Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,347 npm 223,209 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,347 reports · Feed

  • npm
    @an1mshnpmb9c84920/pipe-compat-m19r8 all versions
    MAL-2026-18048 ghsa-malware
  • npm
    @an1mshnpmb9c84920/oidc-cross-cafb9d929e 1.0.0
    MAL-2026-18047 ghsa-malware, amazon-inspector
  • npm
    codex-setup 1.0.1, 1.0.0, 1.0.2, 1.0.3
    MAL-2026-18060 ghsa-malware, amazon-inspector
  • npm
    claude-desktop-setup 1.0.8, 1.0.12, 1.0.0, 1.0.13, 1.0.3, 1.0.2, 1.0.5, 1.0.10, 1.0.1, 1.0.6, 1.0.11…
    MAL-2026-18059 ghsa-malware, amazon-inspector
  • npm
    chatgpt-pro-setup-tool all versions
    MAL-2026-18058 ghsa-malware
  • npm
    chatgpt-pro-activator all versions
    MAL-2026-18057 ghsa-malware
  • npm
    chatgpt-desktop-setup 1.0.2, 1.0.3, 1.0.1, 1.0.0
    MAL-2026-18056 ghsa-malware, amazon-inspector
  • npm
    api-anthropic 1.1.2, 1.1.1, 1.1.3, 1.1.0, 0.1.0, 0.1.1
    MAL-2026-18055 ghsa-malware, amazon-inspector
  • npm
    @decoopus/claude-setup 1.0.13, 1.0.2, 1.0.0, 1.0.6, 1.0.11, 1.0.10, 1.0.3, 1.0.8, 1.0.5, 1.0.1, 1.0.9,…
    MAL-2026-18054 ghsa-malware, amazon-inspector
  • npm
    @decoopus/chatgpt-setup 1.0.2, 1.0.0, 1.0.1, 1.0.3
    MAL-2026-18053 ghsa-malware, amazon-inspector
  • PyPI
    asurion 99.0.0
    MAL-2026-18045 kam193, amazon-inspector
  • PyPI
    vinted-mocked-apis 99.0.0
    MAL-2026-17943 ossf-package-analysis, kam193
  • npm
    zubn7b all versions
    MAL-2026-18044 ghsa-malware
  • npm
    ysqp68 all versions
    MAL-2026-18041 ghsa-malware
  • npm
    x294tn all versions
    MAL-2026-18040 ghsa-malware
  • npm
    waojpf all versions
    MAL-2026-18039 ghsa-malware
  • npm
    v49yzy all versions
    MAL-2026-18038 ghsa-malware
  • npm
    tkacg3 all versions
    MAL-2026-18037 ghsa-malware
  • npm
    rvmbnj all versions
    MAL-2026-18036 ghsa-malware
  • npm
    rhlozh all versions
    MAL-2026-18035 ghsa-malware
  • npm
    oo9fja all versions
    MAL-2026-18034 ghsa-malware
  • npm
    noe77e all versions
    MAL-2026-18033 ghsa-malware
  • npm
    lstsyw all versions
    MAL-2026-18022 ghsa-malware
  • npm
    ljem3j all versions
    MAL-2026-18021 ghsa-malware
  • npm
    ju0oud all versions
    MAL-2026-18020 ghsa-malware
  • npm
    j5opb7 all versions
    MAL-2026-18019 ghsa-malware
  • npm
    j019qc all versions
    MAL-2026-18018 ghsa-malware
  • npm
    ivzlid all versions
    MAL-2026-18017 ghsa-malware
  • npm
    gtjgd4 all versions
    MAL-2026-18016 ghsa-malware
  • npm
    giu094 all versions
    MAL-2026-18015 ghsa-malware
  • npm
    g8ez1y all versions
    MAL-2026-18014 ghsa-malware
  • npm
    g23p4g all versions
    MAL-2026-18013 ghsa-malware
  • npm
    f4iomt all versions
    MAL-2026-18011 ghsa-malware
  • npm
    f0klcr all versions
    MAL-2026-18010 ghsa-malware
  • npm
    esgbz5 all versions
    MAL-2026-18009 ghsa-malware
  • npm
    aqj3w7 all versions
    MAL-2026-17971 ghsa-malware
  • npm
    8i7pp4 0.0.0-stage
    MAL-2026-17952 ghsa-malware, amazon-inspector
  • npm
    8h66ok all versions
    MAL-2026-17951 ghsa-malware
  • npm
    5xzkuy all versions
    MAL-2026-17950 ghsa-malware
  • npm
    5k5t5q all versions
    MAL-2026-17949 ghsa-malware