Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,349 npm 223,211 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,349 reports · Feed

npm
5xzkuy all versions
MAL-2026-17950 ghsa-malware

Oct 19, 2026
npm
5k5t5q all versions
MAL-2026-17949 ghsa-malware

Oct 19, 2026
npm
4p9kgm all versions
MAL-2026-17948 ghsa-malware

Oct 19, 2026
npm
3qamjp all versions
MAL-2026-17947 ghsa-malware

Oct 19, 2026
npm
3gr841 all versions
MAL-2026-17946 ghsa-malware

Oct 19, 2026
npm
3gr2dj all versions
MAL-2026-17945 ghsa-malware

Oct 19, 2026
npm
1n9lip all versions
MAL-2026-17944 ghsa-malware

Oct 19, 2026
npm
new-al-bum-av-ailable-50924-satta-massagana-rje2z-lfxsfe all versions
MAL-2026-18031 ghsa-malware

Oct 19, 2026
npm
mp3-file-zip-d-ownload-hypnotize-kpkk0-ygzaqq all versions
MAL-2026-18029 ghsa-malware

Oct 19, 2026
npm
mp3-file-zip-d-ownload-challengers-ym2l6-mkqhum all versions
MAL-2026-18027 ghsa-malware

Oct 19, 2026
npm
mp3-file-zip-d-ownload-10759-grand-prix-ojzwj-auchhw all versions
MAL-2026-18025 ghsa-malware

Oct 19, 2026
npm
mp3-do-wnload-file-to-day-d-nu951-cjkdsy all versions
MAL-2026-18024 ghsa-malware

Oct 19, 2026
npm
mp3-do-wnload-file-to-day-27091-usa-united-state-of-atlanta-xoisl-pqpsio all versions
MAL-2026-18023 ghsa-malware

Oct 19, 2026
npm
file-alb-um-zip-new-mp3-32338-think-before-you-speak-9znpc-akvcbt all versions
MAL-2026-18012 ghsa-malware

Oct 19, 2026
npm
down-load-available-zip-now-8238-bricks-are-heavy-0v3kh-yluceh all versions
MAL-2026-18008 ghsa-malware

Oct 19, 2026
npm
down-load-available-zip-now-42301-gloria-tp7wn-dcxkwl all versions
MAL-2026-18007 ghsa-malware

Oct 19, 2026
npm
down-load-available-zip-now-265533-the-safeway-elhem-xoyofv all versions
MAL-2026-18006 ghsa-malware

Oct 19, 2026
npm
down-load-available-zip-now-12673-dirt-farmer-jn0vw-rkwppg all versions
MAL-2026-18005 ghsa-malware

Oct 19, 2026
npm
down-lo-ad-now-zip-mp3-year-of-the-gentleman-8mpja-vdihqg all versions
MAL-2026-18004 ghsa-malware

Oct 19, 2026
npm
down-lo-ad-now-zip-mp3-duppy-writer-9bxwq-qpdzyd all versions
MAL-2026-18003 ghsa-malware

Oct 19, 2026
npm
down-lo-ad-now-zip-mp3-390322-the-silver-scream-2-welcome-to-horrorwood-4a2qf-tjkdio all versions
MAL-2026-18001 ghsa-malware

Oct 19, 2026
npm
do-wnload-available-provincial-q7d0i-muzxoj all versions
MAL-2026-17997 ghsa-malware

Oct 19, 2026
npm
do-wnload-available-mulatu-steps-ahead-ag2jn-fzxotp all versions
MAL-2026-17996 ghsa-malware

Oct 19, 2026
npm
do-wnload-available-61075-you-think-you-really-know-me-1-c368u-jspcon all versions
MAL-2026-17994 ghsa-malware

Oct 19, 2026
npm
do-wnload-available-20999-ruff-ryders-first-lady-6wp8i-xhznkl all versions
MAL-2026-17993 ghsa-malware

Oct 19, 2026
npm
do-wnload-available-2016-44937-in-the-magic-hour-xgzaj-txvlft all versions
MAL-2026-17992 ghsa-malware

Oct 19, 2026
npm
availab-le-alb-um-zip-music-is-rotted-one-note-7chcp-frcmmy all versions
MAL-2026-17986 ghsa-malware

Oct 19, 2026
npm
availab-le-alb-um-zip-hope-for-men-wmh1o-fjstib all versions
MAL-2026-17985 ghsa-malware

Oct 19, 2026
npm
availab-le-alb-um-zip-56502-interstellar-space-1qv3j-xsmien all versions
MAL-2026-17984 ghsa-malware

Oct 19, 2026
npm
availab-le-alb-um-zip-38895-crimes-of-passion-oeiro-wmybis all versions
MAL-2026-17983 ghsa-malware

Oct 19, 2026
npm
availab-le-alb-um-zip-2022-482703-broken-hearts-club-bhvqx-hxwudi all versions
MAL-2026-17981 ghsa-malware

Oct 19, 2026
npm
availab-le-alb-um-zip-101158-the-louder-i-call-the-faster-it-runs-64ggm-khmrzg all versions
MAL-2026-17980 ghsa-malware

Oct 19, 2026
npm
avail-able-albu-m-down-load-almanac-tdedm-bajrnj all versions
MAL-2026-17979 ghsa-malware

Oct 19, 2026
npm
avail-able-albu-m-down-load-9815-young-americans-vygt4-atskbj all versions
MAL-2026-17978 ghsa-malware

Oct 19, 2026
npm
ava-ilable-down-load-mp3-today-75491-life-after-youth-hfdu7-yzwkck all versions
MAL-2026-17976 ghsa-malware

Oct 19, 2026
npm
ava-ilable-down-load-mp3-today-5767-all-eyez-on-me-9vh62-ohwdae all versions
MAL-2026-17975 ghsa-malware

Oct 19, 2026
npm
ava-ilable-down-load-mp3-today-2018-120200-young-sick-camellia-qvg9z-dqpzyh all versions
MAL-2026-17973 ghsa-malware

Oct 19, 2026
npm
ava-ilable-down-load-mp3-today-157397-polymer-0dwv9-btizmd all versions
MAL-2026-17972 ghsa-malware

Oct 19, 2026
npm
alb-um-availa-ble-zip-mp3-file-someone-to-drive-you-home-vbwzp-koufrz all versions
MAL-2026-17970 ghsa-malware

Oct 19, 2026
npm
alb-um-availa-ble-zip-mp3-file-470287-watch-my-moves-2zscf-aatbzj all versions
MAL-2026-17968 ghsa-malware

Oct 19, 2026