Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,346 npm 223,208 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,346 reports · Feed

npm
@mobile-platform/magnetic-components 0.0.1, 0.0.2, 0.0.3
MAL-2026-18448 ghsa-malware 1 IOC

Oct 29, 2026
npm
@jasperquinn/postcss-motion-helpers 0.0.0-stage
MAL-2026-18379 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
black-spindle-2 301.0.0, 100.0.0
MAL-2026-18376 amazon-inspector

Oct 29, 2026
PyPI
poc-revshell 0.1.0
MAL-2026-18378 amazon-inspector

Oct 29, 2026
npm
cjlowuxbnexkhgpzq 0.0.0-stage, 1.0.0
MAL-2026-18381 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
bcxhdh1kjlopsde 1.0.0, 0.0.0-stage
MAL-2026-18380 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
mw-communication-client 10.0.0, 1.0.1
MAL-2026-18370 amazon-inspector

Oct 29, 2026
npm
mw-test-utils 1.0.0, 10.0.0, 10.0.1
MAL-2026-18371 amazon-inspector

Oct 29, 2026
npm
mui-wrapper-x-date-pickers 1.0.0, 10.0.0
MAL-2026-18369 amazon-inspector

Oct 29, 2026
npm
monte-md-baileys 1.0.0
MAL-2026-17399 amazon-inspector

Oct 29, 2026
npm
noxleyss 1.1.11, 1.1.8, 1.1.7, 1.1.6, 1.1.5, 1.1.4, 1.1.3, 1.1.2, 1.1.1, 1.1.0, 1.0.0, 2…
MAL-2026-17402 amazon-inspector

Oct 29, 2026
npm
@rennnpm/baileys 1.0.0
MAL-2026-17374 amazon-inspector

Oct 29, 2026
PyPI
seapy-ops 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.1, 1.2.2
MAL-2026-17880 amazon-inspector 2 IOCs

Oct 29, 2026
npm
@testsecuiitytestme/cache-helper 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7
MAL-2026-18358 amazon-inspector

Oct 29, 2026
npm
dsh-volcengine-provider 0.2.5, 0.2.8, 0.2.3, 0.2.11
MAL-2026-18374 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
zystcdemo 1.0.0
MAL-2026-18447 3 IOCs

Oct 29, 2026
npm
dsh-redteam-mode 0.15.2
MAL-2026-18366 ghsa-malware, amazon-inspector

Oct 29, 2026
npm
spectral-core 3.0.6, 3.0.4, 3.0.10, 3.0.5, 3.0.3, 3.0.11, 3.0.7, 3.0.12, 3.0.9, 3.0.2
MAL-2026-18377 amazon-inspector 2 IOCs

Oct 29, 2026
npm
@dmangal/curse-dependent-ecto 99999.0.2, 99999.0.1, 99999.0.0
MAL-2026-18375 amazon-inspector 2 IOCs

Oct 29, 2026
npm
@notrainer/nobtrainer-sdk 1.0.2, 1.0.3, 1.0.4, 1.0.5
MAL-2026-18446 1 IOC

Oct 29, 2026
npm
self-v8 1.0.0, 2.1.8, 2.1.9, 8.1.9, 8.3.9, 8.5.9, 8.7.9, 8.9.9
MAL-2026-18445 1 IOC

Oct 29, 2026
npm
@johnruff215-dev/solana-wallet-tracker 1.0.0, 1.0.1
MAL-2026-18444 1 IOC

Oct 29, 2026
npm
litecore-lib-ltc 1.0.0, 1.9.3, 1.9.4, 1.9.5, 1.9.6, 1.9.7, 1.9.8, 1.9.9, 1.9.10, 1.9.11, 1.9.12,…
MAL-2026-18442 1 IOC

Oct 29, 2026
npm
@zaip-ai/cli 7.3.0, 7.0.0, 7.1.0, 7.4.0, 6.5.0, 7.2.0, 6.4.0
MAL-2026-18364 ghsa-malware, amazon-inspector

Oct 28, 2026
npm
itsa-utils 1.4.2
MAL-2026-18363 ghsa-malware

Oct 28, 2026
npm
itsa-react-checkbox 16.0.5
MAL-2026-18360 ghsa-malware

Oct 28, 2026
npm
transaction-info-generate-sdk 0.0.0-stage, 1.0.4
MAL-2026-18362 ghsa-malware, amazon-inspector

Oct 28, 2026
npm
mock-transactions-sdk 1.0.1, 0.0.0-stage
MAL-2026-18361 ghsa-malware, amazon-inspector

Oct 28, 2026
npm
black-spindle 999.0.0
MAL-2026-18359 ossf-package-analysis, amazon-inspector

Oct 28, 2026
npm
@zmtcdn/components 9999.0.0
MAL-2026-18372 amazon-inspector 1 IOC

Oct 28, 2026
npm
@zmtcdn/ui 9999.0.0, 9999.0.7
MAL-2026-18373 amazon-inspector 2 IOCs

Oct 28, 2026
npm
identity-two-factor 999.0.0
MAL-2026-18367 amazon-inspector 1 IOC

Oct 28, 2026
npm
spectral-net-probe 1.0.1, 1.0.4, 1.0.10
MAL-2026-18368 amazon-inspector 5 IOCs

Oct 28, 2026
npm
glyphmatrix-fixture 1.0.1, 1.0.0
MAL-2026-18355 ghsa-malware, amazon-inspector

Oct 28, 2026
PyPI
trajmetrics 0.5.3
MAL-2026-18354 kam193, amazon-inspector 1 IOC

Oct 27, 2026
npm
csec-form-validatorr 0.0.0-stage
MAL-2026-18353 ghsa-malware, amazon-inspector

Oct 27, 2026
npm
csec-form-validator 0.0.0-stage
MAL-2026-18352 ghsa-malware, amazon-inspector

Oct 27, 2026
npm
csec-crypto-toolkit 0.0.0-stage
MAL-2026-18351 ghsa-malware, amazon-inspector

Oct 27, 2026
npm
ccsseecc-form-validator 0.0.0-stage
MAL-2026-18350 ghsa-malware, amazon-inspector

Oct 27, 2026
npm
ccsseecc-crypto-toolkit 0.0.0-stage
MAL-2026-18349 ghsa-malware, amazon-inspector

Oct 27, 2026