Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,432 npm 223,271 PyPI 12,012 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,432 reports · Feed

  • npm
    nottuff21 1.1.7, 2.0.0, 1.7.7
    MAL-2026-10348 ghsa-malware, amazon-inspector
  • npm
    nottuff20 1.7.7, 1.1.7, 2.0.0
    MAL-2026-10347 ghsa-malware, amazon-inspector
  • npm
    nottuff2 1.1.7, 2.0.0, 1.7.7
    MAL-2026-10346 ghsa-malware, amazon-inspector
  • npm
    nottuff19 1.7.7, 2.0.0, 1.1.7
    MAL-2026-10345 ghsa-malware, amazon-inspector
  • npm
    nottuff18 2.0.0, 1.1.7, 1.7.7
    MAL-2026-10344 ghsa-malware, amazon-inspector
  • npm
    nottuff17 2.0.0, 1.7.7, 1.1.7
    MAL-2026-10343 ghsa-malware, amazon-inspector
  • npm
    nottuff16 1.1.7, 2.0.0, 1.7.7
    MAL-2026-10342 ghsa-malware, amazon-inspector
  • npm
    nottuff14 1.1.7, 2.0.0, 1.7.7
    MAL-2026-10341 ghsa-malware, amazon-inspector
  • npm
    nottuff13 1.7.7, 2.0.0, 1.1.7
    MAL-2026-10340 ghsa-malware, amazon-inspector
  • npm
    nottuff12 1.7.7, 2.0.0, 1.1.7
    MAL-2026-10339 ghsa-malware, amazon-inspector
  • npm
    nottuff11 1.7.7, 1.1.7, 2.0.0
    MAL-2026-10338 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    nottuff10 1.1.7, 2.0.0, 1.7.7
    MAL-2026-10337 ghsa-malware, amazon-inspector
  • npm
    nottuff1 2.0.0, 1.1.7, 1.7.7
    MAL-2026-10336 ghsa-malware, amazon-inspector
  • npm
    ishowfeet20 1.7.7, 2.0.0, 1.1.7
    MAL-2026-10323 ghsa-malware, amazon-inspector
  • npm
    ishowfeet19 2.0.0, 1.7.7, 1.1.7
    MAL-2026-10321 ghsa-malware, amazon-inspector
  • npm
    ishowfeet18 2.0.0, 1.7.7, 1.1.7
    MAL-2026-10320 ghsa-malware, amazon-inspector
  • npm
    ishowfeet17 2.0.0, 1.7.7, 1.1.7
    MAL-2026-10319 ghsa-malware, amazon-inspector
  • npm
    ishowfeet15 1.1.7, 2.0.0, 1.7.7
    MAL-2026-10317 ghsa-malware, amazon-inspector
  • npm
    ishowfeet14 1.7.7, 1.1.7, 2.0.0
    MAL-2026-10316 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    ishowfeet13 2.0.0, 1.7.7, 1.1.7
    MAL-2026-10315 ghsa-malware, amazon-inspector
  • npm
    abuden5 2.0.0, 1.7.7, 1.1.7
    MAL-2026-10281 ghsa-malware, amazon-inspector
  • npm
    abuden4 1.7.7, 2.0.0, 1.1.7
    MAL-2026-10280 ghsa-malware, amazon-inspector
  • npm
    abuden3 1.1.7, 2.0.0, 1.7.7
    MAL-2026-10279 ghsa-malware, amazon-inspector
  • npm
    abuden29 1.1.7, 1.7.7, 2.0.0
    MAL-2026-10278 ghsa-malware, amazon-inspector
  • npm
    abuden27 1.7.7, 1.1.7, 2.0.0
    MAL-2026-10276 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    abuden26 1.7.7, 2.0.0, 1.1.7
    MAL-2026-10275 ghsa-malware, amazon-inspector
  • npm
    abuden25 2.0.0, 1.7.7, 1.1.7
    MAL-2026-10274 ghsa-malware, amazon-inspector
  • npm
    abuden24 1.7.7, 1.1.7, 2.0.0
    MAL-2026-10273 ghsa-malware, amazon-inspector
  • npm
    abuden23 1.1.7, 2.0.0, 1.7.7
    MAL-2026-10271 ghsa-malware, amazon-inspector
  • npm
    abuden2 2.0.0, 1.1.7, 1.7.7
    MAL-2026-10252 ghsa-malware, amazon-inspector
  • npm
    abuden1 1.7.7, 2.0.0, 1.1.7
    MAL-2026-10251 ghsa-malware, amazon-inspector
  • npm
    timmytuffknuckles9 1.1.7, 2.0.0
    MAL-2026-10390 ghsa-malware, amazon-inspector
  • npm
    timmytuffknuckles6 1.1.7, 2.0.0
    MAL-2026-10389 ghsa-malware, amazon-inspector
  • npm
    timmytuffknuckles3 1.1.7, 2.0.0
    MAL-2026-10388 ghsa-malware, amazon-inspector
  • npm
    speed5 1.1.7, 2.0.0
    MAL-2026-10385 ghsa-malware, amazon-inspector
  • npm
    speed3 1.1.7, 2.0.0
    MAL-2026-10384 ghsa-malware, amazon-inspector
  • npm
    speed2 2.0.0, 1.1.7
    MAL-2026-10383 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    speed1 2.0.0, 1.1.7
    MAL-2026-10382 ghsa-malware, amazon-inspector
  • npm
    sixseven6 1.7.7, 2.0.0, 1.1.7
    MAL-2026-10378 ghsa-malware, amazon-inspector
  • npm
    sixseven5 1.7.7, 2.0.0, 1.1.7
    MAL-2026-10377 ghsa-malware, amazon-inspector