Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,349 npm 223,211 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,349 reports · Feed

npm
alb-um-availa-ble-zip-mp3-file-43857-green-light-mrpup-qmtshy all versions
MAL-2026-17967 ghsa-malware

Oct 19, 2026
npm
alb-um-availa-ble-zip-mp3-file-31673-finally-1m7lu-usrooy all versions
MAL-2026-17965 ghsa-malware

Oct 19, 2026
npm
a-vailable-al-bum-file-36850-other-peoples-lives-vys1z-fuucqk all versions
MAL-2026-17963 ghsa-malware

Oct 19, 2026
npm
a-vailable-al-bum-file-101379-communion-mt1lk-dvshll all versions
MAL-2026-17959 ghsa-malware

Oct 19, 2026
npm
a-lbum-do-wnload-avai-lable-file-playing-the-angel-l9tng-nkbcwn all versions
MAL-2026-17957 ghsa-malware

Oct 19, 2026
npm
a-lbum-do-wnload-avai-lable-file-11522-seven-and-the-ragged-tiger-bkmqg-xorids all versions
MAL-2026-17954 ghsa-malware

Oct 19, 2026
npm
a-lbum-do-wnload-avai-lable-file-10635-about-to-choke-pzt0k-onnsvp all versions
MAL-2026-17953 ghsa-malware

Oct 19, 2026
npm
zip-mp3-a-lbum-do-wnload-new-67476-what-we-do-egj2h-bgfgzz all versions
MAL-2026-18043 ghsa-malware

Oct 19, 2026
npm
zip-mp3-a-lbum-do-wnload-new-392999-fantasy-island-wlvf4-bxyvtm all versions
MAL-2026-18042 ghsa-malware

Oct 19, 2026
npm
new-al-bum-av-ailable-girls-can-tell-ccfoc-vmqodd all versions
MAL-2026-18032 ghsa-malware

Oct 19, 2026
npm
new-al-bum-av-ailable-131000-eton-alive-qzngy-cjxczf all versions
MAL-2026-18030 ghsa-malware

Oct 19, 2026
npm
mp3-file-zip-d-ownload-hearts-of-oak-7cyqu-oiygcz all versions
MAL-2026-18028 ghsa-malware

Oct 19, 2026
npm
mp3-file-zip-d-ownload-48120-lost-nation-road-0cibe-ynawhz all versions
MAL-2026-18026 ghsa-malware

Oct 19, 2026
npm
down-lo-ad-now-zip-mp3-6140-the-ideal-crash-jysrl-jcdvdw all versions
MAL-2026-18002 ghsa-malware

Oct 19, 2026
npm
down-lo-ad-now-zip-mp3-12737-talking-book-grhl4-lwvpqw all versions
MAL-2026-18000 ghsa-malware

Oct 19, 2026
npm
down-lo-ad-now-zip-mp3-116827-chaos-is-me-rj9kf-abdorv all versions
MAL-2026-17999 ghsa-malware

Oct 19, 2026
npm
do-wnload-available-the-white-stripes-1-yywrn-pvfqxa all versions
MAL-2026-17998 ghsa-malware

Oct 19, 2026
npm
do-wnload-available-f2oap-wvzhe9 all versions
MAL-2026-17995 ghsa-malware

Oct 19, 2026
npm
do-wnload-available-2013-5195-ripley-pine-zoryg-cyvlnz all versions
MAL-2026-17991 ghsa-malware

Oct 19, 2026
npm
availab-le-alb-um-zip-the-visitor-l1n8t-frzacy all versions
MAL-2026-17987 ghsa-malware

Oct 19, 2026
npm
availab-le-alb-um-zip-211740-city-burials-xwcy6-bhxnvc all versions
MAL-2026-17982 ghsa-malware

Oct 19, 2026
npm
avail-able-albu-m-down-load-6807-yo-bum-rush-the-show-tq11q-lqcaye all versions
MAL-2026-17977 ghsa-malware

Oct 19, 2026
npm
ava-ilable-down-load-mp3-today-35981-saints-and-sinners-mv3po-fqndxw all versions
MAL-2026-17974 ghsa-malware

Oct 19, 2026
npm
alb-um-availa-ble-zip-mp3-file-6053-the-specials-giqmz-flbewh all versions
MAL-2026-17969 ghsa-malware

Oct 19, 2026
npm
alb-um-availa-ble-zip-mp3-file-43838-stories-of-the-years-sslgg-bqfcko all versions
MAL-2026-17966 ghsa-malware

Oct 19, 2026
npm
a-vailable-al-bum-file-the-world-wont-end-7io2n-pbncia all versions
MAL-2026-17964 ghsa-malware

Oct 19, 2026
npm
a-vailable-al-bum-file-30258-secrets-of-the-beehive-rk1pl-vebirt all versions
MAL-2026-17962 ghsa-malware

Oct 19, 2026
npm
a-vailable-al-bum-file-2015-39171-harmlessness-khwlm-ihtwah all versions
MAL-2026-17961 ghsa-malware

Oct 19, 2026
npm
a-vailable-al-bum-file-19105-filles-de-kilimanjaro-4syt9-khnipp all versions
MAL-2026-17960 ghsa-malware

Oct 19, 2026
npm
a-vailable-al-bum-513977-rant-in-e-minor-lybr0-bdhlsb all versions
MAL-2026-17958 ghsa-malware

Oct 19, 2026
npm
a-lbum-do-wnload-avai-lable-file-36733-tchamantche-9uiic-rfzaip all versions
MAL-2026-17956 ghsa-malware

Oct 19, 2026
npm
a-lbum-do-wnload-avai-lable-file-2019-138062-i-need-a-new-war-pp6yu-vclmgu all versions
MAL-2026-17955 ghsa-malware

Oct 19, 2026
npm
bs58x64.js all versions
MAL-2026-17990 ghsa-malware

Oct 19, 2026
npm
bs58x64 all versions
MAL-2026-17989 ghsa-malware

Oct 19, 2026
npm
base58x64 all versions
MAL-2026-17988 ghsa-malware

Oct 19, 2026
npm
array-inline 2.0.5
MAL-2026-17942 ghsa-malware, amazon-inspector

Oct 19, 2026
npm
array-inline-transform 1.0.0
MAL-2026-17934 ghsa-malware, amazon-inspector

Oct 19, 2026
npm
dsjklweuvhgsdcq 1.0.0, 1.0.1
MAL-2026-17935 ghsa-malware, amazon-inspector

Oct 19, 2026
npm
zxhgssiyluwxchn 1.0.0
MAL-2026-17941 ghsa-malware, amazon-inspector

Oct 19, 2026
npm
vjkpwjxbvndelta 1.0.1
MAL-2026-17940 ghsa-malware, amazon-inspector

Oct 19, 2026