Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

npm
txs-runner-lib 1.0.1
MAL-2026-11091 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
txs-random-lib 1.0.1
MAL-2026-11090 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
txs-sdk-lib 1.0.1
MAL-2026-11092 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
sixbails 1.0.4, 1.0.0, 1.0.8, 1.1.1, 1.1.0, 1.0.2, 1.0.3, 1.0.7, 1.0.5, 1.0.1, 1.0.6
MAL-2026-11088 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
@vinnxcode/xbailsync 1.0.0, 1.0.1
MAL-2026-11080 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
@vinnxcode/libsignal-node 1.0.0, 1.0.1
MAL-2026-11079 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
amanexzyra-baileys 4.0.2, 4.0.0, 3.0.0
MAL-2026-11081 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
fazzgram 0.1.1, 0.1.0
MAL-2026-11086 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
fazzanime all versions
MAL-2026-11085 ghsa-malware

Jul 27, 2026
npm
@fazzcode/baileys 2.5.3, 2.5.4, 2.5.5, 2.5.6, 2.5.7
MAL-2026-11073 ghsa-malware, amazon-inspector

Jul 27, 2026
npm
@sqlite-tag/sql-creator all versions
MAL-2026-11077 ghsa-malware

Jul 27, 2026
npm
@sqlite-tag/schema-generator all versions
MAL-2026-11076 ghsa-malware

Jul 27, 2026
npm
@sqlite-frame/createsql all versions
MAL-2026-11075 ghsa-malware

Jul 27, 2026
npm
express-self-destruct1 all versions
MAL-2026-11084 ghsa-malware

Jul 27, 2026
npm
@my_name_is_khn/express-security-tool-v2 all versions
MAL-2026-11074 ghsa-malware

Jul 27, 2026
npm
@ks-radar/radar 22.0.0, 21.0.0, 20.0.0
MAL-2026-11066 ossf-package-analysis, amazon-inspector

Jul 25, 2026
npm
swiper_angular 5.9999.0, 5.9999.1
MAL-2026-11065 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 25, 2026
npm
whs4_deu 1.0.1, 1.0.0
MAL-2026-11070 ossf-package-analysis, amazon-inspector

Jul 25, 2026
npm
wsh4_edu 1.0.0
MAL-2026-11072 ossf-package-analysis, amazon-inspector

Jul 25, 2026
npm
whs4_eud 1.0.1, 1.0.0
MAL-2026-11071 ossf-package-analysis, amazon-inspector

Jul 25, 2026
npm
page-navigation 1.0.1
MAL-2026-11064 ossf-package-analysis, amazon-inspector

Jul 25, 2026
npm
identityscimapiserv 28.0.0, 4.0.0
MAL-2026-11061 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 25, 2026
npm
xo-member-components 28.0.0, 8.0.0
MAL-2026-11063 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 25, 2026
npm
f0-form-manipulator 28.0.0
MAL-2026-11060 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 25, 2026
npm
preferenceslifecycle-paypal 28.0.0, 24.0.0
MAL-2026-11062 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 25, 2026
npm
merchantprefsservice-paypal 28.0.0, 24.0.0, 4.0.0
MAL-2026-11057 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 25, 2026
npm
gpaas-paypal 28.0.0, 4.0.0
MAL-2026-11056 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 25, 2026
npm
pp-react-ui5 28.0.0, 21.0.0
MAL-2026-11059 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 25, 2026
npm
payoutsvettingserv-paypal 28.0.0, 24.0.0
MAL-2026-11058 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 25, 2026
npm
fundraiserservicepp 1.5.0, 1.7.0
MAL-2026-11055 ossf-package-analysis, amazon-inspector

Jul 25, 2026
npm
clerk-next-fix-auth-protection 8.8.8, 7.7.7
MAL-2026-11069 ossf-package-analysis, amazon-inspector

Jul 24, 2026
npm
app-node-layer 2.1.6
MAL-2026-11054 ghsa-malware, amazon-inspector

Jul 24, 2026
npm
app-data-lts 2.1.6
MAL-2026-11053 ghsa-malware, amazon-inspector

Jul 24, 2026
npm
app-data-layer 2.1.6
MAL-2026-11052 ghsa-malware, amazon-inspector

Jul 24, 2026
npm
subapp-pkg-util 99.0.1, 99.0.0
MAL-2026-11045 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 24, 2026
npm
@daylightqc/date-fmt-lite 1.1.1, 1.0.1, 1.0.0, 1.1.2
MAL-2026-11041 ossf-package-analysis, amazon-inspector

Jul 24, 2026
npm
eth-slint 1.0.0
MAL-2026-11034 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
chai-as-stringify 7.0.2, 7.0.1
MAL-2026-11032 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
yuinpm 2026.7.19-2
MAL-2026-11039 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
eth-codergen 1.0.2, 1.0.1, 1.0.0
MAL-2026-11033 ghsa-malware, amazon-inspector

Jul 23, 2026