Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,377 npm 223,238 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,377 reports · Feed

  • npm
    @viertechjs/wb 6.0.0-vier.6, 6.0.0-vier.3, 6.0.0-vier.5, 6.0.0-vier.4, 6.0.0-vier.7, 6.0.0-vie…
    MAL-2026-15832 ghsa-malware, amazon-inspector
  • npm
    @viertechjs/baileys 7.0.0-rc14, 6.7.22
    MAL-2026-15831 ghsa-malware, amazon-inspector
  • npm
    @viertechjs/api 1.0.0
    MAL-2026-15830 ghsa-malware, amazon-inspector
  • PyPI
    syswatch 1.0.0
    MAL-2026-15811 kam193, amazon-inspector 5 IOCs
  • npm
    order-package-saas 999.0.1, 999.0.0
    MAL-2026-15816 amazon-inspector, ossf-package-analysis
  • npm
    bt2-api-gateway-node-js 999.0.1, 999.0.0
    MAL-2026-15813 amazon-inspector, ossf-package-analysis
  • PyPI
    gcphelpit 0.1.0, 0.1.1, 0.1.2
    MAL-2026-15810 kam193, amazon-inspector
  • PyPI
    tallyboxlite 1.0
    MAL-2026-15809 kam193
  • npm
    react-mongoose 1.0.3, 1.0.5, 1.0.0, 1.0.2, 1.0.1
    MAL-2026-15845 ghsa-malware, amazon-inspector
  • npm
    @yane88/workbuddy-03 1.0.3, 1.0.1, 1.0.2, 1.0.0
    MAL-2026-15667 ghsa-malware, amazon-inspector
  • npm
    @yane88/workbuddy-02 1.0.3, 1.0.2, 1.0.0, 1.0.1
    MAL-2026-15666 ghsa-malware, amazon-inspector
  • npm
    @yane88/workbuddy-01 1.0.2, 1.0.0, 1.0.1
    MAL-2026-15665 ghsa-malware, amazon-inspector
  • npm
    @yane88/workbuddy 1.0.1, 1.0.3, 1.0.2, 1.0.0
    MAL-2026-15664 ghsa-malware, amazon-inspector
  • npm
    @yane88/term-reqable-02 all versions
    MAL-2026-15663 ghsa-malware
  • npm
    @yane88/term-reqable-01 all versions
    MAL-2026-15662 ghsa-malware
  • npm
    @yane88/term-reqable all versions
    MAL-2026-15661 ghsa-malware
  • npm
    @yane88/ripgrep-win all versions
    MAL-2026-15660 ghsa-malware
  • npm
    @yane88/listary-02 1.0.1, 1.0.0
    MAL-2026-15659 ghsa-malware, amazon-inspector
  • npm
    @yane88/listary-01 1.0.1, 1.0.0
    MAL-2026-15658 ghsa-malware, amazon-inspector
  • npm
    @yane88/listary 1.0.0, 1.0.1
    MAL-2026-15657 ghsa-malware, amazon-inspector
  • npm
    @yane88/hexhub-client all versions
    MAL-2026-15649 ghsa-malware
  • npm
    @yane88/idea-2026.2-06 1.0.0
    MAL-2026-15656 ghsa-malware, amazon-inspector
  • npm
    @yane88/idea-2026.2-05 all versions
    MAL-2026-15655 ghsa-malware
  • npm
    @yane88/idea-2026.2-04 all versions
    MAL-2026-15654 ghsa-malware
  • npm
    @yane88/idea-2026.2-03 all versions
    MAL-2026-15653 ghsa-malware
  • npm
    @yane88/idea-2026.2-02 all versions
    MAL-2026-15652 ghsa-malware
  • npm
    @yane88/idea-2026.2-01 all versions
    MAL-2026-15651 ghsa-malware
  • npm
    @yane88/idea-2026.2 all versions
    MAL-2026-15650 ghsa-malware
  • npm
    matrix-by-lmx all versions
    MAL-2026-15670 ghsa-malware
  • npm
    randomunblockedwebsite 1.0.1, 1.0.0, 1.0.2
    MAL-2026-15672 ghsa-malware, amazon-inspector
  • npm
    quartz-core 99.1.9, 99.9.9, 10.1.9
    MAL-2026-15671 ghsa-malware, amazon-inspector
  • npm
    kendo-angular-window 19.10.13
    MAL-2026-15669 ghsa-malware, amazon-inspector
  • npm
    core_main 10.9.9
    MAL-2026-15668 ghsa-malware, amazon-inspector
  • npm
    @fdr-mar/promos-types 10.10.9
    MAL-2026-15648 ghsa-malware, amazon-inspector
  • npm
    @systemzero/baileys 1.1.2
    MAL-2026-15820 amazon-inspector, ghsa-malware 1 IOC
  • npm
    @mrlegendbot/baileys 1.2.4, 1.2.5, 1.2.7, 7.0.0-rc14, 1.0.0, 1.1.0, 1.1.1, 1.2.0, 1.2.1, 1.2.3, 1.2.6
    MAL-2026-15819 ghsa-malware 1 IOC
  • npm
    @testrelic/appium-analytics 1.1.1-next.88
    MAL-2026-15647 ghsa-malware, amazon-inspector
  • npm
    claude-channel-telegram 9.9.9
    MAL-2026-15624 amazon-inspector
  • npm
    nextjsupdater 1.2.1, 1.0.0, 1.2.2
    MAL-2026-15631 amazon-inspector
  • npm
    mfaatest 1.0.0
    MAL-2026-15629 amazon-inspector