Skip to content
OpenAdvisories

Supply chain

Malicious packages · crates.io

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,345 npm 223,208 PyPI 11,993 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

Compromised well-known packages

Legitimate, widely used packages that had malicious versions published (account takeover, hijacked releases).

23 reports · Feed

  • crates.io
    lwd-uri-util 0.1.3, 0.1.4, 0.1.2, 0.1.0, 0.1.1, 0.1.5, 0.1.6, 0.1.7
    MAL-2026-19058 amazon-inspector
  • crates.io
    env-test-guard 0.2.0, 0.3.0
    MAL-2026-18776 2 IOCs
  • crates.io
    sharpnes all versions
    MAL-2026-17713 2 IOCs
  • crates.io
    logs-update all versions
    MAL-2026-16164 4 IOCs
  • crates.io
    tinymember all versions
    MAL-2026-14340
  • crates.io
    proc-macro-en all versions
    MAL-2026-14339
  • crates.io
    proc-macro1 all versions
    MAL-2026-14338 5 IOCs
  • crates.io
    internment 0.8.7
    MAL-2026-14337
  • crates.io
    arrayref 0.3.10
    MAL-2026-14336 5 IOCs
  • crates.io
    aronenao all versions
    MAL-2026-14335
  • crates.io
    arone all versions
    MAL-2026-14334
  • crates.io
    append-only-vec 0.1.9
    MAL-2026-14333
  • crates.io
    aovine all versions
    MAL-2026-14332
  • crates.io
    proton-pfff 99.99.5
    MAL-2026-6959 ossf-package-analysis
  • crates.io
    supertag 99.1.1
    MAL-2026-3129 ossf-package-analysis
  • crates.io
    lsh 99.0.1, 99.1.0
    MAL-2026-3126 ossf-package-analysis
  • crates.io
    amzn-codewhisperer-streaming-client 99.0.1
    MAL-2026-3103 ossf-package-analysis
  • crates.io
    amzn-consolas-client 99.0.1
    MAL-2026-3101 ossf-package-analysis
  • crates.io
    semantic-search-client 99.0.1
    MAL-2026-3102 ossf-package-analysis
  • crates.io
    mysten-metrics 9.0.3, 9.0.0
    MAL-2026-2958 ossf-package-analysis
  • crates.io
    replit_ruspty 1.0.0
    MAL-2025-49350 ossf-package-analysis
  • crates.io
    littest 0.3.1
    MAL-2023-8429 ossf-package-analysis
  • crates.io
    rustdecimal all versions
    MAL-2022-1 ghsa-malware