Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,377 npm 223,238 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,377 reports · Feed

  • npm
    @bx-ui-framework/common 1.2.0, 15.0.0
    MAL-2026-15867 amazon-inspector
  • npm
    prime-coding-agent all versions
    MAL-2026-16014 1 IOC
  • npm
    agent-free all versions
    MAL-2026-16013 1 IOC
  • npm
    orbitron-cli all versions
    MAL-2026-16012 1 IOC
  • npm
    orbitron-tui all versions
    MAL-2026-16011 2 IOCs
  • PyPI
    tsshare 1.0.19, 1.0.7, 1.0.5, 1.0.11, 1.0.18, 1.0.6, 1.0.14, 1.0.10, 1.0.16, 1.0.2, 1.0…
    MAL-2026-16044 amazon-inspector 2 IOCs
  • npm
    @avigilon/node-webrtc 2.1.5, 2.1.4
    MAL-2026-15865 amazon-inspector
  • npm
    1nestjs 0.0.1
    MAL-2026-15909 ossf-package-analysis, amazon-inspector
  • npm
    0nestjs 0.0.1
    MAL-2026-15908 ossf-package-analysis, amazon-inspector
  • PyPI
    asti 0.1.0
    MAL-2026-15864 kam193, amazon-inspector
  • npm
    megan-baileys 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.8, 1.0.9, 1.0.11
    MAL-2026-15919 amazon-inspector 1 IOC
  • npm
    @modss/baileys 1.0.0, 1.0.1, 1.0.2, 2.0.0
    MAL-2026-15918 ghsa-malware, amazon-inspector 1 IOC
  • npm
    @crysnovax/baileys 2.7.6, 2.7.10, 2.7.11, 2.7.12, 2.7.13, 2.7.14, 2.7.15, 2.7.16, 2.7.17, 2.7.18, …
    MAL-2026-15917 ghsa-malware 2 IOCs
  • PyPI
    py-1requests 0.0.1
    MAL-2026-15861 kam193, amazon-inspector
  • PyPI
    py-2equests 0.0.1
    MAL-2026-15862 kam193, amazon-inspector
  • PyPI
    py-0requests 0.0.1
    MAL-2026-15860 kam193, amazon-inspector
  • PyPI
    0requests 0.0.1
    MAL-2026-15859 kam193, amazon-inspector
  • npm
    vscode-vue all versions
    MAL-2026-15894 ghsa-malware
  • npm
    html_vue all versions
    MAL-2026-15887 ghsa-malware
  • npm
    dsh-waste-market 0.6.1
    MAL-2026-15879 ghsa-malware, amazon-inspector
  • npm
    @a23842/dsh-notifier 0.1.2, 0.3.0, 0.2.3, 0.2.1, 0.2.0, 0.2.2, 0.1.0
    MAL-2026-15872 ghsa-malware, amazon-inspector
  • PyPI
    uvhttp-custom 1.7.9, 1.8.1, 1.9.9
    MAL-2026-15863 kam193, amazon-inspector 1 IOC
  • PyPI
    trongridi 0.0.1
    MAL-2026-15858 kam193, amazon-inspector 4 IOCs
  • npm
    @quantixfinance/config 1.0.0
    MAL-2026-15850 amazon-inspector
  • npm
    @quantixfinance/tron 1.0.0
    MAL-2026-15855 amazon-inspector
  • npm
    @quantixfinance/common 1.0.0
    MAL-2026-15849 amazon-inspector
  • npm
    @quantixfinance/sdk 1.0.0
    MAL-2026-15852 amazon-inspector
  • npm
    @quantixfinance/contracts 1.0.0
    MAL-2026-15851 amazon-inspector
  • npm
    @quantixfinance/ui 1.0.0
    MAL-2026-15856 amazon-inspector
  • npm
    @quantixfinance/wallet 1.0.0
    MAL-2026-15857 amazon-inspector
  • npm
    @quantixfinance/token 1.0.0
    MAL-2026-15854 amazon-inspector
  • npm
    @quantixfinance/supabase 1.0.0
    MAL-2026-15853 amazon-inspector
  • npm
    @quantixfinance/api 1.0.0
    MAL-2026-15848 amazon-inspector
  • npm
    fieldbase-webapplication-buildtools 99.99.99
    MAL-2026-15847 ossf-package-analysis, amazon-inspector
  • npm
    sliding-score-window 2.3.5
    MAL-2026-15893 ghsa-malware, amazon-inspector
  • npm
    priority-slot-queue 3.2.3
    MAL-2026-15892 ghsa-malware, amazon-inspector
  • npm
    ordered-kv-index 1.0.1
    MAL-2026-15891 ghsa-malware, amazon-inspector
  • npm
    ordered-freq-counter 3.3.3
    MAL-2026-15890 ghsa-malware, amazon-inspector
  • npm
    neighbor-key-map 2.1.4
    MAL-2026-15889 ghsa-malware, amazon-inspector
  • npm
    btree-time-index 1.2.1
    MAL-2026-15877 ghsa-malware, amazon-inspector