Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,345 npm 223,208 PyPI 11,993 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,345 reports · Feed

npm
real-gen-erator-one-shade-h-a-c-k-gen-erat-or-8ks294 all versions
MAL-2026-18560 ghsa-malware

Nov 3, 2026
npm
new-code-unlim-ited-my-time-at-portia-h-a-c-k-gen-erat-or-i477p4 all versions
MAL-2026-18558 ghsa-malware

Nov 3, 2026
npm
new-code-unlim-ited-jurassic-world-m-od-f-r-e-e-wuo1ky all versions
MAL-2026-18557 ghsa-malware

Nov 3, 2026
npm
more-resour-ces-gen-tailed-demon-slayer-h-a-c-k-gen-erat-or-yas2jz all versions
MAL-2026-18556 ghsa-malware

Nov 3, 2026
npm
more-resour-ces-gen-stickman-legends-f-r-e-e-h-a-c-k-gen-erat-or-bv4n15 all versions
MAL-2026-18555 ghsa-malware

Nov 3, 2026
npm
more-resour-ces-gen-disney-mirrorverse-h-a-c-k-gen-erat-or-gulnxl all versions
MAL-2026-18554 ghsa-malware

Nov 3, 2026
npm
more-resour-ces-gen-daylio-h-a-c-k-gen-erat-or-qvi0r6 all versions
MAL-2026-18553 ghsa-malware

Nov 3, 2026
npm
latest-update-my-talking-angela-h-a-c-k-gen-erat-or-q8z42f all versions
MAL-2026-18551 ghsa-malware

Nov 3, 2026
npm
l52upm all versions
MAL-2026-18550 ghsa-malware

Nov 3, 2026
npm
k7nhgj all versions
MAL-2026-18548 ghsa-malware

Nov 3, 2026
npm
j5ugvu all versions
MAL-2026-18546 ghsa-malware

Nov 3, 2026
npm
gene-rator-new-rope-hero-h-a-c-k-gen-erat-or-azkrvc all versions
MAL-2026-18542 ghsa-malware

Nov 3, 2026
npm
gene-rator-new-hearthstone-h-a-c-k-gen-erat-or-9wy4b5 all versions
MAL-2026-18541 ghsa-malware

Nov 3, 2026
npm
code-resour-ces-new-app-cloner-premium-9upyk2 all versions
MAL-2026-18539 ghsa-malware

Nov 3, 2026
npm
9ct8bi all versions
MAL-2026-18536 ghsa-malware

Nov 3, 2026
npm
1b67v5 all versions
MAL-2026-18531 ghsa-malware

Nov 3, 2026
npm
updated-gen-erator-carx-drift-racing-h-a-c-k-gen-erat-or-tkfm7v all versions
MAL-2026-18567 ghsa-malware

Nov 3, 2026
npm
@shein-risk/si_verify all versions
MAL-2026-18537 ghsa-malware

Nov 3, 2026
npm
@vanzxy/nusa all versions
MAL-2026-18530 ghsa-malware

Nov 3, 2026
npm
@vanzxy/baileys all versions
MAL-2026-18529 ghsa-malware

Nov 3, 2026
npm
@lynnidoffc/libsignal-node all versions
MAL-2026-18528 ghsa-malware

Nov 3, 2026
npm
@lynnidoffc/baileys all versions
MAL-2026-18527 ghsa-malware

Nov 3, 2026
npm
@zhengliyoux/baileys 0.0.0-stage, 1.0.2, 1.0.3, 1.0.4
MAL-2026-19115

Nov 3, 2026
npm
@lekzsync/baileys 0.0.0-stage, 1.0.5
MAL-2026-19109

Nov 3, 2026
npm
raiden-baileys 0.0.0-stage, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7
MAL-2026-19108

Nov 3, 2026
npm
sauruspro-bail 0.0.0-stage, 5.0.0, 5.0.1, 5.0.2-alpha.spr.test
MAL-2026-19073

Nov 3, 2026
npm
@yshtxxproject/baileys 0.0.0-stage, 0.0.1
MAL-2026-19072

Nov 3, 2026
npm
@zanxiky/baileys 0.0.0-stage, 1.1.0
MAL-2026-19059

Nov 3, 2026
npm
nulio-connector 1.1.16, 1.1.10, 1.1.11
MAL-2026-18526 ghsa-malware

Nov 3, 2026
npm
blitzstrike 2.4.180
MAL-2026-18525 ghsa-malware

Nov 3, 2026
npm
dsh-moss-wallpaper 3.4.0
MAL-2026-18523 ghsa-malware

Nov 3, 2026
npm
vibes-plug 4.5.0
MAL-2026-18524 ghsa-malware

Nov 3, 2026
npm
dsh-moss-console 3.3.0
MAL-2026-18522 ghsa-malware

Nov 3, 2026
npm
luna-baileys 9.0.33, 9.0.28, 9.0.27, 9.0.26, 9.0.25, 9.0.24, 1.0.0, 0.0.0-stage
MAL-2026-18520 ghsa-malware

Nov 3, 2026
npm
paidwithtab 3.0.0
MAL-2026-18521 ghsa-malware

Nov 3, 2026
RubyGems
dopc-client 1.0.0, 10.0.0
MAL-2026-18518 amazon-inspector

Nov 3, 2026
npm
@atedone/workspace-context 0.0.23, 0.0.14, 0.0.25, 0.0.22, 0.0.20, 0.0.15, 0.0.19, 0.0.13, 0.0.12, 0.0.18,…
MAL-2026-18517 amazon-inspector

Nov 3, 2026
npm
scdn-jquery 0.1.6
MAL-2026-18455 ghsa-malware

Nov 3, 2026
npm
@corexium/xbails 0.0.7
MAL-2026-18491 amazon-inspector

Nov 3, 2026
npm
unemployed_xerinae-toolteadev 1.4.4
MAL-2026-18667

Nov 2, 2026