Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

  • npm
    ded-pwa-c-page-maker-props 35.7.7
    MAL-2026-13497 amazon-inspector
  • npm
    eacq-core 35.8.1
    MAL-2026-13514 amazon-inspector
  • npm
    distributorblock 35.8.1
    MAL-2026-13503 amazon-inspector
  • npm
    streak-kit-map 1.0.0
    MAL-2026-13519 amazon-inspector, ghsa-malware
  • npm
    blekit 1.2.1, 1.2.0, 1.1.0, 1.0.0, 0.3.2, 0.3.1, 0.3.0, 0.2.0, 0.1.0
    MAL-2026-13495 amazon-inspector, ghsa-malware
  • npm
    postcss-theme-provider 1.0.2, 1.0.3, 1.0.4, 1.0.1
    MAL-2026-13518 amazon-inspector, ghsa-malware
  • npm
    forge-gas-diff 1.0.0, 1.0.1
    MAL-2026-13516 amazon-inspector
  • npm
    gas-diff-core 1.0.0
    MAL-2026-13517 amazon-inspector
  • PyPI
    speed-hashes 0.1.0
    MAL-2026-13607 amazon-inspector, kam193 2 IOCs
  • PyPI
    fast-hashes 0.1.0
    MAL-2026-13490 kam193, amazon-inspector 2 IOCs
  • PyPI
    idnna 0.1.1, 0.1.2, 0.2.0, 0.3.0
    MAL-2026-13488 kam193, amazon-inspector 2 IOCs
  • PyPI
    pydanticc 0.1.1, 0.1.2, 0.2.0, 0.3.0
    MAL-2026-13489 kam193, amazon-inspector 2 IOCs
  • PyPI
    fastapii 0.1.1, 0.1.2, 0.2.0, 0.3.0
    MAL-2026-13486 kam193, amazon-inspector 2 IOCs
  • PyPI
    flasq 0.1.1, 0.1.2, 0.2.0, 0.3.0
    MAL-2026-13487 kam193, amazon-inspector 2 IOCs
  • npm
    velabuild 2.1.1, 1.0.1, 2.0.0, 1.0.0, 1.0.3, 1.0.2, 2.2.0, 2.1.0
    MAL-2026-13493 ghsa-malware, amazon-inspector
  • npm
    rdfxvela-build 1.0.0
    MAL-2026-13492 ghsa-malware, amazon-inspector
  • npm
    rdfxvela 1.0.1, 1.0.3, 1.0.6, 6.0.0, 2.0.1, 1.0.4, 4.0.1, 4.0.5, 1.0.5, 4.1.0, 6.2.1, 3.…
    MAL-2026-13491 ghsa-malware, amazon-inspector
  • npm
    @prototypevip/baileys 0.0.3
    MAL-2026-13480 amazon-inspector
  • npm
    merge-grid-stats 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.1.0, 1.0.1, 1.0.0
    MAL-2026-13484 amazon-inspector
  • npm
    diezyclutch-baileys 8.6.78, 8.6.91, 8.6.95, 8.6.92, 8.6.93, 8.6.90, 8.6.94
    MAL-2026-13482 amazon-inspector, ghsa-malware
  • npm
    cdf-tag-commander-helper 3.6.2, 3.1.1
    MAL-2026-13481 amazon-inspector
  • npm
    @cats-cdf/authentication 3.1.1, 2.17.1
    MAL-2026-13478 amazon-inspector
  • npm
    @cats-cdf/browser-metrics-meter 3.1.1, 2.0.0
    MAL-2026-13479 amazon-inspector
  • npm
    weight2loss 1.0.5
    MAL-2026-13485 amazon-inspector
  • npm
    internallib_v514 1.0.0, 1.0.1
    MAL-2026-13483 amazon-inspector
  • npm
    remote-claude-daemon 0.3.9, 0.3.7, 0.3.5, 0.5.7, 0.4.6, 0.5.2, 0.5.5, 0.6.0, 0.3.0, 0.4.2, 0.3.8, 0.…
    MAL-2026-13455 amazon-inspector
  • npm
    santana-baileys 2.0.4, 2.0.2, 2.0.3, 2.0.0, 2.0.1
    MAL-2026-13456 amazon-inspector, ghsa-malware
  • npm
    shadowx-fca 10.0.0, 10.1.0, 10.6.0
    MAL-2026-13457 amazon-inspector
  • npm
    squeez 1.40.0, 1.44.1, 1.42.1, 1.38.0
    MAL-2026-13458 amazon-inspector
  • npm
    supersig 1.0.5
    MAL-2026-13461 amazon-inspector, ghsa-malware
  • npm
    trimprompt 1.0.47, 1.0.35, 1.0.49, 1.0.46, 1.0.42, 1.0.48
    MAL-2026-13462 amazon-inspector
  • npm
    vite-plugin-cleaner 4.1.3
    MAL-2026-13463 amazon-inspector, ghsa-malware
  • npm
    vite-svg-parse 1.1.3
    MAL-2026-13464 amazon-inspector, ghsa-malware
  • npm
    vite-vue-path-map 1.0.2, 1.0.1, 1.0.0
    MAL-2026-13465 amazon-inspector
  • npm
    xdaxx 1.0.1
    MAL-2026-13468 amazon-inspector
  • npm
    xxdxax 1.0.0, 1.0.1
    MAL-2026-13469 amazon-inspector
  • npm
    ynastore-baileys 1.0.21
    MAL-2026-13470 amazon-inspector
  • npm
    zyr-agent 1.6.2, 1.5.7
    MAL-2026-13471 amazon-inspector
  • npm
    elephant-tusk-runner 1.0.1, 1.0.0
    MAL-2026-13445 amazon-inspector
  • npm
    opencode-optimised-toolings 3.4.0, 4.0.0, 4.0.1
    MAL-2026-13452 amazon-inspector