Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,477 npm 223,309 PyPI 12,018 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,309 reports · Feed

npm
statist-browser-typed-client-mb.product.operations 20.4.9
MAL-2026-12448 amazon-inspector

Aug 5, 2026
npm
finance-business-company-id-models 20.1.5
MAL-2026-12382 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@nasdtickets/common 1.0.23
MAL-2026-12324 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-statist-core 20.9.9
MAL-2026-12456 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@hoteldev/common 1.0.9
MAL-2026-12318 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
simplipayng 1.0.8
MAL-2026-12437 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
block_package 1.0.0
MAL-2026-12340 amazon-inspector

Aug 5, 2026
npm
trapp-configuration 20.5.3
MAL-2026-12485 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
mcp-audit-sync-internal 99.9.9
MAL-2026-12401 amazon-inspector

Aug 5, 2026
npm
eslint-plugin-vitest-ts 1.0.4
MAL-2026-12370 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
streak-calendar-core 1.0.0
MAL-2026-12458 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
bnpl-blocks-independent-bnpl-search 20.2.9
MAL-2026-12341 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@nasddatax/common 1.0.21
MAL-2026-12323 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
uniswap-sdk-v4 1.0.0
MAL-2026-12490 amazon-inspector

Aug 5, 2026
npm
dolyame-ui-form 20.1.7
MAL-2026-12367 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
csv-parser-helper 1.0.0
MAL-2026-12360 amazon-inspector, reversing-labs

Aug 5, 2026
npm
invest-module-cookie 20.8.2
MAL-2026-12393 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
runtime-sentinel 1.0.1, 1.0.2
MAL-2026-12432 amazon-inspector

Aug 5, 2026
npm
elephant-array-utils 1.0.6
MAL-2026-12369 amazon-inspector

Aug 5, 2026
npm
digital-interview-digital-interview-core 20.5.3
MAL-2026-12362 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
time-linters-webapp-eslint-config 20.2.2
MAL-2026-12479 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
chart-data-utils 1.0.0
MAL-2026-12350 amazon-inspector, reversing-labs

Aug 5, 2026
npm
statist-browser-typed-client-automlplatform.nlppl.searchy 20.2.2
MAL-2026-12443 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
react-fontawesome-icons 1.0.6, 1.0.2, 1.0.1, 1.0.4, 1.0.5, 1.0.3
MAL-2026-12423 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
boxy-fixture-allure 20.8.1
MAL-2026-12342 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
streak-int-lib 1.0.0
MAL-2026-12467 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
pvm-autodoc 20.4.6
MAL-2026-12421 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-twork.tsales.nitro.metrics 20.6.2
MAL-2026-12455 amazon-inspector

Aug 5, 2026
npm
streak-metricsa 1.0.0
MAL-2026-12470 amazon-inspector

Aug 5, 2026
npm
foodi 99.99.1
MAL-2026-12383 amazon-inspector

Aug 5, 2026
npm
tcb-web-copy-to-clipboard 20.1.2
MAL-2026-12475 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
streak-day-engine 1.0.0
MAL-2026-12462 amazon-inspector

Aug 5, 2026
npm
statist-browser-typed-client-social.shorts.editor 20.7.1
MAL-2026-12454 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
pfp-forms-mobile-sme-group-tiles 20.3.6
MAL-2026-12413 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@copilot-mcp/apex 1.0.0, 1.0.4, 1.0.6, 1.0.8, 1.0.2, 1.0.17, 1.0.3, 1.0.16, 1.0.22, 1.0.5, 1.0.7,…
MAL-2026-12314 amazon-inspector

Aug 5, 2026
npm
@zahlen/checkout-react 0.1.1
MAL-2026-12333 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-sme.rko.finance.web 20.7.7
MAL-2026-12453 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-eventea.projects.pfpacquiring 20.5.8
MAL-2026-12445 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
streak-daykit 1.0.0
MAL-2026-12466 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
postcss-animate-css-vars 2.0.3, 1.0.0
MAL-2026-12418 amazon-inspector, ghsa-malware

Aug 5, 2026