Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,408 npm 223,266 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,408 reports · Feed

  • npm
    @fhkry/x-baileys 1.3.0, 1.4.0, 1.0.0, 1.7.0, 1.1.0, 1.6.0, 1.2.0, 1.5.0
    MAL-2026-10665 ghsa-malware, amazon-inspector
  • npm
    @fhkry/baileys-v2 all versions
    MAL-2026-10664 ghsa-malware
  • npm
    crypto-hasher 3.1.3, 3.1.2
    MAL-2026-10666 ghsa-malware, amazon-inspector
  • npm
    true 0.0.4, 0.0.3, 0.0.2, 0.0.1
    MAL-2026-10667 ghsa-malware
  • npm
    ssweb-wp 1.0.0
    MAL-2026-10662 ghsa-malware, amazon-inspector
  • npm
    @sauruslord/libsignal 2.0.2
    MAL-2026-10659 ghsa-malware, amazon-inspector
  • npm
    @sauruslord/eslint-config all versions
    MAL-2026-10658 ghsa-malware
  • npm
    zaldy-baileys all versions
    MAL-2026-10663 ghsa-malware
  • npm
    sauruslord-baileys 3.0.0, 3.0.1, 3.0.2
    MAL-2026-10661 ghsa-malware, amazon-inspector
  • npm
    saurus-assets all versions
    MAL-2026-10660 ghsa-malware
  • npm
    @sauruslord/baileys all versions
    MAL-2026-10657 ghsa-malware
  • npm
    @debile/require-dir 1.9.1, 1.9.2
    MAL-2026-10654 amazon-inspector
  • npm
    gmail-changer 2.0.2
    MAL-2026-10635 amazon-inspector
  • npm
    monogrok 1.0.30, 1.0.33, 1.0.7, 1.0.8, 1.0.1, 1.0.43, 1.0.31, 1.0.40, 1.0.37, 1.0.11, 1.…
    MAL-2026-10638 amazon-inspector, ghsa-malware
  • npm
    core-dotenv 1.4.1
    MAL-2026-10631 amazon-inspector, ghsa-malware
  • npm
    estore-client 5.0.0
    MAL-2026-10634 amazon-inspector
  • npm
    ogensec-sdk 1.2.1, 1.1.1
    MAL-2026-10639 amazon-inspector
  • npm
    creditgauge 1.0.0
    MAL-2026-10633 amazon-inspector
  • PyPI
    data-proxy-for-test 0.1.1
    MAL-2026-10642 amazon-inspector
  • PyPI
    ethereum-input-decorder 1.2.4, 1.2.2
    MAL-2026-10643 amazon-inspector, kam193 8 IOCs
  • npm
    webpack-session-cache 0.1.4
    MAL-2026-10653 ghsa-malware, amazon-inspector
  • npm
    polygon-toolkit-validator 1.1.2
    MAL-2026-10641 amazon-inspector, ghsa-malware
  • npm
    polygon-toolkit-validation 1.0.9, 1.1.0
    MAL-2026-10640 amazon-inspector
  • npm
    @bcs-mi-ui/test1243npmpacket76 all versions
    MAL-2026-10647 ghsa-malware
  • npm
    @bcs-mi-ui/message-block all versions
    MAL-2026-10646 ghsa-malware
  • npm
    @bcs-mi-ui/message all versions
    MAL-2026-10645 ghsa-malware
  • npm
    leviosa86-test 4.999.0
    MAL-2026-10636 amazon-inspector
  • npm
    ai-explain 0.3.4
    MAL-2026-10628 amazon-inspector
  • npm
    ai-pro-sdk 2.0.3, 2.0.1, 2.0.4, 2.0.2
    MAL-2026-10629 amazon-inspector, ghsa-malware
  • npm
    @hkyyy/portal-widget-helper-0601 1.0.0
    MAL-2026-10648 ghsa-malware, amazon-inspector
  • npm
    @saladin0x1/js-shared-modules all versions
    MAL-2026-10649 ghsa-malware
  • npm
    @leviosa86com/leviosa86-test 6.2.1, 6.0.0, 4.999.0, 5.999.0
    MAL-2026-10625 amazon-inspector, ossf-package-analysis
  • npm
    chai-as-byte 3.1.5, 3.1.6
    MAL-2026-10630 amazon-inspector
  • npm
    @sqlite-frame/nodesql 1.0.3, 1.0.2
    MAL-2026-10627 amazon-inspector, ghsa-malware
  • npm
    @react-case/option 1.0.0
    MAL-2026-10626 amazon-inspector
  • npm
    mc-reg 1.0.3, 1.0.4, 1.0.8, 1.0.6, 1.0.5, 1.0.7, 1.0.2
    MAL-2026-10637 amazon-inspector, ghsa-malware
  • PyPI
    proxy-checker-j 0.1.0
    MAL-2026-10644 amazon-inspector, kam193
  • npm
    iwsdk 22.0.0
    MAL-2026-10651 ghsa-malware, amazon-inspector
  • npm
    install-skia 1.0.0
    MAL-2026-10650 ghsa-malware, amazon-inspector
  • npm
    cppt-common 13.1.1
    MAL-2026-10632 amazon-inspector