Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,465 npm 223,299 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,299 reports · Feed

npm
poc-ch4rlygr 1.5.0, 1.3.0, 1.4.0, 1.2.0, 1.1.0, 1.6.0
MAL-2026-13454 amazon-inspector

Aug 6, 2026
npm
sui-migration-audit-cli 1.0.0
MAL-2026-13476 ghsa-malware, amazon-inspector

Aug 6, 2026
npm
sui-graphql-client 0.1.0, 0.2.0
MAL-2026-13475 ghsa-malware, amazon-inspector

Aug 6, 2026
npm
move-bcs-codec 1.0.0, 1.0.1, 1.0.2
MAL-2026-13450 amazon-inspector, ghsa-malware

Aug 6, 2026
npm
svelte-visual-map 1.0.0
MAL-2026-13477 ghsa-malware, amazon-inspector

Aug 6, 2026
npm
@junyoung-kim/reins 0.1.7, 0.1.6
MAL-2026-13432 amazon-inspector

Aug 6, 2026
npm
@lyxa.ai/core 1.0.145-debug, 1.0.144-test, 1.0.16, 1.0.8-debug-1, 1.1.36, 1.1.47, 1.0.201, 1.…
MAL-2026-13434 amazon-inspector

Aug 6, 2026
npm
@itsreduxtm/unpkg-xss-test 1.0.5, 1.0.9
MAL-2026-13431 amazon-inspector

Aug 6, 2026
npm
@ks-video/kwai-player-web 9.1.2
MAL-2026-13433 amazon-inspector

Aug 6, 2026
npm
nms-dashboard-js 9.9.11, 9.9.0
MAL-2026-13451 amazon-inspector, ghsa-malware

Aug 6, 2026
npm
aitable-workflow-server 9.9.9
MAL-2026-13437 amazon-inspector

Aug 6, 2026
npm
lib-frontsga 9.999.999
MAL-2026-13448 amazon-inspector, reversing-labs

Aug 6, 2026
npm
pilgrimage-portal-client 99.0.0
MAL-2026-13453 amazon-inspector, reversing-labs

Aug 6, 2026
npm
wos-library-ui 99.0.0, 999.999.999
MAL-2026-13467 amazon-inspector, ghsa-malware, reversing-labs

Aug 6, 2026
npm
@wbnr/frontend-shared 99.0.0, 99.0.1
MAL-2026-13436 amazon-inspector, reversing-labs

Aug 6, 2026
npm
commonweb-balance 99.9.1
MAL-2026-13439 amazon-inspector, ghsa-malware

Aug 6, 2026
npm
consumerweb-creditcollection 99.9.1
MAL-2026-13441 amazon-inspector, ghsa-malware

Aug 6, 2026
npm
connect-contingency 99.9.1
MAL-2026-13440 amazon-inspector, ghsa-malware

Aug 6, 2026
npm
content-common 99.9.9
MAL-2026-13442 amazon-inspector

Aug 6, 2026
npm
cewe-npm-cops 99.9.9
MAL-2026-13438 amazon-inspector, reversing-labs

Aug 6, 2026
npm
merchantweb-lang-cookie-reset 99.99.99, 1.0.998, 2.0.0, 0.1.999, 0.999.999, 0.1.0, 1.999.999, 1.0.999, 0.0.99…
MAL-2026-13449 amazon-inspector, reversing-labs

Aug 6, 2026
npm
@ch4acko3/frontal-lobe 0.1.12, 0.1.12-preview.2, 0.1.14
MAL-2026-13430 amazon-inspector

Aug 6, 2026
npm
@avi892nash/aegis-grid-runner 0.3.3
MAL-2026-13429 amazon-inspector

Aug 6, 2026
npm
stretchshop 0.7.5
MAL-2026-13460 amazon-inspector

Aug 6, 2026
npm
streak-map-cache 1.0.0
MAL-2026-13459 amazon-inspector, ghsa-malware

Aug 6, 2026
npm
@love-moon/conductor-cli 0.7.5, 0.7.4, 0.8.0, 0.7.6
MAL-2026-13428 amazon-inspector

Aug 6, 2026
npm
@diezyyasha/libsignal-node all versions
MAL-2026-13474 ghsa-malware

Aug 6, 2026
npm
diezyyasha-baileys 9.0.0, 8.6.59, 8.6.58, 8.6.62, 9.1.3, 8.6.61, 9.1.5, 9.2.0, 8.6.57, 8.6.60, 9.1…
MAL-2026-13443 amazon-inspector, ghsa-malware

Aug 6, 2026
npm
@leejungkiin/awkit 3.6.1, 3.3.9, 3.5.10, 3.4.4, 3.6.2, 3.3.3, 3.5.5, 3.5.0, 3.5.7, 3.4.7, 3.4.6, 3…
MAL-2026-13427 amazon-inspector

Aug 6, 2026
npm
@holocronlab/botruntime-runtime 2.2.5, 2.9.7, 2.2.7, 2.6.1, 2.5.4, 2.4.2, 2.5.0, 2.1.15, 2.6.0, 2.6.3, 2.6.4
MAL-2026-13419 amazon-inspector

Aug 6, 2026
npm
@innocarpe/deepseek-build 1.0.0
MAL-2026-13420 amazon-inspector

Aug 6, 2026
npm
fetchrtds 1.1.0
MAL-2026-13423 amazon-inspector

Aug 6, 2026
npm
tailwindcss-hide-scrollbar 2.5.4, 2.5.3, 1.0.0, 0.0.1
MAL-2026-13424 amazon-inspector, ghsa-malware

Aug 6, 2026
npm
@ccfly/setup-linux-x64 0.1.4, 0.1.3, 0.1.9, 0.1.0, 0.1.1, 0.1.10, 0.1.17, 0.1.19, 0.1.14, 0.1.2
MAL-2026-13418 amazon-inspector

Aug 6, 2026
npm
@ccfly/setup-linux-arm64 0.1.0
MAL-2026-13417 amazon-inspector

Aug 6, 2026
npm
@atom8n/inspector 0.17.32
MAL-2026-13414 amazon-inspector

Aug 6, 2026
npm
@astralcore/aura-wb 1.0.1, 1.0.4, 1.0.0
MAL-2026-13413 amazon-inspector

Aug 6, 2026
npm
@aubea/mars 1.2.12, 1.2.11, 1.0.0, 1.1.0, 1.2.8, 1.2.2, 1.2.9, 1.2.10, 1.2.6, 1.2.3, 1.2.4,…
MAL-2026-13415 amazon-inspector

Aug 6, 2026
npm
@addai/entity-runtime 0.2.55, 0.2.51, 0.2.53, 0.2.47, 0.2.46, 0.2.45, 0.2.49, 0.2.48, 0.2.50, 0.2.58,…
MAL-2026-13410 amazon-inspector

Aug 6, 2026
npm
@addai/node 0.9.0, 0.8.2, 0.5.0, 0.7.0, 0.11.0, 0.8.1, 0.11.2, 0.8.0, 0.11.1, 0.4.0
MAL-2026-13411 amazon-inspector

Aug 6, 2026