Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,370 npm 223,232 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,370 reports · Feed

PyPI
anthropic-sdk 0.1.0
MAL-2026-17472 kam193, amazon-inspector 4 IOCs

Oct 4, 2026
npm
virgil-cli 0.1.4
MAL-2026-17630 amazon-inspector 2 IOCs

Oct 3, 2026
PyPI
zencleaner 1.0.0, 1.0.3, 1.0.3.1
MAL-2026-17629 amazon-inspector 1 IOC

Oct 3, 2026
PyPI
caoxiltts 0.1.0, 0.1.1
MAL-2026-17471 kam193, amazon-inspector

Oct 3, 2026
PyPI
infrabench 0.1.0, 0.1.1, 0.2.0
MAL-2026-17469 kam193, amazon-inspector

Oct 3, 2026
PyPI
voxcpmruntime 0.1.0
MAL-2026-17470 kam193, amazon-inspector

Oct 3, 2026
PyPI
voxcpmintel 0.1.0
MAL-2026-17468 kam193

Oct 3, 2026
PyPI
voxcpmeval 0.1.0
MAL-2026-17465 kam193

Oct 3, 2026
PyPI
voxcpmkit 0.1.0
MAL-2026-17466 kam193

Oct 3, 2026
PyPI
voxcpmui4 0.2.0
MAL-2026-17467 kam193

Oct 3, 2026
PyPI
voxcpmui3 0.1.0
MAL-2026-17464 kam193, amazon-inspector

Oct 3, 2026
npm
@nagular/router 2.2.1
MAL-2026-17500 amazon-inspector 2 IOCs

Oct 3, 2026
npm
@angularr/router 2.2.0
MAL-2026-17494 amazon-inspector 2 IOCs

Oct 3, 2026
npm
@babell/core 8.0.6
MAL-2026-17497 amazon-inspector 2 IOCs

Oct 3, 2026
npm
@nagular/core 1.0.67
MAL-2026-17499 amazon-inspector 2 IOCs

Oct 3, 2026
npm
@angularr/core 1.0.67
MAL-2026-17493 amazon-inspector 2 IOCs

Oct 3, 2026
npm
@angularr/cli 22.2.1
MAL-2026-17492 amazon-inspector 2 IOCs

Oct 3, 2026
npm
express-enhanced 5.2.2
MAL-2026-17489 amazon-inspector 2 IOCs

Oct 3, 2026
npm
express-fork 5.2.2
MAL-2026-17490 amazon-inspector 2 IOCs

Oct 3, 2026
PyPI
echogen 1.0.0
MAL-2026-17462 kam193, amazon-inspector

Oct 3, 2026
PyPI
voxcpmtts3 0.1.0, 0.1.1, 0.1.2
MAL-2026-17463 kam193, amazon-inspector

Oct 3, 2026
PyPI
voxel-tts 0.5.0, 0.5.1
MAL-2026-17461 kam193, amazon-inspector

Oct 3, 2026
PyPI
voxeval 0.4.2, 0.4.3, 0.4.4, 0.4.5
MAL-2026-17457 kam193, amazon-inspector

Oct 2, 2026
npm
ui.dist.min.js all versions
MAL-2026-17460 ghsa-malware

Oct 2, 2026
npm
ui-base-colors all versions
MAL-2026-17459 ghsa-malware

Oct 2, 2026
npm
translate-base-font 1.4.2
MAL-2026-17458 ghsa-malware, amazon-inspector

Oct 2, 2026
npm
@smwebserver/static 99.9.1
MAL-2026-17456 ossf-package-analysis, amazon-inspector, ghsa-malware

Oct 2, 2026
PyPI
dedh-devops-automation 0.0.1, 5.0.0, 5.6.0, 5.6.1, 5.6.999, 5.8.0, 5.8.1, 5.9.0
MAL-2026-17455 kam193, amazon-inspector 1 IOC

Oct 2, 2026
npm
kartykgithub-ph-f 1.0.0
MAL-2026-17426 ghsa-malware

Oct 2, 2026
npm
kartykgithub-ph-e 1.0.0
MAL-2026-17425 ghsa-malware

Oct 2, 2026
npm
kartykgithub-ph-b 1.0.0, 0.0.1-security.0, 0.0.1-security
MAL-2026-17424 ghsa-malware

Oct 2, 2026
Go
gogets.dev/btreex all versions
MAL-2026-17454 5 IOCs

Oct 2, 2026
Go
gocommunity.io/orderedbtree all versions
MAL-2026-17453 5 IOCs

Oct 2, 2026
npm
wailib 1.0.0
MAL-2026-17451

Oct 1, 2026
npm
mikuhostt-baileys 1.0.0, 1.0.1, 1.0.2
MAL-2026-17447

Oct 1, 2026
npm
danz-bails 1.0.0, 1.1.0
MAL-2026-17444

Oct 1, 2026
npm
illusion-datalab 1.1.5, 1.1.4, 1.1.3, 1.1.2, 1.1.1
MAL-2026-17423 ghsa-malware

Oct 1, 2026
PyPI
shortneer 0.1.0
MAL-2026-17422 kam193, amazon-inspector

Oct 1, 2026
PyPI
spo365-graph 1.0.0, 1.1.0, 1.1.1, 1.1.2
MAL-2026-17421 kam193, amazon-inspector 1 IOC

Oct 1, 2026
npm
@kelvdra/baileys 1.0.6-rc.1, 1.0.6, 1.0.5-rc.3, 1.0.6-rc.4, 1.0.6-rc.5, 1.0.6-rc.2, 1.0.6-rc.6, …
MAL-2026-17362 amazon-inspector

Oct 1, 2026