Supply chain

Malicious packages · PyPI

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

12,020 reports · Feed

PyPI
telebot-infoo 0.3
MAL-2026-935 kam193 6 IOCs

Feb 18, 2026
PyPI
easyreg 1.0.0
MAL-2026-932 kam193 3 IOCs

Feb 17, 2026
PyPI
pywin-simple-gui 1.0.0
MAL-2026-933 kam193 3 IOCs

Feb 17, 2026
PyPI
telebot-infe 0.3
MAL-2026-931 kam193 6 IOCs

Feb 17, 2026
PyPI
telebot-info 0.3, 0.4
MAL-2026-930 kam193 6 IOCs

Feb 17, 2026
PyPI
polyutil 1.0.0
MAL-2026-928 kam193 10 IOCs

Feb 17, 2026
PyPI
polyclawd 1.1.0
MAL-2026-927 kam193 10 IOCs

Feb 16, 2026
PyPI
cicibot-fix-message-naming 0.0.1
MAL-2026-921 kam193, ossf-package-analysis 1 IOC

Feb 16, 2026
PyPI
aliyun-python-sdk-v2 2.13.36
MAL-2026-917 kam193, reversing-labs

Feb 16, 2026
PyPI
alibabacloude 2.2.0, 2.13.37
MAL-2026-916 kam193, reversing-labs

Feb 16, 2026
PyPI
alibabacloud-code-tool 2.0.0, 2.0.1, 2.0.2, 2.0.3
MAL-2026-915 kam193, reversing-labs

Feb 16, 2026
PyPI
groq-ppe-pkg 1.0.0
MAL-2026-913 kam193

Feb 16, 2026
PyPI
http-request-toolkit 2.28.3, 2.28.4, 2.28.5
MAL-2026-912 kam193, reversing-labs

Feb 16, 2026
PyPI
malpkgv2-0 0.1.0
MAL-2026-911 oracle-using-macaron

Feb 16, 2026
PyPI
dns-execution-test 1.1.2, 1.1.3
MAL-2026-910 kam193 1 IOC

Feb 15, 2026
PyPI
clawdist 1.2.5, 1.2.6
MAL-2026-909 kam193 9 IOCs

Feb 15, 2026
PyPI
tronpad 0.0.1
MAL-2026-907 kam193 4 IOCs

Feb 15, 2026
PyPI
marshmellows 1.0.0
MAL-2026-905 kam193, ossf-package-analysis

Feb 15, 2026
PyPI
strands-agents-anthropic 0.0.0, 1.0.0
MAL-2026-904 kam193

Feb 15, 2026
PyPI
requests-toolkit 0.1.2, 0.1.3
MAL-2026-903 kam193

Feb 15, 2026
PyPI
crc32fast 1.0.99
MAL-2026-902 ossf-package-analysis, kam193

Feb 14, 2026
PyPI
cubaflixdownload 1.0.0, 1.0.1, 2.0.0, 3.0.0, 4.0.0, 5.0.0, 6.0.0
MAL-2026-900 kam193

Feb 14, 2026
PyPI
platforms 1.0.0, 1.0.1, 2.0.0, 3.0.0, 4.0.0, 5.0.0, 6.0.0
MAL-2026-901 kam193

Feb 14, 2026
PyPI
dzuseragents 0.0.1, 0.0.2
MAL-2026-899 kam193 1 IOC

Feb 14, 2026
PyPI
langraph 0.0.0, 1.0.0
MAL-2024-12375 kam193

Feb 14, 2026
PyPI
magicwolf 1.1.8, 1.1.9, 1.2.0, 1.2.1
MAL-2026-898 kam193 8 IOCs

Feb 14, 2026
PyPI
clawdest 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7
MAL-2026-897 kam193 7 IOCs

Feb 13, 2026
PyPI
troncloud 0.0.1, 0.0.2, 0.0.3, 0.0.4
MAL-2026-894 kam193 4 IOCs

Feb 13, 2026
PyPI
magichat 0.1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0, 1.…
MAL-2026-878 kam193 4 IOCs

Feb 13, 2026
PyPI
displaydoc 1.0.0
MAL-2026-875 ossf-package-analysis, kam193

Feb 13, 2026
PyPI
acpi-tables 1.0.9
MAL-2026-876 kam193

Feb 13, 2026
PyPI
arrayvec 1.0.99
MAL-2026-877 kam193

Feb 13, 2026
PyPI
google-search-result 2.4.3
MAL-2026-874 ossf-package-analysis, kam193

Feb 12, 2026
PyPI
b10connoisseur 0.1.0, 0.2.0, 0.3.0, 0.4.0, 0.5.0, 0.12.0, 0.13.0, 0.14.0, 0.17.0, 0.18.0, 0.19…
MAL-2026-870 kam193, ossf-package-analysis, reversing-labs 2 IOCs

Feb 12, 2026
PyPI
ritch 1.0.0
MAL-2026-869 kam193, ossf-package-analysis

Feb 12, 2026
PyPI
oraceldb 1.0.0
MAL-2026-866 kam193, ossf-package-analysis

Feb 12, 2026
PyPI
krbutils 1.0.0
MAL-2026-863 kam193, ossf-package-analysis

Feb 12, 2026
PyPI
pydantics 1.0.0
MAL-2026-868 kam193, ossf-package-analysis

Feb 12, 2026
PyPI
pandaai 1.0.0
MAL-2026-867 kam193, ossf-package-analysis

Feb 12, 2026
PyPI
opentelematry-api 1.0.0
MAL-2026-865 kam193, ossf-package-analysis

Feb 12, 2026