Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,378 npm 223,239 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,378 reports · Feed

  • PyPI
    bigquery-agent-analytics-tracing 0.0.0, 0.0.1
    MAL-2026-14524 kam193
  • PyPI
    rce-test 0.1
    MAL-2026-14523 kam193
  • PyPI
    syntaxerror-package-12345 0.1
    MAL-2026-14522 kam193
  • npm
    array-shuffler-utils-99 all versions
    MAL-2026-14519 ghsa-malware
  • npm
    fivem-tool-helper-v2 all versions
    MAL-2026-14521 ghsa-malware
  • npm
    fivem-tool-helper all versions
    MAL-2026-14520 ghsa-malware
  • npm
    svelte-ui-cls 1.0.0
    MAL-2026-14518 ghsa-malware, amazon-inspector
  • npm
    hydration-ui-cls 1.0.0
    MAL-2026-14517 ghsa-malware, amazon-inspector
  • PyPI
    minecraft-ytreceiver 0.1.0, 0.2.0, 0.3.0, 0.4.0, 0.5.0
    MAL-2026-14516 kam193, amazon-inspector
  • npm
    bamru 1.0.0
    MAL-2026-15674 amazon-inspector 2 IOCs
  • npm
    wm-eslint-fe all versions
    MAL-2026-14514 ghsa-malware
  • npm
    wm-lib-env-provider all versions
    MAL-2026-14515 ghsa-malware
  • npm
    hexdrift 10.0.1
    MAL-2026-14508 ghsa-malware, amazon-inspector
  • npm
    foldmap 2.0.3
    MAL-2026-14507 ghsa-malware, amazon-inspector
  • npm
    snapbuf 1.4.2
    MAL-2026-14510 ghsa-malware, amazon-inspector
  • npm
    dim-svelte-ui 1.0.0
    MAL-2026-14506 ghsa-malware, amazon-inspector
  • npm
    svelte-cls-ui 1.0.0
    MAL-2026-14511 ghsa-malware, amazon-inspector
  • npm
    typedoc-xyz 0.28.19
    MAL-2026-14513 ghsa-malware, amazon-inspector
  • npm
    r4wk-book 2.2.2
    MAL-2026-14509 ghsa-malware, amazon-inspector
  • npm
    tailwind-scrollbar-hider 5.0.2, 5.0.1, 0.0.1
    MAL-2026-14512 ghsa-malware, amazon-inspector
  • npm
    voice-crate-check 1.0.0
    MAL-2026-14505 ghsa-malware, amazon-inspector
  • npm
    video-crate-check 1.0.0
    MAL-2026-14504 ghsa-malware, amazon-inspector
  • npm
    text-crate-check 1.0.0
    MAL-2026-14503 ghsa-malware, amazon-inspector
  • npm
    svelte-streak-map 1.0.0
    MAL-2026-14500 ghsa-malware, amazon-inspector
  • npm
    svelte-map-metric 1.0.0
    MAL-2026-14499 ghsa-malware, amazon-inspector
  • npm
    svelte-hydration-streak 1.0.0
    MAL-2026-14495 ghsa-malware, amazon-inspector
  • npm
    svelte-intake-streaks 1.0.0
    MAL-2026-14498 ghsa-malware, amazon-inspector
  • npm
    svelte-goal-streaks 1.0.0
    MAL-2026-14494 ghsa-malware, amazon-inspector
  • npm
    svelte-streak-panel 1.0.0
    MAL-2026-14501 ghsa-malware, amazon-inspector
  • npm
    svelte-streak-tracker 1.0.0
    MAL-2026-14502 ghsa-malware, amazon-inspector
  • npm
    svelte-insights-streak 1.0.0
    MAL-2026-14497 ghsa-malware, amazon-inspector
  • npm
    svelte-insight-streaks all versions
    MAL-2026-14496 ghsa-malware
  • npm
    svelte-daily-streaks 1.0.0
    MAL-2026-14493 ghsa-malware, amazon-inspector
  • npm
    spotify-url-infos 3.4.2
    MAL-2026-14492 amazon-inspector
  • npm
    chai-as-otc 1.0.5
    MAL-2026-14491 amazon-inspector
  • npm
    mkb-manager 1.0.11, 1.0.13, 1.0.12, 1.0.15, 1.0.14, 1.0.10
    MAL-2026-14490 ghsa-malware, amazon-inspector
  • npm
    hydration-cls-ui 1.0.0
    MAL-2026-14489 amazon-inspector, ghsa-malware
  • npm
    modules-newline 0.0.6
    MAL-2026-14483 amazon-inspector, ghsa-malware
  • npm
    react-remove-properties 6.14.1
    MAL-2026-14484 amazon-inspector, ghsa-malware
  • PyPI
    python-walletlibr-v 0.7.9
    MAL-2026-14488 amazon-inspector