Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,407 npm 223,265 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,407 reports · Feed

  • PyPI
    ml-data-shared 12.0.1, 16.0.1
    MAL-2026-11199 kam193 1 IOC
  • npm
    tgnode all versions
    MAL-2026-11399 ghsa-malware
  • npm
    base58-ts all versions
    MAL-2026-11247 ghsa-malware
  • npm
    base-x-ts all versions
    MAL-2026-11246 ghsa-malware
  • npm
    node-logger-winston all versions
    MAL-2026-11341 ghsa-malware
  • npm
    dash-merge all versions
    MAL-2026-11274 ghsa-malware
  • PyPI
    ml-nps-shared 6.0.3, 8.2.3
    MAL-2026-11201 kam193 1 IOC
  • PyPI
    ml-fdbk-shared 1.0.0, 2.3.1
    MAL-2026-11200 kam193 1 IOC
  • npm
    @grua/icons 99.0.0
    MAL-2026-11214 ghsa-malware, reversing-labs
  • npm
    @grua/core all versions
    MAL-2026-11213 ghsa-malware
  • npm
    isix all versions
    MAL-2026-11323 ghsa-malware
  • npm
    @solana-sdk/web3.js all versions
    MAL-2026-11227 ghsa-malware
  • npm
    @ethers-sdk/wallet 5.8.0
    MAL-2026-11211 ghsa-malware, reversing-labs
  • npm
    @ethers-sdk/ethers all versions
    MAL-2026-11210 ghsa-malware
  • PyPI
    ml-shared 6.3.0, 8.8.0
    MAL-2026-11202 kam193, amazon-inspector 1 IOC
  • npm
    dotex-plugin all versions
    MAL-2026-11282 ghsa-malware
  • npm
    dotenv-core all versions
    MAL-2026-11281 ghsa-malware
  • npm
    compose-logger-stand 1.0.126
    MAL-2026-11267 ghsa-malware, amazon-inspector
  • npm
    xp-node-logger all versions
    MAL-2026-11411 ghsa-malware
  • npm
    wistia_namespace all versions
    MAL-2026-11410 ghsa-malware
  • npm
    unified-help-center-alpha all versions
    MAL-2026-11406 ghsa-malware
  • npm
    time-to-reload all versions
    MAL-2026-11402 ghsa-malware
  • npm
    termly-namespace all versions
    MAL-2026-11395 ghsa-malware
  • npm
    srgb-linear all versions
    MAL-2026-11386 ghsa-malware
  • npm
    slowest-build-nodes all versions
    MAL-2026-11380 ghsa-malware
  • npm
    pulleeelll all versions
    MAL-2026-11350 ghsa-malware
  • npm
    pjm-dls all versions
    MAL-2026-11347 ghsa-malware
  • npm
    page_colors all versions
    MAL-2026-11343 ghsa-malware
  • npm
    model-data-cache-service all versions
    MAL-2026-11332 ghsa-malware
  • npm
    live-reload-on-error all versions
    MAL-2026-11326 ghsa-malware
  • npm
    js-focus-within all versions
    MAL-2026-11324 ghsa-malware
  • npm
    impv all versions
    MAL-2026-11319 ghsa-malware
  • npm
    gatorhelper all versions
    MAL-2026-11315 ghsa-malware
  • npm
    fcogvspgigatanzcydfyvgtjhvxibyau all versions
    MAL-2026-11310 ghsa-malware
  • npm
    ethers-v6 1.0.0, 9.0.0, 90.0.0
    MAL-2026-11297 ghsa-malware, reversing-labs
  • npm
    ember-livereload-indicator 99.0.0
    MAL-2026-11291 ghsa-malware, reversing-labs
  • npm
    ember-cli-deploy-secrets all versions
    MAL-2026-11290 ghsa-malware
  • npm
    ember-cli-deploy-derploy all versions
    MAL-2026-11289 ghsa-malware
  • npm
    easycommons all versions
    MAL-2026-11285 ghsa-malware
  • npm
    decline all versions
    MAL-2026-11276 ghsa-malware