Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,432 npm 223,271 PyPI 12,012 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,432 reports · Feed

  • npm
    sixseven4 1.7.7, 2.0.0, 1.1.7
    MAL-2026-10376 ghsa-malware, amazon-inspector
  • npm
    sixseven3 1.7.7, 1.1.7, 2.0.0
    MAL-2026-10375 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    sixseven2 1.1.7, 1.7.7, 2.0.0
    MAL-2026-10374 ghsa-malware, amazon-inspector
  • npm
    sixseven1 2.0.0, 1.1.7, 1.7.7
    MAL-2026-10372 ghsa-malware, amazon-inspector
  • npm
    ratelimitsucks9 2.0.0, 1.1.7
    MAL-2026-10371 ghsa-malware, amazon-inspector
  • npm
    ratelimitsucks5 2.0.0, 1.7.7, 1.1.7
    MAL-2026-10370 ghsa-malware, amazon-inspector
  • npm
    ratelimitsucks4 1.1.6, 2.0.0, 1.1.7
    MAL-2026-10369 ghsa-malware, amazon-inspector
  • npm
    ratelimitsucks3 1.1.7, 2.0.0, 1.1.5
    MAL-2026-10368 ghsa-malware, amazon-inspector
  • npm
    ratelimitsucks2 1.1.7, 2.0.0, 1.1.4, 1.7.7
    MAL-2026-10367 ghsa-malware, amazon-inspector
  • npm
    ratelimitsucks10 2.0.0, 1.1.7, 1.7.7
    MAL-2026-10366 ghsa-malware, amazon-inspector
  • npm
    ratelimitsucks1 1.1.7, 2.0.0, 1.1.3
    MAL-2026-10365 ghsa-malware, amazon-inspector
  • npm
    miguelphonk 2.0.0, 1.1.2
    MAL-2026-10335 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    ishowfeet9 2.0.0, 1.7.7, 1.1.7
    MAL-2026-10330 ghsa-malware, amazon-inspector
  • npm
    ishowfeet8 1.1.7, 2.0.0, 1.7.7
    MAL-2026-10329 ghsa-malware, amazon-inspector
  • npm
    ishowfeet7 1.1.7, 1.7.7, 2.0.0
    MAL-2026-10328 ghsa-malware, amazon-inspector
  • npm
    ishowfeet6 1.1.7, 1.7.7, 2.0.0
    MAL-2026-10327 ghsa-malware, amazon-inspector
  • npm
    ishowfeet5 2.0.0, 1.7.7, 1.1.7
    MAL-2026-10326 ghsa-malware, amazon-inspector
  • npm
    ishowfeet4 1.1.7, 2.0.0, 1.7.7
    MAL-2026-10325 ghsa-malware, amazon-inspector
  • npm
    ishowfeet3 1.7.7, 2.0.0, 1.1.7
    MAL-2026-10324 ghsa-malware, amazon-inspector
  • npm
    ishowfeet2 2.0.0, 1.7.7, 1.1.7
    MAL-2026-10322 ghsa-malware, amazon-inspector
  • npm
    ishowfeet16 1.1.7, 1.7.7, 2.0.0
    MAL-2026-10318 ghsa-malware, amazon-inspector
  • npm
    ishowfeet12 1.1.7, 2.0.0, 1.7.7
    MAL-2026-10314 ghsa-malware, amazon-inspector
  • npm
    ishowfeet11 2.0.0, 1.1.7, 1.7.7
    MAL-2026-10313 ghsa-malware, amazon-inspector
  • npm
    ishowfeet10 1.7.7, 2.0.0, 1.1.7
    MAL-2026-10312 ghsa-malware, amazon-inspector
  • npm
    ishowfeet1 1.7.7, 1.1.7, 2.0.0
    MAL-2026-10311 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    imillegal5 1.7.7, 1.1.7, 2.0.0
    MAL-2026-10310 ghsa-malware, amazon-inspector
  • npm
    imillegal4 1.1.7, 1.7.7, 2.0.0
    MAL-2026-10309 ghsa-malware, amazon-inspector
  • npm
    imillegal3 2.0.0, 1.1.7, 1.7.7
    MAL-2026-10308 ghsa-malware, amazon-inspector
  • npm
    imillegal2 1.1.7, 1.7.7, 2.0.0
    MAL-2026-10307 ghsa-malware, amazon-inspector
  • npm
    imillegal1 1.7.7, 1.1.7, 2.0.0
    MAL-2026-10306 ghsa-malware, amazon-inspector
  • npm
    howmanygreatbritain 2.0.0, 1.1.2
    MAL-2026-10304 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    bismillahitidakimas 2.0.0, 1.1.2
    MAL-2026-10295 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    backupsitetuff9 2.0.0, 1.1.7
    MAL-2026-10294 ghsa-malware, amazon-inspector
  • npm
    backupsitetuff6 1.1.7, 2.0.0
    MAL-2026-10293 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    backupsitetuff3 2.0.0, 1.1.7
    MAL-2026-10292 ghsa-malware, amazon-inspector
  • npm
    backupsitetuff10 1.1.7, 2.0.0
    MAL-2026-10291 ghsa-malware, amazon-inspector
  • npm
    whatsadmaidk 2.0.0, 1.1.2
    MAL-2026-10396 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    thebigyahu 2.0.0, 1.1.2
    MAL-2026-10387 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    pasirianspirit 2.0.0
    MAL-2026-10364 ghsa-malware, amazon-inspector
  • npm
    omgyesyesyes 2.0.0, 1.1.2
    MAL-2026-10362 ghsa-malware, amazon-inspector, reversing-labs