Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,371 npm 223,233 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,371 reports · Feed

  • PyPI
    azure-langchain-example 0.1.0
    MAL-2026-17213 kam193, amazon-inspector
  • npm
    wbnr-probe-visible-check 1.0.1
    MAL-2026-17212 ghsa-malware, amazon-inspector
  • npm
    @wbnr/lottiefiles-loader all versions
    MAL-2026-17205 ghsa-malware
  • npm
    @wbnr/design-kit all versions
    MAL-2026-17204 ghsa-malware
  • npm
    kalasnik-npm-simple-test 1.0.0
    MAL-2026-17206 ghsa-malware, amazon-inspector
  • npm
    kjj81 1.0.0
    MAL-2026-17207 ghsa-malware, amazon-inspector
  • npm
    uuid-date all versions
    MAL-2026-17210 ghsa-malware
  • npm
    riot-private all versions
    MAL-2026-17208 ghsa-malware
  • npm
    vinzzsync-wacli 1.0.0
    MAL-2026-17211 ghsa-malware, amazon-inspector
  • npm
    tanksync 1.0.7, 1.0.4, 1.0.5, 1.0.8, 1.0.3, 1.0.1, 1.0.6, 1.0.2, 1.0.0
    MAL-2026-17209 ghsa-malware, amazon-inspector
  • npm
    @consts/links all versions
    MAL-2026-17202 ghsa-malware
  • npm
    @digi-kernel/digi-kernel-constrains all versions
    MAL-2026-17203 ghsa-malware
  • npm
    @bb1ptest23/test-paket 1.0.3
    MAL-2026-17201 ossf-package-analysis, amazon-inspector
  • PyPI
    scrapetools2 1.2.1, 1.2.0, 0.2.0, 0.2.1
    MAL-2026-17199 amazon-inspector
  • PyPI
    aseity 0.1.0
    MAL-2026-17200 kam193, amazon-inspector 4 IOCs
  • PyPI
    caracas4check 1.1.1, 1.1.2
    MAL-2026-17198 kam193, amazon-inspector 2 IOCs
  • PyPI
    coinscan 0.1.0
    MAL-2026-17197 kam193, amazon-inspector 4 IOCs
  • PyPI
    claudedashbord 0.1.0, 0.1.1, 0.1.2, 0.1.3
    MAL-2026-17195 kam193, amazon-inspector 4 IOCs
  • PyPI
    donutpromotion 0.1.0
    MAL-2026-17196 kam193, amazon-inspector 4 IOCs
  • PyPI
    metrics-sdk 999.0.0, 1000.0.0, 1001.0.0
    MAL-2026-17194 kam193, amazon-inspector
  • PyPI
    metrio 999.0.0, 1000.0.0, 1001.0.0
    MAL-2026-17193 kam193, amazon-inspector
  • PyPI
    donutautosellsrc 0.3.7, 0.3.8, 0.3.9
    MAL-2026-17192 kam193, amazon-inspector 3 IOCs
  • PyPI
    requests-cache-utils 1.0.0
    MAL-2026-17191 kam193 2 IOCs
  • npm
    chai-as-relay 1.2.1
    MAL-2026-17189 amazon-inspector
  • npm
    cma-self-hosted-sandbox-cf 1.0.0
    MAL-2026-17190 amazon-inspector
  • PyPI
    sherpy 0.1.0, 0.1.1
    MAL-2026-17188 kam193, amazon-inspector
  • npm
    @digift/cli 99.99.100
    MAL-2026-17187 ossf-package-analysis, ghsa-malware
  • npm
    @nubjs/types 0.9.4
    MAL-2026-17186 ghsa-malware
  • npm
    @zeronexcode/baileys 7.0.0-zeronex.8
    MAL-2026-17326 amazon-inspector, ghsa-malware
  • npm
    @airbnb-extended/typescript-config 99.9.1
    MAL-2026-17184 amazon-inspector, ghsa-malware
  • npm
    shoplist-app 993.99.99, 99.99.99
    MAL-2026-17185 amazon-inspector
  • PyPI
    tego-managed-agents-test 0.1.0
    MAL-2026-17183 kam193, amazon-inspector 1 IOC
  • npm
    app-sca-info-banking 0.0.24
    MAL-2026-17182 ossf-package-analysis, amazon-inspector, ghsa-malware
  • PyPI
    reqparser 1.0.0, 1.0.1
    MAL-2026-17181 kam193, amazon-inspector 2 IOCs
  • npm
    @alphaspace/core 99.0.0, 99.0.1, 99.0.2, 99.0.3
    MAL-2026-17169 amazon-inspector
  • npm
    n8n-nodes-moonlet-helpers 1.0.0, 1.0.4
    MAL-2026-17176 amazon-inspector
  • npm
    n8n-nodes-moonlet-utils 1.0.0
    MAL-2026-17177 amazon-inspector
  • npm
    n8n-nodes-flowstats 1.0.0
    MAL-2026-17175 amazon-inspector
  • npm
    wallet-connect-adapter 1.4.2
    MAL-2026-17179 amazon-inspector
  • npm
    agency-testts 1.0.0
    MAL-2026-17171 amazon-inspector