Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,288 npm 223,152 PyPI 11,993 RubyGems 4,316 NuGet 782 crates.io 22 Go 20 Maven 2 Packagist 1

240,288 reports · Feed

PyPI
supercolor-tui 0.1.0, 0.1.1, 0.1.2, 0.1.4
MAL-2026-18767 kam193 2 IOCs

Nov 8, 2026
RubyGems
control-character-command-injection 1.0.1
MAL-2026-18764 amazon-inspector

Nov 8, 2026
RubyGems
agentic-call-control 1.1.8
MAL-2026-18763 amazon-inspector

Nov 8, 2026
RubyGems
dynamic-object-handler 1.0.1
MAL-2026-18766 amazon-inspector

Nov 8, 2026
RubyGems
donjon-ledger 2.0.2
MAL-2026-18765 amazon-inspector

Nov 8, 2026
PyPI
blender-headless 9.99.9
MAL-2026-18758 amazon-inspector, kam193

Nov 8, 2026
PyPI
infra-libs 99.99.99
MAL-2026-18761 amazon-inspector, kam193

Nov 8, 2026
PyPI
expect-tests 99.99.99
MAL-2026-18760 amazon-inspector, kam193

Nov 8, 2026
PyPI
rainbowcolors 0.1.0
MAL-2026-18762 amazon-inspector, kam193 4 IOCs

Nov 8, 2026
PyPI
chromacli 0.1.2, 0.1.0, 0.1.1, 0.1.3, 0.1.4
MAL-2026-18759 amazon-inspector, kam193 2 IOCs

Nov 8, 2026
npm
@htooayelwinict/travis234 3.3.2
MAL-2026-18757 ghsa-malware

Nov 8, 2026
PyPI
twitch-stream-py 1.0.2rc0, 1.0.3rc0, 1.0.4rc0, 1.0.4rc2, 1.0.5rc2, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1…
MAL-2026-18756 kam193 1 IOC

Nov 7, 2026
PyPI
pyuserox 0.0.2
MAL-2026-18755 kam193 1 IOC

Nov 7, 2026
PyPI
pyuserfox 0.0.2
MAL-2026-18754 kam193 1 IOC

Nov 7, 2026
crates.io
env-test-guard 0.2.0, 0.3.0
MAL-2026-18776 2 IOCs

Nov 7, 2026
PyPI
gcp-log-poc 0.0.1, 0.0.2, 0.0.3
MAL-2026-18753 kam193, amazon-inspector

Nov 7, 2026
PyPI
qzc690384 1.0.0
MAL-2026-18752 kam193, amazon-inspector

Nov 7, 2026
PyPI
qzc690383 1.0.0
MAL-2026-18750 amazon-inspector, kam193

Nov 7, 2026
PyPI
qzc690382 1.0.0
MAL-2026-18749 amazon-inspector, kam193

Nov 7, 2026
PyPI
qzc690385 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0, 1.…
MAL-2026-18751 amazon-inspector, kam193

Nov 7, 2026
PyPI
genblaze-atlascloud 0.1.0
MAL-2026-18747 kam193

Nov 7, 2026
PyPI
genblaze-fal 0.1.0
MAL-2026-18746 kam193

Nov 7, 2026
npm
dsh-notify-focus 0.7.0, 0.5.0, 0.7.1
MAL-2026-18748 ghsa-malware

Nov 7, 2026
PyPI
pulumi-doppler 0.0.0, 1.0.0
MAL-2026-18745 kam193

Nov 7, 2026
PyPI
shanks 0.0.4
MAL-2026-19051

Nov 7, 2026
npm
@cherrydotfun/miniapp-sdk 0.1.22, 0.1.23
MAL-2026-18737 ghsa-malware

Nov 6, 2026
PyPI
fhqiouhq 0.1.0
MAL-2026-18742 kam193

Nov 6, 2026
PyPI
ajfhiuqhfqgwerhuqnfqh 0.1.0
MAL-2026-18741 kam193

Nov 6, 2026
PyPI
reqnests 0.1.0, 0.1.1
MAL-2026-18744 kam193

Nov 6, 2026
PyPI
reqnest 0.1.0
MAL-2026-18743 kam193

Nov 6, 2026
npm
tailwind-animationfound all versions
MAL-2026-18740 ghsa-malware

Nov 6, 2026
npm
modelsdesk 0.4.2
MAL-2026-18739 ghsa-malware

Nov 6, 2026
npm
kampodine 0.8.0
MAL-2026-18738 ghsa-malware

Nov 6, 2026
npm
automic-style-engine all versions
MAL-2026-18736 ghsa-malware

Nov 6, 2026
PyPI
hello-bat-fwi9 0.1.0, 0.1.1
MAL-2026-18735 kam193, amazon-inspector 1 IOC

Nov 6, 2026
npm
monobomber all versions
MAL-2026-18732 ghsa-malware

Nov 6, 2026
npm
monopw all versions
MAL-2026-18733 ghsa-malware

Nov 6, 2026
npm
tw-motion-css all versions
MAL-2026-18734 ghsa-malware

Nov 6, 2026
npm
wisdomtreetest all versions
MAL-2026-18730 ghsa-malware

Nov 6, 2026
npm
@noinheritdoc/n all versions
MAL-2026-18722 ghsa-malware

Nov 6, 2026