Skip to content

Pull requests: ossf/malicious-packages

New pull request New
22 Open 1,295 Closed
22 Open 1,295 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

Add npm/tailwind-gutenberg-block-zero (install-time dropper)
#1389 opened Jul 20, 2026 by akyroslabs Contributor Loading…
Remove false positive astro advisory
#1383 opened Jul 16, 2026 by tolgaergin Contributor Loading…
4
Add malicious npm package @across-toolkit/typescript-config@99.0.0 (dependency-confusion credential stealer)
#1382 opened Jul 16, 2026 by akyroslabs Contributor Loading…
Add LPM Firewall npm malware reports
#1377 opened Jul 14, 2026 by tolgaergin Contributor Loading…
Add OSV reports for 10 malicious npm packages
#1374 opened Jul 14, 2026 by YoSheep Loading…
Malicious npm package 'node-procmetrics'
#1369 opened Jul 13, 2026 by ruthvik-r Loading…
1
Add malicious npm package polymarket-mcp-v2@2.1.6 (SSH-key backdoor)
#1368 opened Jul 12, 2026 by akyroslabs Contributor Loading…
Add malicious package details for polymarket-mcp-v2
#1366 opened Jul 10, 2026 by skb1209 Loading…
4
Malicious packages: npm @wagni_bot campaign — 25 crypto typosquats (postinstall SSH-key + wallet + env stealer, Telegram exfil)
#1365 opened Jul 9, 2026 by akyroslabs Contributor Loading…
1
Malicious package: npm/antsrcsrctest (preinstall cloud-metadata + env stealer)
#1364 opened Jul 9, 2026 by akyroslabs Contributor Loading…
Add malicious npm package testis-pack
#1358 opened Jul 8, 2026 by tolgaergin Contributor Loading…
2
Add malicious npm package testudo-pack
#1357 opened Jul 8, 2026 by tolgaergin Contributor Loading…
2
Add malicious npm package na-rony-test-karem
#1356 opened Jul 8, 2026 by tolgaergin Contributor Loading…
3
Malicious package: npm/logger-daemon-regex (wallet/secret stealer + remote-control agent, fake Autodesk Forge)
#1347 opened Jul 5, 2026 by akyroslabs Contributor Loading…
Malicious package: npm/fmt-date-lite (date-utility download-execute dropper)
#1345 opened Jul 5, 2026 by akyroslabs Contributor Loading…
3
docs: add a consumer guide for using the reports
#1329 opened Jun 23, 2026 by DevamShah Loading…
1
fix: recursively merge and deduplicate database_specific maps and arrays
#1317 opened Jun 17, 2026 by jeffrey-theog06 Loading…
2
Add initial malosv command for managing the repo.
#1306 opened Jun 11, 2026 by calebbrown Contributor Loading…
fix: scope @browserbasehq/* advisories to only compromised versions
#1139 opened Feb 21, 2026 by shrey150 Loading…
2
Doc changes for git-repo support.
#1063 opened Nov 3, 2025 by calebbrown Contributor • Draft
Report ok-script pypi package
#849 opened Mar 28, 2025 by OmkarPh Contributor Loading…
2
Add tiger packages
#848 opened Mar 25, 2025 by behnazh-w Contributor Loading…
ProTip! Type g i on any issue or pull request to go back to the issue listing page.