Supply chain

Malicious packages · PyPI

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

12,020 reports · Feed

PyPI
marshmellow 1.0.0, 1.1.0
MAL-2026-864 kam193, ossf-package-analysis

Feb 12, 2026
PyPI
lala6992 1.0.0, 0.4.0, 1.2.0
MAL-2026-946 ossf-package-analysis

Feb 12, 2026
PyPI
get-incorrect-name-bob 0.1.0
MAL-2026-862 kam193

Feb 12, 2026
PyPI
osopackagepy 10.0.0
MAL-2026-860 ossf-package-analysis, kam193

Feb 11, 2026
PyPI
config-toolkit 1.0.11
MAL-2026-855 kam193 1 IOC

Feb 11, 2026
PyPI
python-files-mod 1.0.0
MAL-2026-851 kam193

Feb 11, 2026
PyPI
ci-metadata-python-logging 0.1.0
MAL-2024-12374 kam193

Feb 11, 2026
PyPI
tablixs 1.0.1
MAL-2025-193013 kam193 8 IOCs

Feb 11, 2026
PyPI
ntoctfutils 0.1.0, 1.0.0
MAL-2026-850 kam193 2 IOCs

Feb 11, 2026
PyPI
jsonconfig-utils 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11
MAL-2026-849 kam193 1 IOC

Feb 11, 2026
PyPI
cryptowallethash 0.0.6, 0.0.7, 0.0.8
MAL-2026-846 kam193 1 IOC

Feb 10, 2026
PyPI
requests-auth-toolkit 2.1.0
MAL-2026-847 kam193 1 IOC

Feb 10, 2026
PyPI
gpu-discovery 99.99.99
MAL-2024-12373 kam193

Feb 10, 2026
PyPI
rzr-home 99.99.99
MAL-2026-845 kam193

Feb 10, 2026
PyPI
amplify-python-logging 0.0.0, 0.1.0
MAL-2026-842 kam193

Feb 10, 2026
PyPI
vllm-plugins 99.99.99
MAL-2026-844 kam193

Feb 10, 2026
PyPI
requests-core-plugin 2.31.5, 2.31.6, 2.31.7, 2.31.8, 2.31.9, 2.31.12, 2.31.13, 2.31.14, 2.31.15
MAL-2026-843 kam193 3 IOCs

Feb 10, 2026
PyPI
lyroxpy 1.0.0, 1.0.1
MAL-2026-841 kam193

Feb 10, 2026
PyPI
testppe-pkg 1.0.0
MAL-2026-826 kam193

Feb 10, 2026
PyPI
dev-pipline-test 1.0.0, 2.0.0, 3.0.0, 4.0.0
MAL-2026-824 kam193

Feb 10, 2026
PyPI
devtools-webhook-cicd-utils 1.4.7, 1.5.0, 1.5.1, 1.6.0
MAL-2026-825 kam193 1 IOC

Feb 10, 2026
PyPI
ntoutils 1.3.1, 1.3.2
MAL-2026-823 kam193 2 IOCs

Feb 10, 2026
PyPI
thecorrectjames 0.1.0, 0.1.1
MAL-2026-818 kam193

Feb 9, 2026
PyPI
ctf-pipline-test 1.0.0, 2.0.0
MAL-2026-817 kam193

Feb 9, 2026
PyPI
http-notifier-test 1.0.0
MAL-2026-814 kam193

Feb 9, 2026
PyPI
skydeo 1.0.0
MAL-2026-815 kam193 2 IOCs

Feb 9, 2026
PyPI
teligram 1.0.0
MAL-2026-813 kam193

Feb 8, 2026
PyPI
hardixx-code 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5
MAL-2026-812 kam193

Feb 8, 2026
PyPI
grokwrapper 0.1.0, 0.2.0
MAL-2026-811 kam193 1 IOC

Feb 8, 2026
PyPI
ccxt-bullish 1.0.0, 99.99.99
MAL-2026-809 kam193

Feb 8, 2026
PyPI
thread-pipeline-test 1.0.0
MAL-2026-810 kam193

Feb 8, 2026
PyPI
carcent 2.1.0
MAL-2026-808 kam193

Feb 6, 2026
PyPI
gridifies 1.0.2
MAL-2025-193012 kam193 8 IOCs

Feb 6, 2026
PyPI
moveworks-pipeline-test 2.0.0
MAL-2026-803 kam193

Feb 6, 2026
PyPI
p7zip-full 0.1.0, 0.2.0, 1.0.0, 2.0.0
MAL-2026-790 kam193

Feb 6, 2026
PyPI
adminbypasser 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 2.0.1
MAL-2026-774 kam193 1 IOC

Feb 6, 2026
PyPI
greeter-pro-test 1.0.0
MAL-2026-766 kam193

Feb 5, 2026
PyPI
web3-meme-tool 0.1.2
MAL-2026-763 kam193 4 IOCs

Feb 5, 2026
PyPI
metadata-checker 1.2.0
MAL-2026-762 kam193 4 IOCs

Feb 5, 2026
PyPI
pipelinepoision-test 1.0.0
MAL-2026-759 kam193

Feb 5, 2026