Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

  • npm
    typescipt-core 1.0.0
    MAL-2026-14147 amazon-inspector
  • npm
    typescipt-cli 1.0.0
    MAL-2026-14146 amazon-inspector
  • npm
    tyepescript-cli 1.0.0
    MAL-2026-14143 amazon-inspector
  • npm
    @mohamed_nowisar/token3-check 0.0.1
    MAL-2026-14135 amazon-inspector
  • npm
    @mohamed_nowisar/depconf-canary-test 0.0.1
    MAL-2026-14134 amazon-inspector
  • npm
    agora402-payment-utils 1.0.0
    MAL-2026-14136 amazon-inspector, ghsa-malware
  • npm
    mtslink-depconf-probe-profileusername 1.0.0
    MAL-2026-14137 amazon-inspector
  • npm
    optimizely-starter-kit-for-fastly-compute 1.0.1, 1.1.1
    MAL-2026-14138 amazon-inspector, ghsa-malware
  • npm
    prism-registry 1.0.1, 1.1.1
    MAL-2026-14139 amazon-inspector, ghsa-malware
  • PyPI
    deepface-weight 0.1.4
    MAL-2026-14158 kam193, amazon-inspector
  • npm
    vite-svg-config 1.1.0
    MAL-2026-14140 amazon-inspector
  • PyPI
    reqcrypt 0.1.0
    MAL-2026-14133 kam193, amazon-inspector
  • PyPI
    deepface-weights 0.1.0, 0.1.1, 0.1.2
    MAL-2026-14132 kam193, amazon-inspector
  • PyPI
    infogram-bot 1.0.0, 1.2.0, 1.2.1, 1.3.0, 1.4.0, 1.5.0, 1.6.0, 1.6.1, 1.7.0, 1.8.0, 1.9.0
    MAL-2026-14131 kam193, amazon-inspector 1 IOC
  • PyPI
    httpz-requests 1.8.0, 1.9.0, 1.10.0, 1.11.0, 1.12.0, 1.13.0, 1.14.0, 1.15.0, 1.16.0, 1.17.0, 1…
    MAL-2026-14130 kam193, amazon-inspector 1 IOC
  • npm
    plugin-react-vite 2.1.2, 2.1.3
    MAL-2026-14129 ghsa-malware, amazon-inspector
  • npm
    @reducers/projects all versions
    MAL-2026-14127 ghsa-malware
  • npm
    @guildai-services/guildai all versions
    MAL-2026-14125 ghsa-malware
  • npm
    @milleree/date-display all versions
    MAL-2026-14126 ghsa-malware
  • npm
    motionspring all versions
    MAL-2026-14128 ghsa-malware
  • npm
    alphazone all versions
    MAL-2026-14124 ghsa-malware
  • npm
    @oyo_tech/oyochat_user 100.0.0, 99.99.99
    MAL-2026-14123 ossf-package-analysis, amazon-inspector
  • npm
    bcc-design-icons 9999.0.0
    MAL-2026-14119 amazon-inspector, reversing-labs
  • npm
    bcc-design 9999.0.0
    MAL-2026-14117 amazon-inspector, reversing-labs
  • npm
    core-tailwindcss-utility 3.7.1
    MAL-2026-14118 amazon-inspector
  • npm
    blastradar 1.0.0
    MAL-2026-14120 ghsa-malware, amazon-inspector
  • npm
    ulebkit 1.0.1, 1.0.0
    MAL-2026-14122 ghsa-malware, amazon-inspector
  • npm
    sui-move-graphql 0.2.0, 0.2.1, 0.1.0
    MAL-2026-14121 ghsa-malware, amazon-inspector
  • PyPI
    socks5901 1.0.0
    MAL-2026-14100 kam193
  • npm
    sui-move-rpc 0.2.0, 0.1.0
    MAL-2026-14113 ghsa-malware, amazon-inspector
  • npm
    sui-gql-core 0.2.0, 0.1.0
    MAL-2026-14112 ghsa-malware, amazon-inspector
  • npm
    leb128x 1.0.1, 1.0.0
    MAL-2026-14109 ghsa-malware, amazon-inspector
  • npm
    bcs-core 1.0.0
    MAL-2026-14105 ghsa-malware, amazon-inspector
  • npm
    reseller-app 9.9.11
    MAL-2026-14110 ghsa-malware, reversing-labs
  • npm
    club-sauce 9.9.11
    MAL-2026-14107 ghsa-malware, reversing-labs
  • npm
    sugarball-cli 1.0.0
    MAL-2026-14111 ghsa-malware, amazon-inspector
  • npm
    cloud-agen-bot 1.0.0
    MAL-2026-14106 ghsa-malware, amazon-inspector
  • npm
    userbotjs-jun all versions
    MAL-2026-14115 ghsa-malware
  • npm
    userbotjs all versions
    MAL-2026-14114 ghsa-malware
  • npm
    junofficial-userbot all versions
    MAL-2026-14108 ghsa-malware