Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,407 npm 223,265 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

223,265 reports · Feed

  • npm
    omhcmbud-bails 7.0.4, 7.0.5, 7.0.6, 7.1.0
    MAL-2026-18999 2 IOCs
  • npm
    r-baileys 1.0.0
    MAL-2026-19004
  • npm
    rsembilaneks-baileyss 2.0.3
    MAL-2026-19011
  • npm
    patron-pro 2.0.3, 2.1.0, 2.1.3, 2.1.4, 2.1.5
    MAL-2026-19000
  • npm
    malvin-wa 0.1.0, 0.1.1
    MAL-2026-18989
  • npm
    queenjusmy-baileys-v1 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.8, 1.0.9
    MAL-2026-19003
  • npm
    noya-baileys 6.1.0, 6.1.1, 6.1.2
    MAL-2026-18996
  • npm
    rimuru-md 3.3.0
    MAL-2026-19009
  • npm
    sakubilzz 1.0.0, 1.0.1, 1.0.2
    MAL-2026-19013
  • npm
    silva-baileys 1.0.0, 1.0.1, 1.0.3, 1.0.4
    MAL-2026-19016 2 IOCs
  • npm
    shin-yagami 2.0.4
    MAL-2026-19015
  • npm
    rfn-baileys 1.0.11
    MAL-2026-19008 2 IOCs
  • npm
    ravionbailey 1.0.0
    MAL-2026-19005
  • npm
    skylerss 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4
    MAL-2026-19018
  • npm
    surabails 1.6.0
    MAL-2026-19020
  • npm
    tr4shxsuit 1.0.0
    MAL-2026-19021
  • npm
    reyz-baileys 1.0.2, 1.0.3, 1.0.4, 1.0.5
    MAL-2026-19006
  • npm
    supun-baileyz 1.0.1
    MAL-2026-19019
  • npm
    reyz4you-baileys-v1 1.0.10, 1.0.2, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9
    MAL-2026-19007
  • npm
    skylen-baileys 7.2.3, 7.6.8
    MAL-2026-19017
  • npm
    vinzzxd 1.0.0, 1.0.2
    MAL-2026-19031 3 IOCs
  • npm
    vanzdev 3.0.4, 3.0.5, 3.0.6
    MAL-2026-19024 2 IOCs
  • npm
    zakkixd1 27.0.24, 27.1.25, 27.1.26, 27.2.1
    MAL-2026-19045
  • npm
    vendettazuu-baileys 1.0.0
    MAL-2026-19026
  • npm
    yagami-bail 1.0.5
    MAL-2026-19038
  • npm
    vlyzer-baileys 1.0.4
    MAL-2026-19032
  • npm
    venzuu-baileys 1.0.0
    MAL-2026-19028
  • npm
    xprov2baileystest 1.0.0
    MAL-2026-19037 2 IOCs
  • npm
    wertybailz 1.0.10, 1.0.11, 1.0.13, 1.0.5, 1.0.6, 1.0.8, 1.0.9
    MAL-2026-19033
  • npm
    vinzz-baileys 1.0.0
    MAL-2026-19029 2 IOCs
  • npm
    yuuki-baileys 1.0.1, 2.0.0, 2.1.0
    MAL-2026-19044
  • npm
    yukistage 1.1.7
    MAL-2026-19042
  • npm
    wileys-neji 2.0.3
    MAL-2026-19034
  • npm
    wizeza-baileys 2.0.6, 2.0.7
    MAL-2026-19035 2 IOCs
  • npm
    zhenbaileys 1.1.1
    MAL-2026-19049 2 IOCs
  • npm
    yantobail 1.0.11
    MAL-2026-19040
  • npm
    zenvy-baileys 8.6.46, 8.6.47, 8.6.48, 8.6.49, 8.6.50, 8.6.51, 8.6.52
    MAL-2026-19046
  • npm
    zexxo-baileys 1.1.1, 1.1.2, 1.1.3, 1.2.1, 1.2.2
    MAL-2026-19048
  • npm
    xnxx-bail-pro 1.0.0, 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.4.0, 2.4.1
    MAL-2026-19036
  • npm
    yuliawhh 2.0.0
    MAL-2026-19043