Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,346 npm 223,208 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,346 reports · Feed

npm
@goparrot-dashboard/combos 0.0.1
MAL-2026-18497

Nov 2, 2026
npm
@goparrot-dashboard/combo-group 0.0.1
MAL-2026-18496

Nov 2, 2026
npm
@goparrot-dashboard/category 0.0.1
MAL-2026-18495

Nov 2, 2026
npm
@goparrot-dashboard/auth 0.0.1
MAL-2026-18494

Nov 2, 2026
npm
@goparrot-dashboard/analytics 0.0.1
MAL-2026-18493

Nov 2, 2026
npm
contracts-upgradeable 1.0.0
MAL-2026-18451 ghsa-malware, amazon-inspector 1 IOC

Nov 2, 2026
npm
@an1mshnpmb9c84920/pipeprobe-obf-m19n5 1.0.0
MAL-2026-18439 amazon-inspector

Nov 2, 2026
npm
@axo_cuy/baileys 1.0.0
MAL-2026-18440 amazon-inspector

Nov 2, 2026
npm
@bil-rgb/baileys 1.0.0, 1.0.1
MAL-2026-18441 amazon-inspector

Nov 2, 2026
npm
dsh-screenshot-native 1.0.0
MAL-2026-18438 ghsa-malware

Nov 1, 2026
npm
wallet-adapter-base 1.0.0
MAL-2026-18459 ghsa-malware 1 IOC

Nov 1, 2026
npm
bigbob22-test 1.0.0
MAL-2026-18457 amazon-inspector 1 IOC

Nov 1, 2026
RubyGems
strutil-core 1.0.1
MAL-2026-19054 1 IOC

Nov 1, 2026
npm
atlassian-wallboard-plugin 10.0.0
MAL-2026-18437 ossf-package-analysis, ghsa-malware 7 IOCs

Nov 1, 2026
RubyGems
macs-shoaibs-pro17 90002.1
MAL-2026-18436 ossf-package-analysis, amazon-inspector

Nov 1, 2026
npm
@axon-web/icons 99.0.0, 2.0.0
MAL-2026-18433 amazon-inspector

Nov 1, 2026
npm
hs-framework 999.9.1, 999.9.2
MAL-2026-18434 amazon-inspector

Nov 1, 2026
PyPI
privacypass-py 0.1.101, 0.1.99, 0.1.100
MAL-2026-18435 amazon-inspector, kam193

Nov 1, 2026
npm
@goparrot-dashboard/app 0.0.2, 0.0.1, 0.0.3
MAL-2026-18492 amazon-inspector 2 IOCs

Nov 1, 2026
npm
axelarjs-sdk 1.0.1
MAL-2026-18456 ghsa-malware 1 IOC

Nov 1, 2026
npm
sol-wallet-adapter 1.0.0, 1.0.1, 1.0.7
MAL-2026-18452 ossf-package-analysis, ghsa-malware, amazon-inspector 1 IOC

Nov 1, 2026
npm
cutekitten-test 1.0.1
MAL-2026-18458 1 IOC

Nov 1, 2026
npm
calculator-preinstall-hook-demo 1.1.2
MAL-2026-18454 ghsa-malware 1 IOC

Nov 1, 2026
npm
calculator-preinstall-chain-demo 1.1.2, 1.1.1
MAL-2026-18453 ossf-package-analysis, ghsa-malware 1 IOC

Nov 1, 2026
PyPI
pystr-codec 0.1.0, 0.1.1, 0.1.2
MAL-2026-18432 kam193 2 IOCs

Nov 1, 2026
npm
claims-ac1 1.0.0
MAL-2026-18450 ghsa-malware 4 IOCs

Oct 31, 2026
npm
@mamans2973/maman 1.0.1, 1.0.0, 1.0.3, 1.0.2
MAL-2026-18431 ghsa-malware

Oct 31, 2026
PyPI
doctreelstm 1.0.0, 10.0.0
MAL-2026-18430 kam193

Oct 31, 2026
npm
ms-client-portal 1.0.0, 10.0.0
MAL-2026-18449 ghsa-malware 3 IOCs

Oct 31, 2026
PyPI
multi-convert 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5
MAL-2026-18429 kam193 2 IOCs

Oct 31, 2026
PyPI
md-to-slides 0.1.0, 0.1.1, 0.1.2, 0.1.3
MAL-2026-18428 kam193 2 IOCs

Oct 31, 2026
PyPI
skills-analyzer 0.1.0, 0.1.1, 0.1.2
MAL-2026-18427 kam193 2 IOCs

Oct 31, 2026
PyPI
is-it-ai 0.1.0, 0.1.1, 0.1.3
MAL-2026-18426 kam193 2 IOCs

Oct 31, 2026
npm
local-commander-agent 0.3.52
MAL-2026-18425 ghsa-malware

Oct 31, 2026
npm
vas-tops2-reportingui all versions
MAL-2026-18424 ghsa-malware

Oct 30, 2026
npm
vas-tops2-digital-assistant-ui all versions
MAL-2026-18423 ghsa-malware

Oct 30, 2026
npm
vas-tops2-core-property-search all versions
MAL-2026-18422 ghsa-malware

Oct 30, 2026
npm
vas-tops2-core-clients-search all versions
MAL-2026-18421 ghsa-malware

Oct 30, 2026
npm
vas-tops2-core-client-cleanup-ui all versions
MAL-2026-18420 ghsa-malware

Oct 30, 2026
npm
@tops2/digital-assistant-ui all versions
MAL-2026-18415 ghsa-malware

Oct 30, 2026