Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,349 npm 223,211 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,349 reports · Feed

npm
function-color 1.0.0, 1.7.3
MAL-2026-17647 ghsa-malware

Oct 7, 2026
npm
function-flag 1.7.3
MAL-2026-17648 ghsa-malware

Oct 7, 2026
npm
tailwind-animatecss-uniform 2.0.7
MAL-2026-17667 ghsa-malware

Oct 7, 2026
npm
animatecss-tailwind-bridge 2.0.6
MAL-2026-17666 ghsa-malware

Oct 7, 2026
npm
animatecss-tailwind-adapter 2.0.6
MAL-2026-17665

Oct 7, 2026
npm
tailwindcss-animatecss-keyframes 1.0.0
MAL-2026-17646 ghsa-malware, amazon-inspector

Oct 7, 2026
npm
@ikyyjee/ikkysingle 0.1.2
MAL-2026-17356 ghsa-malware, amazon-inspector

Oct 7, 2026
npm
@ikyyjee/ikyysingle 1.7.8
MAL-2026-17358 ghsa-malware

Oct 7, 2026
npm
@ikyyjee/ikyysinggle 1.7.7
MAL-2026-17357 ghsa-malware

Oct 7, 2026
npm
vectorizers all versions
MAL-2026-17645 ghsa-malware

Oct 7, 2026
npm
random-certs 0.0.1
MAL-2026-17644 ghsa-malware, amazon-inspector 1 IOC

Oct 7, 2026
npm
waie-crash-baileys 1.0.2, 1.0.0, 0.0.0-stage, 1.0.1
MAL-2026-17643 ghsa-malware, amazon-inspector

Oct 7, 2026
npm
personio-pipeline-projen 1.171.31
MAL-2026-17642 amazon-inspector 3 IOCs

Oct 7, 2026
npm
troubleshooting 0.1.0, 1.0.0, 1.0.1, 99.0.1, 3.0.0, 1.1.0, 2.0.1
MAL-2026-17641 amazon-inspector 2 IOCs

Oct 7, 2026
npm
browser-metrics-plugin.contrib 0.0.1, 1.0.0, 1.1.0, 99.0.1, 1.0.1, 2.0.1
MAL-2026-17640 amazon-inspector 2 IOCs

Oct 7, 2026
PyPI
lore-cs 1.0.0
MAL-2026-17639 kam193, amazon-inspector

Oct 6, 2026
npm
css-jptvix-polyfill 1.0.0
MAL-2026-17638 amazon-inspector 4 IOCs

Oct 6, 2026
npm
@kxa/xbails 0.0.5
MAL-2026-17363 ghsa-malware, amazon-inspector

Oct 6, 2026
npm
captchetat-angularv8 all versions
MAL-2026-17637 ghsa-malware

Oct 6, 2026
npm
hardhat-init 2.21.0
MAL-2026-17636 amazon-inspector

Oct 6, 2026
npm
@badzz88/baileys 8.5.9, 8.5.7, 8.5.5, 8.5.4, 8.5.3, 8.5.2, 8.5.1, 8.4.9, 8.6.0
MAL-2026-17341 amazon-inspector, ghsa-malware

Oct 6, 2026
npm
internallib_v23 1.0.1
MAL-2026-17632 amazon-inspector

Oct 6, 2026
npm
@pinecone-experience/messages 99.9.1
MAL-2026-17631 amazon-inspector, ghsa-malware

Oct 6, 2026
npm
internallib_v30 1.0.1
MAL-2026-17633 amazon-inspector

Oct 6, 2026
npm
internallib_v86 1.0.2
MAL-2026-17634 amazon-inspector

Oct 6, 2026
npm
internallib_v875 1.0.1
MAL-2026-17635 amazon-inspector

Oct 6, 2026
PyPI
erc7730-hackathon 99.0.0
MAL-2026-17628 kam193

Oct 5, 2026
npm
serpacksven2 1.0.0
MAL-2026-17627 ghsa-malware, amazon-inspector

Oct 5, 2026
npm
serpacksven1 1.0.6
MAL-2026-17626 ghsa-malware, amazon-inspector

Oct 5, 2026
npm
serpacksven 1.0.1, 1.0.0, 1.0.4, 1.0.2
MAL-2026-17625 ghsa-malware, amazon-inspector

Oct 5, 2026
npm
documenclient 1.0.5, 1.0.4
MAL-2026-17624 ghsa-malware, amazon-inspector

Oct 5, 2026
npm
css-nrmgzn-polyfill 1.0.0
MAL-2026-17576 amazon-inspector

Oct 5, 2026
npm
css-eqxcdx-polyfill 1.0.0
MAL-2026-17573 amazon-inspector

Oct 5, 2026
npm
css-kfvwax-polyfill 1.0.0
MAL-2026-17575 amazon-inspector

Oct 5, 2026
npm
css-gwqyid-polyfill 1.0.0
MAL-2026-17574 amazon-inspector

Oct 5, 2026
npm
css-yhpodl-polyfill 1.0.0
MAL-2026-17578 amazon-inspector

Oct 5, 2026
npm
css-vvgsze-polyfill 1.0.0
MAL-2026-17577 amazon-inspector

Oct 5, 2026
npm
dzyhaxz-libsignal all versions
MAL-2026-17623 ghsa-malware

Oct 5, 2026
npm
dzyhaxz-baileys 1.1.1, 1.1.0
MAL-2026-17622 ghsa-malware, amazon-inspector

Oct 5, 2026
npm
dzyclutch-libsignal-node all versions
MAL-2026-17621 ghsa-malware

Oct 5, 2026