Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,372 npm 223,233 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,372 reports · Feed

  • RubyGems
    baundlef 1.0.0, 1.0.56462
    MAL-2026-16567 reversing-labs
  • RubyGems
    baumdler 1.0.0, 1.0.38438
    MAL-2026-16566 reversing-labs
  • RubyGems
    basndler 1.0.0, 1.0.53497
    MAL-2026-16565 reversing-labs
  • RubyGems
    banlder 1.0.0, 1.0.7412
    MAL-2026-16564 reversing-labs
  • RubyGems
    bandler 1.0.0, 1.0.80800
    MAL-2026-16563 reversing-labs
  • RubyGems
    bandlef 1.0.0, 1.0.98087
    MAL-2026-16562 reversing-labs
  • RubyGems
    bamdler 1.0.0, 1.0.94078
    MAL-2026-16561 reversing-labs
  • RubyGems
    baiundler 1.0.0, 1.0.44039
    MAL-2026-16560 reversing-labs
  • RubyGems
    ausndler 1.0.0, 1.0.23323
    MAL-2026-16559 reversing-labs
  • RubyGems
    aunlder 1.0.0, 1.0.60483
    MAL-2026-16558 reversing-labs
  • RubyGems
    aundler 1.0.0, 1.0.22809
    MAL-2026-16557 reversing-labs
  • RubyGems
    aundlef 1.0.0, 1.0.88162
    MAL-2026-16556 reversing-labs
  • RubyGems
    aumdler 1.0.0, 1.0.55831
    MAL-2026-16555 reversing-labs
  • RubyGems
    aubndler 1.0.0, 1.0.78264
    MAL-2026-16554 reversing-labs
  • RubyGems
    aiundler 1.0.0, 1.0.42475
    MAL-2026-16553 reversing-labs
  • RubyGems
    abusndler 1.0.0, 1.0.26549
    MAL-2026-16552 reversing-labs
  • RubyGems
    abunxler 1.0.0, 1.0.1863
    MAL-2026-16551 reversing-labs
  • RubyGems
    abunlder 1.0.0, 1.0.29258
    MAL-2026-16550 reversing-labs
  • RubyGems
    abundler 1.0.0, 1.0.29688
    MAL-2026-16549 reversing-labs
  • RubyGems
    abundlef 1.0.0, 1.0.31386
    MAL-2026-16548 reversing-labs
  • RubyGems
    abumdler 1.0.0, 1.0.88171
    MAL-2026-16547 reversing-labs
  • RubyGems
    abndler 1.0.0, 1.0.93884
    MAL-2026-16546 reversing-labs
  • RubyGems
    abiundler 1.0.0, 1.0.36445
    MAL-2026-16545 reversing-labs
  • npm
    @mikudeveloper/baileys 1.0.0
    MAL-2026-16386 amazon-inspector, ghsa-malware
  • npm
    @mr-supun-fernando/supunmd-bail 3.0.3
    MAL-2026-16387 amazon-inspector
  • NuGet
    dip.ioc.extensions 99.0.0
    MAL-2026-16544 reversing-labs
  • NuGet
    dip.ioc 99.0.0
    MAL-2026-16543 reversing-labs
  • NuGet
    dip.infrastructure.context 99.0.0
    MAL-2026-16489 reversing-labs
  • NuGet
    dip.infrastructure 99.0.0
    MAL-2026-16488 reversing-labs
  • NuGet
    dip.api 99.0.0
    MAL-2026-16487 reversing-labs
  • npm
    tlxbnhd 0.0.1
    MAL-2026-16385 amazon-inspector
  • npm
    tldriver 0.0.1
    MAL-2026-16384 amazon-inspector
  • npm
    mxdriver 0.0.2, 0.0.1
    MAL-2026-16383 amazon-inspector
  • npm
    chai-logger 3.0.2
    MAL-2026-16380 amazon-inspector
  • npm
    @tesla-insurance/vinless-quote 9.9.10
    MAL-2026-16378 amazon-inspector, ghsa-malware
  • npm
    @user-services/web-components 9.9.10
    MAL-2026-16379 amazon-inspector, ghsa-malware
  • npm
    take-home-caller-id 1.0.1
    MAL-2026-16382 amazon-inspector
  • npm
    cisco-github-simple 1.0.1
    MAL-2026-16381 amazon-inspector
  • PyPI
    cloushaar-poc-exfil-91827 0.0.1
    MAL-2026-16377 kam193, amazon-inspector
  • npm
    test-react-app-out 1.0.0
    MAL-2026-16375 ghsa-malware, amazon-inspector