Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,408 npm 223,266 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,408 reports · Feed

  • npm
    @hibachi-xyz/ui 99.0.0
    MAL-2026-10716 amazon-inspector, ossf-package-analysis
  • npm
    @hibachi-xyz/sdk 99.0.0
    MAL-2026-10714 amazon-inspector, ossf-package-analysis
  • npm
    loader1 2.1.7, 2.1.3, 2.1.6, 2.1.2, 2.1.5, 2.1.4
    MAL-2026-10696 ghsa-malware, amazon-inspector
  • npm
    ai-p2p 1.0.2, 1.0.0, 1.0.3, 1.0.1, 1.0.4
    MAL-2026-10695 ghsa-malware, amazon-inspector
  • npm
    websight2-p2p 1.0.1, 1.0.0, 1.0.3, 1.0.2, 1.0.4
    MAL-2026-10698 ghsa-malware, amazon-inspector
  • npm
    websight-p2p 1.0.1, 1.0.2, 1.0.0, 1.0.5, 1.0.3, 1.0.6, 1.0.4
    MAL-2026-10697 ghsa-malware, amazon-inspector
  • npm
    vor8zakon 1.0.0
    MAL-2026-10694 ghsa-malware, amazon-inspector
  • npm
    nordpass 1.0.0, 1.0.2, 1.0.4
    MAL-2026-10743 amazon-inspector, ossf-package-analysis
  • npm
    nyt-cms all versions
    MAL-2026-10692 ghsa-malware
  • npm
    syft-acp-util 17.0.0, 1.0.0
    MAL-2026-10767 amazon-inspector
  • npm
    syft-acp-uikit 1.9.45, 1.0.0
    MAL-2026-10766 amazon-inspector
  • npm
    syft-acp-core 16.0.0, 1.0.0
    MAL-2026-10765 amazon-inspector
  • npm
    syft-acp-atoms 14.8.68, 1.0.0
    MAL-2026-10764 amazon-inspector
  • npm
    @edgecommons/streamlog-node all versions
    MAL-2026-10763
  • npm
    @edgecommons/edgecommons all versions
    MAL-2026-10762
  • npm
    @across-toolkit/typescript-config 99.0.0, 99.0.1
    MAL-2026-10704 amazon-inspector 1 IOC
  • npm
    internallib_v907 1.0.3
    MAL-2026-10691 ghsa-malware, amazon-inspector
  • npm
    selparsecss-selector 1.1.0, 2.0.0, 1.0.0, 2.1.0
    MAL-2026-10687 amazon-inspector, ghsa-malware
  • PyPI
    qwen-asr-pvt 0.0.6
    MAL-2026-10690 amazon-inspector
  • PyPI
    pylogora 0.7.8
    MAL-2026-10689 kam193, amazon-inspector 13 IOCs
  • PyPI
    log-guru 0.7.8
    MAL-2026-10688 kam193 13 IOCs
  • npm
    @ddh-libraries/analytics 99.0.0
    MAL-2026-10686 ossf-package-analysis
  • npm
    react-hook-scripts 5.4.2
    MAL-2026-10684 amazon-inspector
  • npm
    code-formatter-setup 1.0.0
    MAL-2026-10682 amazon-inspector, ghsa-malware
  • npm
    formatters.ts 14.2.1
    MAL-2026-10683 amazon-inspector
  • PyPI
    trongridweb 0.0.1
    MAL-2026-10685 kam193 4 IOCs
  • PyPI
    xyq-drama-skill 0.1.0, 0.2.0, 0.3.0
    MAL-2026-10681 kam193, amazon-inspector, reversing-labs 4 IOCs
  • npm
    rakibox 2.0.0
    MAL-2026-10679 amazon-inspector
  • npm
    ls-env-config 1.0.5
    MAL-2026-10678 amazon-inspector
  • npm
    deployowl 2.1.0
    MAL-2026-10677 amazon-inspector
  • npm
    syncgrove 1.4.0
    MAL-2026-10680 amazon-inspector
  • npm
    commonjs-assert 1.0.3, 1.0.4
    MAL-2026-10676 amazon-inspector, ghsa-malware
  • npm
    ac-raf-emitter 3.0.1
    MAL-2026-10675 amazon-inspector
  • PyPI
    northstart-sdk 0.1.0, 0.2.0, 0.2.1, 0.2.2
    MAL-2026-10672 kam193, amazon-inspector 3 IOCs
  • npm
    gulp-jscrambler 8.6.2
    MAL-2026-10673 ghsa-malware, amazon-inspector
  • npm
    jscrambler-metro-plugin 9.0.2
    MAL-2026-10674 ghsa-malware, amazon-inspector
  • npm
    chain-as-log 3.0.1
    MAL-2026-10668 amazon-inspector
  • npm
    spytrack 1.1.0
    MAL-2026-10671 amazon-inspector
  • npm
    dbconnectify 1.0.1, 1.0.2
    MAL-2026-10669 amazon-inspector, ghsa-malware
  • npm
    eslintcmd 0.2.0, 0.1.0
    MAL-2026-10670 amazon-inspector, ghsa-malware