Supply chain

Malicious packages · PyPI

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

12,020 reports · Feed

PyPI
roboat-utils 1.0.0, 2.1.0, 2.2.0, 2.3.0, 2.4.0, 2.5.0, 2.6.0, 2.7.0, 2.8.0, 2.9.0, 3.0.0
MAL-2026-2512 kam193 9 IOCs

Apr 8, 2026
PyPI
genesis-1p-tools-rpm-bundle 9.0.0, 9.0.1
MAL-2026-2503 kam193

Apr 7, 2026
PyPI
databasenaps 0.0.4, 0.0.5
MAL-2026-2502 kam193 9 IOCs

Apr 7, 2026
PyPI
databaselooks 0.0.4
MAL-2026-2501 kam193 9 IOCs

Apr 7, 2026
PyPI
databasetapes 0.0.4
MAL-2026-2494 kam193 9 IOCs

Apr 5, 2026
PyPI
databaserobooms 0.0.4
MAL-2026-2489 kam193 7 IOCs

Apr 4, 2026
PyPI
databaserotacos 0.0.4
MAL-2026-2490 kam193 7 IOCs

Apr 4, 2026
PyPI
photo-extractor 2.33.0
MAL-2026-2488 kam193 2 IOCs

Apr 4, 2026
PyPI
discord-request 1.0.0
MAL-2026-2487 kam193

Apr 4, 2026
PyPI
gangomodule 1.0.20, 1.0.37
MAL-2026-2486 kam193 4 IOCs

Apr 4, 2026
PyPI
supervisors 0.1.0
MAL-2026-2448 kam193 2 IOCs

Apr 3, 2026
PyPI
pycolorlib3 0.0.4, 0.0.5
MAL-2026-2433 kam193 6 IOCs

Apr 2, 2026
PyPI
nwin64tls 0.0.1
MAL-2026-2432 kam193

Apr 2, 2026
PyPI
nwin32tls 0.0.1, 0.0.2, 0.0.3, 0.0.5, 0.0.6, 0.0.7
MAL-2026-2431 kam193

Apr 2, 2026
PyPI
k8s-node-health 1.2.0, 1.3.0
MAL-2026-2430 kam193 2 IOCs

Apr 2, 2026
PyPI
eht-account 0.13.7
MAL-2026-2405 kam193

Apr 1, 2026
PyPI
ether-account 0.13.7, 0.14.0b1
MAL-2026-2404 kam193

Apr 1, 2026
PyPI
polymarkets-sdk 1.0.0, 1.0.1
MAL-2026-2403 kam193 1 IOC

Apr 1, 2026
PyPI
kube-node-health 1.0.0
MAL-2026-2400 kam193 2 IOCs

Apr 1, 2026
PyPI
kube-health-tools 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.8, 1.0.9, 1.0.10, 1.0.11, …
MAL-2026-2327 kam193 2 IOCs

Apr 1, 2026
PyPI
openai-async-helpers 0.0.1
MAL-2026-2316 kam193

Apr 1, 2026
PyPI
pygithub-async-utils 0.0.1
MAL-2026-2317 kam193

Apr 1, 2026
PyPI
latinum-wallet-mcp 0.0.32, 0.0.33, 0.0.34, 0.0.35, 0.0.36
MAL-2026-2315 kam193 1 IOC

Mar 31, 2026
PyPI
coredxloader 0.1.0, 0.1.1
MAL-2026-2313 kam193

Mar 31, 2026
PyPI
officepyai 0.0.1
MAL-2026-2311 kam193

Mar 31, 2026
PyPI
lakeflow-community-connectors 0.0.0, 0.1.0
MAL-2026-2310 kam193

Mar 31, 2026
PyPI
workingitme 1.0.0
MAL-2026-2308 ossf-package-analysis, kam193 3 IOCs

Mar 31, 2026
PyPI
zzzzthisisitwantsafecheckitzzzz 1.0.0
MAL-2026-2309 ossf-package-analysis, kam193 3 IOCs

Mar 31, 2026
PyPI
databaseroboats 0.0.3, 0.0.4
MAL-2026-2305 kam193 6 IOCs

Mar 30, 2026
PyPI
spanner-client 9.9.9
MAL-2026-2304 kam193

Mar 30, 2026
PyPI
prodaccess 9.9.9
MAL-2026-2303 kam193

Mar 30, 2026
PyPI
dremel 9.9.9
MAL-2026-2301 kam193

Mar 30, 2026
PyPI
loas 9.9.9
MAL-2026-2302 kam193

Mar 30, 2026
PyPI
mnemoniclib 0.20.1, 0.21.1, 0.22.1
MAL-2026-2299 kam193 2 IOCs

Mar 30, 2026
PyPI
hiveos-sdk 2.33.0
MAL-2026-2298 kam193 2 IOCs

Mar 30, 2026
PyPI
databaseroboat 0.0.1, 0.0.2
MAL-2026-2295 kam193 6 IOCs

Mar 29, 2026
PyPI
hiveos 2.33.0
MAL-2026-2294 kam193 2 IOCs

Mar 29, 2026
PyPI
pychatz 1.0.0, 1.0.1
MAL-2026-2291 kam193

Mar 29, 2026
PyPI
safecheckit 1.0.0, 2.0.0
MAL-2026-2292 kam193, ossf-package-analysis 3 IOCs

Mar 29, 2026
PyPI
thisismytestnouser 1.0.0, 2.0.0
MAL-2026-2293 kam193 3 IOCs

Mar 29, 2026