Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,347 npm 223,209 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,347 reports · Feed

npm
@worca/app 1.14.0-rc.2, 1.14.0-rc.4
MAL-2026-18325 ghsa-malware, amazon-inspector

Oct 26, 2026
npm
publish-poc-base 1.0.7
MAL-2026-18323 amazon-inspector

Oct 26, 2026
npm
publish-poc-test3 1.0.15, 1.0.27, 1.0.18, 1.0.22, 1.0.19, 1.0.26, 1.0.21
MAL-2026-18324 amazon-inspector

Oct 26, 2026
npm
@apexacc/cli 1.5.121, 1.6.0, 1.6.2, 1.5.122
MAL-2026-17924 amazon-inspector, ghsa-malware 14 IOCs

Oct 26, 2026
npm
numbors 1.6.1
MAL-2026-18322 ghsa-malware, amazon-inspector

Oct 26, 2026
npm
dsh-native 1.4.1
MAL-2026-18315 ghsa-malware, amazon-inspector

Oct 26, 2026
npm
bow-test all versions
MAL-2026-18311 ghsa-malware

Oct 26, 2026
npm
css-hnhxwd-polyfill all versions
MAL-2026-18314 ghsa-malware

Oct 26, 2026
npm
css-flexgap-shim all versions
MAL-2026-18312 ghsa-malware

Oct 26, 2026
npm
util-foriepft 1.0.0
MAL-2026-17878 ghsa-malware, amazon-inspector 1 IOC

Oct 26, 2026
npm
css-grid-snap-util 1.0.1, 1.0.0
MAL-2026-18313 ghsa-malware, amazon-inspector

Oct 26, 2026
npm
@regex33-hackerone/tb-compat 1.0.0
MAL-2026-18310 ghsa-malware, amazon-inspector

Oct 26, 2026
npm
@walknpm/todo-cli 2.0.1
MAL-2026-18320 ossf-package-analysis, amazon-inspector, ghsa-malware 2 IOCs

Oct 26, 2026
npm
dsh-plugin-blender-3d 0.2.1
MAL-2026-18321 ossf-package-analysis, amazon-inspector, ghsa-malware 2 IOCs

Oct 26, 2026
npm
@s4yhiitestpoc/scan-https-dualuse-e all versions
MAL-2026-18309 ghsa-malware

Oct 26, 2026
npm
@s4yhiitestpoc/scan-echo-b all versions
MAL-2026-18308 ghsa-malware

Oct 26, 2026
npm
@s4yhiitestpoc/scan-dns-c all versions
MAL-2026-18307 ghsa-malware

Oct 26, 2026
npm
@s4yhiitestpoc/scan-control-a all versions
MAL-2026-18306 ghsa-malware

Oct 26, 2026
npm
@s4yhiitestpoc/r2-https-dualuse all versions
MAL-2026-18305 ghsa-malware

Oct 26, 2026
npm
@s4yhiitestpoc/r2-echo all versions
MAL-2026-18304 ghsa-malware

Oct 26, 2026
npm
@s4yhiitestpoc/r2-dns all versions
MAL-2026-18303 ghsa-malware

Oct 26, 2026
npm
@s4yhiitestpoc/r2-control all versions
MAL-2026-18302 ghsa-malware

Oct 26, 2026
PyPI
dictmerge-lite 1.0.0
MAL-2026-18301 kam193 3 IOCs

Oct 26, 2026
npm
xzvbailss 1.0.0
MAL-2026-18702

Oct 26, 2026
npm
wxwxtt 0.0.0, 0.0.1, 0.1.0, 1.0.0, 1.0.1, 1.1.0, 2.0.0, 2.0.1, 3.0.0, 99.0.1
MAL-2026-18701

Oct 26, 2026
npm
wisewwasd 1.0.1
MAL-2026-18700

Oct 26, 2026
npm
wiselllx 0.0.1, 1.0.1
MAL-2026-18699

Oct 26, 2026
npm
wiasdcxc 1.0.1
MAL-2026-18698

Oct 26, 2026
npm
testtestkjkldfnjdfn 1.0.0
MAL-2026-18697

Oct 26, 2026
npm
solidity-map 2.21.0
MAL-2026-18696

Oct 26, 2026
npm
solidity-gas-watcher 2.21.0
MAL-2026-18695

Oct 26, 2026
npm
solidity-cat 2.0.1
MAL-2026-18694

Oct 26, 2026
npm
ruby-baileys 1.5.17, 1.5.18
MAL-2026-18693 2 IOCs

Oct 26, 2026
npm
pino-std 7.2.0
MAL-2026-18692

Oct 26, 2026
npm
ndraawzz-baileys 1.5.0
MAL-2026-18691

Oct 26, 2026
npm
lunaaa-baileys 1.1.0, 1.1.1, 9.0.22, 9.0.23
MAL-2026-18690

Oct 26, 2026
npm
loader-utils-kit 4.2.1, 4.3.5
MAL-2026-18689

Oct 26, 2026
npm
kevinx-baileys 1.2.0, 1.2.1, 1.2.2
MAL-2026-18688

Oct 26, 2026
npm
ichigokurosaki-baileys 1.0.0
MAL-2026-18687

Oct 26, 2026
npm
cs-core-api-phoenix 5.1.0
MAL-2026-18686 2 IOCs

Oct 26, 2026