Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,347 npm 223,209 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,347 reports · Feed

  • PyPI
    speaksocket 0.1.0
    MAL-2026-18167 kam193, amazon-inspector
  • PyPI
    asrdock 0.1.0
    MAL-2026-18156 kam193, amazon-inspector
  • PyPI
    pipegrip 0.1.0
    MAL-2026-18154 kam193, amazon-inspector
  • PyPI
    hookgantry 0.1.0
    MAL-2026-18153 kam193, amazon-inspector
  • PyPI
    acousticpack 0.1.0
    MAL-2026-18152 kam193, amazon-inspector
  • PyPI
    dictanovaasr 0.1.0
    MAL-2026-18139 kam193, amazon-inspector
  • PyPI
    orchestril 0.1.0
    MAL-2026-18142 kam193, amazon-inspector
  • PyPI
    prosodinetts 0.1.0
    MAL-2026-18144 kam193, amazon-inspector
  • PyPI
    codecraze 0.1.0
    MAL-2026-18137 kam193, amazon-inspector
  • PyPI
    solivoxtts 0.1.0
    MAL-2026-18147 kam193, amazon-inspector
  • PyPI
    tessivatts 0.1.0
    MAL-2026-18148 kam193, amazon-inspector
  • PyPI
    vellutts 0.1.0
    MAL-2026-18149 kam193, amazon-inspector
  • PyPI
    grommatts 0.1.0
    MAL-2026-18140 kam193, amazon-inspector
  • PyPI
    zennittts 0.1.0
    MAL-2026-18151 kam193
  • PyPI
    aurenatts 0.1.0
    MAL-2026-18134 kam193, amazon-inspector
  • PyPI
    phonoviatts 0.1.0
    MAL-2026-18143 kam193, amazon-inspector
  • PyPI
    voxilaratts 0.1.0
    MAL-2026-18150 kam193, amazon-inspector
  • PyPI
    brummatts 0.1.0
    MAL-2026-18136 kam193, amazon-inspector
  • PyPI
    melcuratts 0.1.0
    MAL-2026-18141 kam193, amazon-inspector
  • PyPI
    quillonatts 0.1.0
    MAL-2026-18145 kam193, amazon-inspector
  • PyPI
    shellgrip 0.1.0
    MAL-2026-18146 kam193, amazon-inspector
  • PyPI
    batchspar 0.1.0
    MAL-2026-18135 kam193, amazon-inspector
  • PyPI
    crenelatts 0.1.0
    MAL-2026-18138 kam193, amazon-inspector
  • PyPI
    journey-test-hellospy 0.1.1
    MAL-2026-18133 kam193 2 IOCs
  • npm
    @sudobility/testomniac_client 0.0.131
    MAL-2026-18129 amazon-inspector, ghsa-malware
  • npm
    @sudobility/indexer_client 0.0.146
    MAL-2026-18127 amazon-inspector, ghsa-malware
  • npm
    @sudobility/wildduck_client 2.3.102
    MAL-2026-18130 amazon-inspector, ghsa-malware
  • npm
    @sudobility/shaperouter_client 0.0.14
    MAL-2026-18128 amazon-inspector, ghsa-malware
  • PyPI
    libseal 1.1.0, 1.1.1, 1.1.2, 1.1.3
    MAL-2026-18132 kam193, amazon-inspector
  • PyPI
    iterquarry 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.2.0, 2.2.1
    MAL-2026-18131 kam193, amazon-inspector
  • RubyGems
    zzhelloworld_socktest 0.1.9, 0.1.5, 0.1.6, 0.2.0, 0.1.7, 0.2.1, 0.1.8
    MAL-2026-18126 amazon-inspector
  • npm
    @worrisome/aaaa 1.0.0, 1.0.1
    MAL-2026-18125 ghsa-malware, amazon-inspector
  • PyPI
    journey-test-helloshell 0.2.0
    MAL-2026-18124 kam193, amazon-inspector 2 IOCs
  • npm
    test-brotli2-testmetest 1.0.0
    MAL-2026-18182 amazon-inspector
  • npm
    test-brotli-testmetest 1.0.0
    MAL-2026-18181 amazon-inspector
  • npm
    pixel-map-testmetest 0.0.1, 0.0.2, 0.0.3
    MAL-2026-18180 amazon-inspector
  • npm
    log-sink-testmetest 1.0.1
    MAL-2026-18179 amazon-inspector
  • npm
    event-emitter-testmetest 1.0.6, 1.0.7, 4.1.0, 5.0.0
    MAL-2026-18178 amazon-inspector
  • npm
    data-pipeline-testmetest 2.0.1
    MAL-2026-18177 amazon-inspector
  • npm
    peptide-modify all versions
    MAL-2026-18123 ghsa-malware