Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 239,987 npm 222,873 PyPI 11,977 RubyGems 4,311 NuGet 782 crates.io 21 Go 20 Maven 2 Packagist 1

Compromised well-known packages

Legitimate, widely used packages that had malicious versions published (account takeover, hijacked releases).

239,987 reports · Feed

  • PyPI
    gcp-log-poc 0.0.1, 0.0.2, 0.0.3
    MAL-2026-18753 kam193
  • PyPI
    qzc690384 1.0.0
    MAL-2026-18752 kam193, amazon-inspector
  • PyPI
    qzc690383 1.0.0
    MAL-2026-18750 amazon-inspector, kam193
  • PyPI
    qzc690382 1.0.0
    MAL-2026-18749 amazon-inspector, kam193
  • PyPI
    qzc690385 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0, 1.…
    MAL-2026-18751 amazon-inspector, kam193
  • PyPI
    genblaze-atlascloud 0.1.0
    MAL-2026-18747 kam193
  • PyPI
    genblaze-fal 0.1.0
    MAL-2026-18746 kam193
  • npm
    dsh-notify-focus 0.7.0, 0.5.0, 0.7.1
    MAL-2026-18748 ghsa-malware
  • PyPI
    pulumi-doppler 0.0.0, 1.0.0
    MAL-2026-18745 kam193
  • npm
    @cherrydotfun/miniapp-sdk 0.1.22, 0.1.23
    MAL-2026-18737 ghsa-malware
  • PyPI
    fhqiouhq 0.1.0
    MAL-2026-18742 kam193
  • PyPI
    ajfhiuqhfqgwerhuqnfqh 0.1.0
    MAL-2026-18741 kam193
  • PyPI
    reqnests 0.1.0, 0.1.1
    MAL-2026-18744 kam193
  • PyPI
    reqnest 0.1.0
    MAL-2026-18743 kam193
  • npm
    tailwind-animationfound all versions
    MAL-2026-18740 ghsa-malware
  • npm
    modelsdesk 0.4.2
    MAL-2026-18739 ghsa-malware
  • npm
    kampodine 0.8.0
    MAL-2026-18738 ghsa-malware
  • npm
    automic-style-engine all versions
    MAL-2026-18736 ghsa-malware
  • PyPI
    hello-bat-fwi9 0.1.0, 0.1.1
    MAL-2026-18735 kam193 1 IOC
  • npm
    monobomber all versions
    MAL-2026-18732 ghsa-malware
  • npm
    monopw all versions
    MAL-2026-18733 ghsa-malware
  • npm
    tw-motion-css all versions
    MAL-2026-18734 ghsa-malware
  • npm
    wisdomtreetest all versions
    MAL-2026-18730 ghsa-malware
  • npm
    @noinheritdoc/n all versions
    MAL-2026-18722 ghsa-malware
  • npm
    @sideeffects/n all versions
    MAL-2026-18723 ghsa-malware
  • npm
    @site-cms/ssr all versions
    MAL-2026-18724 ghsa-malware
  • npm
    @ts-expect-error/n all versions
    MAL-2026-18725 ghsa-malware
  • npm
    @needsaudit/n all versions
    MAL-2026-18720 ghsa-malware
  • npm
    @needsaudit/nexport all versions
    MAL-2026-18721 ghsa-malware
  • npm
    @smart-dev-wa/baileys 1.0.0
    MAL-2026-17442 ghsa-malware
  • npm
    zero2-baileys all versions
    MAL-2026-18731 ghsa-malware
  • npm
    arc-contracts all versions
    MAL-2026-18726 ghsa-malware
  • npm
    evmos-contracts all versions
    MAL-2026-18727 ghsa-malware
  • npm
    securedrop-app all versions
    MAL-2026-18729 ghsa-malware
  • npm
    kc-kline-chart all versions
    MAL-2026-18728 ghsa-malware
  • npm
    @kora20030101/test-pkg-delete-me all versions
    MAL-2026-18719 ghsa-malware
  • npm
    @exclipz/baileys all versions
    MAL-2026-18717 ghsa-malware
  • npm
    @exclipz/bails all versions
    MAL-2026-18718 ghsa-malware
  • npm
    talk-lang all versions
    MAL-2026-18715 ghsa-malware
  • npm
    plain-lang all versions
    MAL-2026-18714 ghsa-malware