Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,378 npm 223,239 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

223,239 reports · Feed

npm
@vanzxy/baileys all versions
MAL-2026-18529 ghsa-malware

Nov 3, 2026
npm
@lynnidoffc/libsignal-node all versions
MAL-2026-18528 ghsa-malware

Nov 3, 2026
npm
@lynnidoffc/baileys all versions
MAL-2026-18527 ghsa-malware

Nov 3, 2026
npm
@zhengliyoux/baileys 0.0.0-stage, 1.0.2, 1.0.3, 1.0.4
MAL-2026-19115

Nov 3, 2026
npm
@lekzsync/baileys 0.0.0-stage, 1.0.5
MAL-2026-19109

Nov 3, 2026
npm
raiden-baileys 0.0.0-stage, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7
MAL-2026-19108

Nov 3, 2026
npm
sauruspro-bail 0.0.0-stage, 5.0.0, 5.0.1, 5.0.2-alpha.spr.test
MAL-2026-19073

Nov 3, 2026
npm
@yshtxxproject/baileys 0.0.0-stage, 0.0.1
MAL-2026-19072

Nov 3, 2026
npm
@zanxiky/baileys 0.0.0-stage, 1.1.0
MAL-2026-19059

Nov 3, 2026
npm
nulio-connector 1.1.16, 1.1.10, 1.1.11
MAL-2026-18526 ghsa-malware

Nov 3, 2026
npm
blitzstrike 2.4.180
MAL-2026-18525 ghsa-malware

Nov 3, 2026
npm
dsh-moss-wallpaper 3.4.0
MAL-2026-18523 ghsa-malware

Nov 3, 2026
npm
vibes-plug 4.5.0
MAL-2026-18524 ghsa-malware

Nov 3, 2026
npm
dsh-moss-console 3.3.0
MAL-2026-18522 ghsa-malware

Nov 3, 2026
npm
luna-baileys 9.0.33, 9.0.28, 9.0.27, 9.0.26, 9.0.25, 9.0.24, 1.0.0, 0.0.0-stage
MAL-2026-18520 ghsa-malware

Nov 3, 2026
npm
paidwithtab 3.0.0
MAL-2026-18521 ghsa-malware

Nov 3, 2026
npm
@atedone/workspace-context 0.0.23, 0.0.14, 0.0.25, 0.0.22, 0.0.20, 0.0.15, 0.0.19, 0.0.13, 0.0.12, 0.0.18,…
MAL-2026-18517 amazon-inspector

Nov 3, 2026
npm
scdn-jquery 0.1.6
MAL-2026-18455 ghsa-malware

Nov 3, 2026
npm
@corexium/xbails 0.0.7
MAL-2026-18491 amazon-inspector

Nov 3, 2026
npm
unemployed_xerinae-toolteadev 1.4.4
MAL-2026-18667

Nov 2, 2026
npm
related_blackbird-toolteadev 2.1.1
MAL-2026-18666

Nov 2, 2026
npm
pearx93qja-notthedevs 1.1.8
MAL-2026-18663

Nov 2, 2026
npm
wet_rat_replicate_automation 2.3.1
MAL-2026-18668

Nov 2, 2026
npm
quiche-tea-curut 4.3.4
MAL-2026-18665

Nov 2, 2026
npm
peas-tea-curut 3.2.2
MAL-2026-18664

Nov 2, 2026
npm
maila-talijah-alpha-128 1.1.11
MAL-2026-18662

Nov 2, 2026
npm
low_hummingbird_replicate_automation 2.2.1
MAL-2026-18661

Nov 2, 2026
npm
dian-peyek23-miaww 1.1.3
MAL-2026-18660

Nov 2, 2026
npm
dependent-final 1.0.3
MAL-2026-18659

Nov 2, 2026
npm
@ifasn/mmd-doc-mcp 1.0.0, 1.0.2
MAL-2026-18488 amazon-inspector

Nov 2, 2026
npm
@ifasn/md-doc-mcp 1.0.5, 1.0.3, 1.0.4
MAL-2026-18486 amazon-inspector

Nov 2, 2026
npm
@ifasn/mmdd-doc-mcp 1.1.1, 1.0.6, 1.0.3, 1.0.4, 1.1.6, 1.0.4-2, 1.1.8, 2.0.1, 1.0.1, 1.0.5, 1.1.3, …
MAL-2026-18489 amazon-inspector

Nov 2, 2026
npm
@ifasn/mdd-doc-mcp 1.0.7, 1.0.8, 2.0.6
MAL-2026-18487 amazon-inspector

Nov 2, 2026
npm
service-roles-registry 99.0.2, 99.0.1
MAL-2026-18519 amazon-inspector 2 IOCs

Nov 2, 2026
npm
bfvkjmeikpwhqxc 1.0.0, 1.0.1, 0.0.0-stage
MAL-2026-18483 ghsa-malware

Nov 2, 2026
npm
pandafortunerush all versions
MAL-2026-18485 ghsa-malware

Nov 2, 2026
npm
internal-renderers 10.0.0
MAL-2026-18484 ghsa-malware, amazon-inspector

Nov 2, 2026
npm
nachles all versions
MAL-2026-18477 ghsa-malware

Nov 2, 2026
npm
@maulenv/baileys all versions
MAL-2026-18473 ghsa-malware

Nov 2, 2026
npm
@levvicode/libsignal-node all versions
MAL-2026-18472 ghsa-malware

Nov 2, 2026