Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,407 npm 223,265 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

223,265 reports · Feed

npm
@s4yhiitestpoc/r2-control all versions
MAL-2026-18302 ghsa-malware

Oct 26, 2026
npm
xzvbailss 1.0.0
MAL-2026-18702

Oct 26, 2026
npm
wxwxtt 0.0.0, 0.0.1, 0.1.0, 1.0.0, 1.0.1, 1.1.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1
MAL-2026-18701

Oct 26, 2026
npm
wisewwasd 1.0.1
MAL-2026-18700

Oct 26, 2026
npm
wiselllx 0.0.1, 1.0.1
MAL-2026-18699

Oct 26, 2026
npm
wiasdcxc 1.0.1
MAL-2026-18698

Oct 26, 2026
npm
testtestkjkldfnjdfn 1.0.0
MAL-2026-18697

Oct 26, 2026
npm
solidity-map 2.21.0
MAL-2026-18696

Oct 26, 2026
npm
solidity-gas-watcher 2.21.0
MAL-2026-18695

Oct 26, 2026
npm
solidity-cat 2.0.1
MAL-2026-18694

Oct 26, 2026
npm
ruby-baileys 1.5.17, 1.5.18
MAL-2026-18693 2 IOCs

Oct 26, 2026
npm
pino-std 7.2.0
MAL-2026-18692

Oct 26, 2026
npm
ndraawzz-baileys 1.5.0
MAL-2026-18691

Oct 26, 2026
npm
lunaaa-baileys 1.1.0, 1.1.1, 9.0.22, 9.0.23
MAL-2026-18690

Oct 26, 2026
npm
loader-utils-kit 4.2.1, 4.3.5
MAL-2026-18689

Oct 26, 2026
npm
kevinx-baileys 1.2.0, 1.2.1, 1.2.2
MAL-2026-18688

Oct 26, 2026
npm
ichigokurosaki-baileys 1.0.0
MAL-2026-18687

Oct 26, 2026
npm
cs-core-api-phoenix 5.1.0
MAL-2026-18686 2 IOCs

Oct 26, 2026
npm
aemeath-baileys 1.1.13
MAL-2026-18685

Oct 26, 2026
npm
@zyrennofficiall/baileys 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.5.0
MAL-2026-18684

Oct 26, 2026
npm
@zaxius/baileys 1.0.1
MAL-2026-18683

Oct 26, 2026
npm
@wanzforme/bails 1.0.0, 2.0.0
MAL-2026-18682

Oct 26, 2026
npm
@sakataa/baileys 1.0.0, 2.0.0, 3.0.0
MAL-2026-18681

Oct 26, 2026
npm
@raffnotdev/baileys 1.0.0
MAL-2026-18680

Oct 26, 2026
npm
@monze1239/baileys 1.0.0, 1.0.1
MAL-2026-18679

Oct 26, 2026
npm
@lekzox/baileys 0.0.1
MAL-2026-18678

Oct 26, 2026
npm
@k.vict1999/pino-std-serializers 7.2.0
MAL-2026-18677

Oct 26, 2026
npm
@dyllxnn/baileys 1.0.0
MAL-2026-18676

Oct 26, 2026
npm
@denzz221/baileys 2.0.0, 7.0.0, 8.0.5, 8.0.6, 8.0.8, 8.1.1, 8.1.2, 8.1.3, 8.1.5, 8.1.6, 8.1.7
MAL-2026-18675

Oct 26, 2026
npm
@bellaxchan/techxatz 0.1.2
MAL-2026-18674

Oct 26, 2026
npm
@bellaxchan/sixtech 1.1.5
MAL-2026-18673

Oct 26, 2026
npm
@bellaxchan/eleventech 0.0.8
MAL-2026-18672

Oct 26, 2026
npm
@bellaxchan/bailtech 1.1.0
MAL-2026-18671

Oct 26, 2026
npm
@axo_cuy/baileyss 1.0.0, 1.0.1, 3.0.1, 4.0.0
MAL-2026-18670

Oct 26, 2026
npm
@alannxds/baileys 6.2.10
MAL-2026-18669

Oct 26, 2026
npm
canta-baileys 1.1.13
MAL-2026-18632 ghsa-malware 1 IOC

Oct 26, 2026
npm
birch-css-utils 1.3.0, 1.2.2, 1.1.0, 1.0.0, 0.0.0-stage
MAL-2026-18331 ghsa-malware, amazon-inspector

Oct 26, 2026
npm
@capsense/ccx-welcome-page 99.99.100, 99.99.99, 0.0.0-stage
MAL-2026-18294 ossf-package-analysis, amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
npm
@capsense/core-ui 99.99.100, 99.99.99, 0.0.0-stage
MAL-2026-18295 ossf-package-analysis, amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
npm
event-bus-lite-testmetest 0.0.6
MAL-2026-18292 amazon-inspector

Oct 25, 2026