Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

npm
react-tabulix-extended 0.1.7
MAL-2026-11040 ossf-package-analysis, amazon-inspector

Jul 22, 2026
npm
svelte-streaks 1.0.2, 1.0.0, 1.0.1
MAL-2026-10983 ghsa-malware, amazon-inspector

Jul 21, 2026
npm
streak-daycount 1.0.0
MAL-2026-10982 ghsa-malware, amazon-inspector

Jul 21, 2026
npm
streak-calendar 1.0.1, 1.0.0
MAL-2026-10981 ghsa-malware, amazon-inspector

Jul 21, 2026
npm
@apexfdn/apex 1.0.32, 1.0.31, 1.0.30, 1.0.29, 1.0.28, 1.0.27, 1.0.26, 1.0.25, 1.0.24, 1.0.23,…
MAL-2026-10979 ghsa-malware, amazon-inspector

Jul 21, 2026
npm
veskra 1.0.0, 1.0.1, 1.0.2, 1.0.3
MAL-2026-10984 ghsa-malware, amazon-inspector

Jul 21, 2026
npm
nolby 1.0.3, 1.0.2, 1.0.1, 1.0.0
MAL-2026-10980 ghsa-malware, amazon-inspector

Jul 21, 2026
npm
react-tabulix-ui 0.1.1, 0.1.0, 0.1.2
MAL-2026-10988 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 21, 2026
npm
react-tabulix-virtual 0.1.1, 0.1.0
MAL-2026-10989 ossf-package-analysis, amazon-inspector

Jul 21, 2026
npm
react-tabulix-core 0.1.3, 0.1.1, 0.1.2, 0.1.0
MAL-2026-10987 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 21, 2026
npm
commonweb-rewards 99.9.1
MAL-2026-10968 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 21, 2026
npm
consumerweb-calurls 99.9.1
MAL-2026-10970 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 21, 2026
npm
commonweb-card 99.9.1
MAL-2026-10966 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 21, 2026
npm
commonweb-moneymovement 99.9.1
MAL-2026-10967 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 21, 2026
npm
signzy-field-level-encrypter 12.9.13, 12.9.12
MAL-2026-10972 ossf-package-analysis, amazon-inspector

Jul 21, 2026
npm
commonweb-wallet 99.9.1
MAL-2026-10969 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 21, 2026
npm
cxpw-offers 99.9.1
MAL-2026-10971 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 21, 2026
npm
requestor-util 99.9.1
MAL-2026-10965 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 21, 2026
npm
chai-leaf 1.4.5, 1.4.7, 1.4.6, 1.4.8
MAL-2026-10940 ghsa-malware, amazon-inspector, reversing-labs

Jul 21, 2026
npm
chai-as-reddit 7.0.2, 7.0.4, 7.0.3
MAL-2026-10939 ghsa-malware, amazon-inspector, reversing-labs

Jul 21, 2026
npm
faust-cont 1.0.0
MAL-2026-11042 amazon-inspector 2 IOCs

Jul 21, 2026
npm
date-format-utils-xz 1.0.3, 1.0.4, 1.0.0, 1.0.1, 1.0.2
MAL-2026-11001 amazon-inspector 2 IOCs

Jul 21, 2026
npm
ts-vitest 1.1.1, 1.1.3, 1.0.8, 1.1.2, 1.1.0, 1.0.9, 1.0.7
MAL-2026-10990 amazon-inspector, ghsa-malware 3 IOCs

Jul 21, 2026
npm
upjsma 1.0.62, 1.0.65, 1.0.61, 1.0.64, 1.0.60, 1.0.63, 1.0.58, 1.0.66, 1.0.59
MAL-2026-10928 ghsa-malware, amazon-inspector

Jul 20, 2026
npm
tilaver-mfa 1.0.0
MAL-2026-10925 amazon-inspector, ghsa-malware

Jul 20, 2026
npm
s3-lambda-dynamodb-cdk all versions
MAL-2026-10924 ghsa-malware

Jul 20, 2026
npm
lwc-slds-lbc 18.9.41
MAL-2026-10923 ghsa-malware, amazon-inspector

Jul 20, 2026
npm
lambda-cloudwatch-cdk 0.0.0
MAL-2026-10922 ghsa-malware, amazon-inspector

Jul 20, 2026
npm
iot-kfh-s3 17.3.23
MAL-2026-10921 ghsa-malware, amazon-inspector

Jul 20, 2026
npm
alb-lambda-cdk 18.2.22
MAL-2026-10920 ghsa-malware, amazon-inspector

Jul 20, 2026
npm
your-unique-package-name1337 1.0.0
MAL-2026-10906 reversing-labs

Jul 20, 2026
npm
win-build-utils 1.0.0
MAL-2026-10905 reversing-labs, amazon-inspector

Jul 20, 2026
npm
solana-web3-v1 1.0.0
MAL-2026-10904 reversing-labs, amazon-inspector

Jul 20, 2026
npm
solana-web3-stable 1.0.0
MAL-2026-10903 reversing-labs, amazon-inspector

Jul 20, 2026
npm
solana-web3-patched 1.0.0
MAL-2026-10902 reversing-labs, amazon-inspector

Jul 20, 2026
npm
solana-web3-lts 1.0.0
MAL-2026-10901 reversing-labs, amazon-inspector

Jul 20, 2026
npm
solana-web3-fork 1.0.0
MAL-2026-10900 reversing-labs, amazon-inspector

Jul 20, 2026
npm
solana-web3-fixed 1.0.0
MAL-2026-10899 reversing-labs, amazon-inspector

Jul 20, 2026
npm
solana-rpc-client 1.0.0
MAL-2026-10898 reversing-labs, amazon-inspector

Jul 20, 2026
npm
golan125-homepage-test 1.0.0
MAL-2026-10897 reversing-labs, amazon-inspector

Jul 20, 2026