Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,347 npm 223,209 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,347 reports · Feed

  • npm
    baileys-dula 1.0.0, 1.0.1, 5.0.1
    MAL-2026-18940
  • npm
    baileyssteam 7.0.0
    MAL-2026-18949 2 IOCs
  • npm
    dula-baileys 2.0.0
    MAL-2026-18969
  • npm
    cloudpedia 1.0.0
    MAL-2026-18957 2 IOCs
  • npm
    foxxy-baileys 0.0.1
    MAL-2026-18975
  • npm
    dct-dula-dev-baileys 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5
    MAL-2026-18963
  • npm
    bellacloudy 26.3.13, 26.3.14, 26.3.15
    MAL-2026-18950
  • npm
    davebaileys 2.5.8
    MAL-2026-18960 2 IOCs
  • npm
    budetzz 2.0.4
    MAL-2026-18953 2 IOCs
  • npm
    dapzsyz-baileysm 0.4.2
    MAL-2026-18959
  • npm
    dct-baileys 1.0.1
    MAL-2026-18961 2 IOCs
  • npm
    botify-wa 0.2.0, 0.4.0, 0.6.0, 1.0.0
    MAL-2026-18952
  • npm
    changli-baileys 0.1.2, 0.1.3
    MAL-2026-18956
  • npm
    diezyxalisa-baileys 1.0.0
    MAL-2026-18967
  • npm
    dct-dev-private-baileys 1.0.0
    MAL-2026-18962
  • npm
    casper-baileys 1.0.0, 1.0.1, 1.0.2, 1.0.3, 2.0.0, 2.0.1
    MAL-2026-18955 2 IOCs
  • npm
    bintzge-baileys 1.0.1, 2.0.2, 2.0.3, 2.0.5, 2.0.9, 3.0.0, 3.0.1
    MAL-2026-18951
  • npm
    diezyxalya-baileys 1.0.0, 1.0.1
    MAL-2026-18968
  • npm
    delkira-baileys 0.8.2
    MAL-2026-18964
  • npm
    fast-baileys 2.0.6, 2.0.7, 2.0.8, 2.0.9
    MAL-2026-18971 2 IOCs
  • npm
    flibu-baileys-official 1.1.1
    MAL-2026-18974
  • npm
    ctbaileys 1.0.13, 1.0.14, 1.0.5, 1.0.6, 1.0.7, 1.0.8
    MAL-2026-18958
  • npm
    felixid 1.1.1, 1.1.2
    MAL-2026-18972
  • npm
    devilkyuuna 1.0.11, 1.0.12, 1.0.13, 1.0.14
    MAL-2026-18965
  • npm
    byleeosbaileys 2.0.5
    MAL-2026-18954
  • npm
    finzzcloud 1.0.0
    MAL-2026-18973
  • npm
    dibosockets 1.0.2, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0
    MAL-2026-18966
  • npm
    ell-bail 2.0.0
    MAL-2026-18970
  • npm
    gupongxyz 2.0.0
    MAL-2026-18977 2 IOCs
  • npm
    hunter-baileys 2.1.1
    MAL-2026-18980 2 IOCs
  • npm
    gifted-baileys 2.0.5, 2.0.6, 2.5.7, 2.5.8
    MAL-2026-18976 2 IOCs
  • npm
    kazumarii-kyuuna 1.0.23, 1.0.24
    MAL-2026-18982
  • npm
    itssofc 1.2.13
    MAL-2026-18981 2 IOCs
  • npm
    hiura 1.0.1
    MAL-2026-18979 2 IOCs
  • npm
    madara-baileys 1.0.0, 1.0.1
    MAL-2026-18986
  • npm
    malvin-baileys 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5
    MAL-2026-18988 2 IOCs
  • npm
    nobiztoblut-bot 1.2.3, 1.2.4
    MAL-2026-18995
  • npm
    phantom-pro 0.0.5, 0.0.7, 1.0.0
    MAL-2026-19001
  • npm
    killua-baileys 2.0.0
    MAL-2026-18983
  • npm
    nrx-bails 0.0.1
    MAL-2026-18997