Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,377 npm 223,238 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,377 reports · Feed

npm
tracker-cloudflare 1.0.0
MAL-2026-16140 amazon-inspector

Sep 11, 2026
PyPI
langgrap 0.2.45
MAL-2026-16133 kam193, amazon-inspector 3 IOCs

Sep 11, 2026
PyPI
transfomers 4.44.2
MAL-2026-16136 kam193, amazon-inspector 3 IOCs

Sep 11, 2026
PyPI
ollamaa 0.4.2
MAL-2026-16134 kam193, amazon-inspector 3 IOCs

Sep 11, 2026
PyPI
openaii 1.55.3
MAL-2026-16135 kam193, amazon-inspector 3 IOCs

Sep 11, 2026
npm
@nimbusedge/auth 19999.1359.6, 19999.0.4, 19999.1337.7, 19999.0.7, 19999.1359.5, 19999.1338.1, 1…
MAL-2026-16132 amazon-inspector

Sep 11, 2026
npm
tailwind-form-kit 0.6.4, 0.6.2, 0.5.1, 0.6.5, 0.6.3
MAL-2026-16139 amazon-inspector, ghsa-malware

Sep 11, 2026
PyPI
aitextutils-py 0.1.0, 0.1.1
MAL-2026-16131 kam193, amazon-inspector 6 IOCs

Sep 11, 2026
PyPI
aitextkit-py 0.1.0, 0.1.1
MAL-2026-16130 kam193, amazon-inspector 6 IOCs

Sep 11, 2026
PyPI
pymem-win 1.14.0, 1.14.1, 1.14.4, 1.14.5, 1.14.6
MAL-2026-16128 kam193, amazon-inspector 1 IOC

Sep 11, 2026
PyPI
eth-account-web3 0.14.0
MAL-2026-16127 kam193, amazon-inspector

Sep 11, 2026
PyPI
web3-eth-account 0.14.0
MAL-2026-16129 kam193, amazon-inspector

Sep 11, 2026
npm
strapi-plugin-vinsoc-1109 3.6.8
MAL-2026-16126 ossf-package-analysis, amazon-inspector

Sep 11, 2026
crates.io
logs-update all versions
MAL-2026-16164 4 IOCs

Sep 11, 2026
PyPI
lucy-python-script-2030 0.1.1, 0.1.2
MAL-2026-16125 kam193, amazon-inspector

Sep 10, 2026
npm
pinochiomathm 2.3.4, 2.3.3, 2.3.2, 2.3.5
MAL-2026-16123 amazon-inspector

Sep 10, 2026
npm
tailwindcss-contact-forms 0.5.8, 0.5.6, 0.5.5, 0.5.4, 0.5.9, 0.6.0, 0.5.7, 0.6.1, 0.6.2
MAL-2026-16124 amazon-inspector

Sep 10, 2026
PyPI
pylever 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1…
MAL-2026-16122 kam193, amazon-inspector

Sep 10, 2026
npm
etoro-cashout 999.0.0, 99.0.0, 99.0.2
MAL-2026-16117 amazon-inspector

Sep 10, 2026
npm
etoro-builders 999.0.0
MAL-2026-16116 amazon-inspector

Sep 10, 2026
npm
etoro-aggregator 999.0.0, 99.0.2, 99.0.0
MAL-2026-16111 amazon-inspector

Sep 10, 2026
npm
etoro-analytics 999.0.0, 99.0.0, 99.0.2
MAL-2026-16112 amazon-inspector

Sep 10, 2026
npm
etoro-api 999.0.0
MAL-2026-16113 amazon-inspector

Sep 10, 2026
npm
etoro-client 999.0.0
MAL-2026-16119 amazon-inspector

Sep 10, 2026
npm
etoro-core 999.0.0
MAL-2026-16120 amazon-inspector

Sep 10, 2026
npm
etoro-charts 999.0.0, 99.0.0
MAL-2026-16118 amazon-inspector

Sep 10, 2026
npm
etoro-auth 999.0.0, 99.0.0
MAL-2026-16114 amazon-inspector, ossf-package-analysis

Sep 10, 2026
npm
etoro-billing 999.0.0
MAL-2026-16115 amazon-inspector

Sep 10, 2026
npm
@nexustechpro/baileys 2.2.7, 2.2.5, 2.2.4
MAL-2026-16104 amazon-inspector, ghsa-malware

Sep 9, 2026
npm
@neroxkira/vangal-baileys 1.0.0, 1.0.1
MAL-2026-16103 amazon-inspector

Sep 9, 2026
npm
@sahril2nd/baileys 1.0.21
MAL-2026-16105 amazon-inspector

Sep 9, 2026
npm
@auction-fe/ui-kit 9.9.3, 9.9.1
MAL-2026-16109 ghsa-malware, amazon-inspector

Sep 9, 2026
npm
@auction-fe/reporting-system all versions
MAL-2026-16108 ghsa-malware

Sep 9, 2026
npm
@auction-fe/portal all versions
MAL-2026-16107 ghsa-malware

Sep 9, 2026
npm
@auction-fe/base all versions
MAL-2026-16106 ghsa-malware

Sep 9, 2026
npm
@convertics/script 0.3.0, 0.2.0, 0.4.0, 0.1.0, 1.0.0, 0.2.1
MAL-2026-16110 ghsa-malware, amazon-inspector

Sep 9, 2026
npm
mfatest2 1.0.0
MAL-2026-16102 amazon-inspector

Sep 9, 2026
npm
mfaby 1.0.0
MAL-2026-16101 amazon-inspector

Sep 9, 2026
npm
discord-mfa-solver 1.0.2, 1.0.1, 1.0.0, 1.0.3
MAL-2026-16100 amazon-inspector, ghsa-malware

Sep 9, 2026
PyPI
bq-sdist-probe-vrp 0.0.1
MAL-2026-16099 amazon-inspector

Sep 9, 2026