Supply chain

Malicious packages · PyPI

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,162 npm 223,990 PyPI 12,022 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

12,022 reports · Feed

PyPI
common-test 0.0.1
MAL-2025-6481 reversing-labs

Jul 31, 2025
PyPI
chalk-harness 0.0.1
MAL-2025-6476 reversing-labs

Jul 31, 2025
PyPI
celery-flower 0.0.1
MAL-2025-6475 reversing-labs

Jul 31, 2025
PyPI
catchmeoutsidehawbade 1.0.1
MAL-2025-6474 reversing-labs

Jul 31, 2025
PyPI
carpentry-ci 0.0.1
MAL-2025-6473 reversing-labs

Jul 31, 2025
PyPI
bunzbar 0.0.1
MAL-2025-6472 reversing-labs

Jul 31, 2025
PyPI
broccoli-server 0.0.1
MAL-2025-6468 reversing-labs

Jul 31, 2025
PyPI
boto3-batch-utils 0.0.1
MAL-2025-6467 reversing-labs

Jul 31, 2025
PyPI
bmlx-openapi-client 0.0.1
MAL-2025-6466 reversing-labs

Jul 31, 2025
PyPI
bluesadway 0.1
MAL-2025-6465 reversing-labs

Jul 31, 2025
PyPI
blackspammerbd-termux 1.0.0, 1.0.1
MAL-2025-6464 reversing-labs

Jul 31, 2025
PyPI
bitranox-coloredlogs 0.0.1
MAL-2025-6463 reversing-labs

Jul 31, 2025
PyPI
bioformats 0.0.1
MAL-2025-6462 reversing-labs

Jul 31, 2025
PyPI
bavard-ml-common 0.0.1
MAL-2025-6461 reversing-labs

Jul 31, 2025
PyPI
aphisherman 4.0.0
MAL-2025-6435 reversing-labs

Jul 31, 2025
PyPI
aphisher 4.0.0
MAL-2025-6434 reversing-labs

Jul 31, 2025
PyPI
aistac-foundation 0.0.1
MAL-2025-6429 reversing-labs

Jul 31, 2025
PyPI
prof-tg-to-qu 0.0.1, 0.0.4, 0.0.2, 0.0.3, 0.0.5
MAL-2025-191828 kam193

Jul 31, 2025
PyPI
prof-tg-go-qu 0.0.1
MAL-2025-191827 kam193

Jul 31, 2025
PyPI
prof-tg-gjho-qu 0.0.1
MAL-2025-191826 kam193

Jul 31, 2025
PyPI
prof-tg-gdghho-qu 0.0.1
MAL-2025-191825 kam193

Jul 31, 2025
PyPI
prof-tg-dggrto-qu 0.0.1
MAL-2025-191823 kam193

Jul 31, 2025
PyPI
backtradingbot 0.1.2, 0.1.1, 0.1.3, 0.1.4, 0.1.5
MAL-2025-191689 kam193 3 IOCs

Jul 31, 2025
PyPI
trongridperm 0.0.1
MAL-2025-41789 reversing-labs, kam193 4 IOCs

Jul 30, 2025
PyPI
flatfox-api 999.999.99, 99.99.99, 99.99, 9.9.9, 9.9.99, 9999.99
MAL-2025-6787 ossf-package-analysis, kam193

Jul 30, 2025
PyPI
maxload 1.0.1, 1.1.1, 1.0.0
MAL-2025-41701 reversing-labs, kam193 1 IOC

Jul 30, 2025
PyPI
someeebbb 10.0.5
MAL-2025-41764 reversing-labs, kam193

Jul 29, 2025
PyPI
triple-equal 10.0.5
MAL-2025-41786 reversing-labs, kam193

Jul 29, 2025
PyPI
testing123kk 10.0.5
MAL-2025-6336 ossf-package-analysis, kam193

Jul 29, 2025
PyPI
testpackageroietest3 0.0.1
MAL-2025-41776 reversing-labs, kam193

Jul 28, 2025
PyPI
testpackageroietest2 0.0.1
MAL-2025-41775 reversing-labs, kam193

Jul 28, 2025
PyPI
greater-than 10.0.5
MAL-2025-41681 reversing-labs, kam193

Jul 28, 2025
PyPI
requires-python 10.0.5
MAL-2025-41747 reversing-labs, kam193

Jul 28, 2025
PyPI
supersafecalc 2.0.0, 2.0.1, 3.0.1
MAL-2025-191881 kam193

Jul 28, 2025
PyPI
treeherder-submitter 0.0.1
MAL-2025-191910 kam193

Jul 28, 2025
PyPI
triple-equals 10.0.1, 10.0.2
MAL-2025-6328 ossf-package-analysis, kam193

Jul 28, 2025
PyPI
hello-from-shiphero 0.0.1
MAL-2025-191751 kam193

Jul 27, 2025
PyPI
prof-qux 0.0.2, 0.0.1, 0.0.3, 0.0.4
MAL-2025-191821 kam193

Jul 26, 2025
PyPI
foundry-jupyter-extension 0.23.0, 0.20.0, 0.21.0, 0.22.0, 800.23.0
MAL-2025-6248 ossf-package-analysis, kam193

Jul 26, 2025
PyPI
prof-qx 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5
MAL-2025-191822 kam193

Jul 25, 2025