Skip to content
OpenAdvisories

Supply chain

Malicious packages · PyPI

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

12,020 reports · Feed

  • PyPI
    syntaxlogger 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4
    MAL-2026-3697 kam193 2 IOCs
  • PyPI
    trickery 1.0.0, 1.0.1
    MAL-2026-3698 kam193 3 IOCs
  • PyPI
    hackling 1.0.0, 1.0.2
    MAL-2026-3665 kam193
  • PyPI
    workingitmehelpit 1.0.0
    MAL-2026-3664 kam193, ossf-package-analysis 1 IOC
  • PyPI
    numpy-lib 0.142.132
    MAL-2026-3660 kam193 3 IOCs
  • PyPI
    pandas-data 0.0.38
    MAL-2026-3661 kam193 3 IOCs
  • PyPI
    py-requests 0.41.25
    MAL-2026-3662 kam193 3 IOCs
  • PyPI
    rich-util 0.218.10
    MAL-2026-3659 kam193 3 IOCs
  • PyPI
    openai-spellcheckers 1.0.0
    MAL-2026-3638 kam193 9 IOCs
  • PyPI
    d4rktg 1.2.7
    MAL-2026-3688 amazon-inspector
  • PyPI
    amino-fix 2.1.8
    MAL-2026-3686 amazon-inspector
  • PyPI
    txwrap 1.0.0, 1.0.1
    MAL-2026-3619 kam193 4 IOCs
  • PyPI
    always-updates 139.2
    MAL-2026-3685 amazon-inspector
  • PyPI
    ai-spellcheckers 1.0.0
    MAL-2026-3615 kam193 9 IOCs
  • PyPI
    kaggle-runner 0.0.2
    MAL-2026-3693 amazon-inspector
  • PyPI
    dlty 0.0.10, 1.0.3
    MAL-2026-3690 amazon-inspector
  • PyPI
    crazehub 3.6.0
    MAL-2026-3687 amazon-inspector
  • PyPI
    projz-py 2.3.5, 2.3.9, 1.8.2, 1.7.1
    MAL-2026-3696 amazon-inspector
  • PyPI
    pirxcypackage 8.0.0
    MAL-2026-3695 amazon-inspector
  • PyPI
    mymaldependency 2.1.1
    MAL-2026-3694 amazon-inspector
  • PyPI
    enhancer 0.2.3
    MAL-2026-3691 amazon-inspector
  • PyPI
    dcchbot 1.9.4, 1.9.1, 1.8.3, 1.9, 1.8.1
    MAL-2026-3689 amazon-inspector
  • PyPI
    guan 0.1.171, 0.1.100
    MAL-2026-3692 amazon-inspector
  • PyPI
    mistralai 2.4.6
    MAL-2026-3608 google-open-source-security 4 IOCs
  • PyPI
    guardrails-ai 0.10.1
    MAL-2026-3607 google-open-source-security 4 IOCs
  • PyPI
    apkeep 0.1.0, 1.0.1
    MAL-2026-3431 kam193 2 IOCs
  • PyPI
    openai-spellchecker 1.0.0
    MAL-2026-3429 kam193 9 IOCs
  • PyPI
    xxx-bale 1.0.0
    MAL-2026-3428 kam193 4 IOCs
  • PyPI
    mpkg123 0.0.0
    MAL-2026-3426 kam193
  • PyPI
    xxoo-bale 1.0.0
    MAL-2026-3425 kam193 4 IOCs
  • PyPI
    dlocal-cli 99.0.0, 99.0.1, 99.0.2, 99.0.3
    MAL-2026-3424 kam193, ossf-package-analysis
  • PyPI
    django-b64-img 1.1
    MAL-2026-3413 kam193
  • PyPI
    web3-py-checksum 1.1, 1.0
    MAL-2026-3411 kam193, reversing-labs
  • PyPI
    textwrap-ext 1.2.5
    MAL-2026-3408 kam193 3 IOCs
  • PyPI
    textwrap-toolkit 1.2.2
    MAL-2026-3407 kam193 3 IOCs
  • PyPI
    ggfmttygl-new 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5
    MAL-2026-3406 kam193
  • PyPI
    ggfmttygl 1.0.0
    MAL-2026-3405 kam193
  • PyPI
    bttcli 1.1.0
    MAL-2026-3401 kam193 1 IOC
  • PyPI
    python-bittensor-config-v2 1.1.0
    MAL-2026-3402 kam193 1 IOC
  • PyPI
    textwrap-formatter 1.2.4, 1.2.5
    MAL-2026-3403 kam193 3 IOCs