Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,151 npm 223,981 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,981 reports · Feed

npm
ethers-lib 1.0.0, 1.0.4, 1.0.2, 1.0.1, 1.0.3
MAL-2026-12111 amazon-inspector

Aug 5, 2026
npm
alipclutch-baileys 8.6.60, 8.6.58, 8.6.59, 8.6.75, 8.6.77, 8.6.63, 8.6.70, 8.6.71, 8.6.64, 8.6.66,…
MAL-2026-12108 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@zzzgenesis00/mnemonic-to-key 1.2.0
MAL-2026-12056 amazon-inspector

Aug 5, 2026
npm
volna-boxy-di-test 20.3.8
MAL-2026-12079 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@zzzgenesis00/docker-api-client 2.0.2
MAL-2026-12055 amazon-inspector

Aug 5, 2026
npm
beaver-ui-card-large 12.4.3, 9.6.4, 9.6.5, 9.6.3, 9.6.2
MAL-2026-12060 amazon-inspector

Aug 5, 2026
npm
trezor-lib 1.0.0, 1.0.2, 1.0.1, 1.0.3
MAL-2026-12078 ossf-package-analysis, amazon-inspector

Aug 5, 2026
npm
hwi-lib 1.0.1, 1.0.0, 1.0.2
MAL-2026-12067 ossf-package-analysis, amazon-inspector

Aug 5, 2026
npm
ckcc-protocol 1.0.0, 1.0.3, 1.0.2, 1.0.1
MAL-2026-12064 ossf-package-analysis, amazon-inspector

Aug 5, 2026
npm
bcore-bravo-eslint-config 12.5.7, 9.5.7, 9.5.9, 9.5.8, 9.5.6
MAL-2026-12059 amazon-inspector

Aug 5, 2026
npm
ledger-lib 1.0.0, 1.0.1, 1.0.3, 1.0.2
MAL-2026-12068 ossf-package-analysis, amazon-inspector

Aug 5, 2026
npm
sso-tramvai-module-context-auth 20.4.5
MAL-2026-12073 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
boardwalk-js-tests 1.1.1, 1.1.2
MAL-2026-12062 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@zzzgenesis00/playwrite 1.48.0
MAL-2026-12057 amazon-inspector

Aug 5, 2026
npm
checkout-create-pos-order-am 20.9.5
MAL-2026-12063 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
hubert-appointment-v2-task-create-am 20.4.4
MAL-2026-12066 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
bigops-eslint 35.9.5
MAL-2026-12061 amazon-inspector

Aug 5, 2026
npm
greatcall-customers-commandapi 99.0.0
MAL-2026-12065 amazon-inspector

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-sme.compliance.web.events 20.4.4
MAL-2026-12077 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
specials-obid-webpack 20.5.4
MAL-2026-12072 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
sotqa-test 20.3.8
MAL-2026-12071 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
nxify-unic 20.3.2
MAL-2026-12069 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
shopping-shared-atom-mobile-cart-counter 20.6.6
MAL-2026-12070 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@zzzgenesis00/spl-token-utils 1.4.2
MAL-2026-12058 amazon-inspector

Aug 5, 2026
npm
tinkoff-boxy-mobile-vivid-heading 20.7.5
MAL-2026-12075 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-cache-path 20.8.3
MAL-2026-12076 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-nfs.grocery.mobile.events 20.3.3
MAL-2026-12074 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
bigops-customer 35.1.1
MAL-2026-12038 amazon-inspector

Aug 5, 2026
npm
statist-browser-typed-client-hra.workplacer.events 20.9.1
MAL-2026-12045 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
bigops-create-manifest 35.2.4
MAL-2026-12037 amazon-inspector

Aug 5, 2026
npm
tui-react-mobile-styles 20.8.7
MAL-2026-12053 amazon-inspector

Aug 5, 2026
npm
beaver-ui-form-modal 34.6.3, 12.7.6
MAL-2026-12034 amazon-inspector

Aug 5, 2026
npm
statist-browser-typed-client-test.jumpwork.circuitbreaker 20.8.2
MAL-2026-12046 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-boxy-desktop-features-banner 20.2.4
MAL-2026-12048 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
bigops-auth-utils 35.4.5
MAL-2026-12035 amazon-inspector

Aug 5, 2026
npm
platform-ui-island 20.5.9
MAL-2026-12042 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
forge-extended 1.0.1, 1.0.2
MAL-2026-12040 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
specials-mvno-client 20.9.8
MAL-2026-12044 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-ui-action 20.5.7
MAL-2026-12051 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
aedes_clusters 1.0.1, 1.1.1
MAL-2026-12033 amazon-inspector, ghsa-malware

Aug 5, 2026