Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,347 npm 223,209 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,347 reports · Feed

npm
aemeath-baileys 1.1.13
MAL-2026-18685

Oct 26, 2026
npm
@zyrennofficiall/baileys 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.5.0
MAL-2026-18684

Oct 26, 2026
npm
@zaxius/baileys 1.0.1
MAL-2026-18683

Oct 26, 2026
npm
@wanzforme/bails 1.0.0, 2.0.0
MAL-2026-18682

Oct 26, 2026
npm
@sakataa/baileys 1.0.0, 2.0.0, 3.0.0
MAL-2026-18681

Oct 26, 2026
npm
@raffnotdev/baileys 1.0.0
MAL-2026-18680

Oct 26, 2026
npm
@monze1239/baileys 1.0.0, 1.0.1
MAL-2026-18679

Oct 26, 2026
npm
@lekzox/baileys 0.0.1
MAL-2026-18678

Oct 26, 2026
npm
@k.vict1999/pino-std-serializers 7.2.0
MAL-2026-18677

Oct 26, 2026
npm
@dyllxnn/baileys 1.0.0
MAL-2026-18676

Oct 26, 2026
npm
@denzz221/baileys 2.0.0, 7.0.0, 8.0.5, 8.0.6, 8.0.8, 8.1.1, 8.1.2, 8.1.3, 8.1.5, 8.1.6, 8.1.7
MAL-2026-18675

Oct 26, 2026
npm
@bellaxchan/techxatz 0.1.2
MAL-2026-18674

Oct 26, 2026
npm
@bellaxchan/sixtech 1.1.5
MAL-2026-18673

Oct 26, 2026
npm
@bellaxchan/eleventech 0.0.8
MAL-2026-18672

Oct 26, 2026
npm
@bellaxchan/bailtech 1.1.0
MAL-2026-18671

Oct 26, 2026
npm
@axo_cuy/baileyss 1.0.0, 1.0.1, 3.0.1, 4.0.0
MAL-2026-18670

Oct 26, 2026
npm
@alannxds/baileys 6.2.10
MAL-2026-18669

Oct 26, 2026
npm
canta-baileys 1.1.13
MAL-2026-18632 ghsa-malware 1 IOC

Oct 26, 2026
npm
birch-css-utils 1.3.0, 1.2.2, 1.1.0, 1.0.0, 0.0.0-stage
MAL-2026-18331 ghsa-malware, amazon-inspector

Oct 26, 2026
PyPI
claudeopuseni 0.1.0, 0.1.1
MAL-2026-18299 kam193, amazon-inspector 7 IOCs

Oct 25, 2026
PyPI
claudeopusenifile 0.1.3
MAL-2026-18300 kam193 7 IOCs

Oct 25, 2026
PyPI
claudeopusfile 0.1.1, 0.1.2
MAL-2026-18298 kam193, amazon-inspector 7 IOCs

Oct 25, 2026
PyPI
nebulallm 1.4.3
MAL-2026-18297 kam193, amazon-inspector 4 IOCs

Oct 25, 2026
PyPI
zagents-message-bus 1.0.5, 1.0.10, 99.99.99, 99.99.100
MAL-2026-18296 kam193, amazon-inspector

Oct 25, 2026
npm
@capsense/ccx-welcome-page 99.99.100, 99.99.99, 0.0.0-stage
MAL-2026-18294 ossf-package-analysis, amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
npm
@capsense/core-ui 99.99.100, 99.99.99, 0.0.0-stage
MAL-2026-18295 ossf-package-analysis, amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
npm
event-bus-lite-testmetest 0.0.6
MAL-2026-18292 amazon-inspector

Oct 25, 2026
npm
w-mousekey 1.0.42, 1.0.41
MAL-2026-18293 ghsa-malware, amazon-inspector

Oct 25, 2026
npm
jshelperdependenceny 99.0.0, 1.0.0, 0.0.0-stage
MAL-2026-18288 amazon-inspector, ghsa-malware

Oct 25, 2026
npm
@fmr-ap153177/apex-kit-icons 99.9.1
MAL-2026-18279 amazon-inspector, ghsa-malware

Oct 25, 2026
npm
@generic-means/ing-feat-scanner-libs 99.9.1
MAL-2026-18281 amazon-inspector, ghsa-malware

Oct 25, 2026
npm
@factoryz/apollo 99.9.1
MAL-2026-18278 amazon-inspector, ghsa-malware

Oct 25, 2026
npm
@jm-telefonica/multibrand-components 99.9.1
MAL-2026-18284 amazon-inspector, ghsa-malware

Oct 25, 2026
npm
@postex/common 99.9.1
MAL-2026-18285 amazon-inspector, ghsa-malware

Oct 25, 2026
npm
sc-hydrate-carousel-price 99.9.1, 0.0.0-stage
MAL-2026-18291 amazon-inspector, ghsa-malware

Oct 25, 2026
npm
@futurae-public/adaptive-js 99.9.1
MAL-2026-18280 amazon-inspector, ghsa-malware

Oct 25, 2026
npm
paychex-pdftron 99.9.1, 0.0.0-stage
MAL-2026-18289 amazon-inspector, ghsa-malware

Oct 25, 2026
npm
@ppa-web-components/ppa-headerfooter 1.0.1, 2.0.1, 1.1.0, 99.0.1, 2.0.0, 3.0.0, 1.0.0, 0.0.0-stage, 0.1.0
MAL-2026-18274 amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
npm
@ppa-web-components/ppa-hotel-collection 99.0.1, 1.1.0, 3.0.0, 1.0.0, 2.0.1, 0.0.0-stage, 0.1.0
MAL-2026-18275 amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
npm
@ppa-web-components/ppa-banner 2.0.0, 2.0.1, 1.0.0, 1.0.1, 0.0.1, 1.1.0, 3.0.0, 0.0.0-stage, 0.1.0
MAL-2026-18272 amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026