Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,349 npm 223,211 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,349 reports · Feed

npm
@newspage/libx-amount 99.99.41, 99.99.4, 99.99.42
MAL-2026-17873 amazon-inspector 3 IOCs

Oct 13, 2026
npm
@newspage/lib-ng-async-routes-ui 99.99.42, 99.99.4
MAL-2026-17872 amazon-inspector 2 IOCs

Oct 13, 2026
npm
@mntv-analysis/workspaces-components 65.11.3
MAL-2026-17871 amazon-inspector, ghsa-malware 2 IOCs

Oct 13, 2026
npm
@mntv-analysis/ui-components 50.1.1
MAL-2026-17870 amazon-inspector, ghsa-malware 2 IOCs

Oct 13, 2026
npm
@mntv-analysis/ui 99.1.1
MAL-2026-17869 amazon-inspector, ghsa-malware 2 IOCs

Oct 13, 2026
PyPI
npp-ml 0.1.7, 0.1.8, 0.1.9, 0.1.10
MAL-2026-17847 kam193, amazon-inspector

Oct 12, 2026
npm
@zanta/baileys 1.0.0, 1.0.1
MAL-2026-17443 ghsa-malware

Oct 12, 2026
npm
@yudzxml/baileys 7.4.2, 7.4.1, 7.4.0
MAL-2026-17846 ghsa-malware, amazon-inspector

Oct 12, 2026
npm
node-telegram-sockets 1.1.6, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.7
MAL-2026-17845 ghsa-malware, amazon-inspector

Oct 12, 2026
npm
@xrelly-stack/bails 2.3.20
MAL-2026-17843 ghsa-malware, amazon-inspector

Oct 12, 2026
npm
@wanzxlonelyy/bailslonely all versions
MAL-2026-17841 ghsa-malware

Oct 12, 2026
npm
@wanzlonelyy/bailslonely all versions
MAL-2026-17840 ghsa-malware

Oct 12, 2026
npm
@wanzlonely/bails4u 5.0.0, 4.0.0, 3.0.0, 2.0.0, 7.0.0, 6.0.0
MAL-2026-17381 ghsa-malware, amazon-inspector

Oct 12, 2026
npm
bailslonely all versions
MAL-2026-17844 ghsa-malware

Oct 12, 2026
npm
@wanzlonely/bailsme all versions
MAL-2026-17839 ghsa-malware

Oct 12, 2026
npm
@wanzlonely/bailsforme all versions
MAL-2026-17838 ghsa-malware

Oct 12, 2026
npm
@wenzyx1/bails 1.0.1, 1.0.0
MAL-2026-17382 ghsa-malware

Oct 12, 2026
npm
@sanzoffc/libsignal-node all versions
MAL-2026-17837 ghsa-malware

Oct 12, 2026
npm
@sakataoffc/baileys 8.0.0, 7.0.0, 6.0.0, 5.0.1, 5.0.0, 4.0.0, 3.0.0, 2.0.0, 1.0.0
MAL-2026-17379 ghsa-malware

Oct 12, 2026
npm
@sairidev/baileys-new 0.3.21
MAL-2026-17378 ghsa-malware

Oct 12, 2026
npm
@saazkira/libsignal-node all versions
MAL-2026-17836 ghsa-malware

Oct 12, 2026
npm
@saazkira/eslint-config all versions
MAL-2026-17835 ghsa-malware

Oct 12, 2026
npm
@saazkira/baileys 2.1.9, 2.1.8, 2.1.7, 2.1.6
MAL-2026-17377 ghsa-malware

Oct 12, 2026
npm
@revizahoshii/hoshino-wam all versions
MAL-2026-17834 ghsa-malware

Oct 12, 2026
npm
@revizahoshii/hoshino-voip all versions
MAL-2026-17833 ghsa-malware

Oct 12, 2026
npm
@revizahoshii/hoshino-native all versions
MAL-2026-17827 ghsa-malware

Oct 12, 2026
npm
@revizahoshii/hoshino-mcp-server all versions
MAL-2026-17825 ghsa-malware

Oct 12, 2026
npm
@revizahoshii/hoshino-fake-server all versions
MAL-2026-17824 ghsa-malware

Oct 12, 2026
npm
@revizahoshii/hoshino-store-sqlite all versions
MAL-2026-17832 ghsa-malware

Oct 12, 2026
npm
@revizahoshii/hoshino-store-redis all versions
MAL-2026-17831 ghsa-malware

Oct 12, 2026
npm
@revizahoshii/hoshino-store-postgres all versions
MAL-2026-17830 ghsa-malware

Oct 12, 2026
npm
@revizahoshii/hoshino-store-mysql all versions
MAL-2026-17829 ghsa-malware

Oct 12, 2026
npm
@revizahoshii/hoshino-store-mongo all versions
MAL-2026-17828 ghsa-malware

Oct 12, 2026
npm
@revizahoshii/hoshino-media-utils all versions
MAL-2026-17826 ghsa-malware

Oct 12, 2026
npm
@revizahoshii/hoshino 1.1.0
MAL-2026-17376 ghsa-malware

Oct 12, 2026
npm
@revizahoshii/baileys 0.5.4, 0.5.3, 0.5.2, 0.5.1, 0.5.0, 0.4.2, 0.4.1, 0.4.0, 0.3.18
MAL-2026-17375 ghsa-malware

Oct 12, 2026
npm
baileys-xbats 1.0.3, 1.0.2, 1.0.1, 1.0.0
MAL-2026-17388 ghsa-malware

Oct 12, 2026
npm
@alipclutch/libsignal-node all versions
MAL-2026-17818 ghsa-malware

Oct 12, 2026
npm
@fhkryxv/baileys-new 0.3.22
MAL-2026-17353 ghsa-malware

Oct 12, 2026
npm
@fhkryxv/baileys 1.0.3, 1.0.1
MAL-2026-17352 ghsa-malware

Oct 12, 2026