Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,377 npm 223,238 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,377 reports · Feed

  • npm
    strapi-plugin-ccresh-meeb 3.6.8
    MAL-2026-16180 amazon-inspector
  • npm
    csa-mfa 1.1.15, 1.1.16
    MAL-2026-16175 amazon-inspector, ossf-package-analysis
  • npm
    n8n-nodes-sysdiag2 2.0.0
    MAL-2026-16162 ossf-package-analysis, amazon-inspector
  • npm
    @yggbrasil/api all versions
    MAL-2026-16163 ghsa-malware
  • npm
    get-power 1.0.3
    MAL-2026-16156 amazon-inspector, ghsa-malware
  • npm
    afhmxiewpsf 1.0.5, 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0
    MAL-2026-16158 ghsa-malware, amazon-inspector
  • npm
    ultra-ws 1.0.0
    MAL-2026-16155 amazon-inspector, ghsa-malware
  • npm
    noblox-asset.js 7.4.2, 7.6.0, 7.4.0, 7.4.1
    MAL-2026-16148 amazon-inspector
  • npm
    postgreesqlhelper 1.0.3
    MAL-2026-16150 amazon-inspector
  • npm
    sql-limit-enforcer 10.0.0, 10.0.1, 10.0.2
    MAL-2026-16151 amazon-inspector
  • npm
    n8n-nodes-sysdiag 1.0.1, 1.0.0, 1.0.2, 1.0.4, 1.0.3
    MAL-2026-16147 amazon-inspector
  • npm
    os-info-meeb322k 1.0.0
    MAL-2026-16149 amazon-inspector
  • npm
    strapi-plugin-os-info-meeb322k 3.6.8
    MAL-2026-16152 amazon-inspector
  • npm
    web-main 22.1.2
    MAL-2026-16153 amazon-inspector
  • npm
    @aiwfm/communitywfm.scripts.api 28.1.28
    MAL-2026-16146 amazon-inspector
  • npm
    concierge-sdk 99.99.101, 99.99.100, 99.99.99
    MAL-2026-16145 amazon-inspector
  • npm
    app-rrhh 999.0.0
    MAL-2026-16144 amazon-inspector
  • npm
    meraz-project-tracker 1.0.0
    MAL-2026-16161 ghsa-malware, amazon-inspector
  • npm
    lpulogin 1.0.1, 1.0.0
    MAL-2026-16160 ghsa-malware, amazon-inspector
  • npm
    @merazmz/project-tracker all versions
    MAL-2026-16157 ghsa-malware
  • npm
    dilxztech 1.0.4, 1.0.6, 1.0.2, 1.0.1, 1.0.5, 1.0.0, 1.0.3, 1.0.8, 1.0.7, 1.0.9
    MAL-2026-16159 ghsa-malware, amazon-inspector
  • npm
    @biz44/process-runtime-utils 1.1.10, 1.1.79, 1.1.95
    MAL-2026-16171 6 IOCs
  • npm
    @biz44/runtime-utils 1.1.11, 1.1.13, 1.1.81, 1.1.96, 1.1.100
    MAL-2026-16172 8 IOCs
  • npm
    webpackbootstrapscripts 5.110.3
    MAL-2026-16202 6 IOCs
  • npm
    webpackbootstrap5 5.0.0
    MAL-2026-16201 ghsa-malware 6 IOCs
  • npm
    @zaka13/thing 1.0.0
    MAL-2026-16200 ghsa-malware 6 IOCs
  • npm
    pino-ulid 2.12.3, 3.0.1, 2.12.2
    MAL-2026-16154 amazon-inspector 3 IOCs
  • PyPI
    faiss-cpu-avx512 1.9.0, 1.9.1, 1.9.2, 1.9.3, 1.9.4, 1.9.5, 1.9.6, 1.9.7
    MAL-2026-16203 5 IOCs
  • PyPI
    chroma-client 0.5.7
    MAL-2026-16143 kam193, amazon-inspector 3 IOCs
  • npm
    @biz44/id79-client 1.1.80
    MAL-2026-16168 4 IOCs
  • npm
    @biz44/id12-client 1.1.13
    MAL-2026-16166 4 IOCs
  • npm
    @biz44/id99-client 1.1.100
    MAL-2026-16170 4 IOCs
  • npm
    @biz44/id95-client 1.1.96
    MAL-2026-16169 4 IOCs
  • npm
    @biz44/id10-client 1.1.11
    MAL-2026-16165 4 IOCs
  • npm
    id79-client 1.1.79
    MAL-2026-16173 amazon-inspector 4 IOCs
  • PyPI
    python-fork 0.1.0, 0.1.1
    MAL-2026-16142 kam193, amazon-inspector
  • npm
    @biz44/id44-client 1.1.44
    MAL-2026-16167 4 IOCs
  • PyPI
    platform-telemetry-client 1.0.0
    MAL-2026-16141 kam193 2 IOCs
  • npm
    greensaver 1.2.1, 1.2.3, 1.2.2
    MAL-2026-16138 amazon-inspector
  • npm
    cr-bot-common 1.0.0
    MAL-2026-16137 amazon-inspector