Skip to content
OpenAdvisories

Supply chain

Malicious packages · PyPI

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

12,020 reports · Feed

  • PyPI
    instal 1.3.5
    MAL-2026-4195 ossf-package-analysis, kam193
  • PyPI
    txdpy 2026.5
    MAL-2026-4772 amazon-inspector
  • PyPI
    vlifegram 2.1.2.4
    MAL-2026-4773 amazon-inspector
  • PyPI
    libhmac 0.3.0, 0.8.28.0, 0.8.28.1, 1.1.0
    MAL-2026-4194 kam193, amazon-inspector
  • PyPI
    openclaw-agent 1.0.3
    MAL-2026-4183 kam193 2 IOCs
  • PyPI
    stripe-internal 9.5.0
    MAL-2026-4182 ossf-package-analysis, kam193
  • PyPI
    stripe-commands 8.5.0
    MAL-2026-4181 ossf-package-analysis, kam193
  • PyPI
    stripe-utils 99.4.0, 2.0.0, 3.0.0, 4.0.0, 99.0.0, 99.1.0, 99.2.0, 99.5.0
    MAL-2026-4180 ossf-package-analysis, kam193
  • PyPI
    morin 0.5.24, 0.5.23, 0.5.26
    MAL-2026-4757 amazon-inspector
  • PyPI
    aurafarmer 0.3.0
    MAL-2026-4741 amazon-inspector
  • PyPI
    silly-logger 0.1.1, 0.1.6, 0.1.7
    MAL-2026-4767 amazon-inspector
  • PyPI
    eplang 7.8.1, 7.9.0, 7.6.1, 8.0.0
    MAL-2026-4748 amazon-inspector
  • PyPI
    pycalendar-api 0.4.0
    MAL-2026-4764 amazon-inspector
  • PyPI
    glass-of-water 1.0.1, 1.0.3
    MAL-2026-4751 amazon-inspector
  • PyPI
    nebulix-ai 1.0.0, 1.0.3
    MAL-2026-4758 amazon-inspector
  • PyPI
    soundsource 0.1.0
    MAL-2026-4769 amazon-inspector
  • PyPI
    buddyme 0.2.5, 0.2.3
    MAL-2026-4743 amazon-inspector
  • PyPI
    dabrius-utils 0.0.1, 0.0.2
    MAL-2026-4176 kam193
  • PyPI
    durabletask 1.4.1, 1.4.2, 1.4.3
    MAL-2026-4174 amazon-inspector, kam193 8 IOCs
  • PyPI
    tarpackage 1.0.0
    MAL-2026-4166 kam193 2 IOCs
  • PyPI
    vfat-ai 0.3.151
    MAL-2026-4163 kam193
  • PyPI
    vfat 0.1.0
    MAL-2026-4162 kam193
  • PyPI
    solana-web3-alt 0.37.0, 0.37.1
    MAL-2026-3835 kam193
  • PyPI
    foundry-utils 0.3.0, 0.3.1, 0.3.2, 0.3.3
    MAL-2026-3834 kam193
  • PyPI
    pyenvprep 1.0.0
    MAL-2026-3829 kam193 1 IOC
  • PyPI
    netping 0.2.0, 1.1.0
    MAL-2026-3805 kam193 1 IOC
  • PyPI
    venv-utils 1.0.0, 1.0.1, 1.0.3
    MAL-2026-3803 kam193 1 IOC
  • PyPI
    jatinangor-teleport-testing-zer0id 99.0.0
    MAL-2026-3746 kam193
  • PyPI
    sol-batch-transfer-sdk 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7
    MAL-2026-3743 kam193
  • PyPI
    natazx 0.1.2
    MAL-2026-3778 amazon-inspector
  • PyPI
    tronpath 0.0.1
    MAL-2026-3742 kam193 4 IOCs
  • PyPI
    pyexecutorsme 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7
    MAL-2026-3741 kam193 2 IOCs
  • PyPI
    async-http-tools 0.70.125
    MAL-2026-3702 kam193 3 IOCs
  • PyPI
    web3-helpers 0.110.234
    MAL-2026-3706 kam193 3 IOCs
  • PyPI
    math-array-tools 0.250.211
    MAL-2026-3705 kam193 3 IOCs
  • PyPI
    graddio 0.226.51
    MAL-2026-3704 kam193 3 IOCs
  • PyPI
    crypto-hash-utils 0.189.129
    MAL-2026-3703 kam193 3 IOCs
  • PyPI
    aiohttp-util 0.68.253
    MAL-2026-3699 kam193 3 IOCs
  • PyPI
    api-request-helpers 0.185.132
    MAL-2026-3701 kam193 3 IOCs
  • PyPI
    alembic-util 0.189.33
    MAL-2026-3700 kam193 3 IOCs