Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,377 npm 223,238 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,377 reports · Feed

  • npm
    rojo-rbx 1.4.3
    MAL-2026-16059 amazon-inspector
  • npm
    file-type-detector 1.1.0, 1.1.1
    MAL-2026-16053 amazon-inspector, ghsa-malware
  • npm
    gloggo 1.1.3, 1.1.4, 1.1.2
    MAL-2026-16054 amazon-inspector, ghsa-malware
  • npm
    sonmors 2.11.2
    MAL-2026-16055 amazon-inspector
  • npm
    vinzz-wcli 1.0.1
    MAL-2026-16058 amazon-inspector
  • npm
    toru-ultimate 1.0.0
    MAL-2026-16057 amazon-inspector
  • npm
    tailwind-aspect-styles 0.4.2
    MAL-2026-16056 amazon-inspector
  • npm
    open-item-validator 1.0.3, 1.0.5, 1.0.2, 1.0.0, 1.0.4, 1.0.1
    MAL-2026-16052 amazon-inspector, ghsa-malware
  • npm
    @aspect-adv-ui/consent-manager 2.4.0, 2.4.1
    MAL-2026-16050 amazon-inspector
  • npm
    @umschool/analytics 999.0.1, 999.0.0, 999.0.2, 999.0.4, 999.0.3
    MAL-2026-16051 amazon-inspector
  • npm
    tailwindcss-aspectratio-styles 0.3.5, 0.3.4
    MAL-2026-16049 amazon-inspector
  • npm
    punypump 1.2.4, 1.2.5, 1.2.2
    MAL-2026-16048 amazon-inspector
  • npm
    @usemosaik/template-react-js 1.0.1
    MAL-2026-16047 ghsa-malware, amazon-inspector
  • npm
    i18nexus-tools 3.2.0
    MAL-2026-16046 ghsa-malware, amazon-inspector
  • npm
    i18nexus all versions
    MAL-2026-16045 ghsa-malware
  • npm
    @web2apk/baileys 4.5.5, 7.0.0, 9.0.9, 2.0.0, 9.9.9, 3.5.5, 3.5.0, 3.0.0, 5.5.5, 7.0.5, 2.5.0, 7.…
    MAL-2026-16043 ghsa-malware, amazon-inspector
  • npm
    krdpass-auth-react-native 10.0.0, 1.6.0
    MAL-2026-16042 ghsa-malware, amazon-inspector
  • npm
    plogme 1.0.0, 1.0.1, 1.0.2, 1.0.3
    MAL-2026-16199 amazon-inspector 2 IOCs
  • PyPI
    telegram-helper 0.1.1, 0.1.2
    MAL-2026-16017 kam193, amazon-inspector
  • PyPI
    cv-train 0.0.5, 99.0.0
    MAL-2026-16016 kam193, amazon-inspector
  • npm
    @cp-shared-14/frontend-ui 6.3.4
    MAL-2026-16015 ossf-package-analysis
  • npm
    @aircanada/navigation-handler all versions
    MAL-2026-16020 ghsa-malware
  • npm
    @aircanada/core all versions
    MAL-2026-16019 ghsa-malware
  • npm
    @aircanada/components all versions
    MAL-2026-16018 ghsa-malware
  • npm
    service-home 0.0.1
    MAL-2026-16039 ghsa-malware, amazon-inspector
  • npm
    op-ts-server-core 0.0.1
    MAL-2026-16034 ghsa-malware, amazon-inspector
  • npm
    @idkruan-10/dpd-depconf-probe all versions
    MAL-2026-16021 ghsa-malware
  • npm
    redis-type-intel 1.10.5, 1.10.6
    MAL-2026-16036 ghsa-malware, amazon-inspector
  • npm
    oscar-redis 6.1.2, 5.11.2, 5.11.3, 5.11.4, 6.1.1
    MAL-2026-16035 ghsa-malware, amazon-inspector
  • npm
    kiki-baileys 1.0.3, 1.0.1, 1.0.2, 1.0.0
    MAL-2026-16033 ghsa-malware, amazon-inspector
  • npm
    feishu-docx-mcp 0.3.2
    MAL-2026-16032 ghsa-malware, amazon-inspector
  • npm
    bmc-translate-utils 1.1.1
    MAL-2026-16026 ghsa-malware, amazon-inspector
  • npm
    bmc-i18n-extract-cli 1.1.1
    MAL-2026-16025 ghsa-malware, amazon-inspector
  • npm
    blueai-cli 0.7.0
    MAL-2026-16024 ghsa-malware, amazon-inspector
  • npm
    scw-mobile all versions
    MAL-2026-16038 ghsa-malware
  • npm
    base-account-core all versions
    MAL-2026-16022 ghsa-malware
  • npm
    wallet-engine-signing all versions
    MAL-2026-16041 ghsa-malware
  • npm
    wallet-cds-web all versions
    MAL-2026-16040 ghsa-malware
  • npm
    scw-core all versions
    MAL-2026-16037 ghsa-malware
  • npm
    cb-wallet-store all versions
    MAL-2026-16031 ghsa-malware