Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,465 npm 223,299 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,299 reports · Feed

npm
@addai/ainode 0.3.1, 0.3.0
MAL-2026-13409 amazon-inspector

Aug 6, 2026
npm
@activepieces/piece-base44 0.1.7
MAL-2026-13408 amazon-inspector

Aug 6, 2026
npm
@0l00000l/auth 1.1.4, 1.1.3
MAL-2026-13407 amazon-inspector

Aug 6, 2026
npm
9remote 2.1.5, 2.1.14, 2.1.20, 2.1.9, 2.1.16, 2.1.21, 2.1.6, 2.2.5, 2.2.6, 2.1.1
MAL-2026-13406 amazon-inspector

Aug 6, 2026
npm
beautiful-ui-monitoring 1.0.8
MAL-2026-13422 amazon-inspector

Aug 6, 2026
npm
@trackunit/iris-app-sdk-vite 1.2.10-alpha-d785aff3531.0
MAL-2026-13421 amazon-inspector

Aug 6, 2026
npm
@apicity/meta 0.8.5, 0.8.2, 0.8.1, 0.8.3, 0.8.0, 0.8.6, 0.8.4, 0.8.8
MAL-2026-13412 amazon-inspector

Aug 6, 2026
npm
typst-resume-cli 1.0.2, 1.0.3
MAL-2026-13425 amazon-inspector

Aug 6, 2026
npm
agenttunnels 0.1.11, 0.1.9, 0.1.6, 0.1.5, 0.1.12, 0.1.14
MAL-2026-13400 amazon-inspector

Aug 6, 2026
npm
@activepieces/piece-google-bigquery 0.0.6, 0.0.5
MAL-2026-13394 amazon-inspector

Aug 6, 2026
npm
@activepieces/piece-google-contacts 0.4.8, 0.4.7
MAL-2026-13395 amazon-inspector

Aug 6, 2026
npm
@activepieces/piece-google-forms 0.5.7, 0.5.6, 0.5.5
MAL-2026-13396 amazon-inspector

Aug 6, 2026
npm
tsihealth-client 1.0.1, 1.0.2, 1.0.0, 1.0.3, 1.0.4
MAL-2026-13404 amazon-inspector, ghsa-malware

Aug 6, 2026
npm
@xiaohhhh1/canvas-agent 0.4.4, 0.4.11, 0.4.10, 0.4.9, 0.4.8
MAL-2026-13398 amazon-inspector

Aug 6, 2026
npm
vitest-preview-pro-all 10.0.3
MAL-2026-13405 amazon-inspector

Aug 6, 2026
npm
agenthub-multiagent-mcp 1.57.0
MAL-2026-13399 amazon-inspector

Aug 6, 2026
npm
streak-cache-map 1.0.0
MAL-2026-13403 amazon-inspector, ghsa-malware

Aug 6, 2026
npm
helmet-pro 10.0.4
MAL-2026-13401 amazon-inspector

Aug 6, 2026
npm
wallet-monitor-snap 1.0.2, 1.0.4
MAL-2026-13393 amazon-inspector

Aug 6, 2026
npm
golaaa 1.0.0, 1.0.3, 2.0.3
MAL-2026-13392 amazon-inspector

Aug 6, 2026
npm
@zahlen/checkout 0.2.2
MAL-2026-13391 ghsa-malware, amazon-inspector

Aug 6, 2026
npm
@voxepay/checkout 0.5.15, 0.5.12, 0.5.13, 0.5.18, 0.5.14, 0.5.16, 0.5.17, 0.5.19
MAL-2026-13389 ghsa-malware, amazon-inspector

Aug 6, 2026
npm
@simplipayng/checkout 1.4.3, 1.4.2
MAL-2026-13388 ghsa-malware, amazon-inspector

Aug 6, 2026
npm
@afasinatickets/common all versions
MAL-2026-13387 ghsa-malware

Aug 6, 2026
npm
@xsat10/baileys-xsat 2.0.0
MAL-2026-13390 ghsa-malware, amazon-inspector

Aug 6, 2026
npm
@united-airlines-org/atmos-design-system 41.0.0, 40.0.0
MAL-2026-13435 amazon-inspector 1 IOC

Aug 6, 2026
npm
svelte-mapped-metrics 1.0.0
MAL-2026-13383 ghsa-malware, amazon-inspector

Aug 5, 2026
npm
svelte-mapping-core 1.0.0
MAL-2026-13384 ghsa-malware, amazon-inspector

Aug 5, 2026
npm
@chnayser/server 0.1.3
MAL-2026-13374 amazon-inspector

Aug 5, 2026
npm
claude-remote-agent 0.1.2, 0.1.0, 0.1.1
MAL-2026-13376 amazon-inspector

Aug 5, 2026
npm
ezdiscordbots 1.0.2
MAL-2026-13377 amazon-inspector

Aug 5, 2026
npm
npm-dc-dev 1.1.1
MAL-2026-13378 amazon-inspector

Aug 5, 2026
npm
app-api-sdk 2.1.7
MAL-2026-13375 amazon-inspector

Aug 5, 2026
npm
statist-browser-typed-client-sme.rko.tariffs.web 20.3.8
MAL-2026-13379 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
llm-interceptor 0.3.0, 0.3.1, 0.3.4, 0.3.3, 0.4.0, 0.4.1, 0.3.8
MAL-2026-13370 amazon-inspector

Aug 5, 2026
npm
kepler 1.999.999, 5.999.999, 2.1.999, 4.999.999, 1.0.999, 5.0.999, 2.6.999, 2.2.999, 9…
MAL-2026-13369 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
multi-acct 99.99.99, 3.1.0, 4.999.999, 3.0.999, 3.999.999, 2.0.999, 4.0.0, 2.1.999, 1.0.0,…
MAL-2026-13371 amazon-inspector

Aug 5, 2026
npm
express-dever 5.1.8, 5.1.7
MAL-2026-13368 amazon-inspector

Aug 5, 2026
npm
@cliphijack/santaclaude 1.0.104, 1.0.106, 1.0.100, 1.0.107, 1.0.102, 1.0.103, 1.0.108
MAL-2026-13363 amazon-inspector

Aug 5, 2026
npm
@ikbal_fadilah_vanexa01/vanexa-agent 1.3.10, 1.3.19, 1.3.23, 1.1.53, 1.3.17, 1.3.8, 1.1.54, 1.2.0, 1.1.55, 1.3.34, 1…
MAL-2026-13364 amazon-inspector

Aug 5, 2026