Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,458 npm 223,292 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,458 reports · Feed

  • npm
    na-rony-test-karem all versions
    MAL-2026-6966 ghsa-malware
  • npm
    na-rony-test all versions
    MAL-2026-6965 ghsa-malware
  • npm
    na-rony 1.1.2, 1.1.4, 1.1.5, 1.1.3
    MAL-2026-6964 ghsa-malware, amazon-inspector
  • npm
    karem-dp all versions
    MAL-2026-6963 ghsa-malware
  • npm
    vite-json-pwa 1.1.2, 1.1.1
    MAL-2026-6969 ghsa-malware, amazon-inspector
  • npm
    gas-log 1.1.0, 1.1.1
    MAL-2026-6962 ghsa-malware, amazon-inspector
  • PyPI
    pyqt6darktheme 0.1.0
    MAL-2026-6960 kam193 4 IOCs
  • PyPI
    waymo-waymax 99.0.0
    MAL-2026-6961 kam193
  • crates.io
    proton-pfff 99.99.5
    MAL-2026-6959 ossf-package-analysis
  • npm
    nodemon-node all versions
    MAL-2026-6957 ghsa-malware
  • npm
    ts-await all versions
    MAL-2026-6958 ghsa-malware
  • npm
    rio-design-tokens 99.99.100, 99.99.99
    MAL-2026-6956 ossf-package-analysis, ghsa-malware, amazon-inspector
  • npm
    hello244b 1.0.0
    MAL-2026-6955 ossf-package-analysis
  • npm
    whs4_npm_test 1.0.1, 1.0.0, 1.0.3, 1.0.2
    MAL-2026-6952 ghsa-malware, amazon-inspector
  • npm
    @whs4/whs4_npm all versions
    MAL-2026-6946 ghsa-malware
  • npm
    wsh4_npm 1.0.0
    MAL-2026-6954 ghsa-malware, amazon-inspector
  • npm
    whs4_pnm 1.0.0
    MAL-2026-6953 ghsa-malware, amazon-inspector
  • npm
    whs4_npm 1.0.0
    MAL-2026-6951 ghsa-malware, amazon-inspector
  • npm
    whs4_nmp 1.0.0, 1.0.1
    MAL-2026-6950 ghsa-malware, amazon-inspector
  • npm
    runtimedev-link 1.0.13, 1.0.12, 1.0.14, 1.0.2, 1.0.11, 1.0.10, 1.0.8, 1.0.3, 1.0.5, 1.0.1, 1.0.…
    MAL-2026-6948 ghsa-malware, amazon-inspector
  • npm
    polytrade 2.4.1
    MAL-2026-6939 ghsa-malware, amazon-inspector
  • npm
    evm-typechain 0.5.4
    MAL-2026-6932 ghsa-malware, amazon-inspector
  • npm
    nuxt-fonts-devtools 99.0.3
    MAL-2026-6937 ghsa-malware, amazon-inspector
  • npm
    load-nuxt-dev 99.0.3
    MAL-2026-6935 ghsa-malware, amazon-inspector
  • npm
    load-nuxt 99.0.3
    MAL-2026-6934 ghsa-malware, amazon-inspector
  • npm
    some-theme 99.0.3
    MAL-2026-6942 ghsa-malware, amazon-inspector
  • npm
    shopify-internel 99.0.1
    MAL-2026-6941 ghsa-malware, amazon-inspector
  • npm
    rnx-align-deps 99.0.7
    MAL-2026-6940 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    nonexistent-package 99.0.3
    MAL-2026-6936 ghsa-malware, amazon-inspector
  • npm
    hook-augmenting-module 99.0.3
    MAL-2026-6933 ghsa-malware, amazon-inspector
  • npm
    annotator-harvardx 9.0.2
    MAL-2026-6930 ghsa-malware, amazon-inspector
  • npm
    tx-guard-snap 1.0.0
    MAL-2026-6943 ghsa-malware, amazon-inspector
  • PyPI
    jsonschemavalidation 4.26.0
    MAL-2026-6945 kam193, amazon-inspector
  • PyPI
    paysafe-sdk 1.0.0
    MAL-2026-6929 kam193, amazon-inspector 1 IOC
  • PyPI
    paysafe-payments 1.0.0
    MAL-2026-6928 kam193, amazon-inspector 1 IOC
  • PyPI
    paysafe-kyc 1.0.0
    MAL-2026-6927 kam193, amazon-inspector 1 IOC
  • PyPI
    paysafe-api 1.0.0
    MAL-2026-6926 kam193, amazon-inspector 1 IOC
  • npm
    chai-sdk 1.4.7, 1.4.8
    MAL-2026-6931 ghsa-malware, amazon-inspector
  • npm
    notifier-utils 1.3.8, 1.3.7, 1.3.9, 1.4.0
    MAL-2026-6923 ghsa-malware, amazon-inspector
  • npm
    jsf-utils 1.3.1, 0.3.1
    MAL-2026-6921 ghsa-malware, amazon-inspector