Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,371 npm 223,233 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,371 reports · Feed

  • RubyGems
    bundlwr 1.0.0, 1.0.52738
    MAL-2026-17006 reversing-labs
  • RubyGems
    bundlwf 1.0.0, 1.0.97876
    MAL-2026-17005 reversing-labs
  • RubyGems
    bundlur 1.0.0, 1.0.72871
    MAL-2026-17004 reversing-labs
  • RubyGems
    bundluf 1.0.0, 1.0.93384
    MAL-2026-17003 reversing-labs
  • RubyGems
    bundlsr 1.0.0, 1.0.73267
    MAL-2026-17002 reversing-labs
  • RubyGems
    bundlsf 1.0.0, 1.0.88915
    MAL-2026-17001 reversing-labs
  • RubyGems
    bundlser 1.0.0, 1.0.52868
    MAL-2026-17000 reversing-labs
  • RubyGems
    bundlsef 1.0.0, 1.0.8469
    MAL-2026-16999 reversing-labs
  • RubyGems
    bundlrr 1.0.0, 1.0.58217
    MAL-2026-16998 reversing-labs
  • RubyGems
    bundlrf 1.0.0, 1.0.45596
    MAL-2026-16997 reversing-labs
  • RubyGems
    bundlrer 1.0.0, 1.0.73331
    MAL-2026-16996 reversing-labs
  • RubyGems
    bundlref 1.0.0, 1.0.88055
    MAL-2026-16995 reversing-labs
  • RubyGems
    bundlre 1.0.68430, 1000.0.0
    MAL-2026-16994 reversing-labs
  • RubyGems
    bundlor 1.0.0, 1.0.92488
    MAL-2026-16993 reversing-labs
  • RubyGems
    bundlof 1.0.0, 1.0.41334
    MAL-2026-16992 reversing-labs
  • RubyGems
    bundloer 1.0.0, 1.0.91886
    MAL-2026-16991 reversing-labs
  • RubyGems
    bundloef 1.0.0, 1.0.91422
    MAL-2026-16990 reversing-labs
  • RubyGems
    bundlner 1.0.0, 1.0.66161
    MAL-2026-16989 reversing-labs
  • RubyGems
    bundlnef 1.0.0, 1.0.35570
    MAL-2026-16988 reversing-labs
  • RubyGems
    bundller 1.0.0, 1.0.48518
    MAL-2026-16987 reversing-labs
  • RubyGems
    bundllef 1.0.0, 1.0.18131
    MAL-2026-16986 reversing-labs
  • RubyGems
    bundlir 1.0.0, 1.0.74460
    MAL-2026-16985 reversing-labs
  • RubyGems
    bundlif 1.0.0, 1.0.2227
    MAL-2026-16984 reversing-labs
  • RubyGems
    bundlier 1.0.0, 1.0.26600
    MAL-2026-16983 reversing-labs
  • RubyGems
    bundlief 1.0.0, 1.0.47682
    MAL-2026-16982 reversing-labs
  • RubyGems
    bundlfe 1.0.0, 1.0.91837
    MAL-2026-16981 reversing-labs
  • RubyGems
    bundlf 1.0.0, 1.0.41559
    MAL-2026-16980 reversing-labs
  • RubyGems
    bundlev 1.0.0, 1.0.40584
    MAL-2026-16979 reversing-labs
  • RubyGems
    bundleu 1.0.0, 1.0.85893
    MAL-2026-16978 reversing-labs
  • RubyGems
    bundlet 1.0.0, 1.0.35369
    MAL-2026-16977 reversing-labs
  • RubyGems
    bundlesr 1.0.0, 1.0.73709
    MAL-2026-16976 reversing-labs
  • RubyGems
    bundlesf 1.0.0, 1.0.78708
    MAL-2026-16975 reversing-labs
  • RubyGems
    bundlers 1.0.0, 1.0.86125
    MAL-2026-16974 reversing-labs
  • RubyGems
    bundlerr 1.0.15959, 1000.0.0
    MAL-2026-16973 reversing-labs
  • RubyGems
    bundlero 1.0.0, 1.0.62898
    MAL-2026-16972 reversing-labs
  • RubyGems
    bundlern 1.0.0, 1.0.19565
    MAL-2026-16971 reversing-labs
  • RubyGems
    bundlerl 1.0.0, 1.0.92832
    MAL-2026-16970 reversing-labs
  • RubyGems
    bundleri 1.0.0, 1.0.41449
    MAL-2026-16969 reversing-labs
  • RubyGems
    bundlerf 1.0.0, 1.0.15023
    MAL-2026-16968 reversing-labs
  • RubyGems
    bundlere 1.0.0, 1.0.43208
    MAL-2026-16967 reversing-labs