Supply chain

Malicious packages · PyPI

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,345 npm 223,208 PyPI 11,993 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

Compromised well-known packages

Legitimate, widely used packages that had malicious versions published (account takeover, hijacked releases).

11,993 reports · Feed

PyPI
logger-libs 0.4.1, 0.4.2, 0.4.3, 0.4.5, 0.4.6
MAL-2026-18778 kam193 12 IOCs

Nov 9, 2026
PyPI
extrahtml 0.1.0, 0.1.1, 0.1.2
MAL-2026-18771 kam193 1 IOC

Nov 8, 2026
PyPI
parseyaml 1.2.0
MAL-2026-18772 kam193 1 IOC

Nov 8, 2026
PyPI
bundyfed 1.0.0, 1.0.1
MAL-2026-18770 kam193 1 IOC

Nov 8, 2026
PyPI
lookuptest11 0.0.1
MAL-2026-18769 kam193

Nov 8, 2026
PyPI
super-color 0.1.0, 0.1.1, 0.1.2, 0.1.3
MAL-2026-18768 kam193 4 IOCs

Nov 8, 2026
PyPI
supercolor-tui 0.1.0, 0.1.1, 0.1.2, 0.1.4
MAL-2026-18767 kam193 2 IOCs

Nov 8, 2026
PyPI
blender-headless 9.99.9
MAL-2026-18758 amazon-inspector, kam193

Nov 8, 2026
PyPI
infra-libs 99.99.99
MAL-2026-18761 amazon-inspector, kam193

Nov 8, 2026
PyPI
expect-tests 99.99.99
MAL-2026-18760 amazon-inspector, kam193

Nov 8, 2026
PyPI
rainbowcolors 0.1.0
MAL-2026-18762 amazon-inspector, kam193 4 IOCs

Nov 8, 2026
PyPI
chromacli 0.1.2, 0.1.0, 0.1.1, 0.1.3, 0.1.4
MAL-2026-18759 amazon-inspector, kam193 2 IOCs

Nov 8, 2026
PyPI
twitch-stream-py 1.0.2rc0, 1.0.3rc0, 1.0.4rc0, 1.0.4rc2, 1.0.5rc2, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1…
MAL-2026-18756 kam193 1 IOC

Nov 7, 2026
PyPI
pyuserox 0.0.2
MAL-2026-18755 kam193 1 IOC

Nov 7, 2026
PyPI
pyuserfox 0.0.2
MAL-2026-18754 kam193 1 IOC

Nov 7, 2026
PyPI
gcp-log-poc 0.0.1, 0.0.2, 0.0.3
MAL-2026-18753 kam193, amazon-inspector

Nov 7, 2026
PyPI
qzc690383 1.0.0
MAL-2026-18750 amazon-inspector, kam193

Nov 7, 2026
PyPI
qzc690382 1.0.0
MAL-2026-18749 amazon-inspector, kam193

Nov 7, 2026
PyPI
qzc690384 1.0.0
MAL-2026-18752 kam193, amazon-inspector, ossf-package-analysis

Nov 7, 2026
PyPI
qzc690385 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0, 1.…
MAL-2026-18751 amazon-inspector, kam193, ossf-package-analysis

Nov 7, 2026
PyPI
genblaze-atlascloud 0.1.0
MAL-2026-18747 kam193

Nov 7, 2026
PyPI
genblaze-fal 0.1.0
MAL-2026-18746 kam193

Nov 7, 2026
PyPI
pulumi-doppler 0.0.0, 1.0.0
MAL-2026-18745 kam193

Nov 7, 2026
PyPI
shanks 0.0.4
MAL-2026-19051

Nov 7, 2026
PyPI
fhqiouhq 0.1.0
MAL-2026-18742 kam193

Nov 6, 2026
PyPI
ajfhiuqhfqgwerhuqnfqh 0.1.0
MAL-2026-18741 kam193

Nov 6, 2026
PyPI
reqnests 0.1.0, 0.1.1
MAL-2026-18744 kam193

Nov 6, 2026
PyPI
reqnest 0.1.0
MAL-2026-18743 kam193

Nov 6, 2026
PyPI
hello-bat-fwi9 0.1.0, 0.1.1
MAL-2026-18735 kam193, amazon-inspector 1 IOC

Nov 6, 2026
PyPI
mcp-teamviewer 0.0.1
MAL-2026-18706 ossf-package-analysis, kam193

Nov 5, 2026
PyPI
teamviewer-mcp-server 0.0.1
MAL-2026-18705 ossf-package-analysis, kam193

Nov 5, 2026
PyPI
dbt-adapter 0.0.0, 0.1.0a2
MAL-2026-18704 kam193

Nov 5, 2026
PyPI
rcp-ndcg 9999.0.0
MAL-2026-18658 ossf-package-analysis, kam193, amazon-inspector

Nov 5, 2026
PyPI
strands-aidr 9999.0.0
MAL-2026-18657 kam193

Nov 5, 2026
PyPI
extera-runtime 1.1.0
MAL-2026-18633 kam193, amazon-inspector 1 IOC

Nov 4, 2026
PyPI
msgpackrpc 0.0.0, 0.1.0
MAL-2026-18627 kam193

Nov 4, 2026
PyPI
extera-plugin-runtime 1.0.0, 1.0.1
MAL-2026-18625 kam193 1 IOC

Nov 4, 2026
PyPI
ln9qw38745g 0.1.0, 0.1.1
MAL-2026-18583 kam193

Nov 3, 2026
PyPI
protecteda 0.1.0
MAL-2026-18584 kam193

Nov 3, 2026
PyPI
zyto 0.2.0, 0.2.1, 0.2.2, 0.2.3
MAL-2026-18582 kam193

Nov 3, 2026