Supply chain

Malicious packages · PyPI

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

12,020 reports · Feed

PyPI
lm-sys 99.0.0
MAL-2026-2178 kam193

Mar 25, 2026
PyPI
torchunmix 0.2
MAL-2026-2158 kam193, ossf-package-analysis

Mar 25, 2026
PyPI
mattermost-data-warehouse 99.0.0
MAL-2026-2148 kam193

Mar 24, 2026
PyPI
snooty 99.0.0
MAL-2026-2150 kam193

Mar 24, 2026
PyPI
sentry-filter-forks 99.0.0
MAL-2026-2149 kam193

Mar 24, 2026
PyPI
mattermost-airflow 99.0.0
MAL-2026-2147 kam193

Mar 24, 2026
PyPI
databricks-clean-room-orchestrator 99.0.0
MAL-2026-2146 kam193

Mar 24, 2026
PyPI
compose-rl 99.0.0
MAL-2026-2145 kam193

Mar 24, 2026
PyPI
target-iceberg 99.0.0
MAL-2026-2152 kam193

Mar 24, 2026
PyPI
tap-wordpress 99.0.0
MAL-2026-2151 kam193

Mar 24, 2026
PyPI
roboat-util 2.30, 2.40
MAL-2026-2142 kam193 4 IOCs

Mar 24, 2026
PyPI
roboated 2.30
MAL-2026-2143 kam193 4 IOCs

Mar 24, 2026
PyPI
corexloader 1.0.0
MAL-2026-2141 kam193

Mar 24, 2026
PyPI
coreloader 1.0.0
MAL-2026-2140 kam193

Mar 24, 2026
PyPI
stats-helpers 1.0.0
MAL-2026-2139 kam193 1 IOC

Mar 24, 2026
PyPI
open-vp-cal 1.3.1
MAL-2026-2138 kam193 4 IOCs

Mar 24, 2026
PyPI
rocketpill 0.1
MAL-2026-2401 reversing-labs

Mar 24, 2026
PyPI
flycalc 1.2.0, 1.2.1
MAL-2026-2399 reversing-labs

Mar 24, 2026
PyPI
privaton-beacon-img-8f3603448690bdde-png 774.350.288, 774.377.534, 774.377.646, 774.377.756, 774.377.865, 774.379.660, 7…
MAL-2026-2201 oracle-using-macaron

Mar 24, 2026
PyPI
litellm 1.82.7, 1.82.8, 1.107.0
MAL-2026-2144 google-open-source-security, ossf-package-analysis, amazon-inspector 2 IOCs

Mar 24, 2026
PyPI
mgrcfg 1.6.7, 1.6.8, 1.6.9
MAL-2026-2124 kam193 2 IOCs

Mar 24, 2026
PyPI
rowrapee 1.21, 1.22
MAL-2026-2122 kam193 4 IOCs

Mar 23, 2026
PyPI
roboat 0.0.1, 1.1.0, 2.0.0, 2.1.0, 2.20
MAL-2026-2121 kam193 4 IOCs

Mar 23, 2026
PyPI
logutilkit 1.0.1
MAL-2026-2120 kam193 2 IOCs

Mar 23, 2026
PyPI
apachelicense 0.1a1
MAL-2026-2119 kam193 2 IOCs

Mar 23, 2026
PyPI
hash-utils-py 1.0.0, 1.0.5
MAL-2026-2118 kam193

Mar 23, 2026
PyPI
apply-hive-table 3.1.4, 3.1.5
MAL-2026-2112 kam193 5 IOCs

Mar 23, 2026
PyPI
pyregions-snowflake 3.9.1, 3.9.2, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 3.9.8, 3.9.9, 3.9.10
MAL-2026-2109 kam193 5 IOCs

Mar 23, 2026
PyPI
dmclc 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.5, 2.1.6, 2.1.7, 2.1.9, 2.1.10
MAL-2026-2106 kam193 5 IOCs

Mar 23, 2026
PyPI
modelconftranslator 8.13.4
MAL-2026-2108 kam193 5 IOCs

Mar 23, 2026
PyPI
financial-crimes-general-utils 3.9.12
MAL-2026-2107 kam193 5 IOCs

Mar 23, 2026
PyPI
license-utils-kit 0.1a0, 0.1a1, 0.1b1, 0.1b2, 0.1b3, 0.1b4, 0.1rc1, 0.1rc2, 0.1rc3
MAL-2026-2084 kam193 2 IOCs

Mar 23, 2026
PyPI
anduril-sdk 1.0.0, 1.0.1
MAL-2026-2083 kam193

Mar 23, 2026
PyPI
pipinpeace-bind 0.0.0
MAL-2026-2028 kam193

Mar 22, 2026
PyPI
pipinpeace-reverse 0.0.0
MAL-2026-2029 kam193

Mar 22, 2026
PyPI
pipinpeace-env 0.0.0
MAL-2026-2026 kam193

Mar 22, 2026
PyPI
aiolrucache 0.1.0, 0.1.1, 0.2.0, 0.3.0
MAL-2026-2020 kam193

Mar 21, 2026
PyPI
thisismytest 1.0.0, 2.0.0, 3.0.0, 4.0.0, 5.0.0
MAL-2026-2017 kam193, ossf-package-analysis 2 IOCs

Mar 21, 2026
PyPI
qyrm-pipinject4 1.0
MAL-2026-2016 kam193

Mar 21, 2026
PyPI
nump 1, 1.3.3.7, 3.3.0.1, 5.5.5.5
MAL-2026-2013 kam193

Mar 21, 2026