Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,347 npm 223,209 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,347 reports · Feed

PyPI
moveworks-capi-starter 0.0.0, 0.2.0
MAL-2026-18122 kam193, amazon-inspector

Oct 21, 2026
npm
my-auto-follow-eltio 1.0.0
MAL-2026-18121 ghsa-malware, amazon-inspector

Oct 21, 2026
npm
@alannxd/baileys 6.2.8, 6.2.7, 6.1.7, 6.1.6, 6.1.4, 6.1.3, 6.1.2, 6.1.1, 6.1.0, 6.0.9, 6.0.6, 6.…
MAL-2026-18120 ghsa-malware, amazon-inspector

Oct 21, 2026
PyPI
ssemver 1.0.0
MAL-2026-18119 kam193 2 IOCs

Oct 20, 2026
PyPI
semer 1.0.0
MAL-2026-18118 kam193 2 IOCs

Oct 20, 2026
PyPI
debbug 1.0.0
MAL-2026-18116 kam193 2 IOCs

Oct 20, 2026
PyPI
deebug 1.0.0
MAL-2026-18117 kam193 2 IOCs

Oct 20, 2026
npm
tellyo-colours 21.3.1, 101.3.6, 99.99.99
MAL-2026-18115 ghsa-malware, amazon-inspector

Oct 20, 2026
PyPI
hijok-lampam 1.0.0
MAL-2026-18112 kam193, amazon-inspector 3 IOCs

Oct 20, 2026
PyPI
trijigo-kalip 1.0.0
MAL-2026-18114 kam193

Oct 20, 2026
PyPI
jiklpo-tsunari-kay 1.0.0
MAL-2026-18113 kam193, amazon-inspector 3 IOCs

Oct 20, 2026
PyPI
hijiko-pilaka 1.0.0
MAL-2026-18111 kam193, amazon-inspector 3 IOCs

Oct 20, 2026
PyPI
facewareretargeter 9.9.9
MAL-2026-18110 kam193, amazon-inspector 3 IOCs

Oct 20, 2026
npm
@securihackbot/depconf-stage-1792484738 1.0.0
MAL-2026-18105 amazon-inspector

Oct 20, 2026
npm
rs-lookout-sandbox-poc 1.0.1
MAL-2026-18109 amazon-inspector

Oct 20, 2026
npm
memories-core-web 99.0.0
MAL-2026-18106 amazon-inspector

Oct 20, 2026
PyPI
semvver 1.0.0
MAL-2026-18104 amazon-inspector, kam193 2 IOCs

Oct 20, 2026
PyPI
semveer 1.0.0
MAL-2026-18102 amazon-inspector, kam193 2 IOCs

Oct 20, 2026
PyPI
semmver 1.0.0
MAL-2026-18101 amazon-inspector, kam193 2 IOCs

Oct 20, 2026
PyPI
semverr 1.0.0
MAL-2026-18103 amazon-inspector, kam193 2 IOCs

Oct 20, 2026
npm
nwfp-build-config 1.0.0, 0.0.0-stage
MAL-2026-18107 amazon-inspector, ghsa-malware

Oct 20, 2026
npm
unicode-title-normalizer 1.0.0, 1.0.2, 1.0.4, 1.0.5, 1.1.0, 1.0.9
MAL-2026-18100 ghsa-malware, amazon-inspector 1 IOC

Oct 20, 2026
npm
formatting-subtitles-for-claude 1.0.1, 1.0.0
MAL-2026-18099 ghsa-malware, amazon-inspector

Oct 20, 2026
PyPI
security-research-startup-snapshot-810764b303 0.1.0
MAL-2026-18098 kam193

Oct 20, 2026
PyPI
research-probe-6150c1c915 0.1.0
MAL-2026-18097 kam193, amazon-inspector

Oct 20, 2026
PyPI
workalender 17.1.0.dev0
MAL-2026-18096 kam193

Oct 20, 2026
PyPI
pafex 2.3
MAL-2026-18094 kam193, amazon-inspector 3 IOCs

Oct 20, 2026
PyPI
resion 22.0.1
MAL-2026-18095 kam193, amazon-inspector 3 IOCs

Oct 20, 2026
PyPI
workcalender 17.1.0.dev0
MAL-2026-18093 kam193, amazon-inspector

Oct 20, 2026
PyPI
test-workalendar-internal 0.0.1, 0.0.2, 0.0.3
MAL-2026-18092 kam193, amazon-inspector

Oct 20, 2026
npm
@platform-services/hrm-mfe-core 99.9.1
MAL-2026-18091 ossf-package-analysis, amazon-inspector

Oct 20, 2026
npm
sc-announcer 99.9.1, 0.0.0-stage
MAL-2026-18064 ossf-package-analysis, amazon-inspector, ghsa-malware

Oct 20, 2026
npm
fanarena-common 99.9.1
MAL-2026-18063 ossf-package-analysis, amazon-inspector

Oct 20, 2026
npm
ccl-global-shopping 99.9.1, 0.0.0-stage
MAL-2026-18061 ossf-package-analysis, amazon-inspector, ghsa-malware

Oct 20, 2026
npm
sc-wizard 99.9.1
MAL-2026-18062 ossf-package-analysis, amazon-inspector

Oct 20, 2026
npm
@an1mshnpmb9c84920/stage-repo-m19g7 all versions
MAL-2026-18052 ghsa-malware

Oct 19, 2026
npm
@an1mshnpmb9c84920/stage-outer-m19s5 all versions
MAL-2026-18051 ghsa-malware

Oct 19, 2026
npm
@an1mshnpmb9c84920/stage-fn-m19p2 all versions
MAL-2026-18050 ghsa-malware

Oct 19, 2026
npm
@an1mshnpmb9c84920/pipe-dns-m19t2 1.0.0, 1.0.1, 1.0.5
MAL-2026-18049 ghsa-malware, amazon-inspector

Oct 19, 2026
npm
@an1mshnpmb9c84920/gat-scope-target-125ec19a 1.0.0
MAL-2026-18046 ghsa-malware, amazon-inspector

Oct 19, 2026