Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

npm
tidal-embed-player 1.0.1, 1.0.2
MAL-2026-11152 amazon-inspector, ghsa-malware

Jul 28, 2026
npm
basic-vite 1.0.0
MAL-2026-11131 amazon-inspector

Jul 28, 2026
npm
triage_bot_using_sdkv3 2.0.1, 2.0.2
MAL-2026-11153 amazon-inspector, ghsa-malware, reversing-labs

Jul 28, 2026
npm
jobber-app-template-react 1.0.1, 1.1.1
MAL-2026-11137 amazon-inspector, ghsa-malware

Jul 28, 2026
npm
@yancyyu/agentcli 1.9.32, 1.9.42, 1.9.35, 1.9.27, 1.9.52, 1.9.43, 1.9.61, 1.9.66, 1.9.67, 1.9.48,…
MAL-2026-11123 amazon-inspector

Jul 28, 2026
npm
xerohub-discord-voice-v3 3.0.2, 3.0.0, 3.0.3, 3.0.1
MAL-2026-11155 amazon-inspector

Jul 28, 2026
npm
xerohub-discord-voice-v2 1.8.0, 1.7.0, 2.1.0, 2.3.0, 1.6.0, 2.5.0, 2.6.0, 2.2.0, 2.4.0, 2.7.0, 1.2.0, 1.…
MAL-2026-11154 amazon-inspector

Jul 28, 2026
npm
lib-streak-math 1.0.0
MAL-2026-11141 amazon-inspector

Jul 28, 2026
npm
@ai_/autoprefixers 1.2.0, 1.0.0, 1.1.0
MAL-2026-11120 amazon-inspector

Jul 28, 2026
npm
app-sim-layer 2.1.6
MAL-2026-11126 amazon-inspector

Jul 28, 2026
npm
app-sima-layer 2.1.6
MAL-2026-11127 amazon-inspector

Jul 28, 2026
npm
app-svm-layer 2.1.6
MAL-2026-11129 amazon-inspector

Jul 28, 2026
npm
api-rust-sdk 2.1.6
MAL-2026-11125 amazon-inspector

Jul 28, 2026
npm
api-node-sdk 2.1.6
MAL-2026-11124 amazon-inspector

Jul 28, 2026
npm
fluid-type-ui 2.0.8, 2.0.9
MAL-2026-11136 amazon-inspector, ghsa-malware

Jul 28, 2026
npm
chain-analyze 1.0.2, 1.0.4, 1.0.3, 1.0.1, 1.0.5
MAL-2026-11133 amazon-inspector, ghsa-malware

Jul 28, 2026
npm
toll_free 1.0.1, 1.0.2
MAL-2026-11159 ossf-package-analysis, amazon-inspector

Jul 28, 2026
npm
app-soda-layer 2.1.6
MAL-2026-11128 amazon-inspector 6 IOCs

Jul 28, 2026
npm
array-sort-helper 1.0.0
MAL-2026-11118 ossf-package-analysis, amazon-inspector

Jul 28, 2026
npm
json-to-table-util 1.0.0
MAL-2026-11119 ossf-package-analysis, amazon-inspector

Jul 28, 2026
npm
num-format-helper 1.0.0
MAL-2026-11107 ossf-package-analysis, amazon-inspector

Jul 28, 2026
npm
date-sanitize-helper 1.0.0
MAL-2026-11106 ossf-package-analysis, amazon-inspector

Jul 28, 2026
npm
string-format-kit 1.0.2, 1.0.1
MAL-2026-11108 ossf-package-analysis, amazon-inspector

Jul 28, 2026
npm
@vaultflow/update-flow 1.2.6, 1.0.0, 1.2.5
MAL-2026-11097 ghsa-malware, amazon-inspector

Jul 28, 2026
npm
@vaultflow/create-flow 1.0.1, 1.0.2, 1.0.0
MAL-2026-11096 ghsa-malware, amazon-inspector

Jul 28, 2026
npm
motion-forge-css 1.0.1
MAL-2026-11101 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
@heartlandone-private/fontawesome-pro 6.3.3, 6.3.6, 6.3.2
MAL-2026-11093 ossf-package-analysis, amazon-inspector

Jul 27, 2026
npm
xo-twofa 28.0.0, 15.0.0
MAL-2026-11105 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
stargateproxyserv 28.0.0, 24.0.0
MAL-2026-11103 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
riskunifiedgatewayserv 28.0.0, 21.0.0
MAL-2026-11102 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
identityauthorizationserv 28.0.0, 21.0.0
MAL-2026-11100 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
crm-reportinsightserv-paypal 28.0.0, 24.0.0
MAL-2026-11098 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
demo-awesome-date-parser-test 0.0.7, 0.0.6, 0.0.5, 0.0.4, 0.0.3, 0.0.2, 0.0.1
MAL-2026-11099 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
@array-util/subsearch 1.0.3
MAL-2026-11095 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
tailwind-motionkit 1.0.2, 1.0.1, 1.0.3
MAL-2026-11104 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
kalipto-runtime 1.0.0
MAL-2026-11087 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
@thone33/react-helpers 1.0.3, 1.0.1, 1.0.2, 1.0.4, 1.0.0
MAL-2026-11078 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
edu-npm-helper-beta 1.0.0
MAL-2026-11083 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
edu-npm-helper-alpha 1.0.0
MAL-2026-11082 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
txs-builder 1.0.6
MAL-2026-11089 ghsa-malware, amazon-inspector

Jul 27, 2026