Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,377 npm 223,238 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,377 reports · Feed

  • npm
    pipipe all versions
    MAL-2026-16000 ghsa-malware
  • npm
    parallaxy-img all versions
    MAL-2026-15999 ghsa-malware
  • npm
    onetime-rnd all versions
    MAL-2026-15998 ghsa-malware
  • npm
    muswish all versions
    MAL-2026-15996 ghsa-malware
  • npm
    memov all versions
    MAL-2026-15994 ghsa-malware
  • npm
    linkpreview-simple all versions
    MAL-2026-15993 ghsa-malware
  • npm
    lazy-attr all versions
    MAL-2026-15992 ghsa-malware
  • npm
    json-into-html all versions
    MAL-2026-15990 ghsa-malware
  • npm
    jimg 1.0.2
    MAL-2026-15989 ghsa-malware, amazon-inspector
  • npm
    inner-svg-ts all versions
    MAL-2026-15988 ghsa-malware
  • npm
    infinity-grid all versions
    MAL-2026-15987 ghsa-malware
  • npm
    iframe-to-video all versions
    MAL-2026-15986 ghsa-malware
  • npm
    google-img-scrap 1.2.0
    MAL-2026-15985 ghsa-malware, amazon-inspector
  • npm
    fast-html-dom-parser all versions
    MAL-2026-15983 ghsa-malware
  • npm
    enqueu all versions
    MAL-2026-15979 ghsa-malware
  • npm
    drive-album all versions
    MAL-2026-15978 ghsa-malware
  • npm
    discord-tqr all versions
    MAL-2026-15977 ghsa-malware
  • npm
    discord-phub all versions
    MAL-2026-15976 ghsa-malware
  • npm
    chrome-speech-recognition all versions
    MAL-2026-15973 ghsa-malware
  • npm
    card3d all versions
    MAL-2026-15972 ghsa-malware
  • npm
    btn-particles all versions
    MAL-2026-15971 ghsa-malware
  • npm
    anime-vostfr all versions
    MAL-2026-15968 ghsa-malware
  • npm
    @yoannchb/wtf-json all versions
    MAL-2026-15967 ghsa-malware
  • npm
    @yoannchb/tokenize all versions
    MAL-2026-15966 ghsa-malware
  • npm
    @yoannchb/langy all versions
    MAL-2026-15965 ghsa-malware
  • npm
    @yoannchb/cattract all versions
    MAL-2026-15964 ghsa-malware
  • npm
    @domyjs/domy all versions
    MAL-2026-15950 ghsa-malware
  • npm
    @domyjs/debounce all versions
    MAL-2026-15949 ghsa-malware
  • npm
    @domyjs/collapse all versions
    MAL-2026-15948 ghsa-malware
  • npm
    @domyjs/anchor all versions
    MAL-2026-15947 ghsa-malware
  • npm
    trading-bot-utils all versions
    MAL-2026-16003 ghsa-malware
  • npm
    gas-price-checker 1.0.0
    MAL-2026-15984 ghsa-malware, amazon-inspector
  • npm
    eth-query-utils 1.0.0
    MAL-2026-15982 ghsa-malware, amazon-inspector
  • npm
    eth-lib-helpers 1.0.0
    MAL-2026-15981 ghsa-malware, amazon-inspector
  • npm
    ens-namehash-utils all versions
    MAL-2026-15980 ghsa-malware
  • PyPI
    proxycer 0.1.0
    MAL-2026-15935 kam193, amazon-inspector 1 IOC
  • PyPI
    dbt-sa-cli 0.0.1
    MAL-2026-15934 kam193, amazon-inspector
  • PyPI
    houdus 1.0.0, 1.0.1
    MAL-2026-15933 kam193, amazon-inspector 2 IOCs
  • PyPI
    chartkit-core 1.0
    MAL-2026-15932 kam193
  • npm
    ulid-intel 2.12.3, 3.0.1
    MAL-2026-16004 ghsa-malware, amazon-inspector