Skip to content

Pull requests: ossf/malicious-packages

New pull request New
25 Open 1,270 Closed
25 Open 1,270 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

Add malicious package details for polymarket-mcp-v2
#1366 opened Jul 10, 2026 by skb1209 Loading…
Malicious packages: npm @wagni_bot campaign — 25 crypto typosquats (postinstall SSH-key + wallet + env stealer, Telegram exfil)
#1365 opened Jul 9, 2026 by akyroslabs Contributor Loading…
1
Malicious package: npm/antsrcsrctest (preinstall cloud-metadata + env stealer)
#1364 opened Jul 9, 2026 by akyroslabs Contributor Loading…
Add OSV reports for 3 malicious npm packages
#1363 opened Jul 9, 2026 by KunalSin9h Contributor Loading…
Add malicious package report for @injectivelabs/sdk-ts@1.20.21
#1362 opened Jul 9, 2026 by r-bedekar Loading…
Add malicious npm report for tailwind-core
#1361 opened Jul 9, 2026 by tolgaergin Loading…
Remove wide affected range
#1360 opened Jul 8, 2026 by inspector-research Contributor Loading…
1
Add malicious npm package dependency_confusions
#1359 opened Jul 8, 2026 by tolgaergin Loading…
Add malicious npm package testis-pack
#1358 opened Jul 8, 2026 by tolgaergin Loading…
Add malicious npm package testudo-pack
#1357 opened Jul 8, 2026 by tolgaergin Loading…
Add malicious npm package na-rony-test-karem
#1356 opened Jul 8, 2026 by tolgaergin Loading…
Add malicious npm package react-next-vite
#1354 opened Jul 7, 2026 by tolgaergin Loading…
Add OSV reports for 3 malicious npm packages
#1353 opened Jul 7, 2026 by KunalSin9h Contributor Loading…
Add OSV reports for forge-jsx RAT campaign Wave 4 (npm: zredis-typed, pinokio-redis)
#1349 opened Jul 6, 2026 by KunalSin9h Contributor Loading…
Add OSV reports for click2ai dependency-confusion campaign (npm, 14 packages)
#1348 opened Jul 6, 2026 by KunalSin9h Contributor Loading…
Malicious package: npm/logger-daemon-regex (wallet/secret stealer + remote-control agent, fake Autodesk Forge)
#1347 opened Jul 5, 2026 by akyroslabs Contributor Loading…
Malicious package: npm/fmt-date-lite (date-utility download-execute dropper)
#1345 opened Jul 5, 2026 by akyroslabs Contributor Loading…
2
docs: add a consumer guide for using the reports
#1329 opened Jun 23, 2026 by DevamShah Loading…
1
fix: recursively merge and deduplicate database_specific maps and arrays
#1317 opened Jun 17, 2026 by jeffrey-theog06 Loading…
2
Add initial malosv command for managing the repo.
#1306 opened Jun 11, 2026 by calebbrown Contributor Loading…
fix: scope @browserbasehq/* advisories to only compromised versions
#1139 opened Feb 21, 2026 by shrey150 Loading…
2
Doc changes for git-repo support.
#1063 opened Nov 3, 2025 by calebbrown Contributor • Draft
added the CHARTER.md file
#928 opened Jun 10, 2025 by 6mile Contributor Loading…
@6mile
1
Report ok-script pypi package
#849 opened Mar 28, 2025 by OmkarPh Contributor Loading…
2
Add tiger packages
#848 opened Mar 25, 2025 by behnazh-w Contributor Loading…
ProTip! What’s not been updated in a month: updated:<2026-06-10.