Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,407 npm 223,265 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

223,265 reports · Feed

npm
zyleys 1.0.0
MAL-2026-19050

Oct 27, 2026
npm
yagami-baileys 2.0.0
MAL-2026-19039

Oct 27, 2026
npm
zenvyflump 2.0.0, 2.0.1, 2.0.2, 2.0.3
MAL-2026-19047

Oct 27, 2026
npm
yazxz 3.0.0, 5.0.0
MAL-2026-19041

Oct 27, 2026
npm
vendezuubaileys 1.0.0
MAL-2026-19027

Oct 27, 2026
npm
zero2-baileys 3.6.0
MAL-2026-18731 ghsa-malware

Oct 27, 2026
npm
@exclipz/baileys 10.0.1
MAL-2026-18717 ghsa-malware

Oct 27, 2026
npm
@exclipz/bails 2.0.3, 2.0.7
MAL-2026-18718 ghsa-malware

Oct 27, 2026
npm
justinofficial 1.0.0
MAL-2026-18476 ghsa-malware

Oct 27, 2026
npm
aytidaoffc 1.0.0, 1.0.1
MAL-2026-18475 ghsa-malware 3 IOCs

Oct 27, 2026
npm
nuxzofficial 2.1.7
MAL-2026-18469 ghsa-malware

Oct 27, 2026
npm
@nuxzofficial/baileys 2.1.7
MAL-2026-18467 ghsa-malware

Oct 27, 2026
npm
ctf-agent 0.1.0
MAL-2026-18335 ghsa-malware, amazon-inspector

Oct 26, 2026
npm
csvflow-schema 1.0.0
MAL-2026-18357 amazon-inspector 2 IOCs

Oct 26, 2026
npm
@iobandamwer/native-helper 0.0.2, 0.0.1, 0.0.0-stage
MAL-2026-18330 ghsa-malware, amazon-inspector

Oct 26, 2026
npm
path-stream-utils-testmetest 0.0.3, 0.0.2, 0.0.1, 0.0.4, 0.0.0-stage
MAL-2026-18333 ghsa-malware, amazon-inspector

Oct 26, 2026
npm
@iobandamwer/cache-helper 1.1.3, 1.1.2, 1.1.1, 1.1.0, 1.0.9, 1.0.8, 1.0.7, 1.0.6, 1.0.5, 1.0.4, 1.0.3, 1.…
MAL-2026-18329 ghsa-malware, amazon-inspector

Oct 26, 2026
npm
postcss-semantic-themes 1.0.0, 1.0.1, 0.0.0-stage
MAL-2026-18334 ghsa-malware, amazon-inspector

Oct 26, 2026
npm
harlow-css-mixer 0.0.0-stage
MAL-2026-18332 ghsa-malware, amazon-inspector

Oct 26, 2026
npm
@worca/app 1.14.0-rc.2, 1.14.0-rc.4
MAL-2026-18325 ghsa-malware, amazon-inspector

Oct 26, 2026
npm
publish-poc-base 1.0.7
MAL-2026-18323 amazon-inspector

Oct 26, 2026
npm
publish-poc-test3 1.0.15, 1.0.27, 1.0.18, 1.0.22, 1.0.19, 1.0.26, 1.0.21
MAL-2026-18324 amazon-inspector

Oct 26, 2026
npm
@apexacc/cli 1.5.121, 1.6.0, 1.6.2, 1.5.122
MAL-2026-17924 amazon-inspector, ghsa-malware 14 IOCs

Oct 26, 2026
npm
numbors 1.6.1
MAL-2026-18322 ghsa-malware, amazon-inspector

Oct 26, 2026
npm
dsh-native 1.4.1
MAL-2026-18315 ghsa-malware, amazon-inspector

Oct 26, 2026
npm
bow-test all versions
MAL-2026-18311 ghsa-malware

Oct 26, 2026
npm
css-hnhxwd-polyfill all versions
MAL-2026-18314 ghsa-malware

Oct 26, 2026
npm
css-flexgap-shim all versions
MAL-2026-18312 ghsa-malware

Oct 26, 2026
npm
util-foriepft 1.0.0
MAL-2026-17878 ghsa-malware, amazon-inspector 1 IOC

Oct 26, 2026
npm
css-grid-snap-util 1.0.1, 1.0.0
MAL-2026-18313 ghsa-malware, amazon-inspector

Oct 26, 2026
npm
@regex33-hackerone/tb-compat 1.0.0
MAL-2026-18310 ghsa-malware, amazon-inspector

Oct 26, 2026
npm
@walknpm/todo-cli 2.0.1
MAL-2026-18320 ossf-package-analysis, amazon-inspector, ghsa-malware 2 IOCs

Oct 26, 2026
npm
dsh-plugin-blender-3d 0.2.1
MAL-2026-18321 ossf-package-analysis, amazon-inspector, ghsa-malware 2 IOCs

Oct 26, 2026
npm
@s4yhiitestpoc/scan-https-dualuse-e all versions
MAL-2026-18309 ghsa-malware

Oct 26, 2026
npm
@s4yhiitestpoc/scan-echo-b all versions
MAL-2026-18308 ghsa-malware

Oct 26, 2026
npm
@s4yhiitestpoc/scan-dns-c all versions
MAL-2026-18307 ghsa-malware

Oct 26, 2026
npm
@s4yhiitestpoc/scan-control-a all versions
MAL-2026-18306 ghsa-malware

Oct 26, 2026
npm
@s4yhiitestpoc/r2-https-dualuse all versions
MAL-2026-18305 ghsa-malware

Oct 26, 2026
npm
@s4yhiitestpoc/r2-echo all versions
MAL-2026-18304 ghsa-malware

Oct 26, 2026
npm
@s4yhiitestpoc/r2-dns all versions
MAL-2026-18303 ghsa-malware

Oct 26, 2026