Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

  • PyPI
    py-devoli-common 999.999.999
    MAL-2026-15693 reversing-labs, amazon-inspector
  • npm
    dotish 1.0.0
    MAL-2026-14418 ghsa-malware, amazon-inspector
  • npm
    dims-svelte-ui all versions
    MAL-2026-14417 ghsa-malware
  • npm
    dims-hydration-ui 1.0.0
    MAL-2026-14416 ghsa-malware, amazon-inspector
  • npm
    tkyoussef-hb all versions
    MAL-2026-14419 ghsa-malware
  • npm
    @elc-online/up-analytics 99.99.99
    MAL-2026-14443 ossf-package-analysis
  • npm
    react-dynamic-parser all versions
    MAL-2026-14415 ghsa-malware
  • npm
    mcp-real-chrome 1.1.0, 1.2.0, 1.2.1, 1.1.1
    MAL-2026-14414 ghsa-malware, amazon-inspector
  • npm
    livemcp 1.3.0, 1.2.1
    MAL-2026-14413 ghsa-malware, amazon-inspector
  • npm
    @deepaksilaych/sess all versions
    MAL-2026-14412 ghsa-malware
  • npm
    @medisend/webview-bridge 0.0.1-security-research, 0.0.2-security-research
    MAL-2026-14424 amazon-inspector, ossf-package-analysis, ghsa-malware
  • npm
    dpg-media-7ehemel 999.9.15
    MAL-2026-14411 ossf-package-analysis, amazon-inspector
  • PyPI
    msrcpoc 99.1.9
    MAL-2026-14444 ossf-package-analysis
  • npm
    @temptation.js/utils 999.9.16, 999.9.15
    MAL-2026-14410 ossf-package-analysis, amazon-inspector
  • npm
    dext-crate-video 1.0.0
    MAL-2026-14408 ghsa-malware, amazon-inspector
  • npm
    dext-crate-image 1.0.0
    MAL-2026-14407 ghsa-malware, amazon-inspector
  • npm
    dext-crate-check 1.0.0
    MAL-2026-14406 ghsa-malware, amazon-inspector
  • npm
    create-json-client 1.0.0
    MAL-2026-14405 ghsa-malware, amazon-inspector
  • npm
    polis-diraja all versions
    MAL-2026-14409 ghsa-malware
  • npm
    @blurrydespair/libsignal-node 2.2.9, 2.2.7
    MAL-2026-14404 ghsa-malware, amazon-inspector
  • npm
    react-emits 1.0.0, 1.0.1, 1.0.2, 1.0.4, 1.0.5
    MAL-2026-14403 ghsa-malware, reversing-labs
  • PyPI
    multyproccess 2.32.3, 2.32.4, 2.32.5, 2.32.6
    MAL-2026-14401 kam193, amazon-inspector 1 IOC
  • npm
    agentgui 1.0.1127
    MAL-2026-14402 ghsa-malware
  • npm
    message-compiler 9.2.0
    MAL-2026-14392 amazon-inspector
  • npm
    sm-oauth 99.0.0
    MAL-2026-14398 amazon-inspector, ghsa-malware
  • npm
    amundi-compare 999.9.12
    MAL-2026-14390 amazon-inspector
  • npm
    fund-calculator 999.9.12
    MAL-2026-14391 amazon-inspector
  • PyPI
    envprovision 1.2.0, 1.3.0, 1.4.0
    MAL-2026-14389 kam193, amazon-inspector 4 IOCs
  • PyPI
    cryptgraphy 1.0.0
    MAL-2026-14388 kam193, amazon-inspector 1 IOC
  • npm
    @opap/player-kyc-widget 3.999.999
    MAL-2026-14387 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    sm-apikey-model 99.0.0, 99.0.1
    MAL-2026-14394 amazon-inspector, ossf-package-analysis, ghsa-malware
  • npm
    sm-checkout 99.0.0, 99.0.1
    MAL-2026-14397 amazon-inspector, ossf-package-analysis, ghsa-malware
  • npm
    sm-payment 99.0.1, 99.0.0
    MAL-2026-14399 amazon-inspector, ossf-package-analysis, ghsa-malware
  • npm
    sm-session 99.0.1, 99.0.0
    MAL-2026-14400 amazon-inspector, ossf-package-analysis, ghsa-malware
  • npm
    sm-admin 99.0.0, 99.0.1
    MAL-2026-14393 amazon-inspector, ossf-package-analysis, ghsa-malware
  • npm
    sm-cart 99.0.0, 99.0.1
    MAL-2026-14396 amazon-inspector, ossf-package-analysis, ghsa-malware
  • npm
    sm-billing-form 99.0.0, 99.0.1
    MAL-2026-14395 amazon-inspector, ossf-package-analysis, ghsa-malware
  • PyPI
    mlflow-otel-instrumentor 1.1.0
    MAL-2026-14384 kam193, amazon-inspector 1 IOC
  • npm
    svelte-dim-kit 1.0.0
    MAL-2026-14386 ghsa-malware, amazon-inspector
  • npm
    hydration-dim-kit 1.0.0
    MAL-2026-14385 ghsa-malware, amazon-inspector