Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,458 npm 223,292 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,458 reports · Feed

  • PyPI
    turbom 1.0.0, 1.0.1
    MAL-2026-7015 kam193
  • npm
    luludawang-kit 0.0.1
    MAL-2026-6999 amazon-inspector, ghsa-malware
  • npm
    ec-checker 0.0.1
    MAL-2026-6996 amazon-inspector
  • npm
    chai-redirection 0.0.1, 0.0.4, 0.0.3
    MAL-2026-6995 amazon-inspector, ghsa-malware
  • npm
    chai-presentation 0.0.1, 0.0.2, 0.0.4, 0.0.3
    MAL-2026-6994 amazon-inspector
  • npm
    airkey-mfa-react 36.1.1, 20.0.1, 35.1.1, 29.1.1
    MAL-2026-6991 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    pipo-sdk 9999.0.0
    MAL-2026-7000 amazon-inspector
  • npm
    goofy-sdk 9999.0.0
    MAL-2026-6997 amazon-inspector
  • npm
    @luminarycloudinternal/lcvis-st 9999.0.1, 9999.0.2, 9999.0.3
    MAL-2026-6987 amazon-inspector, ghsa-malware
  • npm
    bytefaas-sdk 9999.0.0
    MAL-2026-6993 amazon-inspector
  • npm
    searchresults 999.0.0
    MAL-2026-7003 amazon-inspector, ghsa-malware
  • npm
    thunder-rony 99.9.9
    MAL-2026-7004 amazon-inspector
  • npm
    ronyfortest 99.9.9
    MAL-2026-7002 amazon-inspector
  • npm
    rony-test 99.9.9
    MAL-2026-7001 amazon-inspector
  • npm
    higherlogic-ocfe 99.9.1
    MAL-2026-6998 amazon-inspector, ghsa-malware
  • npm
    babel-eslint-parser-legacy 99.9.1
    MAL-2026-6992 amazon-inspector, ghsa-malware
  • npm
    ag-charts-test 99.9.1
    MAL-2026-6989 amazon-inspector, ghsa-malware
  • npm
    visa-cli-tools 99.9.1
    MAL-2026-7005 amazon-inspector, ghsa-malware
  • npm
    ai-gen-ai-opt-in 99.0.0
    MAL-2026-6990 amazon-inspector
  • npm
    @luminarycloudinternal/frodo 9999.0.1, 9999.0.2, 9999.0.3
    MAL-2026-6986 amazon-inspector, ghsa-malware
  • npm
    promo-helper 1.0.4, 1.0.7, 1.0.0, 1.0.6, 1.0.5, 1.0.8, 1.0.3, 1.0.14
    MAL-2026-6985 ghsa-malware, amazon-inspector
  • PyPI
    manom 1.2.2
    MAL-2026-7007 kam193
  • PyPI
    manik 1.2.1
    MAL-2026-7006 kam193
  • PyPI
    tronpak 0.0.1
    MAL-2026-6983 kam193 4 IOCs
  • npm
    @vite-ln/build-ts 5.15.10, 5.17.0
    MAL-2026-6984 ghsa-malware, amazon-inspector
  • npm
    paysafe-cards 1.0.0
    MAL-2026-6982 amazon-inspector
  • npm
    domains-billing-types 99.91.1
    MAL-2026-6980 ossf-package-analysis, amazon-inspector
  • PyPI
    manin 0.0.1, 0.1.0, 0.1.1
    MAL-2026-6978 kam193
  • PyPI
    turbod 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7
    MAL-2026-6979 kam193
  • PyPI
    py-slugify 0.8.2
    MAL-2026-6976 kam193 3 IOCs
  • PyPI
    rarcore 0.1.1, 0.1.2
    MAL-2026-6977 kam193 3 IOCs
  • PyPI
    oxntime 0.0.1, 0.0.1.post1, 0.0.2, 0.0.3
    MAL-2026-6975 kam193
  • npm
    @vwfs-its/sf-sac-frontend 20.1.1
    MAL-2026-6972 ossf-package-analysis, amazon-inspector
  • npm
    dependency_confusions 99.9.9
    MAL-2026-10085 amazon-inspector 2 IOCs
  • PyPI
    tronhapy 0.0.1
    MAL-2026-6974 kam193 4 IOCs
  • npm
    gitlens 9.4.0, 9.4.1
    MAL-2026-6973 ossf-package-analysis, ghsa-malware, amazon-inspector
  • PyPI
    jsonschemavalid 4.26.0
    MAL-2026-6970 kam193
  • PyPI
    tronhap 0.0.1
    MAL-2026-6971 kam193 4 IOCs
  • npm
    rony-testing 99.9.9
    MAL-2026-6968 ghsa-malware, amazon-inspector
  • npm
    nam-os-a-man 99.9.9
    MAL-2026-6967 ghsa-malware, amazon-inspector