Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,371 npm 223,233 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,371 reports · Feed

  • npm
    @wizloft/harness-memory all versions
    MAL-2026-16428 ghsa-malware
  • npm
    @wizloft/harness-evidence all versions
    MAL-2026-16426 ghsa-malware
  • npm
    @wizloft/harness-authority all versions
    MAL-2026-16423 ghsa-malware
  • npm
    @httttt/mcp-npx-fetch-1 all versions
    MAL-2026-16422 ghsa-malware
  • npm
    @memtensor/memos-cloud-openclaw-plugin 0.1.25, 0.1.23, 0.1.21
    MAL-2026-16476 ghsa-malware, amazon-inspector 4 IOCs
  • PyPI
    memoryos 2.0.34
    MAL-2026-16475 kam193, amazon-inspector 4 IOCs
  • PyPI
    kerokwis 99
    MAL-2026-16421 kam193
  • RubyGems
    kerokwis 99
    MAL-2026-16420 ossf-package-analysis
  • npm
    @gsutevil/hta-stage 1.62.0
    MAL-2026-16419 amazon-inspector
  • npm
    n8n-nodes-data-transformer-utils 1.0.0
    MAL-2026-16418 amazon-inspector
  • npm
    @tvg-mar/promos-context 9.9.10
    MAL-2026-16412 amazon-inspector, ghsa-malware
  • npm
    @tvg-mar/promos-gtm 9.9.10
    MAL-2026-16413 amazon-inspector, ghsa-malware
  • npm
    @tvg-mar/storyblok-bridge 9.9.10
    MAL-2026-16414 amazon-inspector, ghsa-malware
  • npm
    @tvg-mar/utils 9.9.10
    MAL-2026-16416 amazon-inspector, ghsa-malware
  • npm
    @tvg-mar/tvg-promos-atomic-ui 9.9.10
    MAL-2026-16415 amazon-inspector, ghsa-malware
  • RubyGems
    wurl_show_data 3.1.42.99
    MAL-2026-16466 ossf-package-analysis
  • RubyGems
    no-fun 999.99.99
    MAL-2026-16411 ossf-package-analysis
  • PyPI
    auclean 0.4.2, 0.4.3, 0.4.4
    MAL-2026-16410 kam193, amazon-inspector 1 IOC
  • npm
    ubiquiti-agents-link-mcp 0.0.1, 0.0.2, 0.2.0, 0.2.1
    MAL-2026-16409 ossf-package-analysis, amazon-inspector, ghsa-malware
  • PyPI
    snap-queue 1.0.0
    MAL-2026-16408 kam193, amazon-inspector
  • PyPI
    poly-check-b 1.0.0
    MAL-2026-16407 kam193
  • PyPI
    crypto-trader-py 1.0.0
    MAL-2026-16406 kam193, amazon-inspector
  • npm
    tailwind-form-styles 0.5.1
    MAL-2026-16405 ghsa-malware, amazon-inspector
  • npm
    node-env-buffer 2.2.2, 2.2.3
    MAL-2026-16403 ghsa-malware, amazon-inspector
  • npm
    envparse3 1.0.1
    MAL-2026-16395 ghsa-malware, amazon-inspector
  • npm
    envparse2 1.0.1
    MAL-2026-16394 ghsa-malware, amazon-inspector
  • npm
    envforge3 1.0.1
    MAL-2026-16393 ghsa-malware, amazon-inspector
  • npm
    envforge2 1.0.1
    MAL-2026-16392 ghsa-malware, amazon-inspector
  • npm
    sysverify 1.0.9, 2.0.10, 2.0.9
    MAL-2026-16404 ghsa-malware, amazon-inspector
  • npm
    ndmcmsujey 1.0.0
    MAL-2026-16402 ghsa-malware, amazon-inspector
  • npm
    ndmckauxuoincv 1.0.0
    MAL-2026-16401 ghsa-malware, amazon-inspector
  • npm
    ndmcjcxiebysfdb 1.0.2, 1.0.0, 1.0.1
    MAL-2026-16400 ghsa-malware, amazon-inspector
  • npm
    cloudndmcedu 1.0.0
    MAL-2026-16391 ghsa-malware, amazon-inspector
  • npm
    lufxchwmxwyps 1.0.1, 1.0.0
    MAL-2026-16399 ghsa-malware, amazon-inspector
  • npm
    luftmvfiwgxydes 1.0.3, 1.0.4, 1.0.5, 1.0.1, 1.0.2, 1.0.0
    MAL-2026-16398 ghsa-malware, amazon-inspector
  • npm
    kambxjowhdsgyw 1.0.1, 1.0.2, 1.0.0
    MAL-2026-16397 ghsa-malware, amazon-inspector
  • npm
    fdhcxvnwhjiofv 1.0.0
    MAL-2026-16396 ghsa-malware, amazon-inspector
  • npm
    oracle-redis 5.11.3
    MAL-2026-16390 amazon-inspector, ghsa-malware
  • npm
    noverojava 1.1.0, 1.0.9
    MAL-2026-16389 amazon-inspector
  • npm
    nodetokyo 1.0.8
    MAL-2026-16388 amazon-inspector