper): any Windows host that ran import houdus should be treated as persistently compromised - the scheduled-task persistence survives package removal. Isolate the host, image it, and rebuild from a clean template rather than trying to clean in place. The obfuscated .wav payload and sandbox-detection logic mean signature-based AV likely missed the initial infection
3. 3For Cluster B (timeweave): block outbound DNS/HTTPS to timezone.api.globaltimedata.com and *.globaltimedata.com from any Windows build/dev host. Uninstall timeweave from every project. Because activation is on API-call (not just import), a pip list --outdated sweep is insufficient - grep for import timeweave in every project. Rotate any credential accessible to a host that ran a timeweave-using script
4. 4For Cluster C (Box @box/sign-client dep-confusion): Box engineers - audit .npmrc scope-registry pinning for the @box scope on every developer laptop and CI host. If either box-sign-client or box-sign-client-poc resolved on any host, the operator now knows Box's internal namespace resolves to public npm and a weaponised follow-up drop is coming. Block DNS to *.canarytokens.com from build/CI hosts (legit uses of Canarytokens are staff-side, not build-side)
5. 5For Cluster D (tailwind-contact-forms): grep for tailwind-contact-forms in every lockfile. Any hit indicates a fat-finger of @tailwindcss/forms - remove it, pin @tailwindcss/forms explicitly, and audit for wallet-address exposure or unexpected outbound to h.drpc.org/pc.io/stapi.io/ut.com
6. 6For Clusters E + F (real-router-telemetry, line-through webhook.site exfil): rotate every credential in any .env file present on the host during the exposure window. Block outbound to webhook.site from build/CI hosts entirely (webhook.site has zero legitimate build-time use and is by far the most common exfil sink). For line-through: any GitHub Actions workflow that installed it, treat every workflow secret visible at the step as compromised - rotate GITHUB_TOKEN, deploy keys, npm publish tokens, container registry creds, and any org-level secret exposed to the workflow
7. 7For Cluster G (claude-channel-discord): fingerprinting probe only. If it resolved, the follow-up drop is coming; add @claude-* scopes and internal Anthropic-adjacent package names to your private-registry scope pin in .npmrc
8. 8*For Cluster H (ulid-intel + `@crysnovax/)**: uninstall on hit, rotate secrets. The baileys*-named packages are typosquats against @whiskeysockets/baileys (WhatsApp Web API) - if you build WhatsApp automation, pin explicitly to @whiskeysockets/baileys`
9. 9For Cluster I (amirgo4496 PyPI dep-confusion): if any internal tpu-raiden-jax, pymaas, or olympuslib package existed at a version below 99.99.0 and any developer or CI host ran pip install without an explicit index-url override, the malicious public version was pulled. Audit pip config and set --index-url explicitly to your internal mirror. Rotate any env-var-exposed secret on affected hosts (env vars in CI usually include cloud credentials)
10. 10For Clusters J + K + L (pentest, file-exfil, tea.xyz flood): uninstall on hit; no host-forensics response required beyond routine credential-rotation prudence. The tea.xyz flood packages are cataloguing noise - the near-zero probability of a lockfile hit means they exist here for audit-trail completeness, not urgent response
11. 11For every npm install and pip install in CI, prefer --ignore-scripts / pip install --no-deps where feasible - this blocks Clusters B (partial), C, D (partial), E (postinstall path only), F, G preinstall vectors. Clusters A, B (main path), D (require-time), H, I still fire on import - the only defence there is not resolving the package at all

References

• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub
• GHSA-frjq-w86w-r3gr - houdus (PyPI Windows sandbox-detecting shellcode dropper)

  github.com
  GitHub
• GHSA-pjqm-mp65-gqw6 - timeweave (PyPI Windows WinExec dropper via globaltimedata.com)

  github.com
  GitHub
• GHSA-g83p-hr9q-m2pp - box-sign-client (Box internal dep-confusion, canarytokens.com DNS beacon)

  github.com
  GitHub
• GHSA-33rh-wv8r-6q4r - box-sign-client-poc (Box internal dep-confusion, canarytokens.com DNS beacon)

  github.com
  GitHub
• GHSA-389v-79qp-mvg6 - tailwind-contact-forms (@tailwindcss/forms typosquat, wallet-address enumeration)

  github.com
  GitHub
• GHSA-cwm2-j3h3-g35f - real-router-telemetry (.env exfil to webhook.site)

  github.com
  GitHub
• GHSA-j28f-v2rv-5qxh - line-through (GitHub Actions env exfil to webhook.site + oastify.com)

  github.com
  GitHub
• GHSA-787m-xjf4-8gx6 - claude-channel-discord (pipedream.net dep-confusion beacon)

  github.com
  GitHub
• GHSA-h48j-674x-299v - ulid-intel

  github.com
  GitHub
• GHSA-vg98-2r8g-7qw2 - @crysnovax/plug

  github.com
  GitHub
• GHSA-c34p-4828-cg5g - @crysnovax/baileys (baileys typosquat)

  github.com
  GitHub
• GHSA-262v-p7h8-9574 - @crysnovax/baileys-fixed (baileys typosquat)

  github.com
  GitHub
• GHSA-p579-542j-6v98 - @crysnovax/baileys-stable (baileys typosquat)

  github.com
  GitHub
• GHSA-3cvj-xhpg-ggw5 - tpu-raiden-jax (2026-09-amirgo4496 env-var exfil)

  github.com
  GitHub
• GHSA-9hv8-x7fp-26vw - pymaas (2026-09-amirgo4496 env-var exfil)

  github.com
  GitHub
• GHSA-jjjp-27xc-v3pv - olympuslib (2026-09-amirgo4496 env-var exfil)

  github.com
  GitHub
• GHSA-qhj3-jww9-gmfc - chartkit-core

  github.com
  GitHub
• GHSA-92qj-f225-g878 - metricboxlite

  github.com
  GitHub
• GHSA-mcr6-6rvw-7mg3 - astlsi

  github.com
  GitHub
• GHSA-mf95-3h9p-8xpm - qoeoe (2026-09-asti)

  github.com
  GitHub
• OpenSSF malicious-packages repository

  github.com
  OpenSSF