DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
CriticalPublished 6 Sept 202627 packages · 27 versions

GitHub Advisory malware sweep - 2026-09-05/06 batch (`@liuliang520500/*` Chinese e-commerce SDK impersonators + `@domyjs/*` reactive-framework typosquats + `date-fns-formatter` date-fns typosquat + `trongridew` PyPI Tronix private-key exfil + `proxycer`/`dbt-sa-cli` generic PyPI install-time exfil)

Summary

Tail sweep after yesterday's batch. 6 @liuliang520500/* npm packages impersonate Sina Taoke, Pinduoduo, JD.com, and Taobao SDKs; 7 @domyjs/* npm packages typosquat a reactive-framework namespace; date-fns-formatter extends the date-fns typosquat family; trongridew (PyPI) is a Tron/TRX private-key exfil dropper; proxycer/dbt-sa-cli are install-time IP+username exfil pentest artefacts.

typosquatdependency-confusioncredential-theftinfostealercrypto-wallet-drain
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis · bad-packages.kam193.eu
Also known as
2026-09-06 GHSA sweep · @liuliang520500 Chinese e-commerce SDK impersonators · @domyjs reactive-framework typosquat sweep · date-fns typosquat family (date-fns-formatter) · 2025-04-tronix Tron private-key exfil (trongridew) · 2025-02-pxz proxycer
Ecosystems
npmPyPI
Packages tracked
27

What happened

The 24-hour window ending 2026-09-06 published 25 new malware advisories - 13 npm packages published Sept 6 and 12 more Sept 5 npm/PyPI advisories that surfaced after yesterday's (Sept 5) sweep closed. All fall into 6 clusters. Two of the six (Cluster A @liuliang520500/* Chinese e-commerce SDK impersonators, Cluster B @domyjs/* reactive-framework typosquat sweep) are single-operator drops of 6-7 packages each under one npm scope. Cluster C (date-fns-formatter) extends an already-active date-fns typosquat family. Cluster E (trongridew, PyPI) is a Tron/TRX cryptocurrency private-key exfil from the long-running 2025-04-tronix campaign. Clusters D and F are boilerplate opportunistic drops and PROBABLY_PENTEST reconnaissance artefacts.

Cluster A - @liuliang520500/* Chinese e-commerce SDK impersonator sweep (Sept 6)

| Package | GHSA | Impersonates | |---|---|---| | @liuliang520500/sinataoke_cn | GHSA-jjx2-vpx2-qp32 | Sina Taoke (coupon/affiliate SDK) | | @liuliang520500/sinataoke_cn_test | GHSA-36jr-wqjh-q55x | Sina Taoke (test-suffixed variant) | | @liuliang520500/pdd-sdk | GHSA-g9hc-xr9f-27g4 | Pinduoduo (PDD) open-platform SDK | | @liuliang520500/pdd-sdk-new | GHSA-jp84-gqp2-j9qq | Pinduoduo (PDD) - "new" suffix | | @liuliang520500/jd-sdk | GHSA-j849-992g-rggr | JD.com open-platform SDK | | @liuliang520500/taobao-topclient | GHSA-75r6-9fpm-rf6j | Taobao TOP client SDK |

One operator publishing under one npm scope, all six packages named after the four biggest Chinese e-commerce open-platform SDKs. GHSA metadata is thin (boilerplate "any computer that has this package installed or running should be considered fully compromised") but the six-package burst under one scope is the classic drop-and-run pattern - the operator expects a subset of developers at Chinese e-commerce integrators (or Western brands' outsourced integration partners) to fat-finger the scope while adding legitimate @jd/*, @pdd/*, @sina/*, or @taobao/* dependencies.

Cluster B - @domyjs/* reactive-framework typosquat sweep (Sept 5)

| Package | GHSA | Framework role | |---|---|---| | @domyjs/reactive | GHSA-3ggc-3pw2-c9v9 | State / reactivity | | @domyjs/i18n | GHSA-22jr-v88r-5cj6 | Internationalisation | | @domyjs/router | GHSA-j7wp-3648-mh57 | SPA router | | @domyjs/intersect | GHSA-v8xv-9q46-8h3x | Intersection observer | | @domyjs/throttle | GHSA-fr62-p59g-hr9f | Throttle / debounce | | @domyjs/mask | GHSA-93j2-q7r7-7qhh | Input mask | | @domyjs/collapse | GHSA-39q9-7vqg-3m6w | Collapse / expand UI |

Seven packages under @domyjs published together and covering what looks like an entire reactive-framework utility ecosystem. The naming is designed to look like a legitimate Vue-adjacent or Svelte-adjacent utility bundle. Boilerplate GHSA metadata but any lockfile hit on the @domyjs scope means an operator now has full-compromise access to the host.

Cluster C - date-fns-formatter date-fns typosquat (Sept 6)

| Package | GHSA | Family | |---|---|---| | date-fns-formatter | GHSA-h258-m2gc-2p4q | date-fns typosquat |

Extends the ongoing date-fns typosquat family (siblings: datefmt-helper = MAL-2026-6788, date-fns-lite = MAL-2026-6722, date-fns-2). The date-fns family is one of the highest-download npm namespaces so typosquat probability against it is high. Boilerplate GHSA metadata but assume the same postinstall-hook AWS/GCP/Azure/SSH credential harvest pattern the other family members used, until reverse-engineered otherwise.

Cluster D - Miscellaneous npm boilerplate malware (Sept 5-6)

| Package | GHSA | Published | |---|---|---| | @pilllesss/yorn | GHSA-rghh-4gfg-jvqc | Sep 6 | | 1cattunnel | GHSA-r35j-cv2x-mm7h | Sep 6 | | dcftunnel | GHSA-4c2f-x64v-297x | Sep 6 | | multicore-kit | GHSA-q588-cfvg-8346 | Sep 6 | | array-frames | GHSA-24hx-4mc8-g9q7 | Sep 6 | | node-helper | GHSA-2ggc-wmq2-3whp | Sep 6 | | jwt-logger | GHSA-rpqx-cp2g-55w5 | Sep 5 | | array-scala | GHSA-rx3f-9hxc-773g | Sep 5 | | infinity-grid | GHSA-39fr-j2vr-r24p | Sep 5 | | btn-particles | GHSA-6w56-62pq-vhph | Sep 5 |

Boilerplate CWE-506 "any computer that has this package installed or running should be considered fully compromised" with no source, no C2. 1cattunnel / dcftunnel share the -tunnel suffix pattern - either legitimate-sounding tunnel utilities or paired droppers under one operator. jwt-logger and node-helper are generic-utility naming designed to slip past a shallow audit. multicore-kit reads as a plausible node-multicore adjacent name.

Cluster E - trongridew PyPI Tron/TRX private-key exfil (Sept 5)

| Package | Versions | GHSA | Campaign | |---|---|---|---| | trongridew | 0.0.1 | GHSA-vjjx-756v-6p3x | 2025-04-tronix |

OpenSSF malicious-packages: "appears to be designed for private key exfiltration". Naming references TRX (Tron / Tronix blockchain). Uses deceptive tactics by cloning legitimate library documentation. Part of the long-running 2025-04-tronix campaign that has re-uploaded this and adjacent typosquats repeatedly to PyPI. Any Python cryptocurrency tool depending on trongridew (dep-confusion against internal tronpy-adjacent names, or a fat-finger of the real package) leaks TRX private keys.

Cluster F - Generic PyPI install-time exfil pentest artefacts (Sept 5)

| Package | Versions | GHSA | Campaign | |---|---|---|---| | proxycer | 0.1.0 | GHSA-qff6-cqrr-65wv | 2025-02-pxz | | dbt-sa-cli | 0.0.1 | GHSA-xf8p-r8w2-fx5m | GENERIC-standard-pypi-install-pentest |

Both classified "PROBABLY_PENTEST" by OpenSSF - low-harm reconnaissance rather than a real payload. proxycer collects basic user info on import; dbt-sa-cli overrides setup.py install to exfil IP+username on install. The dbt-sa-cli name is a plausible dep-confusion probe against internal dbt (data-build-tool) service-account CLI utilities in enterprise data teams.

Registry state

All packages listed above were flagged as malware on the npm and PyPI registries between 2026-09-05 and 2026-09-06 and added to the respective quarantine lists. Private mirrors (Verdaccio, Artifactory, Nexus, devpi) that cached tarballs before takedown will keep serving the malicious versions - explicit deny-listing of the @liuliang520500 and @domyjs npm scopes and the trongridew PyPI name is a durable mitigation independent of registry-side quarantine.

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, bad-packages.kam193.eu.

Affected packages (27)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.jsonCheck requirements.txt

Impact

  • *Cluster A - `@liuliang520500/ Chinese e-commerce SDK impersonator sweep (6 packages, all versions)**: @liuliang520500/sinataoke_cn (GHSA-jjx2-vpx2-qp32), @liuliang520500/sinataoke_cn_test (GHSA-36jr-wqjh-q55x), @liuliang520500/pdd-sdk-new (GHSA-jp84-gqp2-j9qq), @liuliang520500/jd-sdk (GHSA-j849-992g-rggr), @liuliang520500/pdd-sdk (GHSA-g9hc-xr9f-27g4), @liuliang520500/taobao-topclient` (GHSA-75r6-9fpm-rf6j) - one operator publishing under a single npm scope, all six packages named after the four biggest Chinese e-commerce SDKs (Sina Taoke coupon/affiliate SDK, Pinduoduo PDD open-platform SDK, JD.com open-platform SDK, Taobao Top-Client SDK). GHSA flags each with the boilerplate "any computer that has this package installed or running should be considered fully compromised" - no source, no C2 disclosed, but the six-package burst under one scope is the classic drop-and-run pattern for dep-confusion / typosquat harvesting. Anyone at a Chinese e-commerce integrator (or an outsourcer building against these platforms for a Western brand) who fat-fingered the scope is exposed
  • *Cluster B - `@domyjs/ reactive-framework typosquat sweep (7 packages, all versions)**: @domyjs/reactive (GHSA-3ggc-3pw2-c9v9), @domyjs/i18n (GHSA-22jr-v88r-5cj6), @domyjs/router (GHSA-j7wp-3648-mh57), @domyjs/intersect (GHSA-v8xv-9q46-8h3x), @domyjs/throttle (GHSA-fr62-p59g-hr9f), @domyjs/mask (GHSA-93j2-q7r7-7qhh), @domyjs/collapse (GHSA-39q9-7vqg-3m6w) - one scope publishing what looks like a full reactive-framework ecosystem (state / i18n / router / intersect observer / throttle / input-mask / collapse) in one shot. Boilerplate CWE-506 metadata but the naming pattern is designed to look like a legitimate Vue/Svelte-adjacent utility bundle a developer would trust. Any lockfile hit on the @domyjs` scope means an operator now has full-compromise access to the host
  • Cluster C - date-fns-formatter date-fns typosquat (1 package, all versions): date-fns-formatter (GHSA-h258-m2gc-2p4q) - extends the ongoing date-fns typosquat family (datefmt-helper (MAL-2026-6788), date-fns-lite (MAL-2026-6722), date-fns-2). The date-fns family is one of the highest-download npm namespaces so typosquat probability against it is high. Boilerplate GHSA metadata; assume the same postinstall-hook AWS/GCP/Azure/SSH credential harvest pattern the other family members used until reverse-engineered otherwise
  • Cluster D - Miscellaneous npm boilerplate malware (10 packages, all versions): @pilllesss/yorn (GHSA-rghh-4gfg-jvqc), 1cattunnel (GHSA-r35j-cv2x-mm7h), dcftunnel (GHSA-4c2f-x64v-297x), multicore-kit (GHSA-q588-cfvg-8346), array-frames (GHSA-24hx-4mc8-g9q7), node-helper (GHSA-2ggc-wmq2-3whp), jwt-logger (GHSA-rpqx-cp2g-55w5), array-scala (GHSA-rx3f-9hxc-773g), infinity-grid (GHSA-39fr-j2vr-r24p), btn-particles (GHSA-6w56-62pq-vhph) - GHSA flags each with the boilerplate "any computer that has this package installed or running should be considered fully compromised" and no further technical detail. 1cattunnel / dcftunnel share the -tunnel suffix pattern (either legitimate-sounding tunnel utilities or paired droppers under one operator); jwt-logger and node-helper are generic-utility naming designed to slip past a shallow audit; multicore-kit reads as a plausible node-multicore adjacent name. Uninstall on any lockfile hit and rotate host credentials
  • Cluster E - trongridew PyPI Tronix private-key exfil (1 package, 1 version): trongridew@0.0.1 (GHSA-vjjx-756v-6p3x, campaign 2025-04-tronix) - Tron/TRX-blockchain infostealer that clones the legitimate tronpy (or similar TRX SDK) documentation to look plausible. OpenSSF metadata: "appears to be designed for private key exfiltration". Part of the long-running 2025-04-tronix campaign that has re-uploaded this and adjacent typosquats repeatedly to PyPI. Any Python cryptocurrency tool depending on trongridew (dep-confusion against internal tronpy-adjacent names, or a fat-finger of the real package) leaks TRX private keys
  • Cluster F - Generic PyPI install-time exfil pentest artefacts (2 packages, 2 versions): proxycer@0.1.0 (GHSA-qff6-cqrr-65wv, campaign 2025-02-pxz) collects basic user info on import; dbt-sa-cli@0.0.1 (GHSA-xf8p-r8w2-fx5m, campaign GENERIC-standard-pypi-install-pentest) overrides setup.py install to exfil IP+username on install. Both classified "PROBABLY_PENTEST" by OpenSSF malicious-packages - low-harm reconnaissance rather than a real payload, but the exact same setup.py install override is the pattern real threat actors use, so flag anyway. dbt-sa-cli is a plausible dep-confusion name against dbt (data-build-tool) service-account CLI utilities in enterprise data teams

What to do

  1. 1Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, Pipfile.lock, uv.lock, and internal registry mirror for the package names below. Uninstall and rebuild the lockfile against a clean cache on any hit
  2. 2*For Cluster A (`@liuliang520500/ Chinese e-commerce SDK impersonators)**: any team integrating Sina Taoke, Pinduoduo, JD.com, or Taobao open-platform SDKs - lock explicit scoped-registry pinning for the legitimate scopes (@jd/, @pdd/, @sina/, @taobao/, and their team-side private-registry equivalents) in .npmrc. If any developer or CI host resolved @liuliang520500/*`, rotate every credential on the host
  3. 3*For Cluster B (`@domyjs/)**: uninstall on any lockfile hit and rotate host credentials. Do not import any package under the @domyjs` scope until the operator identity is verified by an unrelated source. If your project uses a Vue/Svelte reactive-framework-style utility bundle from an unfamiliar scope, verify the publisher through a second channel before adopting
  4. 4For Cluster C (date-fns-formatter): block or unpublish date-fns-formatter from any internal npm mirror. Explicitly pin date-fns in your top-level dependencies (never date-fns-*). Also add the sibling typosquats datefmt-helper, date-fns-lite, date-fns-2 to a mirror-side deny-list
  5. 5For Cluster D (miscellaneous boilerplate): uninstall on any lockfile hit and rotate host credentials. Any host that resolved a -tunnel-suffixed npm package it did not explicitly add is likely compromised - grep dev, CI, and runtime hosts for 1cattunnel / dcftunnel / multicore-kit / array-frames / node-helper / jwt-logger / array-scala / infinity-grid / btn-particles / @pilllesss/yorn
  6. 6For Cluster E (trongridew): any Python tool depending on TRX SDKs - pin tronpy explicitly in requirements.txt / pyproject.toml. Audit pip install history on developer laptops and CI hosts for trongridew (and the sibling 2025-04-tronix campaign packages historically indexed to that campaign id). Any Tron wallet whose private key was on a host that ran trongridew must be treated as drained
  7. 7For Cluster F (proxycer, dbt-sa-cli): uninstall on hit; no host-forensics response required beyond routine credential-rotation prudence. For data teams: if you have an internal dbt-sa-cli (dbt service-account CLI) package, pin it to your internal index-url explicitly - the malicious public version was published against an obvious internal-namespace guess
  8. 8For every npm install and pip install in CI, prefer --ignore-scripts / pip install --no-deps where feasible - this blocks Clusters A, B, C, D postinstall vectors and Cluster F setup.py install overrides. Cluster E (trongridew) fires on import so --no-deps alone is insufficient; grep for import trongridew in Python source trees
  9. 9Consider adding the @liuliang520500 and @domyjs npm scopes and trongridew PyPI name to any private-registry deny-list to prevent future re-publishes under the same identity

References

Back to feedSubmit a correction
multi-2026-09-06-ghsa-malware-sweep