Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,347 npm 223,209 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,347 reports · Feed

  • PyPI
    sitecard 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.1.10, 0.1.11, 0.1.12,…
    MAL-2026-18242 kam193, amazon-inspector
  • PyPI
    jobwharf 0.1.0
    MAL-2026-18228 kam193, amazon-inspector
  • PyPI
    slatejob 0.1.0
    MAL-2026-18237 kam193, amazon-inspector
  • PyPI
    reedworker 0.1.0
    MAL-2026-18234 kam193, amazon-inspector
  • PyPI
    loadferry 0.1.0
    MAL-2026-18231 kam193, amazon-inspector
  • PyPI
    runpier 0.1.0
    MAL-2026-18235 kam193, amazon-inspector
  • PyPI
    sedgehaul 0.1.0
    MAL-2026-18236 kam193, amazon-inspector
  • PyPI
    taskquay 0.1.0
    MAL-2026-18238 kam193, amazon-inspector
  • PyPI
    marshrunner 0.1.0
    MAL-2026-18232 kam193, amazon-inspector
  • PyPI
    workslip 0.1.0
    MAL-2026-18241 kam193, amazon-inspector
  • PyPI
    brookworker 0.1.0
    MAL-2026-18224 kam193, amazon-inspector
  • PyPI
    cobbleload 0.1.0
    MAL-2026-18225 kam193, amazon-inspector
  • PyPI
    brambletask 0.1.0
    MAL-2026-18223 kam193, amazon-inspector
  • PyPI
    ferretqueue 0.1.0
    MAL-2026-18226 kam193, amazon-inspector
  • PyPI
    otterload 0.1.0
    MAL-2026-18233 kam193, amazon-inspector
  • PyPI
    badgertask 0.1.0
    MAL-2026-18222 kam193, amazon-inspector
  • PyPI
    larchworker 0.1.0
    MAL-2026-18230 kam193
  • PyPI
    thornqueue 0.1.0
    MAL-2026-18240 kam193
  • PyPI
    thistlerun 0.1.0
    MAL-2026-18239 kam193
  • PyPI
    juniperrun 0.1.0
    MAL-2026-18229 kam193, amazon-inspector
  • PyPI
    flintqueue 0.1.0
    MAL-2026-18227 kam193, amazon-inspector
  • PyPI
    kestreljob 0.1.0
    MAL-2026-18221 kam193
  • npm
    skillward 0.1.1, 0.1.2
    MAL-2026-18220 ghsa-malware, amazon-inspector
  • PyPI
    onsokets 0.1.0
    MAL-2026-18219 kam193, amazon-inspector
  • PyPI
    qowa 0.1.0
    MAL-2026-18218 kam193, amazon-inspector
  • npm
    @grabcad/user-license 1.1.0, 1.0.0, 2.0.1, 2.0.0, 3.0.0, 0.0.1, 1.0.1
    MAL-2026-18217 ghsa-malware, amazon-inspector
  • npm
    @grabcad/preferences-client 0.0.1, 3.0.0, 2.0.0, 1.1.0, 1.0.0
    MAL-2026-18216 ghsa-malware, amazon-inspector
  • npm
    @grabcad/grabcad-shop-shared 1.0.1, 2.0.1, 2.0.0, 3.0.0, 1.0.0, 99.0.1, 1.1.0
    MAL-2026-18215 ghsa-malware, amazon-inspector
  • npm
    @grabcad/company-server-shared 1.0.0, 1.1.0, 2.0.1, 99.0.1, 3.0.0, 2.0.0, 0.0.1, 1.0.1
    MAL-2026-18214 ghsa-malware, amazon-inspector
  • npm
    @cecm-web-sdk/core 99.0.1, 3.0.0, 1.1.0, 1.0.1
    MAL-2026-18213 ghsa-malware, amazon-inspector
  • npm
    @blueskydataplatform/shared-ui 99.0.3, 99.0.2, 0.0.1, 1.0.1, 1.0.0, 2.0.0, 2.0.1, 0.1.0
    MAL-2026-18212 ghsa-malware, amazon-inspector
  • npm
    @ecg-internal/js-react-i18n 2.0.0, 1.1.0, 1.0.1, 1.0.0, 99.0.1
    MAL-2026-18209 amazon-inspector, ghsa-malware
  • npm
    @ecg-internal/aurora-js-formatters 99.0.1, 2.0.0, 1.0.0, 2.0.1, 3.0.0
    MAL-2026-18207 amazon-inspector, ghsa-malware
  • npm
    @ecg-internal/media-util-js-lib 0.0.1, 99.0.1, 2.0.0, 3.0.0, 1.0.1, 1.1.0, 2.0.1
    MAL-2026-18210 amazon-inspector, ghsa-malware
  • npm
    @ecg-internal/favourites-ui 99.0.1, 1.1.0, 0.0.1, 3.0.0, 2.0.1, 1.0.0, 2.0.0
    MAL-2026-18208 amazon-inspector, ghsa-malware
  • npm
    @ecg-internal/adobe-dmp-js 99.0.1, 2.0.0, 1.0.1, 2.0.1, 0.0.1
    MAL-2026-18206 amazon-inspector, ghsa-malware
  • npm
    @ecg-internal/reviews-dialog-ui 99.0.1, 1.0.1, 3.0.0, 0.0.1, 2.0.1, 1.0.0, 2.0.0
    MAL-2026-18211 amazon-inspector, ghsa-malware
  • npm
    @tekmidian/pai 1.0.9, 1.0.8, 1.0.10
    MAL-2026-18205 ghsa-malware, amazon-inspector
  • npm
    react-native-bright-sdk 9000.0.0
    MAL-2026-18290 amazon-inspector 2 IOCs
  • PyPI
    journey-teste-shellhello 0.2.0
    MAL-2026-18203 kam193 2 IOCs