Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,377 npm 223,238 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,377 reports · Feed

  • npm
    @user-services/web-components 9.9.10
    MAL-2026-16379 amazon-inspector, ghsa-malware
  • npm
    take-home-caller-id 1.0.1
    MAL-2026-16382 amazon-inspector
  • npm
    cisco-github-simple 1.0.1
    MAL-2026-16381 amazon-inspector
  • PyPI
    cloushaar-poc-exfil-91827 0.0.1
    MAL-2026-16377 kam193, amazon-inspector
  • npm
    test-react-app-out 1.0.0
    MAL-2026-16375 ghsa-malware, amazon-inspector
  • npm
    test-react-app-in 1.0.0
    MAL-2026-16374 ghsa-malware, amazon-inspector
  • npm
    test-react-app-way 1.0.0
    MAL-2026-16376 ghsa-malware, amazon-inspector
  • npm
    @zig-design-system/react 99.0.0
    MAL-2026-16372 ghsa-malware, reversing-labs
  • npm
    wos-library 999.999.999, 99.0.0
    MAL-2026-16373 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    @vite-tab/tabui 7.15.16
    MAL-2026-16371 ghsa-malware, amazon-inspector
  • npm
    @uol-afiliados/affiliated-config-lib 102.0.0
    MAL-2026-16370 amazon-inspector, ghsa-malware
  • npm
    math-universe 1.0.2, 1.0.0, 1.0.1
    MAL-2026-16367 ghsa-malware, amazon-inspector
  • npm
    mathsbase 1.0.2, 1.0.1, 1.0.0
    MAL-2026-16369 ghsa-malware, amazon-inspector
  • npm
    bytepack-probe-a7x3 1.0.0, 1.0.1
    MAL-2026-16364 amazon-inspector
  • npm
    mathmain 1.0.0
    MAL-2026-16368 ghsa-malware, amazon-inspector
  • npm
    blue-string-formatter-utilss 1.2.0
    MAL-2026-16363 amazon-inspector
  • npm
    my-ctf-helper-script-9921 1.0.0
    MAL-2026-16365 amazon-inspector, ghsa-malware
  • PyPI
    pullgetsage 0.1.2, 0.1.0, 0.1.1
    MAL-2026-16366 amazon-inspector, kam193 2 IOCs
  • npm
    @asdfaskdjfksadhfkasf/nadaver2 102.0.0
    MAL-2026-16357 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    @uh-platform/nadaver 102.0.0
    MAL-2026-16360 amazon-inspector, ghsa-malware
  • npm
    @uh-platform/domain-widget 100.0.0
    MAL-2026-16359 amazon-inspector, ghsa-malware
  • npm
    @uh-platform/webcard 99.0.0
    MAL-2026-16362 amazon-inspector, ghsa-malware
  • npm
    @uh-platform/cloud 101.0.0
    MAL-2026-16358 amazon-inspector, ghsa-malware
  • npm
    @uh-platform/nadaver2 102.0.0
    MAL-2026-16361 amazon-inspector, ghsa-malware
  • npm
    gemini-computer-use 0.1.2, 0.4.3, 0.4.5
    MAL-2026-16355 amazon-inspector, ossf-package-analysis
  • npm
    @woodpecker-web-shared/components 2.20.5, 4.20.5, 1.20.4
    MAL-2026-16354 amazon-inspector, ghsa-malware
  • npm
    @baanx/blockchain-config 9.9.11, 9.9.9
    MAL-2026-16352 amazon-inspector, ghsa-malware
  • npm
    @baanx/abis 9.9.11, 9.9.9
    MAL-2026-16351 amazon-inspector, ghsa-malware
  • npm
    @insiderintelligence/componentlibrary 9.9.10
    MAL-2026-16353 amazon-inspector, ghsa-malware
  • PyPI
    starlette-healthchecks 1.3.1, 1.3.2
    MAL-2026-16356 kam193, amazon-inspector 1 IOC
  • npm
    bnppf-flag-icons 99.99.99
    MAL-2026-16350 amazon-inspector, ghsa-malware
  • npm
    hardhat-base 2.2.2, 2.2.0
    MAL-2026-16348 amazon-inspector
  • npm
    hardhat-devkit 2.3.6, 2.0.1
    MAL-2026-16349 amazon-inspector
  • PyPI
    rrs 0.4.105, 0.3.100, 0.4.106, 0.4.103, 0.4.102, 0.4.104, 0.3.5, 0.1.0, 0.1.3, 0.1.…
    MAL-2026-16346 amazon-inspector, kam193
  • npm
    pf23727 1.0.0
    MAL-2026-16338 amazon-inspector, ghsa-malware
  • npm
    pflag14570 1.0.0
    MAL-2026-16341 amazon-inspector, ghsa-malware
  • npm
    pflag29424 1.0.0
    MAL-2026-16342 amazon-inspector, ghsa-malware
  • npm
    pf25133 1.0.0
    MAL-2026-16339 amazon-inspector, ghsa-malware
  • npm
    keroeltopgg 99.99.99
    MAL-2026-16334 amazon-inspector
  • npm
    keroeltopkkk 99.99.99
    MAL-2026-16336 amazon-inspector