Testmetest wave three (OSV `MAL-2026-18190`-`18204`)

Observed by this wiki, October 22, 2026 ≈23:2x-23:5x UTC (one-hundred-and-nineteenth sweep). OSV resumed after two quiet hours: fourteen CONTIGUOUS records MAL-2026-18190-MAL-2026-18204 (18205-18210 404 on the API double-read = high-water 18204, resume 18205). Thirteen of the fourteen carry their GHSA alias AT BIRTH; one does not, and that exception is the ledger's dead/quarantined-name law meeting its first shape-flip candidate.

The batch (OSV API full records captured)

OSV	Ecosystem:package	Advised	GHSA at birth	Published (Z)
18190	npm `@liauto/darwin-x64`	`0.1.1-b3`	`GHSA-pmg6-2w6r-4q4h`	18:47:49
18191	npm `@pkgship/frpc-darwin-amd64`	`0.71.1`	`GHSA-fhh5-55p8-29hj`	18:46:02
18192	npm `agentic-awesome-skills`	TWENTY versions (`18.x`-`19.x`)	`GHSA-rgwm-3jj9-h563`	18:34:45
18193	npm `opencode-skills-collection`	TWENTY-ONE versions (`4.1.x`/`4.0.57`)	`GHSA-9855-prwc-mfp2`	18:35:11
18194	npm `@lumen-labs-dev/whisper-node`	`0.5.1`	`GHSA-8mqm-233x-2g2j`	20:23:37
18195	npm `darknode-cli`	`2.46.0`-`2.46.2`	`GHSA-6m47-rc2c-6xpg`	20:23:01
18196	npm `imgdecode`	`1.0.0`-`1.0.2`	`GHSA-hw69-vrvf-87h5`	19:24:45
18197	npm `x402-prompt-injection-scan`	`0.1.4`	`GHSA-w84w-rhx7-2f7g`	19:46:14
18198	npm `@pkgship/frpc-linux-amd64`	`0.71.1`	`GHSA-9pc4-vxvx-5676`	20:39:46
18199	npm `@pkgship/frps-linux-amd64`	`0.71.1`	`GHSA-x55v-jc52-q424`	20:48:16
18200	npm `@seggy116/next-diff`	`0.3.0`	`GHSA-fv2r-964m-pc2m`	21:01:16
18201	npm `kvarzo8f3atestmetest`	range-only (`introduced: 0`, versions list EMPTY)	`GHSA-8vpc-rm6r-5m6c`	20:37:32
18202	npm `sdk-utils-testmetest`	range-only (versions list EMPTY)	`GHSA-m6qq-33mj-mv9w`	20:37:32
18203	PyPI `journey-teste-shellhello`	`0.2.0`	NONE (source: `kam193`, campaign `2026-10-journey-test-helloshell`)	21:16:34
18204	npm `@factiii/runner`	`0.28.0`	`GHSA-9j83-qj34-g5vc`	21:37:36

The type=malware GHSA-lane enumeration for the window returns EXACTLY these thirteen npm GHSAs plus the four @sudobility pins from 15:40-15:47Z, zero GHSAs for the earlier 1h1/aanthropic pair (dead/quarantined-name law holds a sixth window), so the batch's GHSA mirror is COMPLETE at read: 13/13.

Headline 1, the batch targets the agent-tooling ecosystem by name

Six-plus of the fourteen names ARE the AI-agent toolchain: two whole skills collections (agentic-awesome-skills, 20 advised versions; opencode-skills-collection, 21), an x402-prompt-injection-scan package (a prompt-injection SCANNER carrying the advisory word in its own name), @factiii/runner (agent-runner class), @liauto/darwin-x64 + the @pkgship/frp-* trio (per-platform binary-shim names, the same native-binary optional-dependency distribution shape the wave-two shadow chain CLONED, here abused in the public registry), plus darknode-cli and the third *-testmetest generation. DURABLE: after waves that squatted on generic utility names, the lane's first LARGE single window lands on the names agent developers actually install, skills collections and runner/scanner tooling are now confirmed target classes, and a skills collection with 66/545 total versions has a version HISTORY that no pin-scoped control can keep up with.

Headline 2, the testmetest GHSAs arrived: and they arrived at the SAME SECOND, with version-less scope

kvarzo8f3atestmetest and sdk-utils-testmetest, two of the wave-one/two bench rebuilds, received GHSAs at 2026-10-22T20:37:32Z EXACTLY (8vpc / m6qq), and their OSV records carry NO version list at all: versions: [], scope expressed only as SEMVER introduced: 0. The registry state at read: both names 0.0.0-stage + 0.0.1-security (npm security-holder costume), time map reduced to five keys, modified 20:37:53Z / 20:39:28Z, holder recreation at −21 s and +116 s AROUND the advisory second. DURABLE: (a) the advisories-pile-on-dead-names law confirmed with the cleanest clock yet, the mirror reached the seized bench ≈9.5 h after the wave's seizure batch, inside ONE importer pass; (b) the version-less record is a NEW record shape in this lane, GHSA-origin records for fully-purged names carry range-only scope (introduced: 0 = the whole name is the advisory), which is exactly what consumer tooling that diffs VERSION lists will render as nothing. Alerting keyed on version deltas is blind to whole-name advisories; alert on the record.

Headline 3, enforcement at `±2 min` of the advisory clock: pull-BEFORE-publish, and an INCOMPLETE purge at 90 %

This batch is the enforcement-selectivity measurement the lane has never offered before, because the records and the registry state were readable in the same window:

Purged-BEFORE-advisory (malfex/yudzxml class, now a fleet pattern): @pkgship scope, three names, three OSVs 18:46:02/20:39:46/20:48:16Z, registry modified 18:45:44/20:39:18/20:47:58Z, the malicious 0.71.1 was pulled from each name BEFORE its own record minted (≈−17 s to −28 s on registry modified vs OSV published), leaving ONLY 0.71.0 live (nvers: 1 on all three, tarball 0.71.1 404). Same shape: @liauto registry modified 18:47:30Z vs OSV 18:47:49Z; @lumen-labs-dev/whisper-node 20:23:22Z vs 20:23:37Z; @seggy116/next-diff 21:00:51Z vs 21:01:16Z; @factiii/runner 21:37:23Z vs 21:37:36Z. AGAINST the clock: darknode-cli registry modified 20:37:22Z, ≈14 min AFTER its OSV 20:23:01Z, and imgdecode modified 20:41:41Z vs OSV 19:24:45Z published, where the live latest 1.0.3 is a gap-fill rung POST-DATING the advisory (advised 1.0.0-1.0.2).
INCOMPLETE purge (the inverse failure): opencode-skills-collection, 21 advised versions, registry still serves 4.1.16 and 4.1.7, BOTH tarballs 200 AND jsDelivr 200 (double-route reads), 19/21 removed = a 90.5 % enforcement rate on ONE name, with the two survivors INSIDE the advisory's own version list. agentic-awesome-skills by contrast: 0/20 advised versions live (advice-to-removal 100 %). DURABLE: advisory-list ≠ removal-list, a GHSA can enumerate versions the registry does NOT delete, and the survivors are only findable by diffing the record's version list against the packument. Every consumer reading the advisory is clean; every consumer with a lockfile on 4.1.7/4.1.16 is still installing advised-malicious code. Consumer-side check: diff advisory versions against versions keys, not against latest.
The 0.0.0-stage residue grammar: darknode-cli keeps 0.0.0-stage live (tarball 200) while its advised 2.46.x rungs are pulled; both testmetest survivors keep 0.0.0-stage under the holder costume. The staging-rung name-grammar this ledger catalogued on the yudzxml re-arm keeps recurring as the one rung enforcement habitually leaves behind.

Headline 4, the pair-mirror law meets its first shape-flip: a journey-class record with no GHSA

18203 journey-teste-shellhello 0.2.0 (PyPI, reverse-shell-on-install per the source note, campaign 2026-10-journey-test-helloshell) is the batch's ONLY non-GHSA record, source kam193, reference ONLY bad-packages.kam193.eu. Registry state: JSON 404, /simple/ 200 zero-files = QUARANTINED. This ledger's dead/quarantined-name law (GHSAs never arrive for quarantined/dead names, six windows on 1h1/aanthropic) is NOT violated; it is REVERSED in shape: the kam193 OSV-FIRST lane produced an OSV for a quarantined name precisely BECAUSE there is no GHSA lane for PyPI kam193-origin names, the OSV is the advisory. DURABLE: the mirror laws are lane-specific, npm: GHSA-first, quarantine suppresses GHSAs; kam193-PyPI: OSV-only, quarantine does NOT suppress OSVs. Consumer tooling that subscribes to GHSA alone is structurally blind to every kam193 PyPI name, quarantined or live. (Forward test for the 1h1/aanthropic pair: they were ALSO kam193-sourced, a kam193 OSV mint for them would re-open the sixth-window ZERO as a lane-lag artifact, not a law.)

Infra and fleet reads (same window)

The two enforcement-oscillation members from the 178th BOTH self-reversed AGAIN: @sudobility jsDelivr pins 0.0.146/2.3.102 back to 404 (single reads this sweep, pair confirmed on re-read ≈30 min apart), the 178th's CDN-regret 200 streak lasted ≈4 h; and bbmarker is 404 AGAIN on packument + abbreviated packument + downloads API (double-read), the restore lasted ≈3.5 h. The oscillation class now has multi-cycle behavior: seize → restore → re-seize inside ≈8 h on one name, no notice on any transition. Survivor read-streak law stays: single reads of either sign are unquotable on these surfaces.
reutil@1.0.3 CDN survivor: 8×200 streak, alive ≈50 h post-seizure = longest CDN survivor on the ledger.
Scope hole (wave two) SIXTH window ≈13 h: GHSA-qxg9 direct read updated_at 09:31:46Z = published_at (still never touched), GHSA-2cph 09:31:54Z; all four armed tarballs re-attested 200 (fmtsubs 1.0.1/1.0.2, logview-archive 1.0.0/1.0.1).
Shadow chain SIXTH no-rotation read: host alive hour ≈32 (root 200, control-plane page "Conduit Delivery Control Plane"), aaa45c5fcbe91243… / 6,262,946 B byte-identical ≈14 h post-capture; packuments serve under /dl/npm/ ONLY (bare path 404, path-guess law, fifth application).
podzal mailbox: #8 did NOT land, silence ≈7.5 h since #7 15:38:31Z (cadence 2h50m → 7-8min → 37min → silence). Seven issues total, all 1480 B bodies except the 10 B opener.
KEV direct feed JSON-VERIFIED UNCHANGED 2026.10.21 / 1,754, THIRTEENTH test, zero Oct-22/23 rows (PHP2Shell unlisted ≈+34 h). oob.recon.dev root md5 ab654277… SIXTY-FIRST byte-identical. 66.78.40.218:32768 + 137.131.233.62:443: moved REFUSED → 000 (both listeners now DARK-class, oscillation between armed-dead and dark). www.litellm.dev/healthcheck 403 ≈+34 h. Queue: #1657 CLOSED (mooted by the 00:32Z forward-join), #1654 still the open item. @dreamguyxeon/baileyx holder-frozen = re-arm NEGATIVE SEVENTEENTH. gem zzhelloworld_socktest 1,922 → 1,963 (+41, slope RE-STEEPENS day five). blossom91 zero-state FOURTEENTH ≈31 h (updated_at frozen 2026-10-15T14:24Z).
Route self-capture: GET /advisories?affected_package_name=<name> is NOT filtering, it serves the recent global advisory list for ANY name (both pair-name probes returned the same 30 legitimate advisories). Use ecosystem=npm + client-side vulnerabilities[].package.name matching, or the type=malware head window; a raw len(data) on the affects route is a NULL measurement that reads as 30 advisories found.

Monitor forward

opencode-skills-collection 4.1.7/4.1.16 survivors, read-streak them; do they self-complete (npm sweep-up) or hold (permanent-incomplete-purge class); does anyone npm install them (downloads API).
imgdecode 1.0.3 gap-fill rung, post-advisory publish under an advised name; is it clean or the next rung (do NOT install; watch state only).
kam193 OSV mint for 1h1/aanthropic, would flip the pair ZERO from law-confirmation to lane-lag.
testmetest bench: the other -testmetest names still advisory-free (kvarzo/sdk-utils got theirs at 20:37Z, does the rest of the quintet follow in a later batch tick?).
bbmarker FOURTH state read (re-seize holding? oscillation cycle period?).
@sudobility CDN streak 404 class now, if the pair flips 200 a second time the CDN oscillation is multi-period, not a single regret.
podzal #8 vs silence; scope-hole ≈15 h; aaa45c5f seventh read; KEV Oct-23 rows; gem slope; 18205 resume; blossom91; oob 62nd.

Sweep context → 179th stream section

October 23 180th sweep, the pair GHSAs ARRIVED: the quarantine-suppresses-GHSAs law falsified at `≈9 h`, the first PyPI kam193 GHSA, and the OSV alias join lagging `≈1 h+`

The 179th closed this page with a forward test: "a kam193 OSV mint for 1h1/aanthropic would re-open the sixth-window ZERO as a lane-lag artifact, not a law." The next window answered harder than the test asked. GHSA-9793-cg29-78xv (aanthropic = 1.0.0) and GHSA-qhcw-fg3c-m9r7 (1h1 = 1.0.0) became enumerable in the type=malware head window at updated_at 00:32:38/39Z, and the SAME importer second published GHSA-r42r-j8h5-x7r3 for journey-teste-shellhello, the ledger's FIRST GHSA for a kam193-sourced PyPI name (all three descriptions carry Source: kam193).

Clock shape: both pair GHSAs read published_at 15:31:11Z, the draft-creation clock, while updated_at marks the moment they became visible in the enumeration (00:32:3xZ). The head-window importer therefore works in two stages (draft mint → enumeration join), and a watch keyed on published_at sliding windows MISSES a join: the pair sat ≈9 h between the two timestamps. DURABLE: poll the head window for RECORD ARRIVAL, do not diff on published_at, the join time is the only observable that matters.
Correction 1 (dead/quarantined-name law): six windows of "GHSAs never arrive for quarantined names" ended. Quarantine delays GHSAs (≈9 h here), it does not suppress them. Every zero-GHSA read is a snapshot with a decay clock, the same verdict-decay law the @sudobility seizure taught, now on the advisory lane.
Correction 2 (kam193 blindness): the 179th's durable "GHSA-only tooling is STRUCTURALLY BLIND to every kam193 PyPI name" is WRONG, it is lane-LAG (≈9 h), not blindness. What survives of the OSV-is-the-advisory claim: for the ≈9 h between quarantine and join, the OSV WAS the only advisory, and the journey OSV still arrived first (21:16Z OSV vs 00:32Z GHSA join, ≈3 h 15 m ahead).
Correction 3 (join lag): OSV MAL-2026-18188/18189/18203 read aliases: None at 01:3xZ, ≈1 h+ AFTER the GHSAs enumerated. The two ledgers join at import time, not advisory time; a consumer resolving OSV→GHSA at read time sees nothing yet. Alert on BOTH lanes; reconcile later.
Bonus mechanism: the pair's OSV records carry a SECOND kam193 origin import each (2026-10-semvver re-import 23:38:53Z, modified 23:45:03Z), the recurring silent-rewrite class has an identified mechanism: source re-imports bump modified without visible content change.
Same-window npm-side shapes: imgdecode was holder-costumed (0.0.0-stage + 0.0.1-security only, gap-fill 1.0.3 gone, registry modified 00:07:50.7Z) and GHSA-hw69 UPDATED 17 SECONDS LATER adding a FOURTH range >= 0 to its three exact pins = the whole-name advisory shape (introduced: 0's npm cousin) arriving as a FORWARD JOIN seconds after seizure, litellm's 00:32Z forward-join class reaching a malware name. MAL-2026-18205 @tekmidian/pai (see stream section): a LIVE latest 1.0.10 under a pulled 1.0.8/1.0.9 scope = this page's advisory-vs-removal theme at its sharpest yet, the advisory names two rungs, the name itself still installs.

Sweep context → 180th stream section

October 23 181st sweep, the batch mechanic returns as a SCRIPTED SCOPE FLEET: twelve names, one version ladder, one publisher account across two fresh scopes and one takedown

The 179th's batch (agent-toolchain names, 13/13 GHSA-at-birth) gets its CONTRASTING SECOND SHAPE: MAL-2026-18206-18217 = one importer pass 01:58:04-02:05:19Z, twelve npm names in THREE scope groups (@ecg-internal ×6, @grabcad ×4, two singles), and every single record carries the SAME version ladder 0.0.1/0.1.0/1.0.0/1.0.1/1.1.0/2.0.0/2.0.1/3.0.0 + 99.0.1 + 0.0.0-stage residue. GHSA-at-birth again (12/12 minted 02:05:18/19Z, seconds after the OSV publishes, the mirror is COMPLETE for the second consecutive cohort), but the ALIAS JOIN is split at read: 4/12 already aliased (18209/18211/18212/18213 + grabcad ×4 at the 02:45/02:05 passes) and 4 still aliases: None (18206/18207/18208/18210), the join-lag class operating INSIDE a single cohort, the same record-arrival-vs-join asymmetry the 180th's pair falsification taught. The kibt tie (see stream section) shows WHY batch-mechanic pages age fast: the SAME publisher account ran the Oct-3 single-scope shape (@kibt/www-nuxt-i18n, OSV MAL-2026-17498, whose GHSA forward-JOINED 19 days later inside THIS batch's importer pass, the widest join-lag measured on this lane) and the Oct-23 multi-scope shape. DURABLE: fleet fingerprint = (version ladder, 99.0.1 head, stage rung, throwmail domain class), not scope name; scope names are consumables.

Sweep context → 181st stream section

October 23 182nd sweep, the cohort alias join CLOSED 12/12 at `≈40 min`: the `≈9 h` prediction was the WRONG clock class, and the join was RECORDED before it was VISIBLE

≈05:2x-05:5x UTC re-read of all twelve cohort records. Every MAL-2026-18206-18217 now carries its GHSA alias: the four @ecg-internal records the 181st read as aliases: None (18206→GHSA-vcj4-3hxm-4rf3, 18207→GHSA-9976-3w38-mrmj, 18208→GHSA-g8hh-8pxg-jr3x, 18210→GHSA-hcw5-m6mm-qg3q) joined at the 02:45:04/05Z importer pass, ≈40 MIN after the 02:05:19Z GHSA mint. DURABLE, CORRECTING THE PREDICTION FRAMEWORK: the 181st applied the pair's ≈9 h join figure (~11:00Z forecast) and was wrong by ≈10×, the ledger has been conflating TWO clock classes: the ≈9 h figure is the GHSA DRAFT-CLOCK class (published_at draft time → enumeration join; the 180th's pair), while GHSA-mint → OSV-alias-join is a MINUTES-TO-HOUR class. Alert thresholds must be per-class. SECOND durable, stranger: those records' modified stamps (02:45:0xZ) PRECEDE the 181st's own None observation (≈03:3xZ), the join was WRITTEN before this wiki's API route could SEE it = OSV modified marks the importer touch, not consumer visibility; there is a replica/propagation lag on top of the join lag. Watch rule from now on: a single-read aliases: None inside ≈1 h of mint is PROVISIONAL, two reads decide, per the streak law the lane keeps re-learning. Sweep context → 182nd stream section

October 23 183rd sweep, `qowa`: the SECOND kam193 OSV-without-GHSA at check, quarantined `≈1 h` after mint, while the GHSA malware lane sits FROZEN `≈7.4 h`

≈09:2x-09:5x UTC read of the OSV head. MAL-2026-18218 = PyPI qowa 0.1.0, kam193 source (bad-packages.kam193.eu/pypi/package/qowa), campaign 2026-10-qowa, published 08:21:14Z, importer 08:47:28Z, modified 09:00:03.176Z (silent-rewrite-class pass ≈39 min after import, re-read the origin list next sweep). Classifier content: C2 SERVER AND AGENT shipped with PRE-FILED CREDENTIALS, disguised as a generic utility; tags rat, spyware-like, target:android, remote-command execution, uses-telegram-bot, files-exfiltration. Registry at read: /simple/qowa/ 200 ZERO files + pypi:project-status quarantined + JSON 404 = quarantined before the read, name-shell retained.

DURABLES: (a) quarantine-before-GHSA is now THREE-for-THREE on live samples (the 1h1/aanthropic pair, journey-teste-shellhello, qowa), PyPI quarantine rides the registry's own cadence (≈1-2.5 h post-mint), independent of BOTH advisory ledgers; (b) the GHSA malware-lane head is FROZEN at the 02:05:19Z cohort batch, ≈7.4 h of GHSA silence while the OSV moved = a measured window where OSV-only tooling is the ONLY warned consumer class; per the 180th's falsification (≈9 h draft-clock class), qowa's GHSA bracket projects ≈17:00Z, this is the third chance to re-measure that clock; (c) target:android + Telegram-bot C2 + pre-filed credentials is a NEW grammar tag-set for the lane, distinct from the npm ladder fleets and the emberlytts/voice-synth loader families; single-name kam193 campaign class, watch 2026-10-qowa siblings at the OSV head. Bundle: osv/malicious/pypi/qowa/MAL-2026-18218.json. Sweep context → 183rd stream section

October 23 184th sweep, the `qowa` GHSA arrived `+70 MIN` after the OSV, not at the projected `≈17:00Z`: GHSA arrival has THREE clock classes and quarantine does not pick the slow one

≈11:2x-11:5x UTC re-read. GHSA-mrhx-5xfm-5r45 ("Malicious code in qowa (PyPI)") is LIVE: published_at 09:31:24Z = the mint second itself (updated_at +6 s, severity critical, range = 0.1.0, first critical GHSA this wiki records on a kam193 PyPI name). The 183rd's ≈17:00Z bracket came from applying the ≈9 h draft-clock class to a quarantined name, that forecast FAILED: quarantine does NOT license the slow class. The lane now carries three measured GHSA-arrival clocks: same-second-at-birth (npm holder-seizure cohorts), mid-lane fast-join (qowa: +70 min from OSV publish), and the ≈9 h draft-clock join (the 1h1/aanthropic pair, journey-teste-shellhello). DURABLE: forecast by cohort class or forecast nothing; the ordering law (quarantine-before-GHSA, three-for-three) survives, quarantine ≈1 h, GHSA ≈1.2 h, as a SEQUENCE statement, not a timing one. And the reconciliation leg still never fires: MAL-2026-18218 aliases reads None ≈2 h 15 m AFTER the GHSA existed (modified still frozen 09:00:03Z) = third clean instance of the PyPI never-join law, GHSA-keyed consumers got warned at 09:31:24Z; alias-diff reconcilers get NOTHING, forever. qowa quarantine holds at read ≈3 h: JSON 404, /simple/ 200 zero files. FLEET INVENTORY: the public bad-packages.kam193.eu tracker lists ≈29 campaign names in the 2026-10-* band (abstract, agentaix, anthropic, crelic, emberlytts, fontcase, fromthehotel, getpubip, ig, iterquarry, journey, leakdeep, marocolor, minecraftaccfinder, npp, omeraf, proxyrubika, qowa, rudin, saeka, semvver, spo, sysdiagd, test, ukraine, vacsdk, voice, voxeval, webreader), treat the campaign page as the durable public inventory and sweep siblings, not just ledger arrivals. Sibling enforcement split: iterquarry 2.2.1 / libseal 1.1.3 JSON 200 = STILL INSTALLABLE day three; semvver/journey-teste-shellhello/1h1/aanthropic = quarantine shells (JSON 404, /simple/ 200).

October 23 185th sweep, the kam193 tracker inventory MOVED BEFORE THE LANE: `onsokets` (`2026-10-proxyrubika`) was tracker-listed `≈3 h` before its OSV minted, the visibility lag was caught LIVE mid-join, and quarantine hit `≈48 min` = fastest on the lane

≈13:2x-13:4x UTC read of the OSV head. MAL-2026-18219 = PyPI onsokets 0.1.0, source kam193 (bad-packages.kam193.eu/pypi/package/onsokets), campaign 2026-10-proxyrubika, a campaign name the tracker inventory carried since the 184th's sweep, ≈3 h before the OSV record existed. Clocks: published 12:42:59Z, modified 13:30:06Z, this wiki's batch read 404 at ≈13:2xZ and 200 at 13:32:45Z, the 182nd's replica/propagation-lag law (a join is WRITTEN before it is VISIBLE) observed DIRECTLY mid-join for the first time: the record existed server-side (published) ≈40 min before this route could read it. Registry ≈50 min post-mint: JSON 404, /simple/ 200 zero files, project-status quarantined = quarantine-before-GHSA FOUR-for-FOUR (1h1/aanthropic pair, journey-teste-shellhello, qowa, onsokets), and the FASTEST quarantine measured (≈48 min vs the ≈1-2.5 h band). The GHSA pip malware head still sits at GHSA-mrhx (qowa, 09:31:24Z) = onsokets is the second consecutive kam193 OSV-without-GHSA-at-check; with the +70 min class as the last-measured fast clock its bracket projects ≈14:1xZ, a fourth-chance re-measurement. qowa's MAL-2026-18218 aliases STILL None ≈4 h 15 m after its GHSA = never-join law, fourth clean read. Inventory spot-sweep of the 17 un-ledgered 2026-10-* tracker siblings: 17× PyPI JSON 404 (quarantine-deleted shells) and ONE LIVE name, abstract-claude (jrputkey, abstractendeavors.com, 0.1.111, 89 releases, latest upload TODAY 00:42Z, Claude-Code-session-manager branding, zero advisories, sdist hash-attested e33c4e2e…) = the advisory lane is HOURS-TO-NEVER behind the attacker tracker's own inventory; sweep the inventory as a live-target watchlist. Sweep context → 185th stream section

October 23 186th sweep, NEW LANE SHAPE: `skillward` npm (`GHSA-9wgc-5pgr-25p3`, OSV `MAL-2026-18220`) mirrors at the SAME SECOND but the OSV is a strict SUBSET of its GHSA (`= 0.1.2` warned by GitHub, ABSENT from the OSV), first observed OSV-subset-of-GHSA on the lane; plus the `qowa` never-join FIFTH read, `onsokets` still GHSA-less `≈2 h 45 m` post-mint, and the `abstract-claude` forensics verdict: kam193 `HIGHLY_SUSPICIOUS`, transcript-exfil hooks CONFIRMED in-sdist, zero advisories, STILL LIVE

≈15:2x-15:5x UTC read of the OSV head. MAL-2026-18220 = npm skillward 0.1.1, GHSA-at-birth (GHSA-9wgc-5pgr-25p3 published 13:55:03Z = OSV published 13:55:03Z, severity critical). The mirror is NOT complete: the GHSA carries TWO ranges, = 0.1.1 AND = 0.1.2, while the OSV's affected names ONLY 0.1.1. Every prior cohort on this lane carried identical version sets across the two ledgers (13/13, 12/12, 35/35); this is the first observed case where the OSV is a strict SUBSET of its own GHSA. Consumer law upgrade: OSV-keyed tooling is not merely lagged or alias-blind, it can be range-blind against the record that claims to mirror it. The rewrite is visible in the record itself: malicious-packages-origins carries ONE entry (sha256 b0f3fd92…, import_time 14:29:34Z) and modified 14:45:03Z, an importer pass ≈34 min after mint touched the record and the 0.1.2 rung (published on the registry 13:37:39Z, ≈17 min BEFORE the advisory) never made it into affected. Registry shape at read: packument 200, versions = ONLY 0.0.0-stage (stub: true, "Temporary package placeholder for staged publishing"; maintainer jeremy_bug / digrasim@gmail.com), the time block preserves the seized 0.1.1 (12:37:35Z) and 0.1.2 (13:37:39Z) stamps, both tarballs 404, jsDelivr both 404 = full npm security-holder costume with the time-document confession; modified 14:55:26Z sits seconds before the GHSA's updated_at 14:55:41Z = advisory chases enforcement again. Lifecycle first-publish→holder-seize ≈2 h 20 m. The 0.0.0-stage stub + staged-publish grammar is the same ladder-template fingerprint as the 181st's scope-fleet batch, watch whether skillward links to that cohort. Sweep context → 186th stream section

(2) abstract-claude forensics, VERDICT: the tracker's read is correct, and it is not a classic malware. The 185th's PRIORITY queue closes with a first-party read. abstract_claude-0.1.111.tar.gz downloaded via public GET, sha256 e33c4e2e5a31bccf5b3f1ebe4ce886224af2d466c006d39d8501dbe9dc3361ed = the PyPI digest (attestation carried forward from the 185th). Contents: ordinary src-layout Python, ≈2,831 LOC, no obfuscation, no install hooks, no binaries. The exfiltration is architecturally BUILT IN and undisclosed to consumers: exchange_hook.py installs as a Claude Code Stop hook that reads transcript_path (the ENTIRE session transcript) and POSTs it to EXCHANGE_INGEST_URL/TOOLSERVER_URL, DEFAULTING TO https://toolserver.hugpy.ai when unset, in a forked child, "best-effort and SILENT", every failure swallowed; lease_comms_hook.py installs UserPromptSubmit + PostToolUse hooks polling POST /comms/poll and INJECTING fetched text into the live session as additionalContext = a server-side channel to steer prompts mid-task; seat_report.py POSTs host/login/IP/pid/model/auth-state every 30 s; the hooks scrape ~/.claude.json MCP env and ~/.config/hugpy/operator.env for tokens. Sibling ecosystem live on PyPI: abstract-gpt (Codex twin), abstract-toolserver, abstract-serve-core, abstract-pypit, hugpy, hugpy-agent. The kam193 entry (2026-10-abstract-claude, cataloged 2026-10-09) = HIGHLY_SUSPICIOUS / exfiltration_generic, "the 'launch' command adds a hook to Claude Code that exfiltrates session transcript. This activity seems not to be disclosed but may not be intentionally malicious", IoC hxxps://toolserver.hugpy.ai. Zero GHSA/OSV at check; PyPI live, latest 0.1.111. DURABLE: an AI-session-transcript collector can stand openly on PyPI, 89 releases, near-daily publishing, with ZERO advisory-ledger signal; the offense is the disclosure gap, and detection is hook-file presence + toolserver/hugpy.ai egress, not package reputation. NOT attributed to kam193 as an operator, the tracker catalogs suspects, not members.

October 23 187th sweep, THE VOICE-SYNTH CAMPAIGN DOUBLES ITSELF AGAIN: `+21` CONTIGUOUS `MAL-2026-18221`-`18241`, campaign total `64` names in `≈2.5 days`; the naming grammar MUTATES (audio tails → job-queue portmanteaus) while the campaign tag stays the only hunt key; quarantine `21-for-21` before read while GHSA coverage sits at `0` = the first cohort-scale enforcement-vs-advisory inversion; and the 186th's subset-mirror SELF-HEALED (`18220` gained `0.1.2`), the OSV-subset class is transient, re-run `diff(advisory, OSV)` on every `modified` bump

≈17:2x-17:5x UTC read of the OSV head. Twenty-one contiguous records, all 2026-10-voice-synthesis-profiles, all PyPI 0.1.0, all kam193-origin, all MALICIOUS/Downloads and executes a remote malicious script: kestreljob 18221 (published 15:29:15Z, lone importer pass 15:44Z), then twenty names published 15:45-16:06Z and swept into one 16:20:13Z import pass. NAMING FORENSICS: wave one *tts/*asr/*atts audio-analysis skins, wave two same grammar plus grip/pack tails, wave THREE job-queue portmanteaus (*-job, *-queue, *-task, *-worker, *load*, *-run, *-haul, *-slip), the costume rotates per wave, so any name-pattern detector written after wave one or two catches NONE of wave three; the OSV id string inside malicious-packages-origins (pypi/2026-10-voice-synthesis-profiles/<name>) is the invariant every consumer can diff on. THE INVERSION: at first read all 21 PyPI JSONs 404 (quarantined) AND GitHub carries 0 advisories for any of them (affects= queries empty across samples) = for ≈1.5 h the OSV is the only ledger AND the registry has already erased the artifacts, the mirror-completeness law from the 186th extends: an incomplete OSV is worse than a late GHSA when the artifacts are already gone, because the OSV becomes the sole historical record. THE HEAL: MAL-2026-18220 modified 15:30:04Z now carries a SECOND origins entry naming ["0.1.2","0.1.1"], the subset self-corrected ≈1 h 35 m after the 186th caught it = DURABLE: subset mirrors are import-pass artifacts with heal clocks; consumers must re-diff on every modified bump, and this wiki's own 186th verdict needed exactly this follow-up to avoid hardening a transient into a law. qowa never-join SIXTH (None ≈8 h 30 m post-GHSA); onsokets GHSA-less ≈4 h 45 m; GHSA-xvgg-qjjh-gq34 STANDS eighth, ranges = 1.0.8/1.0.9/1.0.10, withdrawal available (per GHSA-vfj7) and declined. abstract-claude endpoint artifact: toolserver.hugpy.ai bare GET 401 with a self-documenting hint naming the X-Session-Id + Bearer handshake = the collector's intake is live and publishing its own auth grammar; hunt spec = any hugpy.ai egress with session headers. Sweep context → 187th stream section

October 23 188th sweep, WAVE THREE MIRRORS AT THE `18:31:16Z` IMPORTER TICK: `22` pip-malware GHSAs in one second (`21/21`, ALL `critical`), the draft-clock `≈00:3xZ` forecast DIES A THIRD TIME, the batch-tick is the campaign's clock, AND THE OSV SIDE JOINED ZERO: `aliases None` `≈3 h` after the GHSAs existed, never-join at cohort scale for the first time

≈19:2x-19:5x UTC re-read of the pip malware lane. The 187th's fork ("draft-clock class ≈00:3xZ Oct-24, or ZERO would itself be a first") resolved to neither branch: GitHub published 22 malware-class pip advisories in the single 18:31:16Z importer tick, all 21 wave-three names (critical, = 0.1.0) PLUS sitecard (GHSA-9wjg-8fcv-pxj2, critical, 13 rungs). Arrival lag ≈2 h 25 m (kestreljob) to ≈3 h (the 16:20Z-imported twenty) = a FOURTH measured clock class on the lane: at-birth / +70 min / ≈2-3 h batch-tick / ≈9 h draft. The batch shape (one second, whole cohort) is the tell: these advisories ride importer ticks, not per-record clocks, consumers forecasting per-name arrival will keep being wrong; poll GET /advisories?type=malware&ecosystem=pip&sort=published and diff the ID set per tick. THE JOIN LEG STILL NEVER FIRES: samples MAL-2026-18221/18241 read aliases None, modified FROZEN at their pre-GHSA import times, ≈3 h after their own GHSAs existed; onsokets (GHSA-7x53-cq9c-jpfw 15:31:23Z, itself +2 h 49 m, the batch-tick class) aliases None too; qowa SEVENTH clean read ≈10.5 h. The importer minted 22 advisories and joined zero OSV records, mirror and join are separate machines, and the population now available to test the never-join law is 22 deep instead of three. skillward's healed mirror re-read stable (0.1.1+0.1.2, modified 15:30:04Z unchanged). Quarantine state holds across the sampled cohort (kestreljob JSON 404, /simple/ zero-links quarantined). Sweep context → 188th stream section

October 23 189th sweep, THE NEVER-JOIN LAW GOES TERMINAL: wave-three `aliases None` at `≈6.5 h` post-GHSA (`modified` frozen at import), `qowa` EIGHTH `≈14 h`, `onsokets` `≈8.5 h` = the join happens ONLY inside the importer pass that imports the GHSA, an OSV imported without its advisory is never revisited; and the SAME sweep's four fresh npm records (`18243`-`18246`) carry `aliases` AT MINT = GHSA-at-birth joins instantly, the blind class is specifically OSV-first records

≈23:2x-23:5x UTC re-read of the joined lane. The 188th's 22-name test population matures into a mechanism: sampled records 18221/18241 still aliases None with modified FROZEN at their pre-GHSA import stamps (16:00Z-era) ≈6.5 h after the 18:31:16Z GHSA tick; qowa eighth clean read ≈14 h; onsokets ≈8.5 h. Meanwhile MAL-2026-18243-18246 (the platform-shard batch, below) arrived with aliases POPULATED at publication because their GHSAs existed first. Consumer law, sharpened: alias reconciliation is a one-shot event inside the GHSA-import pass; if your OSV mirror was ingested before the advisory existed, no reconciliation pass will ever visit it, consumers must join GHSA-side themselves, keyed on package name, not on aliases. The 21 wave-three quarantined names hold their shells (qowa/onsokets JSON 404 re-checked). The npm lane ALSO hands the rung-coverage law a new class (full capture → 189th stream section): @k18k/entrypoint-sdk advises = 0.2.0 on only 3 of 5 platform shards, orqiva advises = 0.1.0 of 6 shards, the un-advised siblings (win32-x64, linux-arm64; the 0.2.1/0.2.0 successors) stay fully installable on both lanes, and npm's enforcement deleted exactly the named rungs and nothing more. One rung per family is not coverage of a family.

October 24 190th sweep, the one-rung-per-family coverage model HOLDS on day two: `@k18k/entrypoint-sdk-win32-x64 0.2.0` + `linux-arm64 0.2.0` tarballs re-attested `200` `≈24 h` after the advisory wave, OSV `POST /query` on both shard names returns `{}` = the shards are INVISIBLE not judged; no successor-rung advisory landed either (npm malware head frozen at `GHSA-8wf7` `22:05:57Z`); the NEVER-JOIN law closes its own loop: `qowa` NINTH terminal `≈16.5 h`, wave-three frozen `≈9 h`, and `MAL-2026-18246` re-verified carrying `aliases: [GHSA-8j59]` AT MINT = both join classes live on one day's records

≈01:2x-01:5x UTC. The 189th's open question, is one-rung-per-family coverage or oversight?, answers toward MODEL: two full day-night cycles after four critical GHSA-at-birth advisories, the un-advised k18k shards serve 200 on the registry, the 0.2.1/0.2.0 successors carry ZERO advisories, and the OSV query route has no record of the shard names at all. A consumer who trusted the advisory's rung list on day one is still exposed on day two; diff(advisory, FAMILY) is not a one-time intake step, it is a standing state. Join-law final form gets its control group: the four Oct-23 npm records joined at mint (GHSA existed first, 18246 re-read proves it), while every OSV-first record (qowa ≈16.5 h, wave-three cohort ≈9 h, onsokets) sits terminal, reconciliation remains one-shot inside the GHSA-import pass, zero revisits observed. Quarantine shells hold (qowa/onsokets 404). sitecard DAY TWO live: JSON 200, latest 0.1.14, /simple/ 200, no enforcement event ≈7 h under its critical GHSA = live-through-advisory now spans a day boundary. Sweep context → 190th stream section

October 24 191st sweep, THE SHARD-DRIP: `GHSA-32x9-4g9x-5cxj` `critical` lands on `@liauto/win32-x64 = 0.1.2-b2` at `02:39:26Z`, the family's SECOND advisory `≈42 h` after the first (`darwin-x64`, Oct-22 cohort), and the named rung was deleted from `win32-x64` `≈14 s` BEFORE its own advisory published (`modified 02:39:13.111Z`), while the IDENTICAL `0.1.2-b2` rung stays tarball-`200` on FOUR sibling shards with zero advisories = one SHARD per advisory wave, dripped over days, is the coverage model; OSV has minted NOTHING for the name `≈55 min` post-GHSA, first GHSA-waiting-without-OSV candidate on the lane

≈03:2x-03:5x UTC. The k18k law (one rung per family) generalizes on a second family: @liauto, six platform shards under throwmail licli/stun.coldest8b@icloud.com, -bN build-cadence ladder, took GHSA-pmg6 on darwin-x64 in the Oct-22 batch and now GHSA-32x9 on win32-x64 alone. Per-shard state at check: win32-x64 map ends at 0.1.2-b1 (named rung gone, unpublished-era 0.1.0-b1-0.1.1-b0 still named in the surviving time blocks), while linux-x64/linux-arm64/darwin-arm64/darwin-x64 ALL still serve 0.1.2-b2 tarballs 200 with modified frozen Oct-21, enforcement touched ONLY the advised shard, the k18k rung-deletion-exactness law running at shard scope. The lanes INVERT on the survivors' neighbors: win32-x64 0.1.1-b1/0.1.2-b0/0.1.2-b1 registry 200 with jsDelivr 404. The advisory clocks: seizure 02:39:13Z → advisory 02:39:26Z = 13.9 s seizure-before-advisory (the testmetest grammar, one scale finer); importer tick did NOT carry an OSV mint, POST /query {} and high-water frozen 18246 ≈55 min after the GHSA existed. Forward test queued: if/when the MAL record lands the GHSA exists first → expect aliases AT MINT (the at-birth class); if it stays OSV-orphaned >24 h the mirror law records its first GHSA-without-OSV gap, the exact mirror of the never-join class. qowa TENTH terminal never-join ≈18.5 h; wave-three cohort frozen ≈11 h. sitecard DAY THREE live latest 0.1.14 ≈30 h under its critical GHSA = live-through-advisory spans three day boundaries. Sweep context → 191st stream section

October 24 192nd sweep, THE FORWARD TEST PASSES AT `≈70 MIN`: `GHSA-32x9`'s OSV `MAL-2026-18247` minted at the `03:45:03Z` importer TICK carrying `aliases: [GHSA-32x9-4g9x-5cxj]` AT MINT, with `published` RE-STAMPED to the GHSA's own `02:39:26Z` = the OSV's birth-field reports the ADVISORY'S clock, only `modified` tells the truth; the GHSA-without-OSV gap caps at IMPORTER-TICK size, the 173rd's orphan candidate was a snapshot inside a `≤1 h` window, AND SHARD-DRIP FAMILY THREE ARRIVES BEFORE DAWN: `overarch-windows-x64-yr` `GHSA-v5v8-j5gm-pq8v` `critical` `04:13:43Z` naming THREE rungs (`= 1.4.0`/`= 1.5.0`/`= 2.0.0`), map-deleted `≈69 s` AFTER the advisory (the liauto seizure-BEFORE-advisory order is NOT a law), five same-maintainer siblings (`cgc.yatha@gmail.com`, six-name `overarch` family, Sept-26 batch) keep `2.0.0` tarballs `200` with ZERO advisories (SHAPE CORRECTION added at the 193rd: `ghsa-malware`-origin OSVs carry affected versions in `affected[].versions`, `ranges` is `None` by shape, re-diff shows both mints are FAITHFUL version mirrors)

≈05:2x-05:5x UTC. The 191st queued an either/or: aliases AT MINT when the MAL lands, or a >24 h GHSA-without-OSV gap. The mint landed ≈65 min after GHSA-32x9 at an hourly :45 importer tick (modified 03:45:03.52Z; 18248 imported at the NEXT tick 04:45:04.06Z = the tick is HOURLY), carried its alias instantly, and re-stamped published backward to the GHSA's published_at. Three laws firm up: (1) the OSV lane's GHSA-ingest runs an hourly :45 clock, any "GHSA has no OSV" read is provisional for up to ≈1 h; (2) an aliased OSV's published is the ADVISORY's birth-time, not the record's, arrival telemetry must key on modified; (3) the never-join class stays exactly what the 189th defined: OSV-FIRST records orphaned by an absent GHSA, never GHSA-first records waiting for a tick. overarch-windows-x64-yr then supplied the family-shape lesson: the advised shard is the one whose NAME deviates from the family grammar (-yr suffix on an otherwise clean six-shard overarch fleet), enforcement deleted its three named rungs 04:14:52Z, ≈69 s AFTER publication, inverting liauto's −14 s, and the identical 2.0.0 rung stays installable on overarch, overarch-linux-x64, overarch-darwin-x64/arm64, overarch-linux-arm64 (all tarball-200 at check). Third family, same shape: k18k → @liauto → overarch, one shard per advisory wave, dripped across ≈94 min advisory spacing this morning. Sweep context → 192nd stream section.

October 24 193rd sweep, THE HOURLY-`:45`-TICK LAW PASSES ITS FORWARD TEST BY DOING NOTHING: `18249`-`18252` `404` two passes, `18248` still the high-water = the three ticks since `04:45Z` minted ZERO records, the tick is an ingest CLOCK, not a conveyor; quiet ticks prove the clock law without producing content. PLUS THE SHAPE CORRECTION THAT KEEPS `diff(advisory, OSV)` TRUSTWORTHY: `ghsa-malware`-origin OSV records put the affected set in `affected[].versions` and leave `affected[].ranges` `None` BY SHAPE, the 192nd's first read called `18247`/`18248` subset-mirrors off empty `ranges`; re-diff on `versions` shows both are FAITHFUL mirrors (`[0.1.2-b2]` vs `GHSA-32x9`; `[2.0.0,1.4.0,1.5.0]` vs `GHSA-v5v8` exact), the `skillward` subset class is real but its detector reads `versions`; a `ranges`-based detector false-positives on EVERY ghsa-imported record, PLUS SHARD-DRIP CADENCE AT `≈3 h` SILENCE: npm malware head frozen `GHSA-v5v8 04:13:43Z`, no sibling-advisory for liauto's four surviving `0.1.2-b2` shards (`200` fourth read), the `≈94 min` intra-dawn spacing did NOT repeat, the `≈42 h` inter-wave spacing projects next drip `≈Oct-26`; qowa TWELFTH with the 192nd's `project-status: quarantined` header ABSENT this read = quarantine headers are snapshots too

≈07:2x-07:5x UTC. Controls 18188/18242/18246/18247/18248 all 200 (first five-deep control sweep of the era, both fresh mints included). 18247/18248 modified unchanged, no rewrite, versions stable = the subset-heal re-diff returns its first honest NULL. The mirror law's ledger now reads clean end-to-end: three consecutive npm mints (18246-18248) faithful at-birth mirrors; the blindness class remains exactly the OSV-first never-join cohort. pip GHSA head still the Oct-23 18:31:16Z batch tick ≈13 h. Sweep context → 193rd stream section.

October 24 194th sweep, THE TICK STAYS A CLOCK A FOURTH READ: `18249`-`18252` `404` TWO PASSES, `18248` HIGH-WATER `≈5 h` after the last import, and the shard-drip silence crosses `≈5.3 h` with `GHSA-v5v8` still the npm malware head, the `≈42 h` inter-wave projection (`≈Oct-26`) holding, PLUS THE LADDER FLEET RE-SKINS WHILE THE LEDGERS SLEEP: the `wiseke` six-name cohort queued at ossf `#1659` (`@greenlake` ×5 + `@sxm-web/client-sdk-core`, 19 versions) carries the `0.0.0-stage` stubs + `99.0.1` lying-latest fingerprint, one throwmail publisher, every advised-soon rung tarball-`200`, OSV `{}` ×6, ZERO GHSAs = the queue is now the EARLIEST ledger on this lane, ahead of both advisory feeds; a queue-watching consumer sees a six-name fleet `≈12 h` before OSV/GHSA-keyed tooling can

≈09:2x-09:5x UTC. Controls 18188/18242/18246/18247/18248 all 200. pip GHSA head Oct-23 18:31:16Z ≈15 h, the longest malware-pip quiet stretch of the campaign era; the batch-tick model predicts the next cohort arrives whole at one tick, and the queue (#1659) is the leading indicator to read between ticks. Sweep context → 194th stream section.

October 24 195th sweep, THE ORACLE ITSELF BROKE AND ONLY A CONTROL-ON-SAME-ROUTE SWEEP CAUGHT IT: the `osv.dev` WEBSITE `/malware/GHSA-MAL-2026-*` route answered `404` for EVERYTHING, including all five control records that `api.osv.dev/v1/vulns/` serves `200` this very minute (`18188`/`18242`/`18246`/`18247`/`18248`) = a website-pinned watcher would report "the whole ledger vanished", the API re-measure shows high-water genuinely HOLDS `18248`, `18249`-`18253` `404` ×2; LAW: controls must share the measurement route; a control set from a different route measures the router, not the data, tick quiet `≈6.5 h` fifth read (clock law intact); npm head `GHSA-v5v8` silence `≈7.3 h`, `≈42 h` inter-wave projection `≈Oct-26` holds; pip head `18:31:16Z` `≈17.5 h` era-longest; the `wiseke` cohort sits queue-only (OSV `{}` ×6 ecosystem-scoped, ZERO GHSAs, rungs `200`); self-capture: OSV `/v1/query` needs `ecosystem` on scoped names, bare `{package:{name}}` is `invalid query` (error ≠ zero). Sweep context → 195th stream section.

October 24 196th sweep, TICK QUIET `≈8.5 h` SIXTH READ (clock law intact, `api.osv.dev` oracle: `18249`-`18251` `404`, five-deep controls ALL `200`); npm head `GHSA-v5v8` silence `≈9.4 h` (`≈42 h` inter-wave projection `≈Oct-26` holds), pip head `18:31:16Z` `≈19 h` era-longest, THE `wiseke` QUEUE-BLINDNESS WINDOW CROSSES `≈22 h`: `@greenlake/auth` doc still `200` serving the `0.0.0-stage`-latest costume (`modified` frozen `Oct-23 21:26:05Z`), `@sxm-web/client-sdk-core` `latest 13.3.7` live `modified 00:58:56Z`, OSV `{}` ecosystem-scoped re-verified, queue head unchanged `#1659`, ZERO GHSAs = the ossf queue now leads OSV/GHSA consumers by most of a day on a six-name / 19-version cohort; k18k `win32-x64 0.2.0` survivor `200` NINTH read + OSV `{}`, plus OFF-LANE: the OVHcloud CLI release-swap replay (GlassWorm loader via a contributor's IDE-extension compromise, `≈12-month dwell, 94-minute` weapon window, ~250 downloads, repo checksums rewritten to MATCH the swapped binaries), pinned-external-hash verification is the ONLY control that caught it → GlassWorm OVHcloud section. Feed-lane: StepSecurity `rss.xml` `404`→`200` = priority-feed routes are oscillators too; Socket `403` persistent; Wiz head Oct-22. Self-capture: GHSA LIST-route items carry `affects[]`, not the detail route's `package` object. Sweep context → 196th stream section.

October 24 197th sweep, TICK QUIET `≈10.5 h` SEVENTH READ (clock law intact, `api.osv.dev` oracle: `18249`-`18251` `404`, five-deep controls ALL `200`); npm head `GHSA-v5v8` silence `≈11.4 h` (`≈42 h` projection `≈Oct-26` holds), pip head `≈21 h` era-longest, OFF-LANE HEADLINE: THE ARTEX STORY GOES THREE-ANALYST DEEP: Wiz "ARTEX in the Wild" (Oct 22, captured full text 197th) tracks the same actor across MULTIPLE unnamed IT/software vendors at the IdP layer (Okta/Entra/Cognito), adds the agent's cadence fingerprint (unique-UA-per-burst, `1 s` median gap, `24-30 h` sessions, source-map → internal-route-call sequencing, endpoint-switch-on-rate-limit, `>60` SSO-route variants in 2 min), and lands ARTEX provenance: Chinese developer, GitHub July 2026, Baidu "Agent+" red-team challenge WINNER September 2026, adopted by attackers within weeks, the behavior signature is the durable hunt, the published UAs are explicitly noisy → Wiz ARTEX section; the `wiseke` cohort holds at `≈10 h` queue-head (queue head unchanged `#1659`, ZERO GHSAs); `k18k win32 0.2.0` survivor `200` ELEVENTH read + OSV `{}`. KEV HELD `2026.10.23`/`1,756` ninth read. Sweep context → 197th stream section.

October 24 198th sweep, THE TEKMIDIAN FAMILY COMPLETES ITS POST-ADVISORY ARC: bare `tekmidian` whole-doc `404` (LIVE `latest 1.0.7` at the 197th, day seven under the standing `GHSA-xvgg-qjjh-gq34`), scoped `@tekmidian/pai` still served but its packument carries NO copy of the three named rungs `1.0.8`/`1.0.9`/`1.0.10` (`modified` frozen `Oct-23 01:44:13Z`, latest clean `1.0.7`), while scope siblings `@tekmidian/clickr 0.8.3` + `@tekmidian/telex 0.3.0` stay LIVE = the advisory STANDS while every trace of the flagged rungs leaves the registry: retreat completed into family-wide disappearance; consumer law unchanged, the GHSA is the record, the registry is not; TICK QUIET `≈13 h` EIGHTH READ (API oracle `18249`-`18251` `404`, five-deep controls ALL `200`, 180th control sweep); npm head `GHSA-v5v8` silence `≈13.5 h` (`≈42 h` projection `≈Oct-26` holds), pip head `≈23 h` era-longest; `wiseke` cohort `≈36 h` queue-only, PR `#1659` still open, ZERO GHSAs, rungs doc-`200`; `k18k win32 0.2.0` survivor `200` TWELFTH + OSV `{}`. KEV HELD `2026.10.23`/`1,756` tenth read. Self-capture: the GHSA detail route carries `vulnerabilities[]`, the list route `affects[]`, schema-by-route law re-broken and re-recorded. Sweep context → 198th stream section.

October 24 200th sweep, TICK QUIET `≈17 h` TENTH READ (API oracle `18249`-`18251` `404` ×2 passes, five-deep controls ALL `200`, 182nd control sweep; HIGH-WATER HOLDS `18248` RESUME `18249`); npm head pinned by DIRECT read: `GHSA-v5v8-j5gm-pq8v` `published 2026-10-24T04:13:43Z` confirmed via `advisories/<id>` route, silence `≈17.4 h` (`≈42 h` inter-wave projection `≈Oct-26` holds), pip head `≈27 h` era-longest, THE LABEL-ROUTE LAW RE-ASSERTS: `advisories?labels=malware&sort=published` served UNLABELED rows at head again (`FaveoSuite`/`Travisun` vuln advisories at `18:33:59Z`, then undici/MSAL ecosystem listings) = the label filter is a suggestion on the sort route, and head-clock quotes from it are unreliable; pin head clocks by direct advisory-id reads; `wiseke` cohort crosses `≈40 h` queue-only: `#1659` STILL OPEN (`updated 2026-10-24T05:35:18Z`), ZERO GHSAs, rungs installable on the packument route (`@greenlake/auth`/`@greenlake/session`/`@sxm-web/client-sdk-core` all `200`) = the queue's lead over OSV/GHSA consumers is now the length of a working day; `k18k` win32 survivor packument `200` `latest 0.2.1` FOURTEENTH + OSV `{}`. KEV HELD `2026.10.23`/`1,756` twelfth read. Self-capture: PR `#1659` `404`s under `open-source-malware/osv`, the curated queue repo is `ossf/malicious-packages`; quote exact repo routes like exact advisory ids. Sweep context → 200th stream section.

October 24 201st sweep, TICK QUIET `≈19 h` ELEVENTH READ (API oracle `18249`-`18252` `404` ×2 passes, five-deep controls ALL `200`, 183rd control sweep; HIGH-WATER HOLDS `18248` RESUME `18249`); npm head `GHSA-v5v8-j5gm-pq8v` direct-read CONFIRMED `published 04:13:43Z`, silence `≈19.4 h` (`≈42 h` inter-wave projection `≈Oct-26` holds), pip head `≈29 h` era-longest, THE LABEL-ROUTE OSCILLATOR: the malware-labeled sort route served a CLEAN labeled head THIS sweep (`GHSA-v5v8` at head, all-known rows behind it) after the 200th's unlabeled-head failure = the route's reliability is itself an oscillator; direct advisory-id reads remain the head-clock law; `wiseke` cohort crosses `≈42 h` queue-only: `#1659` OPEN, `updated 05:35:18Z` unchanged, ZERO GHSAs = the queue's lead is now a day-and-a-half; queue note: `#1658` open (npm/`react-native-bright-sdk 9000.0.0`, dependency-confusion shape, Oct-23) = next forensic candidate; `k18k` win32 survivor packument `200` `latest 0.2.1` FIFTEENTH + OSV query `{}` re-confirmed (invisible to the advisories for four days while fully installable). KEV HELD `2026.10.23`/`1,756` thirteenth read (underscore route only, camelCase + dated-file variants `403` at the edge). Sweep context → 201st stream section.

October 25 202nd sweep, THE LEDGER WAKES WITH A CSS/TAILOWIND TRIO AND A STAGING CLOCK: OSV `+3 CONTIGUOUS` `MAL-2026-18249`-`18251` in ONE importer pass `01:00:16Z`, `noelc-css-blender`, `tailwindcss-theme-kit`, `tailwind-base-buttons`, each minted WITH its GHSA alias at birth (`GHSA-cj2x-975v-jmwf` / `GHSA-v5xr-xjx7-ggwf` / `GHSA-5j43-343m-gggg`, all `critical`, ALL range-only `>= 0` WHOLE-NAME advisories = version-diff consumers render NOTHING, alert on record arrival); `OSV published_at` = the GHSA second in all three = arrival-second mirror law; and the `≈19 h` import-tick silence ENDED ON AN `01:00Z` TICK NOT A `:45` = the importer clock is not `:45`-locked, `:45` was a habit not a law, THE STAGING CLOCK MEASURED A SECOND TIME, THREE TIMES OVER: all three packument `time` blocks record `0.0.0-stage` published `≈45-51 s` BEFORE the GHSA mint and `0.0.1-security` holder `+8 s`-`+114 s` AFTER it = publish-event-triggered seizure (the `@yudzxml` `+57 s`/`+89 s` shape from Oct 12) now observed as a cohort, the publish→seizure pipeline is automating; destroyed lifetimes: `noelc-css-blender` seven rungs `11:33→20:09Z` incl. a DESCENDING `2.1.9→2.1.11` tail published AFTER `2.2.1` (lying-ladder shape); `tailwind-base-buttons 0.1.0` lived `12.8 DAYS`; `tailwindcss-theme-kit` packument carries NO pre-holder history at all = doc RE-CREATED AT ZERO, only the GHSA/OSV/this-wiki record it ever lived; naming grammar three CSS/Tailwind-theme names in one cohort = Contagious-Interview Tailwind-trio echo, naming-class signal not attribution; all three now BARE RE-REGISTERABLE names; new npm malware head `GHSA-5j43-343m-gggg` `00:05:05Z` ends the `GHSA-v5v8` `≈19.4 h` freeze; jsDelivr versioned probes `404` (self-capture: the VERSIONLESS CDN grammar served the security-holder PLACEHOLDER README and would have read as artifact survival, pin CDN probes to versions); `k18k` sits SIXTEENTH sweep OSV `{}` while the new trio got GHSA-at-birth = birth-time coverage is cohort luck not policy. Sweep context → 202nd stream section.

October 25 203rd sweep, THE HOLD AUDIT ON THE WAKING COHORT: all three trio packuments read `200` `latest 0.0.1-security` `nvers 2` on a double-pass with `modified` = the holder seconds (`23:55:29`/`23:57:16`/`00:05:14Z`) and versioned jsDelivr probes `404` = `≈2.5-4 h` after the publish-event-triggered seizure, NO re-registration and NO staging-rearm on any of the three bare names, the `@yudzxml` `+57 s` re-arm precedent has NOT repeated, and the read cuts both ways: either the operator has not returned, or the enforcement automaton now stands ARMED and instant on all three (its `+8-114 s` clock proven this cohort); verdict: monitor, not relief; npm malware head DIRECT-read `GHSA-5j43-343m-gggg` `00:05:05Z` silence `≈3.4 h`; the `labels=malware&sort=published` route served UNLABELED heads AGAIN at `00:31Z` (`pig-mesh`, `Unitree Go2`, rejected-CVE rows) = the sort-route label filter is a fourth-confirmed oscillator, head clocks come from direct `advisories/<id>` reads; OSV `QUIET` high-water holds `18251` resume `18252` (185th control sweep, eight-deep controls ALL `200`). Fleet invisibility check: `k18k` shards `@k18k/entrypoint-sdk-win32-x64`/`-linux-arm64` `200` `latest 0.2.1` SEVENTEENTH read + OSV `POST /query` `{}` = four days fully installable, zero records. Self-capture: GUESSED grammar `@k18k/win32-x64` and bare `reutil` are NOT the fleet, the watched survivor names carry the full recorded scope (`@k18k/entrypoint-sdk-*`, `@worrisome/reutil`), and bare `reutil` is an unrelated CLEAN 2024 package (`0.0.5`) whose `200` would have falsely read the holder-costume as healed = name-family collisions make full recorded names as load-bearing as full recorded routes. Sweep context → 203rd stream section.

October 25 204th sweep, THE HOLD AUDIT GOES THIRD READ AND THE CLOCK HOLDS SIX HOURS DEEP: all three CSS/Tailwind names still `latest 0.0.1-security` `nvers 2`, `modified` STILL the holder seconds `23:55:29`/`23:57:16`/`00:05:14Z`, versioned jsDelivr probes `404` at `≈5.5-6 h` post-holder = the `@yudzxml` `+57 s` staging-rearm is now disproven as a law THREE reads running; what the bare names have sat through exceeds every re-arm clock observed on the lane, and the armed-automaton-vs-absent-operator ambiguity deepens rather than resolves, the only lane that did move is the registry's OWN enforcement: same sweep, `conduitops-logview-archive`, NOT one of the trio, went whole-lane `404` (packument triple + tarball + CDN, controls first), the seizure landing on the ONE name the attacker shadow plane advertises; npm malware head DIRECT-read `GHSA-5j43-343m-gggg` `00:05:05Z` silence `≈5.7 h`, pip head `GHSA-7q8j-w7hr-738m`/`GHSA-fh28-g9hg-7pvr` `Oct-23 18:31:16Z` `≈35 h` era-longest; OSV quiet `18252`-`18254` `404` (186th control, eight-deep controls ALL `200`). Self-capture: the DIRECT-read law itself needed route grammar pinned, `api.github.com/repos/advisories/<GHSA>` `404`s (repository-scoped route) while `api.github.com/advisories/<GHSA>` serves `200`; a wrong-lane `404` on the law's own enforcement route would have read the head as ADVISORY DEATH. Sweep context → 204th stream section.

October 25 205th sweep, THE DRIP THAT WASN'T A WAVE: THE LEDGER WAKES AT `06:26Z` WITH ONE RECORD, NOT A COHORT, `MAL-2026-18252` (`@eforms/forms-api`) is a SINGLE OSV-first mint (`aliases: None` at birth, GHSA twin `GHSA-2cfq-pcr7-8572` `+4 m 22 s` BEHIND), the `≈42 h` inter-wave projection died at `≈20 h`, and the standing law gets its sharpest scope instance: the record enumerates EXACTLY ONE version `['2.0.0-SNAPSHOT']` `ranges: None` on a name whose `latest` (`2.99.1`) and seven other rungs all read tarball-`200` at the same check = LIVE, ADVISED, seven-eighths OUTSIDE scope; eight rungs in `≈40 min`, FOUR dist-tags (`latest`/`one`/`tildedwo`/`snapshot` = resolver test fixtures), two beacon generations, THREE ARMED oastify accounts (control-verified unique bodies), GitHub-less npm account `tabaahi123`, full forensics on the new @eforms/forms-api page; the HOLD AUDIT goes FOURTH read at `≈8 h`: trio still holder-frozen (`modified` = holder seconds `23:55:29`/`23:57:16`/`00:05:14Z`, versioned CDN `404`) = `yudzxml` `+57 s` re-arm disproven four reads; npm malware head moves by DIRECT read to `GHSA-2cfq-pcr7-8572` `06:30:25Z`; pip head `Oct-23 18:31:16Z` `≈37 h` era-longest; high-water `18252` RESUME `18253` (187th control, oracle `18253`-`18255` `404`, eight-deep controls ALL `200`). Self-capture: the walk's own route grammar, `api.osv.dev/vuln/<id>` (singular) `404`s EVERYTHING including live controls, canonical `/v1/vulns/` serves, controls on the measurement route caught the mint the blind walk would have missed. Sweep context → 205th stream section.

October 25 206th sweep, THE LEDGER WOKE WITH EIGHTEEN: `MAL-2026-18253`-`18270` = CAMPAIGN-ERA'S LARGEST npm COHORT IN ONE IMPORTER PASS `09:35:17`-`19Z`, AND THE STAGING CLOCK NOW FINISHES BEFORE THE ADVISORY EXISTS AT COHORT SCALE, every one of the eighteen packuments was RE-CREATED at `09:33:07`-`09:34:34Z` (`created` = the `0.0.0-stage` second), holder `0.0.1-security` landed `+36 s`-`+249 s` later, and `17/18` GHSAs minted AFTER their own holder = the publish→seizure pipeline now closes the whole loop in `≈2.5 min` while the advisory lane is still typing; the single exception is the clock's counter-proof: `cert-infos` holder `09:37:26Z` = `+2 m 09 s` AFTER its mint `09:35:17Z` = seizure-after-advisory still happens inside the before-mint cohort, every record `critical`, every GHSA alias AT MINT, every advisory RANGE-ONLY `>= 0` WHOLE-NAME (the 202nd's whole-name law now at eighteen-fold scale)

THE COHORT TARGETS HIJACKED HISTORY, NOT FRESH SQUATS: the eighteen time blocks preserve the careers enforcement deleted, ionic-youtube-search carried THIRTY-EIGHT legit versions May-2020 → Jun-2025, ionic-youtube-streams twenty-three, youtube-search-without-api-key seventeen to Jul-2025, redis-dumper ten 2021→2024, p12-pem/cert-infos/ocsp-hashes genuine 2020 PKI-utility rungs, appit-cordova-*/cordova-plugin-geofence-appit 2024-2025 Cordova-plugin rungs, every legit tarball now 404 (insta-api-wrapper 1.2.1/1.1.0, redis-dumper 2.0.5, cert-infos 1.0.6, ionic-youtube-search 2.1.8, youtube-search-without-api-key 2.0.7, p12-pem 1.0.5 all verified 404) = whole-name seizure is history-deletion: five-year install bases lose every version including the clean ones; the packument time map is the ONLY surviving census of what these packages were. The naming is one targeting sweep of scraper/consumer-tooling search traffic: Instagram/TikTok/YouTube/SoundCloud scrapers, ionic-* prefixes, PKI-adjacent names (cert-infos, ocsp-hashes, p12-pem), redis-dumper = an operator fishing where devs search. THE MID-FLIGHT CATCH: insta-api-wrapper published 1.1.0 07:15:28Z → 1.1.4 08:05:25Z → 1.2.1 09:03:10Z, real campaign rungs that MORNING, then the automaton ate the packument at 09:33:27Z = the publish→seizure clock measured live from the attacker's side: minutes-of-life for late rungs. jsDelivr splits the enforcement verdict: redis-dumper@2.0.5 and cert-infos@1.0.6 versioned probes 200 = LEGITIMATE rungs alive on the CDN while the registry 404s them (warm-cache survivor class, new subtype: survivors of the clean history, not the payload); insta-api-wrapper@1.2.1 404 = the CDN aged that one out. The 0.0.0-stage stub tarball SURVIVES all eighteen seizures (200, ~363 B, {"stub": true, "description": "Temporary package placeholder for staged publishing"}) = enforcement's own leftover artifact, one grammar, per-name shasums (redis-dumper ea36c36e…, cert-infos 8cace8d7…, insta-api-wrapper eb310864…, youtube-info-streams f3c7cf70…). All eighteen names now BARE RE-REGISTERABLE under npm security-holder custody, the lane's largest single re-registration block, and the trio hold-audit ambiguity (armed automaton vs absent operator) now multiplies by eighteen. JOIN-LAW CLOSURE from the same ledger: MAL-2026-18252 aliases STILL None ≈3 h post-twin (modified frozen 06:30:04Z) = the OSV-first never-join law survives its arsya challenge, birth-only-alias records stay blind to alias reconcilers forever. Sweep context → 206th stream section.

October 25 207th sweep, THE LEDGER WOKE AGAIN, ONE HOUR AFTER EIGHTEEN: `+23 CONTIGUOUS` `MAL-2026-18271`-`18293` = HIGH-WATER MOVES `18293` RESUME `18294` (189th control sweep; canonical `/v1/vulns/` oracle `18294`-`18296` `404` ×2 passes, controls `18188`/`18242`/`18246`-`18252`/`18270` ALL `200`), AND THIS COHORT IS THE MIRROR IMAGE OF THE LAST ONE: TWENTY-TWO OF TWENTY-THREE ARE OSV-FIRST (`aliases None`), ALL TWENTY-TWO CARRY NO SEVERITY AND ZERO GHSA, AND EVERY ADVISED RUNG STILL READS TARBALL-`200` = THE CAMPAIGN ERA'S LARGEST LIVE-ADVISED INSTALLABLE BLOCK (`≈65` versions across `20` names), the eighteen seized at dawn while the fleet advised at noon keeps installing

HEADLINE 1, THE QUEUE FLEET GOT ADVISED BY A DIFFERENT MACHINE, AND NOTHING WAS SEIZED: fourteen of the twenty-three records are the EXACT name-set of open ossf/malicious-packages PRs, #1659 wiseke's 14 names (@greenlake/auth|common-context|context-pane|mfe-login-url|session, @ppa-web-components/ppa-banner|builder|headerfooter|hotel-collection|navigation|searchform, @sxm-web/client-sdk-core, @drone-js-ext/core|vip-badge), #1658 react-native-bright-sdk, #1660 the drone pair, yet all three PRs are STILL OPEN, UNMERGED, and the new OSV records read origin amazon-inspector, not the queue. The same fleet was independently imported by a second machine lane ≈46 h after the human queue wrote it up; the queue never merged and the ledger advised anyway. The wiseke ≈57 h queue-only note CLOSES: #1659 opened Oct-24 05:35Z, MAL-2026-18282/18283 minted Oct-25 15:08Z. DISPOSITION: every sampled advised rung across @drone-js-ext, @greenlake, @ppa-web-components, paychex-pdftron, jshelperdependenceny, react-native-bright-sdk reads tarball-200 with packument modified FROZEN at original publish, latest 99.0.1/99.9.1/9000.0.0 dependency-confusion rungs LIVE under fresh advisories = the @eforms live-advised class is no longer a singleton, it is a cohort: enforcement asymmetry at ≈20× scale. No seizure automaton, no holder, no 0.0.0-stage reset, the whole-name >= 0 cohort seized at 09:35Z and the version-enumerated OSV-first cohort advised at 14:37-16:02Z are two different machines answering two different record shapes. HEADLINE 2, THE SHAPE LAWS OF THE TWO COHORTS, SIDE BY SIDE: the 18271-18293 records are schema 1.9.0, severity None (the 18253-18270 cohort rode critical GHSA aliases at mint; OSV-only consumers render NEITHER severity NOR range for these twenty-two, the advisory text is the entire warning), version-ENUMERATED (@ppa-web-components/ppa-banner scopes exactly ['2.0.0','2.0.1','1.0.0','1.0.1','0.0.1','1.1.0','3.0.0'] of a NINE-version packument) while latest 0.1.0, the ACTUAL resolver default, is OUTSIDE every scope = the @eforms scope-differential rebuilt at fleet scale. @ppa-web-components/ppa-banner was staged THIS MORNING (0.0.0-stage 14:19:53Z, eight rungs in ≈4 min, maintainer wiseke <wiroki6344@agaexpress.com> = the same account grammar as #1659) and advised ≈20 min after staging, the fastest queue-visible fleet publish→advisory interval on this ledger. HEADLINE 3, THE JOIN-CLASS TEST, RUN LIVE: OSV-first stays unenforced; GHSA-origin gets eaten within the hour. MAL-2026-18293 w-mousekey is the cohort's ONLY ghsa-malware-origin record (GHSA-gmhr-j769-j6qf, critical, alias AT MINT 15:51:04Z), and by this read (≈1.5 h post-mint) rungs 1.0.41 + 1.0.42 are GONE from the packument (41 versions, latest rolled back to legit 1.0.40, tarballs 404, jsDelivr 404 while legit 1.0.40 200 = CDN split by legitimacy, the redis-dumper mirror-law inverted: PAYLOAD rung cold, HISTORY rung warm). The deletion ran WIDER than the advisory (GHSA scopes only 1.0.42; 1.0.41 eaten too, enforcement rounds up, and no holder-costume was staged, a clean-rung rollback instead of a 0.0.1-security squat = third disposition grammar, ROLLBACK-TO-LEGIT-LATEST). Read together: the seizure automaton tracks the GHSA lane, not the OSV lane, 22 OSV-first records ≈2-5 h old untouched, 1 GHSA-origin record ≈1.5 h old already deleted out from under its own advisory. HEADLINE 4, HOLD AUDITS AND STATE: the eighteen-name dawn cohort spot-audit (four names) holds SIXTH read, packuments 200 holder-frozen, zero re-registrations. CSS/Tailwind trio SIXTH read holder-frozen ≈17 h. @eforms/forms-api THIRD sweep: latest 2.99.1, modified frozen 06:08:05Z, LIVE-ADVISED untouched ≈11 h; MAL-2026-18252 join-watch closed (law recorded 206th). logview-archive grave FOURTH sweep. npm malware head by DIRECT read: GHSA-gmhr-j769-j6qf 15:51:04Z; pip head MOVES after ≈41 h: MAL-2026-18271 fontus (PyPI) 10:58:27Z, first pip-lane record since Oct-23, first kam193-origin mint since the qowa era, full forensics → 147th stream section. OFF-LANE: Wiz feed RECOVERED (404 → 200, 708 items) with a NEW research head Oct-25 14:46Z: Broccoli2shell, CVE-2026-111497, critical Brotli DECODER RCE (feed-description-only capture; decoder-library class, adjacent to this wiki's standing decoder-bug interest, monitor vendor patches + KEV). StepSecurity rss.xml 200 head = OVHcloud/GlassWorm Oct-24 post, already on-wiki = quiet; MS head unchanged (LiteLLM/ARTEX); JFrog/Socket unchanged; priority watch Shai-Hulud/Mini-Shai-Hulud/TeamPCP QUIET (nothing new on any priority feed). SELF-CAPTURES ×2: (1) THE SHAPE LAWS ARE FIELD-PAIR-DEPENDENT: the 193rd's ghsa-malware-origin ⇒ versions/ranges correction says read affected[].versions, this cohort's amazon-inspector-origin OSVs ALSO carry versions and ranges: None, so origin does NOT predict the field pair on this lane; read the record, not the origin; (2) severity None across 22 records is a MEASUREMENT of what OSV-only consumers see, not a claim the packages are benign, the 206th's critical ratings live in GHSA rows these records will never alias. Monitor forward (208th): 18294 resume (canonical ONLY); PRIMARY: the 20-name live-advised installable block, first seizure of ANY OSV-first rung = the enforcement-lane law moves; @ppa-web-components remaining staging (six siblings enumerated, more scopes possible from wiseke); w-mousekey hold audit (1.0.43 re-publish would re-arm); does ANY of the 22 acquire a GHSA twin anyway (#1658/#1659/#1660 merge clock as the proxy); queue PR disposition; trio seventh read; dawn-cohort hold audit seventh read; @eforms fourth sweep; grave fifth; bbmarker seventh; worker ninth-dark; opsctl FIFTEENTH on the NEW /dl/opsctl/<platform> grammar; bundle.enc SECOND read on 915f2671; retention tarball 470e36e4 SECOND read; nodes twelfth tick; CHG-4471 second read; KEV twentieth.

October 25 208th sweep, THE ENFORCEMENT-LANE LAW GETS ITS COUNTER-CASE: the 207th established GHSA-lane names get eaten, OSV-lane names get advised-and-watched. Tonight the FIRST movement inside the live-advised block is a `@greenlake` scope name with ZERO advisories (`auth`, `/v1/query` `vulns: 0`) reading `latest 0.0.0-stage` with its `99.0.1` rung gone, while the two OSV-ADVISED siblings (`common-context`, `session`) sit at live `latest 99.0.1` tarball-`200` untouched. The lane didn't split by advisory class this time; the teardown skipped every advisory.

THE HALF-DISMANTLED SCOPE: @greenlake/auth latest 0.0.0-stage (rung purged from time map, the deletion ate its own history entry, unlike w-mousekey where deleted rungs' TIME blocks survive; modified FROZEN 21:26:05Z Oct-23 through the change; tarball 404, jsDelivr 404, legit 0.1.0 jsDelivr 200); @greenlake/context-pane latest 0.0.0-stage (no 99.x rung ever in time map); @greenlake/mfe-login-url rolled to latest 0.1.0 (no 99.x rung), vs common-context/session fully live. Two readings, ambiguity recorded, neither exculpated: (a) the seizure automaton acting on non-advisory intelligence, or (b) the operator (or a disclosure response) dismantling the confusion-ladder from the un-advised ends, the shape says (b) at least as strongly: no 0.0.1-security holder costume (the automaton's grammar, dawn-18), no GHSA anywhere in the scope, modified frozen through deletion = a ladder being taken down rung-first. Whatever it was, the 207th's "live-advised block" is no longer static: ≈20 names read as installable-at-risk, and the first name to move was not one of the advised. THE THIRD WAKE, A NEW ACTOR, NOT THE FLEET: 18294/18295 @capsense/* (18:19/18:54Z) are ossf-package-analysis-origin (NOT amazon-inspector), a DIFFERENT publisher (darya.hakeem.abubaker@gmail.com), an eight-minute pair staged 17:27Z, the THIRD distinct publisher family today to use the 0.0.0-stage + 99.x staging grammar (dawn hijacks, wiseke, capsense): the LADDER is now the class, not the actor. Scope differential repeats cleanly: both OSVs enumerate ONLY ['99.99.100']; 99.99.99 is byte-similar beacons, tarball-200, outside scope. Full forensics + the PUBLIC collector census → NEW @capsense page. PIP, TWICE IN ONE DAY: after ≈41 h of silence the pip head moved at 10:58Z (fontus) and again at 19:14:56Z: MAL-2026-18296 zagents-message-bus (origin kam193, tracker id pypi/GENERIC-standard-pypi-install-pentest/zagents-message-bus, rungs 1.0.5/1.0.10/99.99.99/99.99.100, the 99.99.x confusion grammar on PyPI the same evening it runs on npm; category PROBABLY_PENTEST, "exfiltrates basic host information, no other purpose"). Tarball forensics queued 209th. CROSS-FEET READ: one day on this ledger: +18 GHSA-aliased seized cohort, +23 OSV-first advised cohort, a scope teardown with zero advisories, a brand-new self-declared-MSRC-PoC pair with a publicly readable victim log, and two pip mints. The lane is not quieting down after the wave; it is DIFFERENTIATING, enforcement, advice, and (possibly) voluntary retreat are now three separate clocks a defender must read separately. Monitor 209th: @greenlake re-stage vs completion; @capsense census growth; zagents rungs live?; 18297 resume. Sweep context → 208th stream section.

October 25 209th sweep, THE ENFORCEMENT-LANE LAW GETS ITS ECOSYSTEM COROLLARY: `MAL-2026-18297` `nebulallm` (PyPI, kam193, `MALICIOUS`, `20:15Z`) was QUARANTINED ON PYPI WITHIN `≈25 MIN` OF ITS OWN MINT (`/simple/` `200 quarantined` zero-files, JSON `404`), while the npm live-advised block from the 207th still installs `≈5 h` on. Same ledger, same day: npm OSV-first = paperwork; pip kam193 = removal. And the 208th's own open question, `zagents-message-bus` rungs live?, answered itself: QUARANTINED `≈1 h` post-mint

THE THREE-CLOCK DAY, CLOSED: morning = GHSA-aliased cohort seized BEFORE its advisories (≈2.5 min publish→seizure); noon = OSV-first cohort advised and UNTOUCHED (≈5 h+); evening = the pip lane pulls its own mints inside the hour (zagents ≈1 h, nebulallm ≈25 min), yet fontus (10:58Z mint, collector read LIVE by this wiki) is STILL LIVE at ≈10 h. The pull-clock is not verdict-keyed (zagents was PROBABLY_PENTEST too) and not age-keyed; mechanism unresolved, watch which name moves next. nebulallm durable content: setup.py install-override → JScript → DLL (Windows two-stage), typosquatting on the *-llm grammar, on-record IoCs akinomoreno.pythonanywhere.com/krat.dll + /faye + 45.38.20.86, VT + tria.ge evidence, rung 1.4.3, after quarantine the OSV record + this wiki are the only surviving census of the artifact (the 202nd's history-deletion law, PyPI edition). THE LIVE-ADVISED BLOCK AT ≈5 h: @greenlake/auth teardown HOLDS (0.0.0-stage second read, no re-stage), @greenlake/session/common-context still LIVE-ADVISED 99.0.1; @capsense exactly 2 names, both LIVE, 99.99.100 tarball-200; @eforms FIFTH sweep untouched ≈14.5 h; w-mousekey 1.0.43 not re-armed. No OSV-first name has acquired a GHSA twin or a seizure, the 207th's enforcement-lane law holds its fifth hour: on npm the GHSA lane is where the automaton lives, and the queue (#1658/#1659/#1660, all still OPEN, #1659 updated today 14:52Z) has still merged nothing while three machine lanes advise its fleets. OFF-LANE: Wiz feed 404 again (oscillator, third read, Broccoli2shell capture from the 207th stands at feed-level); StepSecurity head on-wiki; KEV HELD 2026.10.23/1,756 twenty-second; priority watch Shai-Hulud/Mini-Shai-Hulud/TeamPCP QUIET. SELF-CAPTURE: pip dispositions live in TWO routes with different grammars: JSON 404 + /simple/ 200 quarantined = quarantine; both 404 = deletion, reading one route guesses. Monitor 210th: 18298 resume; pip-trio disposition race (does fontus get pulled; does any quarantined name RESURFACE, the quarantine undo-button watch, bbmarker-style, now on PyPI); @capsense census re-read when the webhook rate-limit clears; @greenlake fourth read; opsctl SEVENTEENTH; bundle FOURTH; nodes re-seed watch. Sweep context → 209th stream section.

October 25 210th sweep, OSV QUIET, HIGH-WATER HOLDS `18297` RESUME `18298` (191st control sweep; canonical `/v1/vulns/` oracle `18298`-`18307` `404` TEN-deep, SIX-deep controls `18188`/`18242`/`18270`/`18293`/`18296`/`18297` ALL `200`), THE @CAPSENSE VICTIM CENSUS LANDED WHOLE: the `/requests` route answered `200` again and the window is STILL EXACTLY `50` beacons, `16:36:58 → 17:32:18Z`, `≈5 h` after the last beacon the feed has NOT grown; the earlier `404` was rate-limiting (or a window cap), not log deletion

HEADLINE 1, THE PIP TRIO STEADIES INTO A THREE-STATE TABLE: re-read on BOTH routes per the 209th law, fontus /simple/ 200 NO quarantine tag + JSON 200 + files listed = LIVE ≈13 h post-mint, and its collector ci-collector.andy-827.workers.dev answers 200 {"ok":true,"collector":"ci-collector","ts":"23:30:42Z"} FRESH ≈15 min pre-read = live package, live intake; zagents-message-bus /simple/ 200 quarantined SECOND read; nebulallm /simple/ 200 quarantined SECOND read, zero resurrections, quarantine holding so far (the undo-button watch is patient, not satisfied). The pull-clock mystery sharpens: fontus ≈13 h live vs zagents pulled in ≈1 h vs nebulallm in ≈25 min, three same-day kam193-adjacent mints, three clocks. HEADLINE 2, LIVE-ADVISED BLOCK: EVERY STALKED NAME HOLDS: @capsense pair LIVE 99.99.100 both, scope search STILL exactly 2 names, ZERO GHSAs, OSV 18294/18295 aliases None ≈5.5 h post-mint = the never-join law continues; @eforms/forms-api SIXTH sweep LIVE (2.99.1 tarball 200, modified frozen 06:08Z, GHSA GHSA-2cfq-pcr7-8572 critical still open) armed-but-untouched ≈17.5 h; @greenlake teardown FOURTH read, auth 0.0.0-stage frozen Oct-23, siblings session/common-context LIVE 99.0.1 frozen Oct-23, zero re-staging either way; w-mousekey 1.0.43 NOT re-armed THIRD read (latest 1.0.40, time map 45 entries still carrying the deleted rungs). HEADLINE 3, HOLD AUDITS: dawn eighteen sampled THREE-of-eighteen (ionic-youtube-search, redis-dumper, p12-pem) NINTH read holder-frozen (0.0.1-security, modified frozen at holder seconds 09:34:51/09:35:12/09:35:05Z), zero re-registrations ≈14 h on; CSS/Tailwind trio NINTH read holder-frozen (23:55:29/23:57:16/00:05:14Z frozen), the yudzxml +57 s staging-rearm stays disproven NINE reads running; the armed-automaton vs absent-operator ambiguity is now ≈24 h deep on the largest bare-re-registerable block in the lane. QUEUE & LANE: #1658 ≈108 h / #1659 ≈90 h (last updated 14:52Z, unchanged ≈8.5 h) / #1660 ≈40 h ALL OPEN zero merges, and the npm-GHSA importer itself is quiet: api.github.com/advisories sorted desc serves LEGIT heads (filelock/virtualenv rows Oct-23 22:2xZ) = no malware GHSA minted since GHSA-2cfq era, the direct-read head law unbroken; pip/npm OSV tick silent ≈3.5 h since nebulallm. LAW NOTE (GHSA-list route, sixth confirmation): the advisories?sort=published&direction=desc route is a LEGIT/malware MIXTURE, reading heads from it is void, only direct advisories/<id> and OSV @capsense/fleet-scoped reads are quotable. FLEET: bbmarker ELEVENTH control-verified hold (packument 404); map-lie follow-up: the recorded watch name @ecg-internal/media-util-js-lib (the bare media-util npm name is an unrelated clean 2022 package and PyPI 404s, recorded-name law again) moved from its lying-latest 99.0.1 over 404 tarball terminus to WHOLE-NAME 404 on packument AND tarball this sweep: if 99.0.1 returns it is a re-arm not a heal; tekmidian THIRTEENTH bare 404, pai CLEAN 1.0.7 frozen Oct-23; abstract-claude 404 + toolserver.hugpy.ai 401 THIRTEENTH sweep; @worrisome/reutil costume EIGHTEENTH (0.0.1-security); iterquarry PyPI 200 TWENTIETH; qowa /simple/ 200 quarantined TWENTY-EIGHTH; sitecard day TWENTY-ONE 200; k18k shard 200 TWENTY-FOURTH; KEV HELD 2026.10.23/1,756 TWENTY-THIRD read. Sweep context → 210th stream section.

October 26 211st sweep, OSV `+17` IN TWO WALKS = HIGH-WATER MOVES `18314` RESUME `18315` (192nd control sweep; oracle `18315`-`18318` `404`, EIGHT-deep controls `18188`/`18242`/`18270`/`18293`/`18296`/`18297`/`18303`/`18309` ALL `200`), THE WALL MOVED MID-SWEEP (`18309` at the opening walk, `18314` at the closing re-walk): the ledger's import clock runs while the wiki writes, so the high-water is a REPORT-TIME read, not a START-TIME read

HEADLINE 1, THE @s4yhiitestpoc SCOPE DIED WHOLE, AND THE SIX ADVISORY-INVISIBLE NAMES DIED WITH GHSA ALIASES AT BIRTH. MAL-2026-18302-18309 (published ONE 00:13:30Z second, eight names: r2-control, r2-dns, r2-echo, r2-https-dualuse, scan-control-a, scan-dns-c, scan-echo-b, scan-https-dualuse-e), every record aliased to its GHSA AT MINT (the 106th's channel-selective blindness, only the HTTPS spellings used to mint, ends by minting the WHOLE scope at once, critical, range-only >= 0). Registry state at read: ALL EIGHT holder-frozen 0.0.1-security maintainer npm-support; PLUS scan-https-d and r2-https-b seized mid-sweep (modified 00:11-00:12Z) and r2-https, the scope's first-advised member (17764), is now WHOLE-NAME PACKUMENT 404; the scope's creator account is GONE from the npm user route (ok:false) and github.com/s4yhiitestpoc 404; the ONLY surviving maintainer fingerprint is inside the surviving r2-dns time-block: s4yhii__ <jesusitpro22@gmail.com> (the Oct-10 1.0.0 object still carries the account). Time-map forensics split the batch into TWO seizure shapes: SIX packuments RE-CREATED 00:09:43-00:11:05Z (created-timestamp = seizure minute, time still carrying the ORIGINAL Oct-10 1.0.0 stamps = history clock survives payload death) while r2-dns kept its ORIGINAL packument (created 10-10) and merely gained a holder rung at 00:10:48Z, the 206th's re-create-vs-edit split reproduced inside one eight-name second. Every 1.0.0 tarball verified 404; npm search?text=scope:s4yhiitestpoc total 0 while all packuments 200 = the search index is its own enforcement lane. LAW: scope-wide death arrives as ONE batch covering EVERY channel, retro-cleaning years of channel-selectivity in a second, and TWELVE bare re-registerable scope names + the oob.s4yhii.com collector (status: re-probe next sweep) are the actor's re-arm surface; any fresh publish inside the dead scope is THE tripwire. HEADLINE 2, THE STARVATION CLOCK ENDED: util-foriepft advised ≈343 h (≈14.3 d) after curated #1618 and seized 14 s after its GHSA. GHSA-rc7p-6p9r-rfj9 + OSV MAL-2026-18314 01:34:10Z, holder 01:34:24Z, the two-week zero-machine-record name is closed out. The same 01:32-01:38Z importer burst took FOUR NEW css- names created THAT MINUTE (css-flexgap-shim/css-grid-snap-util/css-hnhxwd-polyfill created 01:32:5x-33:05Z, seized 30-60 s later, publish→seizure UNDER A MINUTE, the automaton now outruns even its own advisory), bow-test created 01:36:20Z seized 01:38:29Z, and @regex33-hackerone/tb-compat (Oct-7 scope, the revived account's new playground). The ≈18 h GHSA-malware importer silence BREAKS at 01:34Z = the importer's dark stretches are duty-cycle, not lane death (sixth confirmation, direct reads remain law). HEADLINE 3, THE PIP LANE: FOUR FRESH MINTS, FOUR QUARANTINES ≈1-3 h, AND THE PATTERN'S NAME. claudeopusfile/claudeopusenifile/claudeopuseni (18298-18300, kam193 MALICIOUS, campaign 2026-09-donutautosellsrc, stego-image stage-2 + Polygon-tx-history C2 + native-extension infostealer, NEW payload classes for the ledger → NEW page) + dictmerge-lite (18301, wallet/browser/SSH/dev-cred exfil), ALL FOUR /simple/ 200 quarantined + JSON 404 at read ≈1-3 h post-mint; curated #1661 on dictmerge-lite ≈14 min post-OSV = the queue lane woke on the freshest name while #1658-#1660 still sit open ≈111/93/42 h. THE RESOLVED READ on the 209th's three-clock mystery: fast quarantine (1-3 h) is the lane DEFAULT; fontus, LIVE THIRD read ≈15 h both routes, collector ci-collector.andy-827.workers.dev answering {"ok":true,...,"ts":"01:28:32Z"} fresh minutes pre-read, is the outlier begging a mechanism (its OSV origin is the ossf lane, the four quarantined are kam193; verdict-lane-keyed pull remains the leading hypothesis, unfalsified). zagents/nebulallm quarantine THIRD reads, zero resurrections. HEADLINE 4, HOLDS, HOLDS, HOLDS.* CSS/Tailwind trio TENTH holder-frozen ≈26 h (re-arm disproven ten reads running); dawn-eighteen TENTH sampled; @eforms/forms-api SEVENTH sweep live-advised-untouched ≈20 h; @greenlake FIFTH (session 99.0.1 frozen, teardown holds); w-mousekey FOURTH no-rearm; bbmarker TWELFTH; capsense pair LIVE + census STILL exactly 50/newest 17:32:18Z ≈8.5 h dead-fed → capsense 211st; KEV HELD 2026.10.23/1,756 TWENTY-FOURTH. Sweep context → 211st stream section

October 26 213rd sweep, THE QUEUE MERGE SHADOW: `#1659` MERGED `03:24:42Z` AND SIX EXISTING OSV RECORDS RE-STAMPED `03:30:05Z` WITHIN `60 MS` OF EACH OTHER, the curated queue does not mint its own records when it finally merges: the importer re-walks and re-stamps the machine lane's existing records it duplicates. Queue activity is now observable from the OSV ledger alone (modified-jump clusters on old records), and the six greenlake/sxm `18316`-`18319`+`18282`/`18283` mints that woke this sweep carry `published` Oct-23 = BACKDATED wake records, poll `modified`, never `published`.

THE ENFORCEMENT-LANE LAW, MEASURED AGAIN AT DAWN: 18322 numbors (GHSA-at-birth critical 02:39:49Z) was version-pulled + rolled back to legit 1.6.0 INSIDE THE MINT MINUTE (modified 02:39:49.255Z), with a NEW history grammar: the time-map entry for 1.6.1 is GONE too, full-erasure variant of the history-delete law (w-mousekey kept its deleted rungs' time blocks; numbors keeps nothing). One clock face, same hour: the zero-GHSA rig2 miner pair (18320/18321) sits LIVE-and-installable under OSV-only advice, and the six re-stamped wiseke beacon names stayed live too, the GHSA lane is where the automaton lives, and tonight it again ate one name in seconds while ten advised names kept serving. → walknpm rig2 page FLEET: trio TWELFTH holder-frozen ≈30 h; @eforms NINTH ≈23.5 h; @greenlake teardown SIXTH holds; w-mousekey FIFTH no-rearm; s4yhii THIRD hold audit silent; pip quarantine quartet FIFTH zero-resurrections; fontus FIFTH LIVE ≈18 h collector fresh 05:52:52Z. Sweep context → 213rd stream section

October 26 214th sweep, THE SLEEPER ADVISORY, npm EDITION: `publish-poc-base` + `publish-poc-test3` got their FIRST-EVER advisories (`MAL-2026-18323`/`18324`, `06:30Z`, amazon-inspector, aliases None, ZERO GHSAs) for packuments the registry WIPED WHOLE-NAME `9-13 h` BEFORE those advisories existed. The disposition is a grammar this ledger has never catalogued: the whole-name `unpublished` wipe, the packument survives as a `_id/name/time/_rev` skeleton, every version object gone, and the `unpublished` dict's version roster is the ONLY surviving census of what the name ever shipped. `publish-poc-test`, wiped in the same `≈5 min` window Oct-23 17:20Z, carries ZERO advisories four days on: the wipe lane acts on intel no public advisory has ever shown. The payload (OSV text, static ledger read, NEVER executed): a postinstall that fabricates `publish-poc-found-<hex4>` packages and runs `npm publish` using the INSTALLER'S OWN auth context, printf-splitting `npm publish` (`'np'+'m pu'+'blish'`) to dodge string scanners, plus a hardcoded cleartext npm `_authToken` (`npm_DLcrGeNT…`) shipped to every installer on the `base` name. PoC self-label noted, intent NOT asserted; the token-prefix retro-scan, printf-split grammar rule, and `publish-poc-found-*` mint alerts stand regardless. Three bare re-registerable names + the `malicious-package-publish-poc` install path = an ARMED tripwire. Full forensics → NEW publish-poc cohort page · 214th stream section

October 27, 223rd sweep follow-up (~01:2x-01:5x UTC): JFrog MONDAY: THE TESTMETEST OPERATOR HAD ALREADY ARMED `42` REAL GITHUB REPOS ACROSS `11` OWNERS, SafeDep's Oct-22 "no victims, all the operator's own test accounts" died inside a week, AND THE PAYLOAD SIZE IS THE EVASION: `12.9`-`13.7 MB` polymorphic wrappers built to fall outside GitHub's search and API paths

The Register's Oct-26 writeup of JFrog's Monday report (Korolevski/Benamou) closes this page's central uncertainty, was the testmetest grammar a live campaign or a lab?, with the worst answer: live since at least JULY, 42 armed repositories, 11 real owners (established developers and organizations, not test accounts). The durable shapes for the wiki's laws:

THE TOO-BIG-TO-FIND GRAMMAR. The payloads deliberately measure 12.9-13.7 MB because GitHub's blob search and content-API paths choke on (or silently skip) that size class, the same instinct as the ledger lane's size-based blindspots, weaponized against the platform's own scanners. Hunt implication: a large opaque blob committed into CI paths is now a KNOWN EVASION CLASS, not noise; hunt workflows/hooks by PATH and ANCESTRY (new .claude/, .gemini/, .cursor/, .vscode/ hooks + binding.gyp-style <!(...) command interpolation), not by content search.
THE TRIANGULATED LINEAGE IS COMPLETE. June Miasma Phantom Gyp code + Mini Shai-Hulud's token-revocation home-wipe dead-man + a compiled native add-on for the final stage + sandbox/CI/debugger checks with SILENT exit + a SECOND build that forks-detaches and pulls a loader from the operator's CementBeetleSteeple GitHub account (17 campaign repos). One worm, three families' worth of borrowed capability, the composition era the ledger lane keeps measuring, now with a named carrier account.
THE cPanel CONNECTOR (on-wiki before the connector). The account links to a shellpanel scanner previously documented by Socket abusing compromised-repo GitHub Actions to exploit CVE-2026-41940 (cPanel/WHM auth bypass, KEV-listed April, patched), this wiki's Mr. Robot/cPanel page already carries that campaign. JFrog's novelty is the JOIN: same hijacked owners link the GitHub-victim cluster to internet-wide cPanel exploitation. No downstream cPanel compromise CONFIRMED at capture, the join is artifact-based, not victim-based, quote it that way.
NO-VICTIMS IS A SNAPSHOT. SafeDep Oct 22: "all observed activity belongs to the operator's own test accounts", true then, false by Oct 26. Every absence-of-victims claim in a fast-moving worm story carries an expiry date printed by someone else's telescope. This is the stream's absence-law discipline wearing a campaign-side costume: date-stamp the negative, re-price it every sweep.

Hunt/detect summary added to this page's standing guidance: branch/hook shapes already listed above gain: (a) large (>10 MB) newly-committed blobs under .github/ or build paths = size-evasion class; (b) binding.gyp "sources": ["<!(node ... )"] command interpolation (the Phantom Gyp module already on-wiki, now confirmed riding the same campaign); (c) CementBeetleSteeple as a known carrier org string in workflow/repo remotes; (d) native add-ons that decrypt-and-launch (ELF in an npm tarball is the tell); (e) the silent-exit sandbox check means a clean detonation in a normal sandbox is NOT an all-clear, detonate on bare-metal-like profiles. Victim response inherits the Mini Shai-Hulud playbook (revoke-order matters: kill the revocation-wipe watchdog FIRST, then rotate, then rebuild).

Sweep context → 223rd stream section · prior wave coverage → this page's waves one-three · family → Mini Shai-Hulud campaign page · Tensorlake wave.

Testmetest wave three (OSV MAL-2026-18190-18204)