Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,378 npm 223,239 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,378 reports · Feed

  • PyPI
    pygame-renderkit 1.2.0
    MAL-2026-14587 kam193, amazon-inspector 1 IOC
  • PyPI
    yaml-report-formatter 0.1.0, 0.2.0, 0.3.0
    MAL-2026-14588 kam193, amazon-inspector
  • npm
    @fleetbo/svro 0.0.42, 0.0.40, 0.0.39, 0.0.38, 0.0.37, 0.0.35, 0.0.34, 0.0.33, 0.0.32, 0.0.31,…
    MAL-2026-14586 ghsa-malware, amazon-inspector
  • npm
    @znan/wabot 0.2.2-beta.3, 0.2.2-beta.2, 0.2.2-beta.1, 0.2.2-beta.0, 0.2.1, 0.2.0-beta.8, 0.…
    MAL-2026-14585 ghsa-malware
  • npm
    pushgitquickx 1.0.17, 1.0.16, 1.0.15, 1.0.14, 1.0.13, 1.0.12, 1.0.11, 1.0.10, 1.0.9, 1.0.8, 1…
    MAL-2026-14578 ghsa-malware, amazon-inspector
  • npm
    @hd-team/app-impkg-test all versions
    MAL-2026-14576 ghsa-malware
  • npm
    @hd-team/app-impkg-prod all versions
    MAL-2026-14575 ghsa-malware
  • npm
    @hd-team/app-dnpkg-three all versions
    MAL-2026-14574 ghsa-malware
  • npm
    @hd-team/app-dnpkg-prod all versions
    MAL-2026-14571 ghsa-malware
  • npm
    @hd-team/app-dnpkg-beta 1.0.20260808153500
    MAL-2026-14569 ghsa-malware, amazon-inspector
  • npm
    @hd-team/app-dnpkg-test all versions
    MAL-2026-14573 ghsa-malware
  • npm
    @hd-team/app-dnpkg-ten all versions
    MAL-2026-14572 ghsa-malware
  • npm
    @hd-team/app-dnpkg-eight all versions
    MAL-2026-14570 ghsa-malware
  • PyPI
    flyteplugins-redis 2.6.10
    MAL-2026-14584 kam193
  • PyPI
    flyteplugins-nsight 2.6.10
    MAL-2026-14583 kam193
  • PyPI
    flyteplugins-agento11y 2.6.10
    MAL-2026-14581 kam193
  • PyPI
    flyteplugins-echo 2.6.10
    MAL-2026-14582 kam193
  • npm
    svelte-ui-dlx 1.0.0
    MAL-2026-14579 ghsa-malware, amazon-inspector
  • npm
    hydration-ui-dlx 1.0.0
    MAL-2026-14577 ghsa-malware, amazon-inspector
  • npm
    tailwindcss-3d-animate 1.1.0, 1.2.1, 1.2.2, 1.2.0, 0.0.1-security
    MAL-2026-14567 ghsa-malware, amazon-inspector
  • npm
    tailwindcss-form-styles 0.5.15
    MAL-2026-14568 ghsa-malware, amazon-inspector
  • npm
    stackpaths 3.1.2, 3.1.1, 3.1.0, 3.1.3
    MAL-2026-14565 ghsa-malware, amazon-inspector
  • npm
    inspectstack 3.1.1, 3.1.2, 3.1.0, 3.1.3
    MAL-2026-14560 ghsa-malware, amazon-inspector
  • npm
    deepjoin 4.3.3, 4.3.1, 4.3.2
    MAL-2026-14558 ghsa-malware, amazon-inspector
  • npm
    charclass 1.0.4, 1.0.2, 1.0.6, 1.0.3
    MAL-2026-14557 ghsa-malware, amazon-inspector
  • npm
    veloq 1.1.0, 1.0.2, 1.2.2, 1.0.1, 1.2.3, 1.1.3, 1.2.1
    MAL-2026-14566 ghsa-malware, amazon-inspector
  • npm
    sigcheck 1.0.3, 1.0.1, 1.1.0
    MAL-2026-14564 ghsa-malware, amazon-inspector
  • npm
    morglog 1.1.0, 1.2.1
    MAL-2026-14562 ghsa-malware, amazon-inspector
  • npm
    module-relpath 1.0.1, 1.0.2, 1.0.3
    MAL-2026-14561 ghsa-malware, amazon-inspector
  • PyPI
    decoris 0.3.0, 0.3.3
    MAL-2026-14554 kam193 4 IOCs
  • PyPI
    sap-quarterly-report 1.0.0
    MAL-2026-14556 kam193
  • PyPI
    ekx-report-utils 0.1.0, 0.2.0, 0.3.0, 0.4.0
    MAL-2026-14555 kam193, amazon-inspector
  • npm
    rn-push-provisioning 99.0.1, 99.0.0
    MAL-2026-14563 ghsa-malware, amazon-inspector
  • npm
    imo-allowlist-xss-poc 1.0.0
    MAL-2026-14559 ghsa-malware, amazon-inspector
  • PyPI
    mathkitlite 0.1.0
    MAL-2026-14552 kam193
  • npm
    @cortana-md/engine 1.4.1
    MAL-2026-14553 ghsa-malware, amazon-inspector
  • npm
    bnotify-web-sdk 1.3.3, 1.2.8, 1.2.0, 1.2.9, 1.2.10, 1.2.11, 1.2.2, 1.2.3, 1.1.9, 1.2.4, 1.3.1, …
    MAL-2026-14551 ghsa-malware, amazon-inspector
  • npm
    dumb-binding-gyp-package 0.1.0
    MAL-2026-14546 ghsa-malware, amazon-inspector
  • npm
    tset_racie 1.0.3, 1.0.1, 1.0.2, 1.0.0
    MAL-2026-14550 ghsa-malware, amazon-inspector
  • npm
    the_tax_free_cashier_is_at_9f 1995.3.20, 2026.6.3-0.hades.no.isshouni, 1995.3.2-0.miasma, 2026.6.2-5.hades.no…
    MAL-2026-14549 ghsa-malware, amazon-inspector