Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,347 npm 223,209 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,347 reports · Feed

  • npm
    @seggy116/next-diff 0.3.0
    MAL-2026-18200 ghsa-malware, amazon-inspector
  • npm
    @pkgship/frps-linux-amd64 0.71.1
    MAL-2026-18199 ghsa-malware, amazon-inspector
  • npm
    @pkgship/frpc-linux-amd64 0.71.1
    MAL-2026-18198 ghsa-malware, amazon-inspector
  • npm
    sdk-utils-testmetest 1.0.0
    MAL-2026-18202 ghsa-malware, amazon-inspector
  • npm
    kvarzo8f3atestmetest all versions
    MAL-2026-18201 ghsa-malware
  • npm
    @lumen-labs-dev/whisper-node 0.5.1
    MAL-2026-18194 ghsa-malware, amazon-inspector
  • npm
    darknode-cli 2.46.2, 2.46.1, 2.46.0
    MAL-2026-18195 ghsa-malware, amazon-inspector
  • npm
    x402-prompt-injection-scan 0.1.4
    MAL-2026-18197 ghsa-malware, amazon-inspector
  • npm
    imgdecode 1.0.1, 1.0.0, 1.0.2, 1.0.3
    MAL-2026-18196 ghsa-malware, amazon-inspector
  • npm
    @liauto/darwin-x64 0.1.1-b3
    MAL-2026-18190 ghsa-malware, amazon-inspector
  • npm
    @pkgship/frpc-darwin-amd64 0.71.1
    MAL-2026-18191 ghsa-malware, amazon-inspector
  • npm
    opencode-skills-collection 4.1.10, 4.0.57, 4.1.11, 4.1.16, 4.1.13, 4.1.6, 4.1.3, 4.1.4, 4.1.1, 4.1.8, 4.1.…
    MAL-2026-18193 ghsa-malware, amazon-inspector
  • npm
    agentic-awesome-skills 19.0.0, 19.9.0, 19.6.0, 18.12.0, 18.9.0, 18.11.0, 19.4.0, 19.10.1, 18.14.0, 18.…
    MAL-2026-18192 ghsa-malware, amazon-inspector
  • PyPI
    1h1 1.0.0
    MAL-2026-18188 kam193 2 IOCs
  • PyPI
    aanthropic 1.0.0
    MAL-2026-18189 kam193 2 IOCs
  • npm
    net-codec-testmetest 1.0.1
    MAL-2026-18186 amazon-inspector
  • npm
    log-rotate-testmetest 1.0.1
    MAL-2026-18185 amazon-inspector
  • npm
    formatting-subtitles 1.0.2
    MAL-2026-18184 amazon-inspector
  • npm
    @conduitops/logview-archive 1.0.1, 1.0.0
    MAL-2026-18183 amazon-inspector, ghsa-malware
  • npm
    simplewave 0.0.2
    MAL-2026-18187 amazon-inspector
  • PyPI
    acoustichub 0.1.0
    MAL-2026-18155 kam193, amazon-inspector
  • PyPI
    phonemeprobe 0.1.0
    MAL-2026-18164 kam193, amazon-inspector
  • PyPI
    ttsflow 0.1.0
    MAL-2026-18170 kam193, amazon-inspector
  • PyPI
    evalstream 0.1.0
    MAL-2026-18161 kam193, amazon-inspector
  • PyPI
    speakbench 0.1.0
    MAL-2026-18166 kam193, amazon-inspector
  • PyPI
    audiokit 0.1.0
    MAL-2026-18158 kam193, amazon-inspector
  • PyPI
    phonemeforge 0.1.0
    MAL-2026-18163 kam193, amazon-inspector
  • PyPI
    vocabbench 0.1.0
    MAL-2026-18173 kam193, amazon-inspector
  • PyPI
    asrloom 0.1.0
    MAL-2026-18157 kam193
  • PyPI
    benchworks 0.1.0
    MAL-2026-18160 kam193
  • PyPI
    benchbridge 0.1.0
    MAL-2026-18159 kam193
  • PyPI
    speechprobe 0.1.0
    MAL-2026-18168 kam193, amazon-inspector
  • PyPI
    soundsocket 0.1.0
    MAL-2026-18165 kam193, amazon-inspector
  • PyPI
    modelworks 0.1.0
    MAL-2026-18162 kam193, amazon-inspector
  • PyPI
    vocabblend 0.1.0
    MAL-2026-18174 kam193
  • PyPI
    voicekit 0.1.0
    MAL-2026-18175 kam193
  • PyPI
    ttsweaver 0.1.0
    MAL-2026-18172 kam193
  • PyPI
    ttsprobe 0.1.0
    MAL-2026-18171 kam193, amazon-inspector
  • PyPI
    ttsdock 0.1.0
    MAL-2026-18169 kam193
  • PyPI
    voxweaver 0.1.0
    MAL-2026-18176 kam193, amazon-inspector