Skip to content
OpenAdvisories

Supply chain

Malicious packages · PyPI

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,161 npm 223,990 PyPI 12,021 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

12,021 reports · Feed

  • PyPI
    requests-2022 3.22.6
    MAL-2025-41744 reversing-labs
  • PyPI
    request-util 2.4.0
    MAL-2025-41743 reversing-labs
  • PyPI
    requesgs 2.28.2
    MAL-2025-41742 reversing-labs
  • PyPI
    requeqts 2.28.2
    MAL-2025-41741 reversing-labs
  • PyPI
    reqeuest-new 4.22.6
    MAL-2025-41740 reversing-labs
  • PyPI
    reqeuest-2022 4.22.6
    MAL-2025-41739 reversing-labs
  • PyPI
    reqests-2022 3.22.6
    MAL-2025-41738 reversing-labs
  • PyPI
    reqest-2022 3.22.6
    MAL-2025-41737 reversing-labs
  • PyPI
    regexparam 1.0.0
    MAL-2025-41736 reversing-labs
  • PyPI
    rbx-cookie 0.0.1
    MAL-2025-41733 reversing-labs
  • PyPI
    rbx-autohit 0.0.1
    MAL-2025-41732 reversing-labs
  • PyPI
    rblxsetup 0.0.1
    MAL-2025-41731 reversing-labs
  • PyPI
    pyxhttp 0.0.8
    MAL-2025-41728 reversing-labs
  • PyPI
    pythonsftpservermanuel 0.0.6, 0.0.8, 0.0.9, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.2.0, 0.3.0
    MAL-2025-41727 reversing-labs
  • PyPI
    pythonroblox 2.0.1
    MAL-2025-41726 reversing-labs
  • PyPI
    python-kudu 0.4.0
    MAL-2025-41725 reversing-labs
  • PyPI
    python-eicar 0.1
    MAL-2025-41724 reversing-labs
  • PyPI
    python-dependency-confusion-attacks 0.0.2, 0.0.4, 1.1.4
    MAL-2025-41723 reversing-labs
  • PyPI
    pyswyfter 0.3.1
    MAL-2025-41722 reversing-labs
  • PyPI
    pyscapes 0.0.10
    MAL-2025-41721 reversing-labs
  • PyPI
    py4self 1.0.1
    MAL-2025-41720 reversing-labs
  • PyPI
    prometheus-api-metrics 1.0.0
    MAL-2025-41719 reversing-labs
  • PyPI
    pkproxy 6.9.2
    MAL-2025-41718 reversing-labs
  • PyPI
    peloton-clients 0.8.0
    MAL-2025-41716 reversing-labs
  • PyPI
    peloton-client123 0.8.10
    MAL-2025-41715 reversing-labs
  • PyPI
    peew 1.0
    MAL-2025-41714 reversing-labs
  • PyPI
    numbervalidator 0.1.0, 1.4.0
    MAL-2025-41713 reversing-labs
  • PyPI
    nofexhack 0.0.1
    MAL-2025-41712 reversing-labs
  • PyPI
    nofex-hack 0.0.1
    MAL-2025-41711 reversing-labs
  • PyPI
    nexlang 1.3, 1.3.1, 1.3.2, 1.3.3
    MAL-2025-41710 reversing-labs
  • PyPI
    newdontinstallthistest 0.1.0
    MAL-2025-41709 reversing-labs
  • PyPI
    new-sql 0.6
    MAL-2025-41708 reversing-labs
  • PyPI
    new-requests-module 2.28.1
    MAL-2025-41707 reversing-labs
  • PyPI
    new-requests-2021 4.22.6
    MAL-2025-41706 reversing-labs
  • PyPI
    ncurses 6.0.0
    MAL-2025-41705 reversing-labs
  • PyPI
    namedpkg 1.0
    MAL-2025-41704 reversing-labs
  • PyPI
    mozilla 1.3.7
    MAL-2025-41703 reversing-labs
  • PyPI
    more-colors 0.1
    MAL-2025-41702 reversing-labs
  • PyPI
    malicious-pip-package-for-demo 1.0.2, 1.0.3, 1.0.4
    MAL-2025-41700 reversing-labs
  • PyPI
    lyft-avidl 5.0.0, 15.0.1
    MAL-2025-41698 reversing-labs