Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,431 npm 223,271 PyPI 12,011 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,431 reports · Feed

  • npm
    another-poc-by-tipsen 1.0.0
    MAL-2026-10283 ghsa-malware, amazon-inspector
  • npm
    testdonotredeemit 1.0.0, 2.0.0, 2.1.1
    MAL-2026-10386 ghsa-malware, amazon-inspector
  • npm
    sixseven9 1.7.7
    MAL-2026-10381 ghsa-malware, amazon-inspector
  • npm
    sixseven8 1.7.7
    MAL-2026-10380 ghsa-malware, amazon-inspector
  • npm
    sixseven7 1.7.7
    MAL-2026-10379 ghsa-malware, amazon-inspector
  • npm
    sixseven10 1.7.7
    MAL-2026-10373 ghsa-malware, amazon-inspector
  • npm
    acidic 2.0.0
    MAL-2026-10282 ghsa-malware, amazon-inspector
  • npm
    abuden28 1.1.7, 1.7.7, 2.0.0
    MAL-2026-10277 ghsa-malware, amazon-inspector
  • npm
    abuden230 1.7.7, 1.1.7, 2.0.0
    MAL-2026-10272 ghsa-malware, amazon-inspector
  • npm
    abuden229 1.1.7, 2.0.0, 1.7.7
    MAL-2026-10270 ghsa-malware, amazon-inspector
  • npm
    abuden228 1.1.7, 2.0.0, 1.7.7
    MAL-2026-10269 ghsa-malware, amazon-inspector
  • npm
    abuden227 1.1.7, 1.7.7, 2.0.0
    MAL-2026-10268 ghsa-malware, amazon-inspector
  • npm
    abuden226 1.7.7, 1.1.7, 2.0.0
    MAL-2026-10267 ghsa-malware, amazon-inspector
  • npm
    abuden225 1.1.7, 2.0.0, 1.7.7
    MAL-2026-10266 ghsa-malware, amazon-inspector
  • npm
    abuden224 1.7.7, 1.1.7, 2.0.0
    MAL-2026-10265 ghsa-malware, amazon-inspector
  • npm
    abuden223 1.7.7, 2.0.0, 1.1.7
    MAL-2026-10264 ghsa-malware, amazon-inspector
  • npm
    abuden222 2.0.0, 1.1.7, 1.7.7
    MAL-2026-10263 ghsa-malware, amazon-inspector
  • npm
    abuden220 2.0.0, 1.7.7, 1.1.7
    MAL-2026-10262 ghsa-malware, amazon-inspector
  • npm
    abuden219 2.0.0, 1.1.7, 1.7.7
    MAL-2026-10261 ghsa-malware, amazon-inspector
  • npm
    abuden217 1.7.7, 2.0.0, 1.1.7
    MAL-2026-10260 ghsa-malware, amazon-inspector
  • npm
    abuden216 1.7.7, 2.0.0, 1.1.7
    MAL-2026-10259 ghsa-malware, amazon-inspector
  • npm
    abuden215 1.1.7, 1.7.7, 2.0.0
    MAL-2026-10258 ghsa-malware, amazon-inspector
  • npm
    abuden214 1.7.7, 1.1.7, 2.0.0
    MAL-2026-10257 ghsa-malware, amazon-inspector
  • npm
    abuden213 1.7.7, 2.0.0, 1.1.7
    MAL-2026-10256 ghsa-malware, amazon-inspector
  • npm
    abuden212 2.0.0, 1.1.7, 1.7.7
    MAL-2026-10255 ghsa-malware, amazon-inspector
  • npm
    abuden211 2.0.0, 1.1.7, 1.7.7
    MAL-2026-10254 ghsa-malware, amazon-inspector
  • npm
    abuden210 2.0.0, 1.1.7, 1.7.7
    MAL-2026-10253 ghsa-malware, amazon-inspector
  • npm
    nottuff9 2.0.0, 1.7.7, 1.1.7
    MAL-2026-10360 ghsa-malware, amazon-inspector
  • npm
    nottuff8 1.1.7, 2.0.0, 1.7.7
    MAL-2026-10359 ghsa-malware, amazon-inspector
  • npm
    nottuff6 1.7.7, 2.0.0, 1.1.7
    MAL-2026-10358 ghsa-malware, amazon-inspector
  • npm
    nottuff5 1.1.7, 1.7.7, 2.0.0
    MAL-2026-10357 ghsa-malware, amazon-inspector
  • npm
    nottuff30 1.1.7, 1.7.7, 2.0.0
    MAL-2026-10356 ghsa-malware, amazon-inspector
  • npm
    nottuff3 2.0.0, 1.7.7, 1.1.7
    MAL-2026-10355 ghsa-malware, amazon-inspector
  • npm
    nottuff29 1.7.7, 1.1.7, 2.0.0
    MAL-2026-10354 ghsa-malware, amazon-inspector
  • npm
    nottuff28 1.1.7, 2.0.0, 1.7.7
    MAL-2026-10353 ghsa-malware, amazon-inspector
  • npm
    nottuff27 1.1.7, 1.7.7
    MAL-2026-10352 ghsa-malware, amazon-inspector
  • npm
    nottuff26 2.0.0, 1.7.7, 1.1.7
    MAL-2026-10351 ghsa-malware, amazon-inspector
  • npm
    nottuff24 2.0.0, 1.1.7, 1.7.7
    MAL-2026-10350 ghsa-malware, amazon-inspector
  • npm
    nottuff22 1.7.7, 1.1.7, 2.0.0
    MAL-2026-10349 ghsa-malware, amazon-inspector
  • npm
    nottuff21 1.1.7, 2.0.0, 1.7.7
    MAL-2026-10348 ghsa-malware, amazon-inspector