Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,349 npm 223,211 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,349 reports · Feed

  • npm
    @fer2809fl/baileys 7.0.7, 7.0.6, 7.0.5, 7.0.4, 7.0.2, 7.0.1, 7.0.0, 7.0.0-rc13, 1.4.9, 1.4.7, 1.4.…
    MAL-2026-17750 ghsa-malware
  • npm
    cloud-baileys 1.1.42, 1.1.41, 1.1.40, 1.1.39, 1.1.38, 1.1.37, 1.1.36, 1.1.35, 1.1.34, 1.1.33,…
    MAL-2026-17751 ghsa-malware
  • npm
    arsya-baileys 9.2.0, 9.2.2, 9.2.4, 9.2.1, 9.2.3
    MAL-2026-17387 ghsa-malware
  • npm
    @myorder-frontend-commons/analytics 99.0.0, 10.0.0, 3.0.0, 1.0.0, 1.2.0, 0.0.1, 2.0.0, 0.1.0, 5.0.0, 0.2.0, 1.1.0, …
    MAL-2026-17749 ossf-package-analysis, amazon-inspector, ghsa-malware 3 IOCs
  • npm
    kmf-i18n 100.100.102, 100.100.101, 100.100.100
    MAL-2026-17747 ossf-package-analysis, amazon-inspector
  • npm
    test-account-portal-fe 100.100.102, 100.100.100, 100.100.101
    MAL-2026-17748 ossf-package-analysis, amazon-inspector
  • npm
    kmf-bootstrap 100.100.102, 100.100.103, 100.100.106, 100.100.101, 100.100.100
    MAL-2026-17746 ossf-package-analysis, amazon-inspector
  • npm
    bungoma 1.1.0, 1.0.1, 1.0.0
    MAL-2026-17389 amazon-inspector, ghsa-malware
  • npm
    @bellaxchuu/teambails 1.1.9, 1.1.8, 1.1.6, 1.1.4, 1.2.4
    MAL-2026-17348 amazon-inspector
  • npm
    @tunstock/remact-dom 19.2.0
    MAL-2026-17745 amazon-inspector
  • PyPI
    py2ops 2.2
    MAL-2026-17807 5 IOCs
  • npm
    kmf-vendor-pack 99.0.0, 100.100.101, 100.100.100, 100.100.106
    MAL-2026-17744 ossf-package-analysis, amazon-inspector 2 IOCs
  • npm
    tailwind-animatecss-form all versions
    MAL-2026-17743 ghsa-malware
  • npm
    hanncap all versions
    MAL-2026-17740 ghsa-malware
  • npm
    asepxyz-baileys all versions
    MAL-2026-17733 ghsa-malware
  • npm
    razamodsxasepxyz all versions
    MAL-2026-17742 ghsa-malware
  • npm
    pahinuy all versions
    MAL-2026-17741 ghsa-malware
  • npm
    asepxyzz all versions
    MAL-2026-17739 ghsa-malware
  • npm
    asepxyzxrazamodsnew-baileys all versions
    MAL-2026-17738 ghsa-malware
  • npm
    asepxyznew all versions
    MAL-2026-17737 ghsa-malware
  • npm
    asepxyz12 all versions
    MAL-2026-17736 ghsa-malware
  • npm
    asepxyz-signal all versions
    MAL-2026-17735 ghsa-malware
  • npm
    asepxyz-eslint-config all versions
    MAL-2026-17734 ghsa-malware
  • npm
    asepxyz all versions
    MAL-2026-17732 ghsa-malware
  • npm
    @aseppxyzz12/baileys all versions
    MAL-2026-17731 ghsa-malware
  • npm
    pxnpm 7.0.0-beta.6, 7.0.0-beta.8, 7.0.0, 7.0.1, 7.0.2
    MAL-2026-17710 amazon-inspector 5 IOCs
  • PyPI
    ig-gox 1.0.0
    MAL-2026-17712 kam193, amazon-inspector 2 IOCs
  • npm
    wix-reg-poc-bypass 1.0.0
    MAL-2026-17711 amazon-inspector
  • crates.io
    sharpnes all versions
    MAL-2026-17713 2 IOCs
  • npm
    @galicia-toolkit-nestjs-20-lite/paas 1.0.20, 1.0.24, 1.0.21, 1.0.22
    MAL-2026-17730 amazon-inspector 2 IOCs
  • npm
    @galicia-toolkit-nestjs-20-lite/commons 999.0.2, 999.0.3, 999.0.1
    MAL-2026-17729 amazon-inspector 2 IOCs
  • npm
    @galicia-toolkit-nestjs-20-lite/archetype 999.0.5, 999.0.2, 999.0.1, 999.0.3
    MAL-2026-17728 amazon-inspector 2 IOCs
  • npm
    @galicia-toolkit-nestjs-20/paas 3.0.3, 3.0.5, 3.0.7, 3.0.6, 999.0.1
    MAL-2026-17727 amazon-inspector 2 IOCs
  • npm
    @galicia-toolkit-nestjs-20/commons 999.0.2, 999.0.3, 999.0.1
    MAL-2026-17726 amazon-inspector 2 IOCs
  • npm
    @galicia-toolkit-nestjs-20/archetype 999.0.2, 999.0.1
    MAL-2026-17725 amazon-inspector 2 IOCs
  • npm
    @galicia-toolkit-nestjs/swagger 999.0.3, 999.0.2, 999.0.1
    MAL-2026-17724 amazon-inspector 2 IOCs
  • npm
    @galicia-toolkit-nestjs/paas 999.0.4, 999.0.3, 999.0.5, 999.0.6
    MAL-2026-17723 amazon-inspector 2 IOCs
  • npm
    @galicia-toolkit-nestjs/commons 999.0.7, 999.0.1, 999.0.8, 999.0.6, 3.0.1
    MAL-2026-17722 amazon-inspector 2 IOCs
  • npm
    @galicia-toolkit-nestjs/archetype 999.0.6, 999.0.5, 999.0.1
    MAL-2026-17721 amazon-inspector 2 IOCs
  • npm
    @galicia-toolkit-cheques-nc/front 999.0.1, 999.0.3, 999.0.2
    MAL-2026-17720 amazon-inspector 2 IOCs