Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,897 npm 223,728 PyPI 12,019 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,728 reports · Feed

npm
@zzzgenesis00/playwrite 1.48.0
MAL-2026-12057 amazon-inspector

Aug 5, 2026
npm
checkout-create-pos-order-am 20.9.5
MAL-2026-12063 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
hubert-appointment-v2-task-create-am 20.4.4
MAL-2026-12066 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
bigops-eslint 35.9.5
MAL-2026-12061 amazon-inspector

Aug 5, 2026
npm
greatcall-customers-commandapi 99.0.0
MAL-2026-12065 amazon-inspector

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-sme.compliance.web.events 20.4.4
MAL-2026-12077 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
specials-obid-webpack 20.5.4
MAL-2026-12072 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
sotqa-test 20.3.8
MAL-2026-12071 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
nxify-unic 20.3.2
MAL-2026-12069 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
shopping-shared-atom-mobile-cart-counter 20.6.6
MAL-2026-12070 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@zzzgenesis00/spl-token-utils 1.4.2
MAL-2026-12058 amazon-inspector

Aug 5, 2026
npm
tinkoff-boxy-mobile-vivid-heading 20.7.5
MAL-2026-12075 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-cache-path 20.8.3
MAL-2026-12076 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-nfs.grocery.mobile.events 20.3.3
MAL-2026-12074 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
bigops-customer 35.1.1
MAL-2026-12038 amazon-inspector

Aug 5, 2026
npm
statist-browser-typed-client-hra.workplacer.events 20.9.1
MAL-2026-12045 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
bigops-create-manifest 35.2.4
MAL-2026-12037 amazon-inspector

Aug 5, 2026
npm
tui-react-mobile-styles 20.8.7
MAL-2026-12053 amazon-inspector

Aug 5, 2026
npm
beaver-ui-form-modal 34.6.3, 12.7.6
MAL-2026-12034 amazon-inspector

Aug 5, 2026
npm
statist-browser-typed-client-test.jumpwork.circuitbreaker 20.8.2
MAL-2026-12046 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-boxy-desktop-features-banner 20.2.4
MAL-2026-12048 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
bigops-auth-utils 35.4.5
MAL-2026-12035 amazon-inspector

Aug 5, 2026
npm
platform-ui-island 20.5.9
MAL-2026-12042 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
forge-extended 1.0.1, 1.0.2
MAL-2026-12040 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
specials-mvno-client 20.9.8
MAL-2026-12044 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-ui-action 20.5.7
MAL-2026-12051 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
aedes_clusters 1.0.1, 1.1.1
MAL-2026-12033 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tramvai-tinkoff-module-legacy-popup 20.4.9
MAL-2026-12052 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-component-infopanel 20.8.3
MAL-2026-12049 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
streak-day-utils 1.0.0
MAL-2026-12047 amazon-inspector

Aug 5, 2026
npm
data-format-helper 1.0.1, 1.0.0
MAL-2026-12039 amazon-inspector

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-sme.reporting.reporting 20.5.4
MAL-2026-12050 amazon-inspector, ghsa-malware 9 IOCs

Aug 5, 2026
npm
add-two-numbers-x7q9m 1.0.0, 1.0.1
MAL-2026-12032 amazon-inspector

Aug 5, 2026
npm
bigops-chat-tmsg 35.8.5
MAL-2026-12036 amazon-inspector

Aug 5, 2026
npm
platform-ui-codemods 20.6.7
MAL-2026-12041 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@zzzgenesis00/ethers-wallet 6.13.5
MAL-2026-12031 amazon-inspector

Aug 5, 2026
npm
sextant-cli-linux-arm64 0.0.1-rc12, 0.0.1-rc11, 0.0.1-rc25, 0.0.1-rc29, 0.0.1-rc19, 0.0.1-rc20, 0.0.1-r…
MAL-2026-12043 amazon-inspector

Aug 5, 2026
npm
@zzzgenesis00/bip39-mnemonic 2.3.1
MAL-2026-12030 amazon-inspector

Aug 5, 2026
npm
uibabai 5.7.5
MAL-2026-12054 amazon-inspector

Aug 5, 2026
npm
sextant-cli-darwin-amd64 0.0.1-rc34, 0.0.1-rc31, 0.0.1-rc10, 0.0.1-rc16, 0.0.1-rc11, 0.0.1-rc12, 0.0.1-r…
MAL-2026-12028 amazon-inspector

Aug 5, 2026