Skip to content
OpenAdvisories

Supply chain

Malicious packages · PyPI

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

12,020 reports · Feed

  • PyPI
    hmacsync 1.0.0
    MAL-2026-4828 kam193
  • PyPI
    datapipe-util 1.7.2, 1.7.3
    MAL-2026-4820 kam193 2 IOCs
  • PyPI
    vectordb-engine 1.0.0
    MAL-2026-4814 amazon-inspector, kam193 1 IOC
  • PyPI
    baidubsrc 0.0.1
    MAL-2026-4809 amazon-inspector, kam193
  • PyPI
    docontrol-mcp 999.0.0
    MAL-2026-4811 ossf-package-analysis, kam193
  • PyPI
    binproto 1.0.1
    MAL-2026-4810 kam193 2 IOCs
  • PyPI
    m-at-star-tools 1.0.4, 1.0.0, 1.0.3
    MAL-2026-4812 amazon-inspector, kam193 4 IOCs
  • PyPI
    helu 0.2.0
    MAL-2026-4357 kam193 3 IOCs
  • PyPI
    mistral-search-toolkit 999.0.0
    MAL-2026-4358 kam193
  • PyPI
    mistral-workflows-plugins-webhook 999.0.0
    MAL-2026-4355 ossf-package-analysis, kam193
  • PyPI
    mistral-workflows-plugins-mistralai 999.0.0
    MAL-2026-4354 ossf-package-analysis, kam193
  • PyPI
    mistral-workflows 999.0.0
    MAL-2026-4353 ossf-package-analysis, kam193
  • PyPI
    xct-x-ayoub 1.0.0
    MAL-2026-4777 amazon-inspector
  • PyPI
    spip-pth-demo 1.0.2, 1.0.1
    MAL-2026-4770 amazon-inspector
  • PyPI
    pylogkt 0.1.2
    MAL-2026-4291 kam193, amazon-inspector 2 IOCs
  • PyPI
    polymarket-data-fetcher 1.2.4
    MAL-2026-4286 kam193
  • PyPI
    polydata-analytics 1.3.0, 1.3.1
    MAL-2026-4285 kam193, amazon-inspector
  • PyPI
    whatsfly-labfox 0.2.0, 0.2.1
    MAL-2026-4776 amazon-inspector
  • PyPI
    env-loader-cli 0.1.0, 0.1.1
    MAL-2026-4272 kam193, amazon-inspector 4 IOCs
  • PyPI
    data-pipeline-check 0.1.0, 0.1.1
    MAL-2026-4271 kam193, amazon-inspector 4 IOCs
  • PyPI
    git-config-sync 0.1.0, 0.1.1
    MAL-2026-4273 kam193, amazon-inspector 4 IOCs
  • PyPI
    mistral-evals 999.0.0
    MAL-2026-4269 kam193
  • PyPI
    solidity-build-guard 0.1.0
    MAL-2026-4262 kam193, amazon-inspector 3 IOCs
  • PyPI
    defi-risk-scanner 0.1.0
    MAL-2026-4260 kam193, amazon-inspector 3 IOCs
  • PyPI
    eth-security-auditor 0.1.0
    MAL-2026-4261 kam193, amazon-inspector 3 IOCs
  • PyPI
    cryptowallet-safety 0.1.0
    MAL-2026-4259 kam193, amazon-inspector 3 IOCs
  • PyPI
    ml2000 0.1.4
    MAL-2026-4756 amazon-inspector
  • PyPI
    gt-tester-exp-profiler-exp-00000017 1.0.0
    MAL-2026-4753 amazon-inspector
  • PyPI
    gt-tester-exp-profiler-exp-00000015 1.0.0
    MAL-2026-4752 amazon-inspector
  • PyPI
    sklern 0.0.8, 0.0.7, 0.0.10, 0.0.6, 0.0.11, 0.0.9
    MAL-2026-4768 amazon-inspector
  • PyPI
    vulndify-mcp-server 0.3.0
    MAL-2026-4774 amazon-inspector
  • PyPI
    pylogft 0.1.0, 0.1.1
    MAL-2026-4253 kam193, amazon-inspector 2 IOCs
  • PyPI
    pylogfmt 0.1.0
    MAL-2026-4231 kam193, amazon-inspector 2 IOCs
  • PyPI
    mathepy 1.2.0, 3.5.0, 4.5.0, 2.5.0, 6.7.0, 6.6.0, 1.0.0, 8.0.0, 6.8.0, 5.5.0, 2.2.0, 5.…
    MAL-2026-4755 amazon-inspector
  • PyPI
    fakehuop 3.1.0, 3.2.0, 3.7.0, 3.5.0
    MAL-2026-4749 amazon-inspector
  • PyPI
    lognest 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4
    MAL-2026-4227 kam193, amazon-inspector 2 IOCs
  • PyPI
    tensor-compute 1.0.0
    MAL-2026-4223 kam193, amazon-inspector 2 IOCs
  • PyPI
    wdt-erpmcp 0.1.7, 0.1.5, 0.1.6
    MAL-2026-4775 amazon-inspector
  • PyPI
    selfservsweeper 0.1.7
    MAL-2026-4221 kam193, amazon-inspector
  • PyPI
    obs-migrate 0.0.1
    MAL-2026-4201 kam193