Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,346 npm 223,208 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,346 reports · Feed

npm
vas-tops2-bidmatrix-ui all versions
MAL-2026-18419 ghsa-malware

Oct 30, 2026
npm
tefeest-npm-com-test all versions
MAL-2026-18418 ghsa-malware

Oct 30, 2026
npm
neuralwhatsapp all versions
MAL-2026-18411 ghsa-malware

Oct 30, 2026
npm
ourin-baileys all versions
MAL-2026-18412 ghsa-malware

Oct 30, 2026
npm
apex-fetch all versions
MAL-2026-18410 ghsa-malware

Oct 30, 2026
npm
@atfm/utils 99.99.99
MAL-2026-18602 1 IOC

Oct 30, 2026
npm
@atfm/atfm-material-ui 99.99.99
MAL-2026-18601 1 IOC

Oct 30, 2026
npm
grizzly-baileys all versions
MAL-2026-18408 ghsa-malware

Oct 30, 2026
npm
tabby-fknat 0.1.2
MAL-2026-18409 ghsa-malware

Oct 30, 2026
npm
@nexlayerlabs/postcss-keyframe-utils all versions
MAL-2026-18407 ghsa-malware

Oct 30, 2026
PyPI
stdid-nyxprobe 0.0.1, 0.0.2
MAL-2026-18406 kam193, amazon-inspector

Oct 30, 2026
PyPI
log-utils-sdk 0.4.1
MAL-2026-18405 kam193, amazon-inspector 12 IOCs

Oct 30, 2026
npm
claims-acct-unlock 25.2.1
MAL-2026-18404 ossf-package-analysis, amazon-inspector, ghsa-malware

Oct 30, 2026
PyPI
twitter-request-diagnostics 1.0.0
MAL-2026-18403 kam193, amazon-inspector

Oct 29, 2026
PyPI
test-01-rafamarrara-learning-dc 1.0.0
MAL-2026-18402 kam193, amazon-inspector

Oct 29, 2026
npm
ssite-mock-server 0.0.1
MAL-2026-18417 ghsa-malware 3 IOCs

Oct 29, 2026
npm
@sxm-content-creators/tools-ds 1.0.1
MAL-2026-18414 ghsa-malware 3 IOCs

Oct 29, 2026
npm
dowload_ebok_lolita_by_vladimir_nabokov_oy1gy 0.0.0-stage
MAL-2026-18399 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc 0.0.0-stage
MAL-2026-18398 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p 0.0.0-stage
MAL-2026-18401 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t 0.0.0-stage
MAL-2026-18400 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
dowload_ebok_armageddon_by_max_hastings_kv3s4 0.0.0-stage
MAL-2026-18397 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
dependencykfeg 25.0.3, 25.1.3, 25.1.9, 2.1.3
MAL-2026-18416 ghsa-malware 4 IOCs

Oct 29, 2026
PyPI
bq-helix-build-hook-6ade983e 0.1.0
MAL-2026-18395 kam193, amazon-inspector 2 IOCs

Oct 29, 2026
PyPI
bq-helix-recon-6ade983e 0.1.0, 0.1.2
MAL-2026-18396 kam193, amazon-inspector 2 IOCs

Oct 29, 2026
npm
orderbook-volt-plugin 0.0.2, 0.0.1, 0.0.0-stage
MAL-2026-18393 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
dependencykfee-2 1.0.0
MAL-2026-18460 ossf-package-analysis

Oct 29, 2026
npm
react-native-drago-callkit 1.0.16, 1.0.15, 1.0.2, 1.0.1, 1.0.0, 0.0.0-stage
MAL-2026-18394 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
@chatunitycenter/baileys 1.0.0, 0.0.0-stage
MAL-2026-18392 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
789bet-vip-online-login 0.0.0-stage
MAL-2026-18388 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
789bet-vip-login 0.0.0-stage
MAL-2026-18387 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
789bet-vip 0.0.0-stage
MAL-2026-18386 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
789bet-slot 0.0.0-stage
MAL-2026-18385 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
789bet-login-th 0.0.0-stage
MAL-2026-18384 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
789bet-entrance 0.0.0-stage
MAL-2026-18383 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
m98vip 0.0.0-stage
MAL-2026-18391 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
m98th 0.0.0-stage
MAL-2026-18390 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
m98bet 0.0.0-stage
MAL-2026-18389 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
789bet 0.0.0-stage
MAL-2026-18382 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
@pcb-dp/qa-commons 1.0.0, 1.0.10
MAL-2026-18413 ghsa-malware 3 IOCs

Oct 29, 2026