Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,349 npm 223,211 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,349 reports · Feed

npm
ticketcathayoct12 1.0.0, 1.0.2, 1.0.1
MAL-2026-17939 ghsa-malware, amazon-inspector

Oct 19, 2026
npm
nsdhjuiwqxmhsf1 1.0.0
MAL-2026-17938 ghsa-malware, amazon-inspector

Oct 19, 2026
npm
mxckjdgweuxpsiohd 1.0.1, 1.0.2, 1.0.0
MAL-2026-17937 ghsa-malware, amazon-inspector

Oct 19, 2026
npm
mx3dxhgic8xhd6 1.0.1, 1.0.0
MAL-2026-17936 ghsa-malware, amazon-inspector

Oct 19, 2026
npm
zeroz-baileys 1.0.1
MAL-2026-17933 ghsa-malware, amazon-inspector

Oct 19, 2026
npm
aldi02-baileys all versions
MAL-2026-17931 ghsa-malware

Oct 19, 2026
npm
aemath-baileys all versions
MAL-2026-17930 ghsa-malware

Oct 19, 2026
npm
ichigo-baileys 1.0.0, 1.0.5
MAL-2026-17445 ghsa-malware

Oct 19, 2026
npm
item-validator all versions
MAL-2026-17932 ghsa-malware

Oct 19, 2026
npm
rubbydev-crash-baileys 1.0.0
MAL-2026-17450 ghsa-malware

Oct 19, 2026
npm
prastzyy 1.0.0
MAL-2026-17449 ghsa-malware

Oct 19, 2026
npm
xcvrenzcompany 1.0.0, 2.0.0
MAL-2026-17452 ghsa-malware

Oct 19, 2026
npm
prastzy 1.0.0
MAL-2026-17448 ghsa-malware

Oct 19, 2026
npm
xzvexpzcbailey 2.5.0, 2.1.0, 2.0.0, 1.0.0
MAL-2026-17412 ghsa-malware

Oct 19, 2026
npm
xzbails 0.0.5, 0.0.4, 0.0.3
MAL-2026-17410 ghsa-malware

Oct 19, 2026
npm
@fmr-ap149494/apex-base-component 99.9.1
MAL-2026-17929 ossf-package-analysis, amazon-inspector, ghsa-malware

Oct 19, 2026
npm
@fcsmc/commercial-analytics 99.9.1
MAL-2026-17928 ossf-package-analysis, amazon-inspector, ghsa-malware

Oct 19, 2026
PyPI
fabdeploycheck 0.1.1
MAL-2026-17926 amazon-inspector, kam193 1 IOC

Oct 19, 2026
PyPI
fabtoolkit 0.1.2, 0.1.1, 0.1.0, 0.2.1, 0.2.0
MAL-2026-17927 amazon-inspector, kam193 1 IOC

Oct 19, 2026
npm
@fluxionii/baileys all versions
MAL-2026-17925 ghsa-malware

Oct 19, 2026
npm
@ostyado/baileys 2.0.9, 2.0.8, 2.0.7, 2.0.6
MAL-2026-17372 ghsa-malware

Oct 19, 2026
npm
tailwindcss-visual-kit 0.0.0-stage, 1.3.6
MAL-2026-18090 amazon-inspector, ghsa-malware

Oct 19, 2026
npm
tailwindcss-motionanimate 1.0.1
MAL-2026-18089 amazon-inspector

Oct 19, 2026
npm
tailwindcss-keyframe-kit 3.0.0, 3.0.1, 3.0.2, 0.0.0-stage
MAL-2026-18088 amazon-inspector, ghsa-malware

Oct 19, 2026
npm
tailwindcss-effect-lab 0.0.0-stage, 1.6.7
MAL-2026-18087 amazon-inspector, ghsa-malware

Oct 19, 2026
npm
tailwindcss-animatemotion 1.0.7
MAL-2026-18086 amazon-inspector

Oct 19, 2026
npm
tailwindcss-animate-catalog 2.0.6, 2.0.7, 0.0.0-stage
MAL-2026-18085 amazon-inspector, ghsa-malware

Oct 19, 2026
npm
tailwind-kinetic 2.0.6, 2.0.8, 0.0.0-stage
MAL-2026-18084 amazon-inspector, ghsa-malware

Oct 19, 2026
npm
tailwind-keyframes 2.0.6, 0.0.0-stage
MAL-2026-18083 amazon-inspector, ghsa-malware

Oct 19, 2026
npm
tailwind-fabric 3.0.1, 3.0.4
MAL-2026-18082 amazon-inspector

Oct 19, 2026
npm
tailwind-css-keyframes 1.0.7
MAL-2026-18081 amazon-inspector

Oct 19, 2026
npm
tailwind-animationlab 2.0.6, 0.0.0-stage
MAL-2026-18080 amazon-inspector, ghsa-malware

Oct 19, 2026
npm
tailwind-animatecss-kit 2.0.6
MAL-2026-18079 amazon-inspector

Oct 19, 2026
npm
tailwind-animate-kit 2.0.6, 2.0.7, 2.0.8, 0.0.0-stage
MAL-2026-18078 amazon-inspector, ghsa-malware

Oct 19, 2026
npm
tailwind-animaflow-kit 2.0.6
MAL-2026-18077 amazon-inspector

Oct 19, 2026
npm
signalledger-diagnostics 2.0.6
MAL-2026-18076 amazon-inspector

Oct 19, 2026
npm
signalledger-bridge 2.0.6
MAL-2026-18075 amazon-inspector

Oct 19, 2026
npm
animatecss-tailwind-vectrix 2.0.6, 2.0.7
MAL-2026-18074 amazon-inspector

Oct 19, 2026
npm
animatecss-tailwind-presets 1.0.0, 2.0.3
MAL-2026-18073 amazon-inspector

Oct 19, 2026
npm
animatecss-tailwind-plugin 2.0.6
MAL-2026-18072 amazon-inspector

Oct 19, 2026