Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,345 npm 223,208 PyPI 11,993 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,345 reports · Feed

npm
related_blackbird-toolteadev 2.1.1
MAL-2026-18666

Nov 2, 2026
npm
pearx93qja-notthedevs 1.1.8
MAL-2026-18663

Nov 2, 2026
npm
wet_rat_replicate_automation 2.3.1
MAL-2026-18668

Nov 2, 2026
npm
quiche-tea-curut 4.3.4
MAL-2026-18665

Nov 2, 2026
npm
peas-tea-curut 3.2.2
MAL-2026-18664

Nov 2, 2026
npm
maila-talijah-alpha-128 1.1.11
MAL-2026-18662

Nov 2, 2026
npm
low_hummingbird_replicate_automation 2.2.1
MAL-2026-18661

Nov 2, 2026
npm
dian-peyek23-miaww 1.1.3
MAL-2026-18660

Nov 2, 2026
npm
dependent-final 1.0.3
MAL-2026-18659

Nov 2, 2026
PyPI
pyprig 1.2.0, 1.2.1, 1.2.2
MAL-2026-18490 kam193

Nov 2, 2026
npm
@ifasn/mmd-doc-mcp 1.0.0, 1.0.2
MAL-2026-18488 amazon-inspector

Nov 2, 2026
npm
@ifasn/md-doc-mcp 1.0.5, 1.0.3, 1.0.4
MAL-2026-18486 amazon-inspector

Nov 2, 2026
npm
@ifasn/mmdd-doc-mcp 1.1.1, 1.0.6, 1.0.3, 1.0.4, 1.1.6, 1.0.4-2, 1.1.8, 2.0.1, 1.0.1, 1.0.5, 1.1.3, …
MAL-2026-18489 amazon-inspector

Nov 2, 2026
npm
@ifasn/mdd-doc-mcp 1.0.7, 1.0.8, 2.0.6
MAL-2026-18487 amazon-inspector

Nov 2, 2026
npm
service-roles-registry 99.0.2, 99.0.1
MAL-2026-18519 amazon-inspector 2 IOCs

Nov 2, 2026
npm
bfvkjmeikpwhqxc 1.0.0, 1.0.1, 0.0.0-stage
MAL-2026-18483 ghsa-malware

Nov 2, 2026
npm
pandafortunerush all versions
MAL-2026-18485 ghsa-malware

Nov 2, 2026
npm
internal-renderers all versions
MAL-2026-18484 ghsa-malware

Nov 2, 2026
npm
nachles all versions
MAL-2026-18477 ghsa-malware

Nov 2, 2026
npm
@maulenv/baileys all versions
MAL-2026-18473 ghsa-malware

Nov 2, 2026
npm
@levvicode/libsignal-node all versions
MAL-2026-18472 ghsa-malware

Nov 2, 2026
npm
@levvicode/eslint-config all versions
MAL-2026-18471 ghsa-malware

Nov 2, 2026
npm
levvleys 2.1.0, 2.0.26, 2.0.25, 2.0.24, 2.0.23, 2.0.22, 2.0.21, 2.0.20, 2.0.19, 2.0.18, …
MAL-2026-17397 ghsa-malware

Nov 2, 2026
npm
@levvicode/baileys 0.0.3, 0.0.2
MAL-2026-17366 ghsa-malware

Nov 2, 2026
npm
tailwind-animatrix all versions
MAL-2026-18481 ghsa-malware

Nov 2, 2026
npm
tailwind-animate-final all versions
MAL-2026-18479 ghsa-malware

Nov 2, 2026
npm
tailwind-animate-engine all versions
MAL-2026-18478 ghsa-malware

Nov 2, 2026
npm
unjailed all versions
MAL-2026-18482 ghsa-malware

Nov 2, 2026
npm
tailwind-animate-test all versions
MAL-2026-18480 ghsa-malware

Nov 2, 2026
npm
@mrlegendbot/libsignal-node all versions
MAL-2026-18474 ghsa-malware

Nov 2, 2026
npm
@bigdevin55/calculator-install-demo all versions
MAL-2026-18465 ghsa-malware

Nov 2, 2026
npm
@bigdevin55/calculator-install-hook all versions
MAL-2026-18466 ghsa-malware

Nov 2, 2026
npm
@vanzky/baileys 0.0.0-stage, 1.0.0, 1.0.1, 1.0.2, 1.0.4
MAL-2026-19055

Nov 2, 2026
npm
tailwindcss-animate-bridge all versions
MAL-2026-18470 ghsa-malware

Nov 2, 2026
npm
@utilitycraft/tailwindcss-motion-atelier all versions
MAL-2026-18468 ghsa-malware

Nov 2, 2026
npm
@ubedsockets/baileys 1.0.0, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.…
MAL-2026-18600

Nov 2, 2026
npm
atlassian-wallboard-plugin1 all versions
MAL-2026-18464 ghsa-malware

Nov 2, 2026
npm
persona-ai-sdk 1.0.0
MAL-2026-18463 ghsa-malware

Nov 2, 2026
RubyGems
intercom-react-native-example-e2e-tests 1.0.1
MAL-2026-18462 ossf-package-analysis, amazon-inspector

Nov 2, 2026
RubyGems
shoaib-unity 1.0.1
MAL-2026-18461 ossf-package-analysis, amazon-inspector

Nov 2, 2026