GitHub Advisory malware sweep - 2026-09-18 late + 2026-09-19 (npm `algamil7x.xyz` DNS-OOB scope expansion `@shared-web/utils`/`@shared-web/assets`/`@shared-runtime/modules`/`@insiderintelligence/googleadmanager` day 2; `test89-auth`/`test890-auth`/`test899-auth`/`test8999-auth` dep-confusion probe siblings of yesterday`s `test89078-auth`; on-chain Ethereum-C2 `tailwindcss-form@<=0.5.1` + `tailwindcss-forms-ui@<=0.5.2` day 2 of `0xa322E5f3...`; `@sanzoffc/baileys@<=3.0.4` newsletter-follower + unpinned `@whiskeysockets/eslint-config` github ref; `chai-as-indexed@<=7.2.8` `ipcheck-hashed.vercel.app` full-`process.env` exfil + `new Function()` RCE; `x509-escaping@0.0.0-0.0.2/1.0.1` Burp Collaborator `oastify.com` recon; `internallib_v949`, `sinful`, `openmct-heatmap`, `ac-polyfills` CWE-506; pip `py-venv-doctor@0.1.0/0.1.1` full-env-var telemetry exfil; pip `google-cloud-datacatalog-lineage-producer-client@9999`/`99999999`/`0.2.7` google-cloud-* dep-confusion sentinel; npm `keroeltop@99.99.99` malicious-domain probe)

What happened

Between roughly 2026-09-18 12:00 UTC and 2026-09-19 12:00 UTC, GitHub Advisory Database published 20 new malware advisories — 18 npm and 2 pip. Todays batch is dominated by continuations of the operator clusters catalogued yesterday: the algamil7x.xyz DNS-OOB operator is on day 2 with four fresh internal-lookalike scopes; the tailwindcss-form on-chain-C2 operator is on day 2 with two more typosquats reusing the same Ethereum sender address; the test89-auth dep-confusion pentest is on day 2 with four sibling packages; and the Baileys-wave ecosystem continues with a day 4 newsletter-follower (@sanzoffc/baileys). Two require-time RCE payloads (chai-as-indexed, one on-chain) and one full-env-var telemetry exfil (py-venv-doctor) elevate the batch severity to high`.

Cluster A - algamil7x.xyz DNS-OOB scope expansion (npm)

The primitive. Each package ships a package.json with scripts.install: node index.js. On npm install, the script loads a lib/core.js that resolves os.userInfo().username, os.hostname(), and process.cwd() basename via module.constructor._load (bypassing literal require() calls); domain names and API strings are stored as hex byte arrays in two per-package obfuscation files (lib/a9b3de.js+lib/f8a2cd.js, lib/a74d1f.js+lib/f63c0e.js, lib/c5df9a.js+lib/b4ce8f.js, lib/g7h8i9.js+lib/h8i9j0.js), reconstructed via String.fromCharCode at runtime. The reconstructed exfil chain is a DNS resolution query of the form <prefix>-<user>-<host>-<cwd>.<ts>.oob.algamil7x.xyz, and the operator sees the resolution in their authoritative DNS log.

Same operator as yesterdays @tink/tink-link-core@9.9.10` (Cluster D of 2026-09-18 sweep): same DNS zone (oob.algamil7x.xyz), same sentinel version (9.9.10), same hex-array obfuscation pattern, same module.constructor._load evasion. Yesterday impersonated Tink open-banking SDK; today four fresh internal-lookalike scopes (@shared-web/*, @shared-runtime/*, @insiderintelligence/*). Treat any 9.9.10-tagged internal-name lookalike as this operator until proven otherwise, and keep watching for day-3 expansion tomorrow.

Cluster B - test89*-auth dep-confusion probe siblings (npm)

Same operator as yesterdays test89078-auth@99.99.99` (Cluster D of 2026-09-18 sweep) — same preinstall: node index.js primitive, same DNS-OOB primitive against 31ee29fe-db68-4fd3-86a2-2b707b9e95f0.dnshook.site. GHSA published only the CWE-506 boilerplate on these four, but the naming lineage (four sequential numeric-suffix test89*-auth variants plus yesterdays test89078-auth`) is diagnostic: one dep-confusion pentest engagement iterating the numeric suffix in the same 48-hour window.

Cluster C - On-chain Ethereum-C2 tailwindcss-form* typosquats (day 2) (npm)

Same Ethereum sender address as yesterdays tailwindcss-form-utils/-form-ui (Cluster C of 2026-09-18 sweep). Same primitive: impersonate @tailwindlabs/tailwindcss-forms, obfuscator.io control-flow-flattened string array, query multiple Ethereum JSON-RPC endpoints (eth.publicnode.com, eth.drpc.org, 1rpc.io/eth, eth-mainnet.public.blastapi.io, eth.blockscout.com) for transactions authored by the hardcoded sender, decompress the transaction data (gzip/inflate/brotli), reconstruct a JavaScript payload, and execute via child_process.spawn`. The EtherHiding pattern is being iterated aggressively — four packages across two days against the same on-chain sender. Every new transaction from that address is a fresh command pushed to every installed victim.

Cluster D - @sanzoffc/baileys Baileys-wave day 4 (npm)

@sanzoffc/baileys@<=3.0.4 (GHSA-grqc-r63w-6845). Continues the day 1 plogme (2026-09-16) → day 2 jexkcode (2026-09-17) → day 3 libsignal-hijack quad (Cluster A of 2026-09-18) Baileys wave.

Todays variant is a nuisance-tier newsletter-follower — reconstructs an obfuscated URL to https://raw.githubusercontent.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json, uses WhatsApp GraphQL mutations (query_id: 7871414976211147) with a base64+XOR-decoded @newsletter JID (XOR key 23`) to subscribe the infected account to attacker-specified newsletters 40 seconds after invocation.

Additionally, the manifest declares @whiskeysockets/eslint-config as an unpinned github: source with most other dependencies pinned to wildcards — same RCE-surface primitive as yesterday`s Cluster A packages. So the effective posture is: a nuisance payload today, an RCE surface waiting for the operator to flip.

Cluster E - chai-as-indexed require-time full-process.env exfil + RCE (npm)

chai-as-indexed@<=7.2.8 (GHSA-727r-6hg5-947x, MAL-2026-16293). Masquerades as a chai assertion-library plugin (impersonates chai-as-promised). On require:

1. Loads ./lib/initializeCaller
2. POSTs the full process.env of the installers Node process to a base64-encoded endpoint: https://ipcheck-hashed.vercel.app/api/auth/13b72bec1d4f2ee1c661`
3. The response body is passed to new Function('require', responseBody) and invoked with the real require

Full remote code execution on every load, and the exfil payload contains every environment variable — CI secrets, npm tokens, cloud provider credentials, database URLs. --ignore-scripts does not block this — it triggers on require, not on install. Egress-block ipcheck-hashed.vercel.app in CI.

Cluster F - x509-escaping Burp Collaborator OOB recon (npm)

x509-escaping@0.0.0-0.0.2/1.0.1 (GHSA-fq85-7xqm-cgj9, MAL-2025-889). preinstall: node index.js reads:

• Hostname, username, home directory
• DNS server config
• Working directory
• /etc/passwd, /etc/hosts

POSTs the collected data to https://agumuj6lhw9yqopq6npl1nlgu70yorcg.oastify.com (a Burp Collaborator payload URL the operator owns). Pentest-shaped — no persistent payload, install-time only — but the exfil is real and the harvested data is now on an attacker-controlled Burp endpoint.

Cluster G - CWE-506 boilerplate takedowns (npm, likely dep-confusion probes)

GitHub Advisory Database boilerplate only ("any computer that has this package installed should be considered fully compromised. All secrets and keys stored on that computer should be rotated"). Treat as medium — likely dep-confusion probes shaped like this week`s other probes, awaiting published payload analysis.

Cluster H - pip py-venv-doctor full-env-var telemetry exfil

py-venv-doctor@0.1.0/0.1.1 (GHSA-94w6-hr49-qjm7, MAL-2026-16296, campaign 2026-09-py-venv-doctor). Overrides setup.py's install command to execute during pip install, then sends a "fake healthcheck report" telemetry channel that transmits the full environment variable set — including every sensitive variable in scope of pip install (CI secrets, cloud provider credentials, database URLs). Confirmed infostealer, not a probe.

Cluster I - pip google-cloud-datacatalog-lineage-producer-client google-cloud-* dep-confusion

google-cloud-datacatalog-lineage-producer-client@9999/99999999/0.2.7 (MAL-2024-12279). OSV-tracked from 2024 but freshly relisted in todays GitHub Advisory sweep. Three sentinel-tier version numbers on a plausibly-internal google-cloud-* name — classic dep-confusion resolution-attack lure against internal Google/GCP developer registries that mirror the google-cloud-*` namespace.

Cluster J - keroeltop@99.99.99 malicious-domain probe (npm)

keroeltop@99.99.99 (GHSA-gg5m-rqpp-c9xf, MAL-2026-16297). OpenSSF Package Analysis flag only: "The package communicates with a domain associated with malicious activity." Single sentinel version, no detailed payload disclosure yet — treat as medium pending IOC publication.

Cross-operator patterns worth flagging

1. The algamil7x.xyz operator is on day 2. Yesterday one package, today four — the operator is scaling. Block the DNS zone at your resolver; expect day 3 tomorrow.
2. *The `tailwindcss-form on-chain operator is on day 2** and still using the same 0xa322E5f3...` Ethereum sender. Detection cost stays asymmetric: no domain to block, only outbound Ethereum-RPC traffic from build environments to alert on.
3. *The `test89-auth engagement is on day 2** with four numeric-suffix siblings of yesterdays test89078-auth. Same DNS hook, same primitive.
4. The Baileys wave is on day 4 and now includes both nuisance newsletter-followers and full install-time RCE via unpinned github: dependencies. Treat any Baileys wrapper as suspect.
5. chai-as-indexed is a require-time full-process.env exfil + RCE — the highest-severity single package in todays batch. Every environment variable the parent Node process could see is on the operators server.

Registry state

All packages above are flagged as malware on npm and PyPI and quarantined at the time of writing. Private mirrors that cached tarballs before quarantine keep serving the malicious versions; network-edge egress blocks on oob.algamil7x.xyz, dnshook.site, ipcheck-hashed.vercel.app, oastify.com, and outbound Ethereum-JSON-RPC calls from CI are the durable mitigations.

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector, kam193/bad-packages, jaschadub/compromised-packages-check. Per-package IOC details drawn verbatim from GHSA advisory bodies published between 2026-09-18 12:00 UTC and 2026-09-19 12:00 UTC.

Affected packages (20)

Impact

• Cluster A — 4x npm algamil7x.xyz DNS-OOB scope expansion (day 2 of yesterday`s Cluster D operator): @shared-web/utils@9.9.10 (GHSA-29f7-pqf4-c94j, MAL-2026-16292), @shared-web/assets@9.9.10 (GHSA-vmr9-5w3x-4v98, MAL-2026-16283), @shared-runtime/modules@9.9.10 (GHSA-g85c-jph7-8q4r, MAL-2026-16291), @insiderintelligence/googleadmanager@9.9.10 (GHSA-76rx-jxhm-vhww, MAL-2026-16290). All four declare scripts.install: node index.js; the install script loads lib/core.js which resolves os.userInfo().username, os.hostname(), and process.cwd() basename, then DNS-resolves subdomains of oob.algamil7x.xyz (the same zone yesterdays @tink/tink-link-core@9.9.10 exfiltrated to). Uniform code style: String.fromCharCode hex-array obfuscation in two per-package lib/<random>.js files, module.constructor._load used in place of literal require(), prefix each package chooses (swutils, @shared-runtime/modules, @shared-web/assets, googleadmanager) is the campaign identifier the operator sees in their authoritative DNS log. **Day 2 of the same operator: yesterday @tink/tink-link-core (Tink open-banking SDK impersonation), today four fresh internal-lookalike scopes** — treat any 9.9.10`-tagged internal-name lookalike as this operator until proven otherwise
• *Cluster B — 4x npm `test89-auth dep-confusion probe siblings**: test89-auth (GHSA-7868-hxr7-g8r6, MAL-2026-16288), test890-auth (GHSA-xvpv-wq7p-548c, MAL-2026-16289), test899-auth (GHSA-jf2q-w77c-99vv, MAL-2026-16285), test8999-auth (GHSA-25wf-vfrc-2r82, MAL-2026-16286). Same operator as yesterdays test89078-auth@99.99.99 (Cluster D of 2026-09-18 sweep), same preinstall pattern, same DNS-OOB primitive against 31ee29fe-db68-4fd3-86a2-2b707b9e95f0.dnshook.site. GHSA carries only the CWE-506 boilerplate for these four, but the naming lineage (four sequential test89-, test890-, test899-, test8999-, and yesterdays test89078-`) is diagnostic: this is one dep-confusion pentest engagement iterating the numeric suffix. Pentest-shaped, but the payload nevertheless exfils hostname/username to a public DNS-OOB service — treat installs as intelligence-gathering hits
• *Cluster C — 2x npm on-chain Ethereum-C2 `tailwindcss-form typosquats (day 2 of yesterdays Cluster C operator): tailwindcss-form@<=0.5.1 (GHSA-xhr7-h7hc-7785) and tailwindcss-forms-ui@<=0.5.2 (GHSA-fc5q-m33g-rp9c, MAL-2026-16295). Same primitive as yesterdays tailwindcss-form-utils/-form-ui (Cluster C of 2026-09-18): impersonate @tailwindlabs/tailwindcss-forms, obfuscator.io string-array with control-flow flattening, query multiple Ethereum JSON-RPC endpoints (eth.publicnode.com, eth.drpc.org, 1rpc.io/eth, eth-mainnet.public.blastapi.io, eth.blockscout.com), pull txlist for transactions authored by the hardcoded sender 0xa322E5f3D311D3080e9aDC2490Ef6f0121063e1a, decompress the transaction data (gzip/inflate/brotli), reconstruct a JavaScript payload, and execute via child_process.spawn`. This is the same Ethereum address as yesterday`s pair** — the same on-chain command channel is now four packages deep across two days, and the EtherHiding pattern is being iterated aggressively
• Cluster D — 1x npm @sanzoffc/baileys@<=3.0.4 newsletter-follower + unpinned github: RCE surface (day 4 of Baileys wave): GHSA-grqc-r63w-6845. Continues the plogme (2026-09-16) → jexkcode (2026-09-17) → yesterdays libsignal-hijack quad (Cluster A of 2026-09-18) Baileys wave. This one is a nuisance-tier newsletter-follower: reconstructs an obfuscated URL to https://raw.githubusercontent.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json, uses WhatsApp GraphQL mutations (query_id: 7871414976211147) with a base64+XOR-decoded @newsletter JID (XOR key 23) to subscribe the infected account to attacker-specified newsletters 40 seconds after invocation. Additionally, the manifest declares @whiskeysockets/eslint-config as an unpinned github: source — same RCE-surface primitive as yesterdays Cluster A packages. Ship it as day 4 of the Baileys wave
• Cluster E — 1x npm chai-as-indexed@<=7.2.8 require-time RCE via ipcheck-hashed.vercel.app: GHSA-727r-6hg5-947x, MAL-2026-16293. Masquerades as a chai assertion-library plugin (impersonates chai-as-promised naming). On require, POSTs the entire process.env of the installers Node process (every environment variable — CI secrets, npm tokens, cloud provider credentials) to a base64-encoded endpoint https://ipcheck-hashed.vercel.app/api/auth/13b72bec1d4f2ee1c661 (base64: aHR0cHM6Ly9pcGNoZWNrLWhhc2hlZC52ZXJjZWwuYXBwL2FwaS9hdXRoLzEzYjcyYmVjMWQ0ZjJlZTFjNjYx). The response body is passed to new Function('require', responseBody) and invoked with the real require`, enabling arbitrary remote code execution on every load — not just install-time
• Cluster F — 1x npm x509-escaping Burp Collaborator OOB recon: GHSA-fq85-7xqm-cgj9, MAL-2025-889. x509-escaping@0.0.0-0.0.2 + 1.0.1. Preinstall: node index.js; the script harvests hostname, username, home directory, DNS server, working directory, plus reads /etc/passwd and /etc/hosts, then POSTs the data to https://agumuj6lhw9yqopq6npl1nlgu70yorcg.oastify.com (Burp Collaborator payload URL). Same posture as x509-escaping and other -escaping-family reconnaissance packages: dep-confusion tactic, install-time only, pentest-shaped but the harvested data is on a Burp Collaborator endpoint the operator owns
• Cluster G — 4x npm CWE-506 boilerplate takedowns (no published analysis; likely dep-confusion probes): internallib_v949 (GHSA-f863-m366-9cfm, GHSA-4qw5-jqr6-c4fj, MAL-2026-16294) — the name pattern (internallib_v<number>) is a canonical dep-confusion sentinel; sinful (GHSA-2xjj-r8mc-xpf6, MAL-2026-16284); openmct-heatmap (GHSA-qx52-2xq4-3x3v, MAL-2026-16287) — impersonation of NASAs Open MCT visualisation extensions; ac-polyfills (MAL-2026-782 — OSV-only, no GHSA at the time of writing) — dep-confusion of the @ac/ac-* internal scope pattern. All four flagged by GitHub Advisory Database with only the CWE-506 boilerplate warning ("any computer that has this package installed should be considered fully compromised. All secrets and keys stored on that computer should be rotated"). Treat as medium` pending published payload analysis
• Cluster H — pip py-venv-doctor@0.1.0/0.1.1 full-env-var telemetry exfil: GHSA-94w6-hr49-qjm7, MAL-2026-16296 (campaign 2026-09-py-venv-doctor). Overrides setup.py's install command to execute during pip install, then posts a "fake healthcheck report" telemetry channel that transmits "the full environment variable set, including any sensitive variables". Confirmed infostealer, not a probe. Same operator-shaped pattern as this weeks requests-*@2.34.2` setup.py-override cluster
• *Cluster I — pip google-cloud-datacatalog-lineage-producer-client@9999/99999999/0.2.7 google-cloud- dep-confusion*: MAL-2024-12279 (OSV-only, backfilled to 2026-09-18 sweep). Three sentinel-tier version numbers on a plausibly-internal google-cloud- name — classic dep-confusion resolution-attack lure targeting any internal Google/GCP developer registry that mirrors google-cloud-* names. The 9999/99999999 combo is a hallmark of the same operator that has been publishing google-cloud-* dep-confusion probes since at least 2024
• Cluster J — 1x npm keroeltop@99.99.99 malicious-domain probe: GHSA-gg5m-rqpp-c9xf, MAL-2026-16297. OpenSSF Package Analysis flag: "The package communicates with a domain associated with malicious activity." Single sentinel version 99.99.99, no detailed payload disclosure at time of writing. Treat as medium pending IOC publication

What to do

1. 1Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, package.json, requirements.txt, Pipfile.lock, and poetry.lock in your org for every package name in Clusters A through J. Uninstall on hit, wipe node_modules/.venv, delete the lockfile, rebuild against a clean cache. Clusters A, B, C, D, E, F, H include real payloads (DNS exfil, on-chain RCE, require-time env var exfil, Burp Collab OOB recon, install-time env var telemetry) — a hit is a compromise, not a warning
2. 2*For Cluster A (algamil7x.xyz scope expansion) + Cluster B (`test89-auth dep-confusion)**: any host that npm installed @shared-web/utils, @shared-web/assets, @shared-runtime/modules, @insiderintelligence/googleadmanager, test89-auth, test890-auth, test899-auth, or test8999-auth DNS-resolved a label carrying hostname/username. Rotate credentials accessible from that host, block oob.algamil7x.xyz and 31ee29fe-db68-4fd3-86a2-2b707b9e95f0.dnshook.site at your resolver, and if you maintain internal @shared-web, @shared-runtime, @insiderintelligence, or test89* scopes, pin them to your internal registry with .npmrc and configure the internal registry to refuse public-npm publishes under the same names. Sentinel versions 9.9.10 and 99.99.99` are classic dep-confusion resolution-attack markers
3. 3*For Cluster C on-chain-C2 `tailwindcss-form (day 2)**: no domain to block — the command channel is Ethereum mainnet transactions from 0xa322E5f3D311D3080e9aDC2490Ef6f0121063e1a. Detection: alert on any child_process.spawn in a build environment, alert on outbound TCP to *.publicnode.com, eth.drpc.org, 1rpc.io, eth-mainnet.public.blastapi.io, and blockscout instances from build environments (these should never appear in a legitimate frontend build), and pin @tailwindcss/forms` (correct name) explicitly in every project — the four typosquats span two days and are ranking in npm search results
4. 4For Cluster D @sanzoffc/baileys: uninstall on hit, note that any connected WhatsApp account with the package running silently subscribes to skyzopedia/NewsletterID/VIP_Push.json newsletter list 40 seconds after invocation. Additionally, the unpinned github: dependency on @whiskeysockets/eslint-config grants install-time RCE surface — audit that host as if it had run arbitrary code. Extend your registry denylist to any Baileys wrapper you have not personally vetted
5. 5For Cluster E chai-as-indexed: --ignore-scripts does NOT block this — it triggers on require. Any Node process that loaded this package POSTed its complete process.env (every environment variable) to ipcheck-hashed.vercel.app/api/auth/13b72bec1d4f2ee1c661. Assume every environment variable the process could see (CI secrets, npm tokens, AWS/GCP/Azure creds, database URLs) is compromised, and rotate all of them. Block ipcheck-hashed.vercel.app at CI egress
6. 6For Cluster F x509-escaping: uninstall, rotate credentials, block oastify.com (Burp Collaborator) at CI egress. Any host that installed the package exfiltrated /etc/passwd, /etc/hosts, DNS server config, hostname, and username to a Burp Collaborator subdomain the operator owns. Even if legitimate red-team, treat the exfil as harvested until you know otherwise
7. 7For Cluster G CWE-506 boilerplate takedowns: uninstall on hit, rotate env values as a precaution. These are pending published analysis — treat any of them as install-and-forget malware until a vendor publishes IOCs. Consider extending your registry denylist to internallib_*, openmct-*, ac-polyfills
8. 8For Cluster H py-venv-doctor: pip uninstall py-venv-doctor. The install-time payload exfiltrated the entire environment-variable set to the operator; rotate every credential visible to pip install in that environment. Add pip install --no-binary :all: --isolated to CI where possible to block setup.py-side attack paths
9. 9For Cluster I google-cloud-datacatalog-lineage-producer-client: if you maintain an internal google-cloud-* package under this exact name, pin it to your internal registry and refuse public-PyPI publishes under the same name. The 9999/99999999 sentinel-version pair is the classic dep-confusion resolution attack against internal mirrors
10. 10For Cluster J keroeltop: uninstall on hit, rotate credentials. IOC disclosure is pending — assume the sentinel version 99.99.99 behaves like other dep-confusion probes until analysis publishes
11. 11For every npm install in CI, prefer --ignore-scripts or an equivalent lockfile-consumer mode that blocks pre/post-install hooks. This blocks Clusters A, B, F, and H at install; but does NOT block Cluster C (require-time on-chain), Cluster D (require-time GraphQL), or Cluster E (require-time RCE). Layer with egress denylists on oob.algamil7x.xyz, dnshook.site, ipcheck-hashed.vercel.app, oastify.com, webhook.site, and *.publicnode.com/drpc.org/1rpc.io/eth.blockscout.com/eth-mainnet.public.blastapi.io (or, for legitimate Web3 workloads, alert-only on Ethereum RPCs from build environments)
12. 12Add every specific package name below to your internal private-registry deny-list for at least 30 days. Extend your existing pin-lists with @shared-web/*, @shared-runtime/*, @insiderintelligence/*, @sanzoffc/baileys, test89*-auth, chai-as-*, openmct-*, internallib_*, ac-polyfills, keroeltop, x509-escaping, google-cloud-datacatalog-lineage-producer-client, py-venv-doctor, and any Baileys wrapper you have not personally vetted

References

• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub
• GHSA-gg5m-rqpp-c9xf - keroeltop (Cluster J - malicious-domain probe)

  github.com
  GitHub
• GHSA-94w6-hr49-qjm7 - py-venv-doctor (Cluster H - pip full-env-var telemetry exfil)

  github.com
  GitHub
• GHSA-29f7-pqf4-c94j - @shared-web/utils (Cluster A - algamil7x.xyz DNS-OOB day 2)

  github.com
  GitHub
• GHSA-vmr9-5w3x-4v98 - @shared-web/assets (Cluster A)

  github.com
  GitHub
• GHSA-g85c-jph7-8q4r - @shared-runtime/modules (Cluster A)

  github.com
  GitHub
• GHSA-76rx-jxhm-vhww - @insiderintelligence/googleadmanager (Cluster A)

  github.com
  GitHub
• GHSA-7868-hxr7-g8r6 - test89-auth (Cluster B - dep-confusion probe siblings)

  github.com
  GitHub
• GHSA-xvpv-wq7p-548c - test890-auth (Cluster B)

  github.com
  GitHub
• GHSA-jf2q-w77c-99vv - test899-auth (Cluster B)

  github.com
  GitHub
• GHSA-25wf-vfrc-2r82 - test8999-auth (Cluster B)

  github.com
  GitHub
• GHSA-xhr7-h7hc-7785 - tailwindcss-form (Cluster C - on-chain ETH C2 day 2)

  github.com
  GitHub
• GHSA-fc5q-m33g-rp9c - tailwindcss-forms-ui (Cluster C)

  github.com
  GitHub
• GHSA-grqc-r63w-6845 - @sanzoffc/baileys (Cluster D - Baileys wave day 4)

  github.com
  GitHub
• GHSA-727r-6hg5-947x - chai-as-indexed (Cluster E - ipcheck-hashed.vercel.app env exfil + RCE)

  github.com
  GitHub
• GHSA-fq85-7xqm-cgj9 - x509-escaping (Cluster F - Burp Collab OOB recon)

  github.com
  GitHub
• GHSA-f863-m366-9cfm - internallib_v949 (Cluster G - CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-2xjj-r8mc-xpf6 - sinful (Cluster G)

  github.com
  GitHub
• GHSA-qx52-2xq4-3x3v - openmct-heatmap (Cluster G)

  github.com
  GitHub
• jaschadub/compromised-packages-check - Sep 18-19 2026 sweep

  github.com
  jaschadub
• OpenSSF malicious-packages repository

  github.com
  OpenSSF