DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
HighAdvisory sweepPublished 9 Sept 202625 packages · 45 versions

GitHub Advisory malware sweep - 2026-09-08/09 (coordinated `sonner` typosquat trio, Baileys scope hijacks, `rojo-rbx` Windows persistence, dep-confusion probes and remote-code loaders)

Summary

Between 2026-09-08 and 2026-09-09 UTC GHSA published ~25 npm/PyPI malware advisories: a coordinated sonner typosquat trio (sonmors/gloggo/file-type-detector) with a PNG-steganography loader gated on a fake isSign(); three @*/baileys WhatsApp scope hijacks; a rojo-rbx Roblox typosquat with Windows Run-key persistence; plus dep-confusion probes and remote-code loaders.

typosquatdependency-confusioncredential-theftdns-exfiltrationobfuscationci-cd-compromise
Incident type
Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis · amazon-inspector
Also known as
2026-09-09 GHSA npm/PyPI sweep · sonmors gloggo file-type-detector coordinated sonner typosquat · rojo-rbx Roblox Windows Run-key persistence · baileys scope hijack wave 2026-09-09
Ecosystems
npmPyPI
Packages tracked
25

What happened

Between roughly 2026-09-08 00:00 UTC and 2026-09-09 12:00 UTC, GitHub Advisory Database published ~25 new npm and PyPI malware advisories. Unlike the 2026-09-07/08 wave (which was dominated by corporate-namespace dep-confusion probes hitting Air Canada / Medisend / Coinbase / Swisscom and many others), this window is dominated by analysed payloads: typosquats, remote-code loaders, an OS-level persistence chain, and a coordinated three-package cluster.

Cluster A — Coordinated sonner typosquat trio

The most operationally interesting drop of the day is a three-package coordinated attack against the very-widely-used sonner React toast library:

PackageGHSARole
sonmorsGHSA-vp67-pvcp-4j8jTyposquat of sonner; spoofs sonner's package.json identity; require('gloggo') at load time
gloggoGHSA-wmgg-555m-p7h6Typosquat of glogg (gulpjs); gates hidden loader on isSign('favorite','gloggo',12467) from file-type-detector
file-type-detectorGHSA-cjhh-g8v5-hg5gTyposquat of file-type-checker; the concealed isSign() function reads PNG files, extracts payloads, writes them to sibling packages under node_modules

All three carry the false attribution "Blockvora Team" / team@blockvora.com. The load-time chain is deliberately obfuscated: sonmors looks like a working toast library, gloggo looks like a working logger, and file-type-detector looks like a MIME-sniffing utility. Only when all three are present, and only when gloggo calls isSign(), does the malicious loader activate and extract the payload from PNG bytes.

The PNG-steganography step is the reason a static .js-only scan will not find the payload. Yara rules that trigger on eval(), Function(), child_process, or a known malicious URL will miss it entirely - the URL and shell commands only exist inside decoded PNG bytes, and only after all three packages line up.

Cluster B — WhatsApp Baileys scope hijacks

Three more Baileys-namespace scope hijacks landed (@vallensofficial/baileys, @versacode/baileys, @haimiya/baileys), all with the standard full-compromise GHSA boilerplate ("any computer that has this package installed or running should be considered fully compromised"). This continues the pattern from kiki-baileys (2026-09-08 sweep) and WhiskeySAML/baileys earlier in the year. Baileys (the real one, @whiskeysockets/baileys) is the de-facto unofficial WhatsApp Web API library for Node - a fertile lookalike target.

Cluster C — Roblox / gaming ecosystem malware

rojo-rbx@<=1.4.3 (GHSA-p55w-6rww-5frg) impersonates the well-known Rojo Roblox tooling project. On Windows, scripts/install.js:

  1. Downloads a VBScript from https://l81.me/updater.vbs
  2. Writes it to %APPDATA%\Rojo\rojo-sync.vbs
  3. Adds HKCU\Software\Microsoft\Windows\CurrentVersion\Run\RojoClientSync so the VBS re-launches on every login
  4. Provides no actual Rojo functionality

Unlike the OAST / webhook.site probes above, this one commits to persistence on the victim host - a genuine backdoor rather than reconnaissance. The real Rojo tool is distributed as a binary through GitHub releases, not through npm, so any npm-based "Rojo" install is fake by definition.

open-item-validator@1.0.3/1.0.5 (GHSA-jfq9-9hf7-gr4x) is a game-adjacent name grab (declared homepage game.spawnrealm.com, actual C2 itemx.servegame.com:8888 on the No-IP dynamic DNS) that spawns a persistent background Node process, polls /api/x-realtime, and new Function()-executes the returned code. The daemon survives its parent process exit, so a single dev-machine npm install gives the operator ongoing RCE.

Cluster D — Corporate-namespace dep-confusion probes

Same pattern as yesterday's Cluster A/B/C but with per-target IOCs published:

  • unifi-credential-server@99.0.0 (GHSA-9rgc-h7qj-q8w3) - Ubiquiti UniFi internal-build target; hex-encoded DNS labels to <payload>.oast.me
  • twilio-functions@99.99.99/99.99.100 (GHSA-73g6-c624-22hf) - Twilio SDK impersonator; POST to webhook.site/42ce0f0e-a0a0-41b5-b157-1c0f918e064f, DNS fallback 2b22ede784d5.oast.fun
  • @umschool/analytics@999.0.0-999.0.4 (GHSA-2qmq-f9mj-rwcj) - Umschool corporate scope; GET to akko.requestcatcher.com/dep-confusion
  • py-devoli-common@999.999.999 (PyPI, GHSA-g8qj-vfr2-9w5c) - Devoli target on PyPI; boilerplate-flagged, no published payload

The sentinel-version (99.x, 99.99.x, 999.x, 999.999.x) pattern is the fingerprint - real internal packages don't live at these versions, but they beat any semver range in resolution when a bare name accidentally resolves against public npm.

Cluster E — Webhook / OAST reconnaissance beacons

  • @yongot/canary-mcp-isolation@1.0.1 and @yongot/canary-mcp-test@2.0.0/3.0.0/4.0.0 - same operator; sends hostname + id + GCP metadata probes (169.254.169.254, metadata.google.internal) to webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b. The canary-mcp-* naming appears aimed at MCP (Model Context Protocol) / AI-agent servers, another corporate scope shape
  • alloy-graphql@1.0.1 - preinstall reads /etc/passwd + /etc/hosts, harvests DNS servers and full package.json, POSTs to a Burp Collaborator subdomain (*.oastify.com). This is the deepest reconnaissance in the batch
  • @aspect-adv-ui/consent-manager@2.4.0/2.4.1 - masquerades as a GDPR/CCPA consent manager; postinstall GET to webhook.site/kapper

Cluster F — Remote-code-loader droppers

Five packages that fetch code over the network and immediately execute it:

  • tailwind-aspect-styles@<=0.4.2 — http://23.27.245.100/index.js over plain HTTP; writes ./inout.js, require()s it
  • tailwindcss-aspectratio-styles@0.3.4/0.3.5 — tailwindlan.online remote JS; almost certainly the same operator as the previous line, both impersonating @tailwindcss/aspect-ratio
  • selfcerts@1.0.0 — hides a base64 C2 URL inside a fake sample/cert.pem, fetches http://144.172.104.211/settings/privacy.php, pipes it into detached python3. Cross-language execution is unusual for npm malware
  • punypump@1.2.2/1.2.4/1.2.5 — fetches AES-256-CBC ciphertext from jsonkeeper.com/b/V6NBX, decrypts with hardcoded key, eval()s the result. Disguised as a console-browserify shim
  • bx-ui-view@1.0.0 — self-referential dependency: package.json declares its own package name with an HTTPS URL value pointing to https://package-access.pages.dev/bx-ui-view. npm downloads and runs whatever the pages.dev URL currently serves at install time

Cluster G — Credential theft / hardcoded backdoor

toru-ultimate@1.0.0 (GHSA-jg37-3w86-3rx2) is a Facebook credential harvester. The loginViaAPI() function forwards user-supplied email + password + 2FA Base32 secret to https://minhdong.site/api/v1/facebook/login_ios, and the package pulls its own runtime code from an unpinned GitHub branch (VangBanLaNhat/fca-unofficial) - so the branch owner can inject fresh code any time.

vinzz-wcli@<=1.0.1 (GHSA-xv3f-69vw-grmg) is a WhatsApp CLI framework whose plugin config hardcodes a specific WhatsApp JID (6285185667890@s.whatsapp.net) as an authorised owner. Any user who pairs their own phone through the CLI has given the JID owner silent access to a cmd plugin (child_process.exec) and an eval plugin - full RCE with the installer's privileges over WhatsApp.

Cluster H — Destructive package

express-session-timer@1.0.0-1.0.16 (GHSA-xf4h-cmpp-qfvf) is unusual for the batch: no exfil, no C2, no persistence - just sabotage. Approximately 18 seconds after require('express-session-timer'), it recursively removes <cwd>/src and kills Node / PM2 processes. Its declared dependency express-timer@^0.0.1-security pins to the npm security-hold placeholder version, another red flag.

Cluster I — Amazon Inspector / OpenSSF boilerplate takedown

react-hook-doms@<=5.3.1 (GHSA-hj8f-64m3-wrpj) is amazon-inspector-flagged with only a source hash and no published analysis. Assume the full-compromise GHSA boilerplate applies until independent per-package analysis surfaces.

Distinction from the parallel 2026-09-08 sweep

Yesterday's multi-2026-09-08-ghsa-malware-sweep covered the sprawling corporate-namespace dep-confusion probe wave (Air Canada, Medisend, OPAP, Optimizely/Fastly, MATLAB/Azure DevOps, SimpliSafe, Tidal, PayPal, Twilio, Afterpay, Ecobee, Karapace, Glia, Jobber, Feishu, BMC, and more) with the oast.online + 5.189.159.252 shared-infrastructure Cluster A. Today's window is smaller and more analytical - each cluster comes with published IOCs and enough detail to identify per-cluster mitigation. Some Sept-8 corporate-namespace probes may still trickle through the GHSA pipeline today; check the parallel record for those.

Registry state

All packages listed below are flagged as malware on npm / PyPI and quarantined. Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs before quarantine will keep serving them - explicit deny-listing of every name below plus the @vallensofficial/, @versacode/, @haimiya/, @yongot/, @aspect-adv-ui/, and @umschool/ scopes is the durable mitigation.

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector. Per-package IOC details (URLs, IPs, hashes, hardcoded JIDs, webhook tokens) drawn verbatim from the GHSA advisory bodies published between 2026-09-08 and 2026-09-09.

Affected packages (25)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.jsonCheck requirements.txt

Impact

  • Cluster A — Coordinated sonner React-toast typosquat trio (sonmors + gloggo + file-type-detector): three npm packages published by the same operator work together as one payload. sonmors@<=2.11.2 (GHSA-vp67-pvcp-4j8j) is a near-copy of the widely-used sonner React toast library that spoofs sonner's identity in package.json and calls require('gloggo') at load time. gloggo@1.1.2/1.1.3/1.1.4 (GHSA-wmgg-555m-p7h6) masquerades as gulpjs' glogg logging library and gates its hidden loader on isSign('favorite','gloggo',12467) from file-type-detector. file-type-detector@1.1.0/1.1.1 (GHSA-cjhh-g8v5-hg5g) impersonates the legitimate file-type-checker and hides a payload in a PNG that it extracts and writes into sibling packages under node_modules. Any project that installed the sonner typosquat picked up all three; the PNG-steganography loader means static scanners that only look at .js will miss the payload
  • Cluster B — WhatsApp Baileys scope hijacks: @vallensofficial/baileys, @versacode/baileys, and @haimiya/baileys (all versions; GHSA-gg93-mm5f-23v8 / GHSA-fw7g-gr3j-7wf7 / GHSA-q246-72rh-fp8w) all carry the full-compromise GHSA boilerplate ("any computer that has this package installed or running should be considered fully compromised"). Continues the ongoing Baileys namespace-abuse pattern (kiki-baileys in the 2026-09-08 sweep, WhiskeySAML/baileys earlier). Baileys is a heavily-used unofficial WhatsApp Web API client; a bare or unscoped Baileys reference in a Node.js bot repo resolves against public npm and picks these up
  • Cluster C — Roblox / gaming ecosystem malware with confirmed persistence: rojo-rbx@<=1.4.3 (GHSA-p55w-6rww-5frg) impersonates the legitimate Rojo Roblox development tooling. On Windows, scripts/install.js downloads a VBScript from https://l81.me/updater.vbs, writes it to %APPDATA%\Rojo\rojo-sync.vbs, and installs a HKCU\Software\Microsoft\Windows\CurrentVersion\Run\RojoClientSync registry entry so the VBS re-launches on every login. open-item-validator@1.0.3/1.0.5 (GHSA-jfq9-9hf7-gr4x) spawns a background Node process that repeatedly polls http://itemx.servegame.com:8888/api/x-realtime and new Function()-executes the returned code, giving the operator arbitrary code execution on the host
  • Cluster D — Corporate-namespace dep-confusion probes at sentinel versions: unifi-credential-server@99.0.0 (GHSA-9rgc-h7qj-q8w3) targets Ubiquiti UniFi internal build systems - preinstall harvests hostname / username / cwd / internal IPv4s / CI environment variables and exfils via DNS queries to <hex-payload>.oast.me. twilio-functions@99.99.99/99.99.100 (GHSA-73g6-c624-22hf) impersonates the Twilio SDK - postinstall POSTs system info to webhook.site/42ce0f0e-a0a0-41b5-b157-1c0f918e064f with DNS fallback to 2b22ede784d5.oast.fun. @umschool/analytics@999.0.0-999.0.4 (GHSA-2qmq-f9mj-rwcj) targets the Umschool scope - postinstall GET to akko.requestcatcher.com/dep-confusion. PyPI py-devoli-common@999.999.999 (GHSA-g8qj-vfr2-9w5c) is the same shape on PyPI, boilerplate-flagged
  • Cluster E — Webhook / OAST reconnaissance beacons: @yongot/canary-mcp-isolation@1.0.1 (GHSA-7gq6-vvhp-97f4) and @yongot/canary-mcp-test@2.0.0/3.0.0/4.0.0 (GHSA-469r-xxvx-62x3) send installer hostname + id output + GCP metadata (169.254.169.254, metadata.google.internal) probe results to https://webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b - same operator across both. alloy-graphql@1.0.1 (GHSA-5xmm-9965-mvqw) reads /etc/passwd and /etc/hosts, harvests DNS servers and package.json, POSTs to ipbtwv9063nc5hvhodh0s4u9x03rrhf6.oastify.com (Burp Collaborator). @aspect-adv-ui/consent-manager@2.4.0/2.4.1 (GHSA-2m5c-v74g-r4m8) postinstall GET to webhook.site/kapper
  • Cluster F — Remote-code-loader droppers: tailwind-aspect-styles@<=0.4.2 (GHSA-r28r-839h-4gqw) fetches http://23.27.245.100/index.js over plain HTTP, writes it to ./inout.js, and immediately require()s it. tailwindcss-aspectratio-styles@0.3.4/0.3.5 (GHSA-4gjp-7xcv-m2gc) does the same shape via tailwindlan.online - clearly a related pair impersonating the Tailwind CSS aspect-ratio plugin. selfcerts@1.0.0 (GHSA-2cj2-qj4h-42hp) hides a base64-encoded C2 URL in a fake TLS cert, fetches http://144.172.104.211/settings/privacy.php, and pipes the response to a detached python3 process. punypump@1.2.2/1.2.4/1.2.5 (GHSA-45jc-2qr4-pmgf) fetches an AES-256-CBC-encrypted payload from jsonkeeper.com/b/V6NBX and eval()s the plaintext. bx-ui-view@1.0.0 (GHSA-hqg3-m33m-mvcr) declares a self-referential dependency pointing at https://package-access.pages.dev/bx-ui-view so npm downloads and runs whatever the pages.dev URL currently serves
  • Cluster G — Credential theft / hardcoded backdoor: toru-ultimate@1.0.0 (GHSA-jg37-3w86-3rx2) is a Facebook credential harvester - the loginViaAPI() function forwards email + password + 2FA Base32 secret to https://minhdong.site/api/v1/facebook/login_ios, and the package pulls an unpinned GitHub branch (VangBanLaNhat/fca-unofficial) so the branch controller can inject fresh code at any time. vinzz-wcli@<=1.0.1 (GHSA-xv3f-69vw-grmg) is a WhatsApp CLI tool with a hardcoded JID (6285185667890@s.whatsapp.net) that has always-on cmd- and eval-plugin authority - any user who pairs their phone gives the JID owner silent RCE with the installer's privileges
  • Cluster H — Destructive package: express-session-timer@1.0.0-1.0.16 (GHSA-xf4h-cmpp-qfvf) recursively removes <cwd>/src roughly 18 seconds after require(), then kills Node / PM2 processes on Unix and Windows. Not exfil - straight sabotage. Its declared dependency express-timer@^0.0.1-security pins to npm's security-hold placeholder, another red flag
  • Cluster I — Amazon Inspector / OpenSSF boilerplate takedown (no published analysis): react-hook-doms@<=5.3.1 (GHSA-hj8f-64m3-wrpj) is flagged by amazon-inspector with only a source hash; assume the same GHSA full-compromise boilerplate applies pending independent analysis

What to do

  1. 1Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, package.json, requirements.txt, and poetry.lock in your org for the names below. Uninstall on hit, wipe node_modules, delete the lockfile, and rebuild against a clean cache
  2. 2For Cluster A (sonmors / gloggo / file-type-detector): anyone who typosquat-installed sonmors instead of sonner picked up all three packages. The PNG-steganography payload is not visible in a .js-only static scan - grep for the exact package names, not for the payload. Any hit means the host executed hidden code from a PNG bundled by file-type-detector; treat as fully compromised, rotate every credential the host had access to, and reimage
  3. 3For Cluster B Baileys hijacks: audit every WhatsApp/Baileys-based Node bot repo for scoped @vallensofficial/baileys, @versacode/baileys, @haimiya/baileys (and the previous kiki-baileys). Pin the real upstream @whiskeysockets/baileys explicitly in package.json and enforce it in CI. GHSA marks all versions of these packages as malicious - assume any host that resolved one is fully compromised
  4. 4For Cluster C rojo-rbx Windows persistence: on any Windows dev machine that installed rojo-rbx, immediately delete %APPDATA%\Rojo\rojo-sync.vbs, remove the HKCU\Software\Microsoft\Windows\CurrentVersion\Run\RojoClientSync registry value, and block l81.me at the egress proxy. Real Rojo distribution is via github.com/rojo-rbx/rojo releases, not npm - never install a Roblox-tooling package that claims to be Rojo via npm
  5. 5For Cluster D dep-confusion probes: Ubiquiti / UniFi build systems - audit internal npm mirror logs for unifi-credential-server resolution attempts. Twilio SDK consumers - explicitly pin twilio (the real SDK), never resolve twilio-functions from public npm. Any org whose internal scope contains @umschool/ - enforce a scoped registry= line in .npmrc and treat the presence of @umschool/analytics@999.x in any mirror as evidence of active enumeration. Block oast.me, oast.fun, oastify.com (Interactsh / Burp Collaborator hosts), webhook.site, and akko.requestcatcher.com at the corporate egress proxy - all four are legitimate OAST services being repeatedly weaponised by dep-confusion probe operators and have no legitimate use in production egress
  6. 6For Cluster E OAST beacons: audit DNS logs for queries to *.oast.me, *.oast.fun, *.oastify.com, webhook.site, and *.requestcatcher.com between 2026-09-08 and now. Any host with matching DNS or egress records against a package named below is confirmed compromised on install. alloy-graphql in particular exfiltrates the contents of /etc/passwd and /etc/hosts - that leak is not undoable
  7. 7For Cluster F remote-code loaders: block 23.27.245.100, 144.172.104.211, tailwindlan.online, jsonkeeper.com, l81.me, minhdong.site, itemx.servegame.com, and package-access.pages.dev at the corporate egress proxy. Any host that fetched from one of these while any package below was in the lockfile is fully compromised - reimage after credential rotation
  8. 8For Cluster G credential-theft: any host that ran toru-ultimate may have leaked user-provided Facebook credentials + 2FA seeds to minhdong.site; notify affected users and rotate seeds. Any WhatsApp-bot host that installed vinzz-wcli has granted RCE to JID 6285185667890@s.whatsapp.net - assume every command that JID could have run has run
  9. 9For Cluster H destructive: any repo that had express-session-timer in its lockfile and imported it lost its src/ tree 18 seconds later. Restore from git; do not attempt to recover from node_modules
  10. 10For every npm install in CI, prefer --ignore-scripts to block postinstall / preinstall payloads. This is the single highest-value mitigation against Clusters D, E, and F
  11. 11Add every name below to internal private-registry (Verdaccio / Artifactory / Nexus) deny-lists for at least 30 days to prevent re-uploads by rotating operators

References

Back to feedSubmit a correction
multi-2026-09-09-ghsa-malware-sweep