Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

npm
@markscan/reports all versions
MAL-2026-10953

Jul 20, 2026
npm
@markscan/core all versions
MAL-2026-10952

Jul 20, 2026
npm
@markscan/api all versions
MAL-2026-10951

Jul 20, 2026
npm
@iphouse/core all versions
MAL-2026-10950

Jul 20, 2026
npm
@iphouse/api all versions
MAL-2026-10949

Jul 20, 2026
npm
@akrai/report_new all versions
MAL-2026-10948

Jul 20, 2026
npm
@akrai/report all versions
MAL-2026-10947

Jul 20, 2026
npm
@akrai/core all versions
MAL-2026-10946

Jul 20, 2026
npm
zer0onetencent2 1.0.0
MAL-2026-10945 amazon-inspector

Jul 20, 2026
npm
zer0onetencent 1.0.0
MAL-2026-10944 amazon-inspector

Jul 20, 2026
npm
aftermathfi 99.0.0
MAL-2026-10943 amazon-inspector

Jul 20, 2026
npm
aftermath-sui 99.0.0
MAL-2026-10942 amazon-inspector

Jul 20, 2026
npm
aftermath-finance 99.0.0
MAL-2026-10941 amazon-inspector

Jul 20, 2026
npm
twiliointernal-messaging-toolbox 99.99.100, 99.99.99
MAL-2026-10938 amazon-inspector

Jul 20, 2026
npm
twilio-serverless 99.99.99, 99.99.100
MAL-2026-10937 amazon-inspector

Jul 20, 2026
npm
twilio-platform-request 99.99.100, 99.99.99
MAL-2026-10936 amazon-inspector

Jul 20, 2026
npm
twilio-platform-async-data-fetch 99.99.100, 99.99.99
MAL-2026-10935 amazon-inspector

Jul 20, 2026
npm
twilio-internal 99.99.99, 99.99.100
MAL-2026-10934 amazon-inspector

Jul 20, 2026
npm
twilio-deploy 99.99.99, 99.99.100
MAL-2026-10933 amazon-inspector

Jul 20, 2026
npm
twilio-assets 99.99.99, 99.99.100
MAL-2026-10932 amazon-inspector

Jul 20, 2026
npm
org-twilio-phone-numbers-utils 99.99.99, 99.99.100
MAL-2026-10931 amazon-inspector

Jul 20, 2026
npm
zoom-widget-xss-poc-paresh 1.0.0
MAL-2026-10782 ghsa-malware, amazon-inspector

Jul 19, 2026
npm
chart-animation-helper 1.0.0
MAL-2026-10781 ghsa-malware, amazon-inspector

Jul 19, 2026
npm
relativity-pdfjs-dist 5.8.2, 99.9.9
MAL-2026-10778 ossf-package-analysis, amazon-inspector

Jul 18, 2026
npm
telemetry-axios 0.1.5, 0.1.6
MAL-2026-10773 ghsa-malware, amazon-inspector

Jul 17, 2026
npm
axios-native 1.16.4, 1.16.1, 1.16.3
MAL-2026-10772 ghsa-malware, amazon-inspector

Jul 17, 2026
npm
n8n-nodes-final-mile 1.0.5, 1.0.1, 1.0.3, 1.0.4, 1.0.0, 1.0.2
MAL-2026-10776 ossf-package-analysis, amazon-inspector

Jul 17, 2026
npm
n8n-nodes-devops-utils 1.0.7, 1.0.0, 1.0.5, 1.0.4, 1.0.6, 1.0.3, 1.0.2, 1.0.1
MAL-2026-10775 ossf-package-analysis, amazon-inspector

Jul 17, 2026
npm
n8n-nodes-probe 1.0.6, 1.0.2, 1.0.1, 1.0.5, 1.0.0, 1.0.3, 1.0.4
MAL-2026-10777 ossf-package-analysis, amazon-inspector

Jul 17, 2026
npm
easyway2 1.0.3, 1.0.7, 1.0.11, 1.0.0, 1.0.8, 1.0.2, 1.0.6, 1.0.5, 1.0.10, 1.0.1, 1.0.9
MAL-2026-10769 ossf-package-analysis, amazon-inspector

Jul 17, 2026
npm
n8n-nodes-api-finder 1.0.0, 1.0.2, 1.0.1
MAL-2026-10774 ossf-package-analysis, amazon-inspector

Jul 17, 2026
npm
my-tailwind-gutenberg-block 0.1.2, 0.1.4, 0.1.3, 0.1.5, 0.1.0
MAL-2026-10761 ghsa-malware, amazon-inspector

Jul 16, 2026
npm
@ai-support-agent/cli 0.3.2-beta.1, 0.4.2, 0.3.2-beta.15, 0.3.2-beta.9, 0.3.2-beta.2, 0.3.5-beta.5, 0…
MAL-2026-10707 amazon-inspector

Jul 16, 2026
npm
@cyberrant-rantai/rantai 1.0.15
MAL-2026-10709 amazon-inspector

Jul 16, 2026
npm
channel-worker 2.5.39
MAL-2026-10729 amazon-inspector

Jul 16, 2026
npm
memtry-cli 1.0.4
MAL-2026-10736 amazon-inspector

Jul 16, 2026
npm
bvm-core 1.1.43, 1.1.42
MAL-2026-10728 amazon-inspector

Jul 16, 2026
npm
@whalent/agent 0.3.231, 0.3.283, 0.3.295, 0.3.282, 0.3.280, 0.3.296, 0.3.277, 0.3.297, 0.3.272…
MAL-2026-10721 amazon-inspector

Jul 16, 2026
npm
@agentvox/host 0.1.5
MAL-2026-10706 amazon-inspector

Jul 16, 2026
npm
@thepayulink/server 2.0.0
MAL-2026-10719 amazon-inspector

Jul 16, 2026