Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,349 npm 223,211 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,349 reports · Feed

npm
animatecss-tailwind-luminary 2.0.6, 2.0.7
MAL-2026-18071 amazon-inspector

Oct 19, 2026
npm
animatecss-tailwind-helper 2.0.6
MAL-2026-18070 amazon-inspector

Oct 19, 2026
npm
animatecss-tailwind-graphic 2.0.6
MAL-2026-18069 amazon-inspector

Oct 19, 2026
npm
animatecss-tailwind-binary 2.0.6
MAL-2026-18068 amazon-inspector

Oct 19, 2026
npm
animate-twcss-pack 2.0.6
MAL-2026-18067 amazon-inspector

Oct 19, 2026
npm
animate-twcss-bridge 2.0.6
MAL-2026-18066 amazon-inspector

Oct 19, 2026
npm
animate-tailwind-kit 3.0.1, 3.0.4
MAL-2026-18065 amazon-inspector

Oct 19, 2026
npm
@pkgship/frpc-linux-arm64 0.71.0, 0.71.1
MAL-2026-17922 ghsa-malware, amazon-inspector

Oct 18, 2026
npm
rootaccessxvv-bbmarker 1.0.2
MAL-2026-18108 amazon-inspector, ghsa-malware 1 IOC

Oct 18, 2026
PyPI
leakdeep 2.6.4, 2.5.0, 2.6.6, 2.5.2, 2.6.0, 2.4.1, 2.4.5, 2.6.2, 3.0.0
MAL-2026-17921 amazon-inspector, kam193

Oct 18, 2026
PyPI
tonemaptts 0.1.0
MAL-2026-17918 kam193, amazon-inspector

Oct 17, 2026
PyPI
pyrechoasr 0.1.0
MAL-2026-17916 kam193, amazon-inspector

Oct 17, 2026
PyPI
driftwavets 0.1.0
MAL-2026-17912 kam193, amazon-inspector

Oct 17, 2026
PyPI
novalithtts 0.1.0
MAL-2026-17915 kam193, amazon-inspector

Oct 17, 2026
PyPI
voltswannts 0.1.0
MAL-2026-17920 kam193, amazon-inspector

Oct 17, 2026
PyPI
glassbeakasr 0.1.0
MAL-2026-17914 kam193, amazon-inspector

Oct 17, 2026
PyPI
emberlytts 0.1.0
MAL-2026-17913 kam193, amazon-inspector

Oct 17, 2026
PyPI
quasitonnts 0.1.0
MAL-2026-17917 kam193, amazon-inspector

Oct 17, 2026
PyPI
ukraine69 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.5, 1.2.6, 1.2.7, 1.2.8
MAL-2026-17919 kam193, amazon-inspector

Oct 17, 2026
npm
itsa-react-maskedinput 16.1.2
MAL-2026-17911 ghsa-malware

Oct 16, 2026
npm
itsa-react-focuscontainer 16.0.10
MAL-2026-17910 ghsa-malware

Oct 16, 2026
npm
@beloved-lenora/opencode-todo all versions
MAL-2026-17909 ghsa-malware

Oct 16, 2026
npm
@beloved-lenora/opencode-stats all versions
MAL-2026-17908 ghsa-malware

Oct 16, 2026
npm
@beloved-lenora/opencode-shell-guard 1.0.4, 1.0.3
MAL-2026-17907 ghsa-malware, amazon-inspector

Oct 16, 2026
npm
@beloved-lenora/opencode-shared-rpc all versions
MAL-2026-17906 ghsa-malware

Oct 16, 2026
npm
@beloved-lenora/opencode-orchestrator all versions
MAL-2026-17905 ghsa-malware

Oct 16, 2026
npm
@beloved-lenora/opencode-goal all versions
MAL-2026-17904 ghsa-malware

Oct 16, 2026
npm
@beloved-lenora/opencode-btw all versions
MAL-2026-17903 ghsa-malware

Oct 16, 2026
PyPI
pyyi 2.4.1, 2.4.2, 2.4, 2.5.5, 2.5.2, 2.5.0, 2.5.1, 2.5.4, 2.5.3
MAL-2026-17866 amazon-inspector 5 IOCs

Oct 16, 2026
npm
@xatancchii/natabaileys 1.2.5
MAL-2026-17901 ghsa-malware, amazon-inspector

Oct 16, 2026
npm
parxleys 1.0.1, 1.0.0
MAL-2026-17902 ghsa-malware, amazon-inspector 1 IOC

Oct 16, 2026
PyPI
marocolor 1.0.0
MAL-2026-17900 kam193, amazon-inspector

Oct 16, 2026
npm
@flexmr/survey-conversation 1.0.12, 10.0.12, 2.0.12, 1.0.0, 3.0.12, 0.0.0-stage
MAL-2026-17899 amazon-inspector, ghsa-malware

Oct 16, 2026
npm
@flexmr/survey-client 1.0.0, 1.0.12, 3.0.12, 10.0.12, 2.0.12, 0.0.0-stage
MAL-2026-17898 amazon-inspector, ghsa-malware

Oct 16, 2026
PyPI
fromthehotel-poems 0.1.0
MAL-2026-17897 kam193, amazon-inspector 4 IOCs

Oct 16, 2026
npm
xmd-baileys all versions
MAL-2026-17892 ghsa-malware

Oct 16, 2026
npm
@developmentyora/yorakids all versions
MAL-2026-17890 ghsa-malware

Oct 16, 2026
npm
@developmentyora/baileyss 1.0.0
MAL-2026-17439 ghsa-malware

Oct 16, 2026
npm
asistenyorstore 8.0.14
MAL-2026-17891 ghsa-malware, amazon-inspector

Oct 16, 2026
npm
@celestial-community/baileys 1.0.0
MAL-2026-17438 ghsa-malware 2 IOCs

Oct 16, 2026