Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,377 npm 223,238 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,377 reports · Feed

  • npm
    hyperliquid-composer 1.0.0
    MAL-2026-15627 amazon-inspector, ghsa-malware
  • npm
    test__123q2 2.1.1
    MAL-2026-15638 amazon-inspector
  • npm
    spc-grafeno-login 1.0.0
    MAL-2026-15633 amazon-inspector
  • npm
    node-request-utils 1.0.0
    MAL-2026-15632 amazon-inspector
  • npm
    tailwind-minanimated 2.3.7
    MAL-2026-15634 amazon-inspector
  • npm
    mfafix 1.1.1, 1.1.0, 1.0.0
    MAL-2026-15630 amazon-inspector
  • npm
    tailwind-modernanimation 2.3.8
    MAL-2026-15635 amazon-inspector
  • npm
    mfa.io 1.0.0, 1.0.1
    MAL-2026-15628 amazon-inspector
  • npm
    tailwindcss-forms-style 0.1.2
    MAL-2026-15636 amazon-inspector
  • npm
    test__123q1 4.3.5, 3.2.4
    MAL-2026-15637 amazon-inspector
  • npm
    kisama-js 0.4.6, 0.4.8, 0.3.5, 0.2.4, 0.2.0, 0.1.8, 0.3.0, 0.1.9
    MAL-2026-15645 ghsa-malware, amazon-inspector
  • npm
    @baipiaodajun/reverseproxy-fm all versions
    MAL-2026-15643 ghsa-malware
  • npm
    @baipiaodajun/podman_env all versions
    MAL-2026-15642 ghsa-malware
  • npm
    @baipiaodajun/npmsshx all versions
    MAL-2026-15641 ghsa-malware
  • npm
    @baipiaodajun/mcbots all versions
    MAL-2026-15640 ghsa-malware
  • npm
    @baipiaodajun/mcbot all versions
    MAL-2026-15639 ghsa-malware
  • npm
    pig-ui-first all versions
    MAL-2026-15646 ghsa-malware
  • npm
    @pipi596888/ccursor 0.0.16, 0.0.17
    MAL-2026-15644 ghsa-malware, amazon-inspector
  • npm
    selfsigned-certificate 1.1.0, 1.0.0
    MAL-2026-15623 ghsa-malware, amazon-inspector
  • npm
    spc_login 1.0.0
    MAL-2026-15622 amazon-inspector
  • npm
    gas-monitor 1.1.0
    MAL-2026-15621 amazon-inspector
  • npm
    evilpostinstall 49.13.4074225, 4127000.0.1, 0.2.0, 0.6.0, 0.4.0, 0.3.0, 0.5.0, 0.9.1, 0.9.3, 0.…
    MAL-2026-15625 amazon-inspector, ossf-package-analysis
  • PyPI
    pyservercheck 0.1.0, 0.1.1
    MAL-2026-15603 kam193, amazon-inspector 2 IOCs
  • npm
    redis-cookie-server 1.0.0
    MAL-2026-15602 ghsa-malware, amazon-inspector
  • npm
    eslint-prettier-js 0.0.1
    MAL-2026-15601 ghsa-malware, amazon-inspector
  • npm
    fuels-versions 1.0.0
    MAL-2026-15673 ghsa-malware, amazon-inspector
  • npm
    fuels-forc 1.0.0
    MAL-2026-15626 amazon-inspector, ghsa-malware
  • npm
    @lucideproxy/svg all versions
    MAL-2026-15600 ghsa-malware
  • PyPI
    tronlinker 0.0.1
    MAL-2026-15588 kam193 4 IOCs
  • npm
    cloudfcrxz 1.0.3, 1.0.4, 1.0.1, 1.0.0
    MAL-2026-15581 ghsa-malware, amazon-inspector
  • npm
    @fidzzhost/baileys all versions
    MAL-2026-15579 ghsa-malware
  • npm
    real-browser-plus 1.1.0
    MAL-2026-15587 ghsa-malware, amazon-inspector
  • npm
    h3client 1.0.0
    MAL-2026-15585 ghsa-malware, amazon-inspector
  • npm
    h3-codex 1.0.0, 1.0.1
    MAL-2026-15584 ghsa-malware, amazon-inspector
  • npm
    h2-codex 2.0.1, 2.0.0
    MAL-2026-15583 ghsa-malware, amazon-inspector
  • npm
    cloufcrxz 1.0.1, 1.0.0
    MAL-2026-15582 ghsa-malware, amazon-inspector
  • npm
    brat-codex 1.0.0
    MAL-2026-15580 ghsa-malware, amazon-inspector
  • npm
    originaldevelopmentstelemetry 1.2.7, 1.2.2
    MAL-2026-15586 ghsa-malware, amazon-inspector
  • npm
    verify-contract-ethers 1.0.0
    MAL-2026-15598 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    fuels-typegen 1.0.0
    MAL-2026-15593 ossf-package-analysis, amazon-inspector, ghsa-malware