Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,377 npm 223,238 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,377 reports · Feed

  • npm
    cre-setup 1.0.0
    MAL-2026-15591 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    verify-contract-viem 1.0.0
    MAL-2026-15599 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    generate-schema-viem 1.0.0
    MAL-2026-15595 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    fuels-core 1.0.0
    MAL-2026-15592 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    generate-schema-ethers 1.0.0
    MAL-2026-15594 ossf-package-analysis, amazon-inspector, ghsa-malware
  • PyPI
    auth-app-streamlit 2.1.1
    MAL-2026-15577 kam193
  • PyPI
    trongridor 0.0.1
    MAL-2026-15578 kam193 4 IOCs
  • npm
    quesoeducation 1.0.67, 1.0.0
    MAL-2026-15576 ghsa-malware, amazon-inspector
  • npm
    opiumbest 1.1.1, 1.0.1
    MAL-2026-15575 ghsa-malware, amazon-inspector
  • npm
    gclassroom 1.1.1, 1.0.0
    MAL-2026-15574 ghsa-malware, amazon-inspector
  • npm
    com.db.autobahn.notification-center-electron 88.88.2, 88.88.1
    MAL-2026-15590 ossf-package-analysis, amazon-inspector
  • npm
    autobahn-electron-probe 99.99.1, 99.99.2, 99.99.3
    MAL-2026-15589 ossf-package-analysis, amazon-inspector
  • npm
    grafeno-webhook 1.0.0
    MAL-2026-15573 amazon-inspector
  • npm
    grafeno-billing 1.0.0
    MAL-2026-15571 amazon-inspector
  • npm
    grafeno-payments 1.0.0
    MAL-2026-15572 amazon-inspector
  • npm
    node-net-pool 1.0.0
    MAL-2026-15570 ghsa-malware, amazon-inspector
  • npm
    npx-oob-package 1.0.2, 1.0.1, 1.0.0
    MAL-2026-15597 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    nuvyra-marketplace-sdk 1.0.14, 1.0.11, 1.0.13, 1.0.2, 1.0.12, 1.0.7, 1.0.9, 1.0.10, 1.0.3, 1.0.4, 1.0.8
    MAL-2026-15569 ghsa-malware, amazon-inspector
  • npm
    manager-thedate 1.0.16, 1.0.15
    MAL-2026-15568 ghsa-malware, amazon-inspector
  • npm
    htps-provider 1.0.11, 1.0.10
    MAL-2026-15567 ghsa-malware, amazon-inspector
  • PyPI
    flask-header-guard 1.0.0
    MAL-2026-15566 kam193, amazon-inspector 1 IOC
  • npm
    @testrelic/playwright-analytics 2.13.0, 2.12.1-next.88
    MAL-2026-15565 amazon-inspector
  • npm
    ckeditor5-ckbox 5.0.0
    MAL-2026-15549 amazon-inspector
  • npm
    common-array-token 1.0.0
    MAL-2026-15550 amazon-inspector
  • npm
    supersignaturenature 1.0.5, 1.0.6
    MAL-2026-15560 amazon-inspector, ghsa-malware
  • npm
    secretkey2fa 1.0.1
    MAL-2026-15559 amazon-inspector
  • npm
    js-tokens-array 1.0.0, 1.1.1
    MAL-2026-15556 amazon-inspector
  • npm
    date-fns-sync 1.0.0
    MAL-2026-15551 amazon-inspector
  • npm
    eth-pino 2.0.3
    MAL-2026-15554 amazon-inspector
  • npm
    techportal 4.0.10, 4.0.11
    MAL-2026-15561 amazon-inspector
  • npm
    vs-modules 1.2.2, 1.2.1
    MAL-2026-15564 amazon-inspector, ghsa-malware
  • npm
    js-array-tokens 1.0.2
    MAL-2026-15555 amazon-inspector
  • npm
    es6-migrator 1.0.1, 1.0.0
    MAL-2026-15553 amazon-inspector
  • npm
    vitest-chalk-pro 10.0.7
    MAL-2026-15563 amazon-inspector
  • npm
    mfacord 1.0.2, 1.0.3, 1.0.4, 1.0.0
    MAL-2026-15557 amazon-inspector
  • npm
    discord-mfa 3.0.1, 3.0.0
    MAL-2026-15552 amazon-inspector
  • npm
    test-in-one 1.0.0
    MAL-2026-15562 amazon-inspector
  • npm
    mfakit 1.4.0
    MAL-2026-15558 amazon-inspector
  • npm
    2fasecretkey 1.1.4, 1.1.3, 1.1.2
    MAL-2026-15548 amazon-inspector
  • npm
    2fa-secretkey 1.0.3, 1.0.5, 1.0.7, 1.0.4, 1.0.2, 1.0.6, 1.0.1
    MAL-2026-15547 amazon-inspector