GitHub Advisory malware sweep - 2026-09-10/11 (`pinochiomathm` picomatch typosquat with AES payload, `tailwindcss-contact-forms` Ethereum-RPC wallet drainer, `lucy-python-script-2030` Telegram infostealer, `@fyxzpediaa/baileys` wave 4, tea.xyz mass spam wave)

What happened

Between roughly 2026-09-10 12:00 UTC and 2026-09-11 12:00 UTC, GitHub Advisory Database published a handful of substantive new npm and PyPI malware advisories, plus a very large tea.xyz token-farming spam wave. This window is smaller than yesterday's on analysed payloads (yesterday brought Baileys wave 3, the @umschool/platform Kubernetes-secrets harvester, and the "Master Harvester" Solana wallet drainers), but it introduces one novel payload family (tailwindcss-contact-forms Ethereum-RPC C2) and continues two already-tracked sub-waves (Baileys namespace abuse and the @yongot/canary-mcp-* OAST beacon operator).

Cluster A — pinochiomathm (picomatch typosquat with AES payload)

pinochiomathm@2.3.2/2.3.3/2.3.4/2.3.5 (GHSA-cq4w-8cp6-cmvf) impersonates the very widely used picomatch glob-matching library (copied README, similar API shape, deliberate misspelling meant to survive a fast copy-paste in a package.json).

The payload chain, from lib/pinochiomathm.js:

1. Base64-decodes ciphertext hidden inside lib/parse.ts.map (which looks like a normal source map at a glance) and writes it to parsetmp.js
2. HTTP-GETs https://www.jsonkeeper.com/b/V6NBX with a custom header - the same collector path used by punypump in the 2026-09-09 sweep (Cluster F)
3. Decrypts the response with AES-256-CBC using a hardcoded password
4. eval()s the plaintext
5. Deletes lib/parse.ts.map, parsetmp.js, lib/init.ts.map, and config.js to remove forensic artefacts

Because the plaintext is fetched at runtime from a jsonkeeper URL that the operator can rewrite at any time, per-installation payloads can differ - a static scan will only find the AES ciphertext and the URL fragments; the payload the victim actually executes has to be captured live from jsonkeeper.com under operator control at the moment of install. This is the third campaign in a week to use jsonkeeper.com/b/V6NBX as a payload host (punypump on 2026-09-09, an as-yet-unnamed batch reference in the internal 2026-09-10 sweep, and now pinochiomathm). Treat the collector path as a durable IOC.

Cluster B — tailwindcss-contact-forms (Ethereum-RPC wallet-address-derived C2)

tailwindcss-contact-forms@0.5.4/0.5.5/0.5.6/0.5.7/0.5.8/0.5.9/0.6.0 (GHSA-h9xr-6q2x-2v47) impersonates the legitimate @tailwindcss/forms plugin. Its require()-time behaviour:

1. Installs a createRequire and publishes require, module, and global into named globals - a common early-stage sandbox-escape trick
2. Imports spawn from node:child_process for arbitrary command execution
3. Enumerates a hardcoded list of public Ethereum JSON-RPC providers (drpc.org, publicnode.com, blockscout, blastapi.io) and queries transaction data touching the attacker wallet 0xa322E5f39aDC2490Ef6f0121063eD311D3080e1a
4. POSTs results to a C2 endpoint reconstructed from interleaved string fragments ending in ut.com/api, with a custom X-Payload-* header

This is a variant of the NullReceiver / EtherHiding technique previously documented against @kolbo/mcp, agentgui, godot-kit (legitimate-but-compromised) and envpack-conf, postcss-initial-provider, tailwindcss-motion-advanced (malicious from first publish) - the campaign that OpenSourceMalware / Sonatype attributed to the DPRK-linked Contagious Interview cluster (Lazarus). The IOC-shape here matches: on-chain wallet, JSON-RPC public providers as read paths, C2 URL fragment reconstruction from string arrays. Whether this specific package is DPRK-operated is not stated in the GHSA advisory; the pattern is consistent with that operator, but attribution requires the vendor blog.

Cluster C — lucy-python-script-2030 (PyPI, Telegram-exfil infostealer)

lucy-python-script-2030@0.1.1/0.1.2 (GHSA-2q36-rrph-f47p) is a PyPI infostealer. On import it:

1. Enumerates browser autofill databases, saved credentials, cookies
2. Reads local authentication tokens and cloud-credential files (AWS ~/.aws/credentials, GCP application default credentials, Azure profile files)
3. Applies sandbox-detection heuristics (host uptime, MAC-address prefixes, common analysis-VM process names) to reduce noisy detection
4. Exfils via Telegram's Bot API

The advisory notes the specific 0.1.1/0.1.2 versions contained implementation bugs that reduced their effectiveness - i.e. they would have worked but did not fully drain most victims. Later versions (not yet on PyPI) should be presumed complete. SHA-256 0b93ebb2207ccfa0d02d068d444dce91835203dfe89a5ece38906158b4d3b891.

Cluster D — Baileys wave 4 (@fyxzpediaa/baileys)

@fyxzpediaa/baileys@8.1.2/9.1.0 (GHSA-5wxh-fwcf-rv5j) is the fourth wave of Baileys scope hijacks in as many days. Unlike wave 1-3 (which relied on obfuscated chats.js payloads, hardcoded C2s, or unpinned transitive GitHub-branch loaders), this wave hijacks the victim's live WhatsApp session to run an authenticated FOLLOW query:

• 200 seconds after WebSocket connect, the malware calls sock.query({ tag: 'iq', ... , content: [{ tag: 'graphql', ... QueryIds.FOLLOW /* 7871414976211147 */ ... }] }) with the payload built from a base64+XOR-encoded (key 23) newsletter JID
• The newsletter JID list is fetched from https://raw.githubusercontent.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json - an operator-controlled GitHub raw URL that can be swapped at any time
• The dependency @whiskeysockets/eslint-config references an unpinned GitHub branch instead of an npm-registry version, so the transitive publisher can inject fresh code at any time

This is account-control, not host-RCE - a compromised Baileys bot silently follows operator-controlled newsletters. It also demonstrates a way to trigger authenticated WhatsApp mutations on behalf of the victim (FOLLOW, UNFOLLOW, REPORT, BLOCK - any GraphQL mutation the account is authorised for) without visible UI action. The full set of Baileys namespace hijacks in the last four days: @fyxzpediaa/baileys (today, wave 4), @sahril2nd/baileys / @nexustechpro/baileys / @neroxkira/vangal-baileys (2026-09-10, wave 3), @vallensofficial/baileys / @versacode/baileys / @haimiya/baileys (2026-09-09, wave 2), @web2apk/baileys (2026-09-08, wave 1-b), kiki-baileys (2026-09-07, wave 1-a).

Cluster E — @yongot/canary-mcp-* follow-up

Three new GHSA advisories were issued this window for the same operator that ran @yongot/canary-mcp-isolation@1.0.1 and @yongot/canary-mcp-test@2.0.0/3.0.0/4.0.0 yesterday (2026-09-09 sweep Cluster E, webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b):

Combined evidence points to a security-research / red-team canary rather than commercial malware, but the OAST-beacon-with-GCP-metadata-probes payload is distinguishable from a benign canary only in intent - the packages still POST to a webhook.site collector under operator control.

Cluster F — daytona-test-* boilerplate trio

Three new npm packages published 2026-09-11 under a shared prefix, all flagged with the full-compromise GHSA CWE-506 boilerplate but no published source or IOC analysis:

• daytona-test-miner (GHSA-7fxg-v94h-8j5g)
• daytona-test-npm (GHSA-j8pm-8rv6-xg64)
• daytona-test-filereader (GHSA-f2vx-rj2m-pmp8)

The daytona-test- prefix references Daytona (Daytona Platforms), a developer-cloud IDE. Real Daytona packages ship under @daytonaio/*. The daytona-test-<capability> naming has two plausible readings: (a) Daytona's own security team detonating test payloads under this prefix to prove their internal detection works, or (b) an external operator lookalike aimed at anyone typing npm install daytona-test-* from a stale Daytona tutorial. Without per-package analysis, treat as malicious.

Cluster G — Miscellaneous OpenSSF-flagged singletons

Small, low-analysis batch:

• cat-sis2go-utils (GHSA-5pwp-vwhm-wm7x, all versions) - CWE-506 boilerplate on a name that looks like an internal-scope utility for a "Cat SIS2Go" build (potentially Caterpillar SIS2 Go, a heavy-equipment service tooling product; consistent with dep-confusion probing)
• familylink@>=9.9.5, >=81.2.0 (GHSA-f5cq-29jg-wfch) - flagged by OpenSSF Package Analysis for communicating with a malicious domain and executing malicious commands. SHA-256 dcd324585f9b17cb0f06cf892908dbc6dd3a208bb5661635da6283fe5c05f544. Two disjoint version-range flags in one advisory is unusual and suggests two separate malicious releases collapsed under one GHSA record
• false-positive-reddit-rce@0.0.2 (GHSA-q893-q866-7rrw) - OpenSSF-flagged; the name reads as a security-research / red-team artefact but is on the malware list all the same

Cluster H — tea.xyz token-farming spam wave (very large)

The vast majority of the window's advisories (hundreds) are the tea.xyz token-farming spam campaign that Amazon Inspector originally detected at ~150,000 packages in Nov 2025 and that has intermittently resurged since. Sample confirmed names in this batch:

• fancy_dormouse_z3n, fancy_snail_z3n, fancy_goose_z3n, fancy_wolf_z3n, fancy_firefly_0xrequest, fancy_bobcat_dumbs, fancy_bovid-appteadev, fancy_cattle_z3n, fancy_cricket_z3n, fancy_cuckoo_z3n, fancy-blue-sailfish, fancy-beige-gamefowl, fancy-blush-egret, fancy-tomato-pony, fancy-apricot-whitefish, fancy-pure-vfk847-project, fancy-radiate-ygx449-project, fancy-alligator_z3n
• fantastic_goldfish_z3n, fantastic_lynx_z3n, fantastic_koi_z3n, fantastic_hamster_z3n, fantastic_hedgehog_z3n, fantastic_lemur_z3n, fantastic_lion_z3n, fantastic_locust_z3n, fantastic_toad_z3n, fantastic_gopher_z3n, fantastic_magpie_z3n, fantastic_mackerel_z3n, fantastic_mollusk_z3n, fantastic_bug_z3n, fantastic_rat_0xrequest, fantastic_goat_dumbs, fantastic-copper-heron, fantastic-crimson-dolphin, fantastic-coffee-lynx, fantastic-violet-hoverfly
• famous_cicada_z3n, famous_firefly_z3n, famous_hummingbird_z3n, famous_hippopotamus_z3n, famous_marsupial_z3n, famous_marlin, famous_mite_z3n, famous_ox_z3n, famous_swordtail_z3n, famous_skunk_z3n, famous_tahr_z3n, famous_whale_z3n, famous_anaconda_z3n, famous_angelfish_dumbs, famous_angelfish-notthedev, famous_ape_0xrequest, famous_goose_z3n, famous_heron_z3n, famous-jade-felidae, famous-red-stoat, famous-amethyst-coyote, famous-scarlet-dog, famous-cyan-crayfish, famous-coral-fly, famous-aquamarine-unicorn, famous-beige-tern
• familiar_kiwi_z3n, familiar_lynx_z3n, familiar_firefly_z3n, familiar_herring_z3n, familiar_limpet_z3n, familiar_ptarmigan_z3n, familiar_marten_dumbs, familiar_hare_z3n, familiar_hippopotamus_z3n, familiar_jackal_z3n, familiar_finch_z3n, familiar_minnow_z3n, familiar_porcupine_z3n, familiar_prawn_scarlet-18, familiar_marlin-appteadev, familiar_jaguar_z3n, familiar-olive-pelican, familiar-orange-camel, familiar_bison_z3n, familiar_guan_z3n, familiar_scorpion_z3n, familiar_puma_z3n
• family-island-unlimited-energy167, family-island-unlimited-energy285, family-island-unlimited-energy362, family-island-unlimited-energy447, family-island-unlimited-energy463
• fanfav, fandyx, fanta-notthedevs, fanada, fankctoxvrkdsmgq

All ship an auto.js / autopublish.js / autopublish2.js / autopublish3.js script that automatically regenerates and republishes derivative packages with fresh randomised names to inflate the operator's tea protocol reputation score. No user-data exfiltration is present; the victim is the npm registry itself, not the developer installing the package.

Because the total count of tea.xyz-shaped packages published in this window is in the hundreds and grows minute-by-minute, this file lists only a representative sample in the machine-readable packages section. The full deny-list should be name-prefix / regex based, not enumerated:

• ^(fancy|fantastic|famous|familiar)_[a-z]+_(z3n|dumbs|0xrequest|scarlet[-_][0-9]+)$
• ^(fancy|fantastic|famous|familiar)_[a-z]+-(appteadev|notthedev|notthedevs)$
• ^(fancy|fantastic|famous|familiar)-[a-z]+-[a-z]+(-[a-z]+)?$
• ^(fancy|fantastic|famous|familiar)-(pure|radiate)-[a-z0-9]+-project$
• ^family-island-unlimited-energy[0-9]+$

Distinction from the parallel 2026-09-10 sweep

Yesterday's file covered Baileys wave 3, the @umschool/platform Kubernetes-secrets harvester, the "Master Harvester" Solana wallet drainer template (gmgn-trading-kit, soltinel-pro), the Discord MFA lure trio (mfatest2, discord-mfa-solver, mfaby), the twilio-hackerone-poc-b8f21a explicit HackerOne POC, the matrixkit-js AES-loader, and @staticj/cropperxmjs Cropper.js userscript-RCE. Today's window is smaller on analysed payloads but adds one novel C2 shape (Ethereum-RPC read of an attacker wallet, Cluster B) and one novel behavioural payload (WhatsApp session-forced FOLLOW, Cluster D). The tea.xyz Cluster H is entirely new to this file - previous sweeps were dominated by analysed payloads and did not surface tea.xyz spam waves.

Registry state

All packages in Clusters A-G below are flagged as malware on npm / PyPI and quarantined. The Cluster H tea.xyz spam packages are auto-published and re-auto-published continuously - even after registry takedown, fresh randomised names appear within minutes under the same operator infrastructure. Only prefix / regex denylists on internal mirrors are durable mitigation.

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector. Per-package IOC details drawn verbatim from GHSA advisory bodies published between 2026-09-10 and 2026-09-11 UTC.

Affected packages (111)

Impact

• Cluster A — pinochiomathm picomatch typosquat (AES payload from jsonkeeper.com): pinochiomathm@2.3.2/2.3.3/2.3.4/2.3.5 (GHSA-cq4w-8cp6-cmvf) masquerades as the very popular picomatch glob matcher (copied README, similar API surface) but its lib/pinochiomathm.js extracts a base64-encoded payload from lib/parse.ts.map into parsetmp.js, HTTP-GETs https://www.jsonkeeper.com/b/V6NBX with a custom header, decrypts the response using AES-256-CBC with a hardcoded key, and eval()s the plaintext, then deletes lib/parse.ts.map, parsetmp.js, lib/init.ts.map, and config.js to erase traces. Same jsonkeeper.com/b/V6NBX collector as punypump from the 2026-09-09 sweep - shared operator / rehosted collector across the two campaigns
• Cluster B — tailwindcss-contact-forms Ethereum-RPC wallet drainer: tailwindcss-contact-forms@0.5.4-0.6.0 (GHSA-h9xr-6q2x-2v47) impersonates the legitimate @tailwindcss/forms plugin. On require() the module installs a createRequire and publishes require, module, and global into named globals, then spawns child processes via node:child_process.spawn. It enumerates public Ethereum JSON-RPC endpoints (drpc.org, publicnode.com, blockscout, blastapi.io), queries transaction data associated with the hardcoded attacker wallet 0xa322E5f39aDC2490Ef6f0121063eD311D3080e1a, and POSTs results with a custom X-Payload-* header to an external endpoint reconstructed from string-array fragments ending in ut.com/api. Variant of the DPRK-linked NullReceiver / Contagious Interview blockchain-C2 technique previously documented against envpack-conf / postcss-initial-provider / tailwindcss-motion-advanced and the legitimate-but-compromised @kolbo/mcp, agentgui, and godot-kit
• Cluster C — lucy-python-script-2030 PyPI infostealer (Telegram exfil): lucy-python-script-2030@0.1.1/0.1.2 (GHSA-2q36-rrph-f47p) is a PyPI infostealer that during import attempts to harvest browser data (saved credentials, cookies, autofill), authentication tokens, and cloud credentials. Includes sandbox-detection to evade analysis environments and exfiltrates via a Telegram bot, matching the 2026-09-lucy-python-script-2030 campaign fingerprint. The specific 0.1.1/0.1.2 versions contained implementation errors that reduced effectiveness, but the collection routine is intact. SHA-256 0b93ebb2207ccfa0d02d068d444dce91835203dfe89a5ece38906158b4d3b891
• Cluster D — Baileys wave 4 (@fyxzpediaa/baileys newsletter-forced-follow): @fyxzpediaa/baileys@8.1.2/9.1.0 (GHSA-5wxh-fwcf-rv5j) is a fourth-wave Baileys scope hijack that behaves differently from wave 1-3: instead of stealing credentials or dropping RATs, it injects a covert remote-directed action into the victim's WhatsApp socket. 200 seconds after the WebSocket connects the malware runs an authenticated FOLLOW query (QueryIds.FOLLOW = 7871414976211147) using the victim's Signal-identity credentials against a hardcoded WhatsApp newsletter JID decoded via base64+XOR (key=23). The newsletter list is pulled from https://raw.githubusercontent.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json (an operator-controlled GitHub raw URL) and the dependency @whiskeysockets/eslint-config references a mutable GitHub branch instead of a pinned tag. Confirmed reach is account-control not host-RCE, but the operator can pivot to further authenticated WhatsApp mutations at any time
• *Cluster E — `@yongot/canary-mcp- follow-up advisories (three new GHSA IDs, same operator as 2026-09-09 Cluster E)**: @yongot/canary-mcp-isolation (GHSA-cr2f-c82j-mj6q, ALL versions >=0 flagged), @yongot/canary-mcp-test (GHSA-qjwm-vq22-4xx8, ALL versions >=0 flagged), and *new sibling* @yongot/canary-mcp-test-2 (GHSA-93xr-jvm3-jpch, ALL versions >=0 flagged). Broader all-versions coverage on the two already-flagged packages plus a fresh -test-2 sibling published under the same disposable scope - same OAST beacon operator that hit webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b with GCP metadata probes in yesterday's sweep. Any organization that already caught @yongot/canary-mcp-isolation@1.0.1 or @yongot/canary-mcp-test@2.0.0/3.0.0/4.0.0 from that sweep should widen the block to the entire @yongot/` scope
• *Cluster F — `daytona-test- npm boilerplate trio (three packages published 2026-09-11, no analysis)**: daytona-test-miner (GHSA-7fxg-v94h-8j5g), daytona-test-npm (GHSA-j8pm-8rv6-xg64), and daytona-test-filereader (GHSA-f2vx-rj2m-pmp8), all versions >=0, flagged with the full-compromise GHSA CWE-506 boilerplate ("any computer that has this package installed or running should be considered fully compromised") but no published payload analysis or source. The daytona-test-` name-prefix impersonates or references the Daytona (Daytona Platforms) developer-cloud IDE - either a targeted lookalike lure aimed at Daytona users, or a testing artefact from Daytona's own security researchers. Assume malicious pending independent per-package analysis
• Cluster G — CWE-506 boilerplate / OpenSSF-flagged singletons (small): cat-sis2go-utils (GHSA-5pwp-vwhm-wm7x, all versions) - CWE-506 boilerplate on a name that looks like an internal-scope utility for a "Cat SIS2Go" build. familylink@>=9.9.5, >=81.2.0 (GHSA-f5cq-29jg-wfch) - OpenSSF Package Analysis flagged it for communicating with a malicious domain and executing malicious commands, SHA-256 dcd324585f9b17cb0f06cf892908dbc6dd3a208bb5661635da6283fe5c05f544. false-positive-reddit-rce@0.0.2 (GHSA-q893-q866-7rrw) - OpenSSF-flagged, name pattern suggests security research / red-team artefact but currently listed as malicious
• Cluster H — tea.xyz token-farming spam wave (very large, hundreds of npm packages, all boilerplate): The sweep window is dominated by a fresh burst of the tea.xyz token-farming spam campaign originally detected at ~150,000 packages by Amazon Inspector in Nov 2025 and periodically resurgent since. Naming patterns confirmed in this batch: fancy_<animal>_z3n, famous_<animal>_z3n, fantastic_<animal>_z3n, familiar_<animal>_z3n, <name>_dumbs, <name>_0xrequest, <name>-appteadev, <name>-notthedev(s), <color>-<gemstone>-<animal>, family-island-unlimited-energy<NNN>, <name>-<color>-<verb>-<code>-project, plus one-off names like fandyx, fanfav, fanta-notthedevs, fanada. Each package ships an autopublish routine (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that removes the private flag from package.json, bumps version numbers, and continuously republishes derivative packages with randomised Indonesian/English animal-and-color names to inflate developer reputation metrics for tea protocol token rewards. No user-data exfiltration; the ecosystem is the victim (npm registry pollution, resolver-cache noise, false-positive noise in threat feeds). Package counts in this specific window are in the hundreds - see references and searchable name-prefix rules below

What to do

1. 1Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, package.json, requirements.txt, and poetry.lock in your org for the specific package names in Clusters A-F below. Uninstall on hit, wipe node_modules, delete the lockfile, and rebuild against a clean cache
2. 2For Cluster A pinochiomathm: any host that installed pinochiomathm@2.3.2-2.3.5 executed operator-supplied JavaScript decrypted from jsonkeeper.com/b/V6NBX and should be treated as fully compromised. Rotate SSH keys, cloud tokens, and any secrets touched by the affected build. Block jsonkeeper.com at corporate egress (this is now the third campaign this week using it as an AES-encrypted-payload host). Pin the real upstream picomatch explicitly in package.json and enforce it in CI
3. 3For Cluster B tailwindcss-contact-forms: any host that imported tailwindcss-contact-forms@0.5.4-0.6.0 may have leaked build-environment recon. Block *.ut.com at corporate egress, and audit ETH RPC-endpoint egress logs from build containers for outbound queries to drpc.org, publicnode.com, blockscout.com, and blastapi.io. Any wallets on hosts that ran this package should be considered leaked at the address-derivation level (though this variant reads the attacker wallet, not the victim wallet). Pin the real upstream @tailwindcss/forms explicitly in package.json
4. 4For Cluster C lucy-python-script-2030: any Python environment that imported lucy-python-script-2030 may have leaked browser autofill, saved credentials, cookies, and cloud tokens over Telegram's Bot API. Rotate every credential from the affected host, invalidate cloud sessions, and block outbound requests to api.telegram.org from CI runners that don't need it
5. 5For Cluster D Baileys wave 4 (@fyxzpediaa/baileys): any Baileys-based WhatsApp bot that installed @fyxzpediaa/baileys@8.1.2/9.1.0 has silently followed an operator-controlled WhatsApp newsletter under the victim account 200 seconds after connect. Unfollow any unexpected newsletters, audit raw.githubusercontent.com/skyzopedia/* egress in logs, and pin the real upstream @whiskeysockets/baileys in package.json. The Baileys namespace has now been hit at least eight times in four days (this wave 4 plus the wave 1-3 packages in the 2026-09-08/09/10 sweeps) - every Baileys-labelled package other than @whiskeysockets/baileys should currently be treated as suspicious
6. 6*For Cluster E `@yongot/canary-mcp-**: widen any existing block from the two individual packages already caught (2026-09-09 sweep Cluster E) to the entire @yongot/ npm scope, and add the new @yongot/canary-mcp-test-2 name to internal deny-lists. If your CI logs show any resolution against the @yongot/ scope from public npm, revoke any GCP service-account tokens that could have been reachable at 169.254.169.254, and block webhook.site` at corporate egress
7. 7*For Cluster F `daytona-test-**: block all three names in internal registries. If your organization actually uses the Daytona developer-cloud IDE and installs anything Daytona-flavoured from public npm, pin the real upstream (@daytonaio/) explicitly in package.json and audit any build container that resolved a daytona-test-` name from public npm as if the full-compromise GHSA boilerplate applied, pending independent per-package analysis
8. 8For Cluster H tea.xyz spam: these packages do not contain user-data exfil, so they are not an urgent host-compromise priority - but they clutter internal mirrors and dependency graphs. Add prefix rules to internal-mirror deny-lists (Verdaccio / Artifactory / Nexus) for fancy_*_z3n, famous_*_z3n, fantastic_*_z3n, familiar_*_z3n, *_dumbs, *_0xrequest, *-appteadev, *-notthedev, *-notthedevs, family-island-unlimited-energy*, *-<color>-<animal> composite names (any autogenerated Indonesian-English zoology combinatorics on npm this year is almost certainly tea.xyz spam)
9. 9For every npm install and pip install in CI, prefer --ignore-scripts / --no-build-isolation where feasible to block postinstall/preinstall/setup.py payloads. This blocks Clusters A, B, C, D, E, F, and the executable half of H entirely for lockfile-consumer paths
10. 10Add every specific name below to internal private-registry deny-lists for at least 30 days to prevent re-uploads by rotating operators. Also block scopes @fyxzpediaa/, @yongot/ (broader than yesterday), and daytona-test-* prefix

References

• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub
• GHSA-cq4w-8cp6-cmvf - pinochiomathm (Cluster A - picomatch typosquat, jsonkeeper.com/b/V6NBX AES payload)

  github.com
  GitHub
• GHSA-h9xr-6q2x-2v47 - tailwindcss-contact-forms (Cluster B - Ethereum-RPC wallet-derived C2)

  github.com
  GitHub
• GHSA-2q36-rrph-f47p - lucy-python-script-2030 (Cluster C - PyPI Telegram infostealer)

  github.com
  GitHub
• GHSA-5wxh-fwcf-rv5j - @fyxzpediaa/baileys (Cluster D - Baileys wave 4 newsletter-forced-FOLLOW)

  github.com
  GitHub
• GHSA-cr2f-c82j-mj6q - @yongot/canary-mcp-isolation follow-up (Cluster E)

  github.com
  GitHub
• GHSA-qjwm-vq22-4xx8 - @yongot/canary-mcp-test follow-up (Cluster E)

  github.com
  GitHub
• GHSA-93xr-jvm3-jpch - @yongot/canary-mcp-test-2 (Cluster E - new sibling)

  github.com
  GitHub
• GHSA-7fxg-v94h-8j5g - daytona-test-miner (Cluster F)

  github.com
  GitHub
• GHSA-j8pm-8rv6-xg64 - daytona-test-npm (Cluster F)

  github.com
  GitHub
• GHSA-f2vx-rj2m-pmp8 - daytona-test-filereader (Cluster F)

  github.com
  GitHub
• GHSA-5pwp-vwhm-wm7x - cat-sis2go-utils (Cluster G boilerplate)

  github.com
  GitHub
• GHSA-f5cq-29jg-wfch - familylink (Cluster G - OpenSSF-flagged malicious-domain communication)

  github.com
  GitHub
• GHSA-q893-q866-7rrw - false-positive-reddit-rce (Cluster G)

  github.com
  GitHub
• Amazon Inspector: over 150,000 malicious packages linked to token farming campaign (Cluster H origin)

  aws.amazon.com
  AWS
• Socket: Another Round of TEA Protocol Spam Floods npm (Cluster H context)

  socket.dev
  Socket
• Sonatype: Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads (Cluster B precedent)

  sonatype.com
  Sonatype
• OpenSSF malicious-packages repository

  github.com
  OpenSSF