Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

npm
axios-test-one 1.19.0, 1.19.1, 1.19.6, 1.19.5, 1.19.2, 1.19.4, 1.19.7, 1.19.3
MAL-2026-10727 amazon-inspector

Jul 16, 2026
npm
telemetry-metrics 0.2.1, 0.2.5, 0.2.3, 0.2.4, 0.2.2
MAL-2026-10750 amazon-inspector

Jul 16, 2026
npm
codeam-cli 2.61.1, 2.61.3
MAL-2026-10730 amazon-inspector

Jul 16, 2026
npm
@yeaft/webchat-agent 1.0.171, 1.0.199, 1.0.325, 1.0.376, 1.0.189, 1.0.283, 1.0.252, 1.0.238, 1.0.243…
MAL-2026-10723 amazon-inspector

Jul 16, 2026
npm
agentto 0.5.36
MAL-2026-10725 amazon-inspector

Jul 16, 2026
npm
sakuraai 0.0.11
MAL-2026-10746 amazon-inspector

Jul 16, 2026
npm
@sciagent/cli 1.0.68, 1.0.69
MAL-2026-10718 amazon-inspector

Jul 16, 2026
npm
sensorium-mcp 3.0.95
MAL-2026-10747 amazon-inspector

Jul 16, 2026
npm
hehehe 2.0.2, 2.0.1
MAL-2026-10732 amazon-inspector, ghsa-malware

Jul 16, 2026
npm
@onescience/onecode 1.14.50-202607161038, 1.14.50-202607161710, 1.14.50-202607161139, 1.14.50-20260…
MAL-2026-10717 amazon-inspector

Jul 16, 2026
npm
@agent-link/agent 0.1.269, 0.1.325, 0.1.319, 0.1.285, 0.1.280, 0.1.272, 0.1.310, 0.1.293, 0.1.283…
MAL-2026-10705 amazon-inspector

Jul 16, 2026
npm
@whalent/agent-core 0.3.230, 0.3.231, 0.3.232, 0.3.233, 0.3.254, 0.3.280, 0.3.298, 0.3.294, 0.3.295…
MAL-2026-10722 amazon-inspector

Jul 16, 2026
npm
netcontrol-agent 1.0.5
MAL-2026-10741 amazon-inspector

Jul 16, 2026
npm
@vibelet/cli 1.2.154
MAL-2026-10720 amazon-inspector

Jul 16, 2026
npm
vanexa-agent 1.1.10, 1.1.9, 1.1.23, 1.1.46, 1.1.34, 1.1.39, 1.1.27, 1.1.18, 1.1.22, 1.1.28, …
MAL-2026-10751 amazon-inspector

Jul 16, 2026
npm
@yuandc/aica 0.1.4, 0.1.1
MAL-2026-10724 amazon-inspector

Jul 16, 2026
npm
infrastructure-common 99.9.9
MAL-2026-10734 amazon-inspector

Jul 16, 2026
npm
myreviews-core 99.0.0
MAL-2026-10740 amazon-inspector

Jul 16, 2026
npm
mw-server-util 2.0.1, 2.0.0
MAL-2026-10739 amazon-inspector

Jul 16, 2026
npm
date-utils-light 1.0.1
MAL-2026-10731 amazon-inspector

Jul 16, 2026
npm
idlive-document-capture-web 14.2.1
MAL-2026-10733 amazon-inspector

Jul 16, 2026
npm
@equans-services/codex 1.0.0
MAL-2026-10710 amazon-inspector

Jul 16, 2026
npm
mmagrt 0.1.10
MAL-2026-10737 amazon-inspector

Jul 16, 2026
npm
xxdxa 1.0.3, 1.0.2, 1.0.4, 1.0.5, 1.0.7, 1.0.1, 1.0.6
MAL-2026-10752 amazon-inspector

Jul 16, 2026
npm
mui-option 1.0.0
MAL-2026-10738 amazon-inspector

Jul 16, 2026
npm
sync-grove 1.0.2, 1.0.1, 1.0.0
MAL-2026-10749 amazon-inspector

Jul 16, 2026
npm
@hibachi-xyz/common 99.0.0
MAL-2026-10712 amazon-inspector

Jul 16, 2026
npm
isite 2026.7.2, 2026.8.26, 2026.7.1, 2026.6.1, 2026.4.5, 2026.4.4, 2026.4.3, 2026.4.2…
MAL-2026-10735 amazon-inspector, ghsa-malware

Jul 16, 2026
npm
@funny-booth/agent-core 0.1.6, 0.1.1, 0.1.5, 0.1.3, 0.1.4, 0.1.2, 0.1.9, 0.1.7, 0.1.8
MAL-2026-10711 amazon-inspector

Jul 16, 2026
npm
node-as-api 2.1.6
MAL-2026-10742 amazon-inspector

Jul 16, 2026
npm
string-formatter-pro 1.0.1, 1.0.0
MAL-2026-10748 amazon-inspector

Jul 16, 2026
npm
time-format-kit 1.0.2, 1.0.0, 1.0.1
MAL-2026-10700 ossf-package-analysis, amazon-inspector

Jul 16, 2026
npm
http-req-lite 1.0.0
MAL-2026-10699 ossf-package-analysis

Jul 16, 2026
npm
@across-toolkit/eslint-config 99.0.1, 99.0.0
MAL-2026-10703 amazon-inspector, ossf-package-analysis

Jul 16, 2026
npm
@hibachi-xyz/types 99.0.0
MAL-2026-10715 amazon-inspector, ossf-package-analysis

Jul 16, 2026
npm
@hibachi-xyz/config 99.0.0
MAL-2026-10713 amazon-inspector, ossf-package-analysis

Jul 16, 2026
npm
@hibachi-xyz/ui 99.0.0
MAL-2026-10716 amazon-inspector, ossf-package-analysis

Jul 16, 2026
npm
@hibachi-xyz/sdk 99.0.0
MAL-2026-10714 amazon-inspector, ossf-package-analysis

Jul 16, 2026
npm
loader1 2.1.7, 2.1.3, 2.1.6, 2.1.2, 2.1.5, 2.1.4
MAL-2026-10696 ghsa-malware, amazon-inspector

Jul 16, 2026
npm
ai-p2p 1.0.2, 1.0.0, 1.0.3, 1.0.1, 1.0.4
MAL-2026-10695 ghsa-malware, amazon-inspector

Jul 16, 2026