Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

npm
websight2-p2p 1.0.1, 1.0.0, 1.0.3, 1.0.2, 1.0.4
MAL-2026-10698 ghsa-malware, amazon-inspector

Jul 16, 2026
npm
websight-p2p 1.0.1, 1.0.2, 1.0.0, 1.0.5, 1.0.3, 1.0.6, 1.0.4
MAL-2026-10697 ghsa-malware, amazon-inspector

Jul 16, 2026
npm
vor8zakon 1.0.0
MAL-2026-10694 ghsa-malware, amazon-inspector

Jul 16, 2026
npm
nordpass 1.0.0, 1.0.2, 1.0.4
MAL-2026-10743 amazon-inspector, ossf-package-analysis

Jul 16, 2026
npm
nyt-cms all versions
MAL-2026-10692 ghsa-malware

Jul 16, 2026
npm
syft-acp-util 17.0.0, 1.0.0
MAL-2026-10767 amazon-inspector

Jul 16, 2026
npm
syft-acp-uikit 1.9.45, 1.0.0
MAL-2026-10766 amazon-inspector

Jul 16, 2026
npm
syft-acp-core 16.0.0, 1.0.0
MAL-2026-10765 amazon-inspector

Jul 16, 2026
npm
syft-acp-atoms 14.8.68, 1.0.0
MAL-2026-10764 amazon-inspector

Jul 16, 2026
npm
@edgecommons/streamlog-node all versions
MAL-2026-10763

Jul 16, 2026
npm
@edgecommons/edgecommons all versions
MAL-2026-10762

Jul 16, 2026
npm
@across-toolkit/typescript-config 99.0.0, 99.0.1
MAL-2026-10704 amazon-inspector 1 IOC

Jul 16, 2026
npm
internallib_v907 1.0.3
MAL-2026-10691 ghsa-malware, amazon-inspector

Jul 15, 2026
npm
selparsecss-selector 1.1.0, 2.0.0, 1.0.0, 2.1.0
MAL-2026-10687 amazon-inspector, ghsa-malware

Jul 15, 2026
npm
@ddh-libraries/analytics 99.0.0
MAL-2026-10686 ossf-package-analysis

Jul 15, 2026
npm
react-hook-scripts 5.4.2
MAL-2026-10684 amazon-inspector

Jul 15, 2026
npm
code-formatter-setup 1.0.0
MAL-2026-10682 amazon-inspector, ghsa-malware

Jul 15, 2026
npm
formatters.ts 14.2.1
MAL-2026-10683 amazon-inspector

Jul 15, 2026
npm
rakibox 2.0.0
MAL-2026-10679 amazon-inspector

Jul 15, 2026
npm
ls-env-config 1.0.5
MAL-2026-10678 amazon-inspector

Jul 15, 2026
npm
deployowl 2.1.0
MAL-2026-10677 amazon-inspector

Jul 15, 2026
npm
syncgrove 1.4.0
MAL-2026-10680 amazon-inspector

Jul 15, 2026
npm
commonjs-assert 1.0.3, 1.0.4
MAL-2026-10676 amazon-inspector, ghsa-malware

Jul 15, 2026
npm
ac-raf-emitter 3.0.1
MAL-2026-10675 amazon-inspector

Jul 15, 2026
npm
gulp-jscrambler 8.6.2
MAL-2026-10673 ghsa-malware, amazon-inspector

Jul 15, 2026
npm
jscrambler-metro-plugin 9.0.2
MAL-2026-10674 ghsa-malware, amazon-inspector

Jul 15, 2026
npm
chain-as-log 3.0.1
MAL-2026-10668 amazon-inspector

Jul 15, 2026
npm
spytrack 1.1.0
MAL-2026-10671 amazon-inspector

Jul 15, 2026
npm
dbconnectify 1.0.1, 1.0.2
MAL-2026-10669 amazon-inspector, ghsa-malware

Jul 15, 2026
npm
eslintcmd 0.2.0, 0.1.0
MAL-2026-10670 amazon-inspector, ghsa-malware

Jul 15, 2026
npm
@fhkry/x-baileys 1.3.0, 1.4.0, 1.0.0, 1.7.0, 1.1.0, 1.6.0, 1.2.0, 1.5.0
MAL-2026-10665 ghsa-malware, amazon-inspector

Jul 15, 2026
npm
@fhkry/baileys-v2 all versions
MAL-2026-10664 ghsa-malware

Jul 15, 2026
npm
crypto-hasher 3.1.3, 3.1.2
MAL-2026-10666 ghsa-malware, amazon-inspector

Jul 15, 2026
npm
true 0.0.4, 0.0.3, 0.0.2, 0.0.1
MAL-2026-10667 ghsa-malware

Jul 15, 2026
npm
ssweb-wp 1.0.0
MAL-2026-10662 ghsa-malware, amazon-inspector

Jul 15, 2026
npm
@sauruslord/libsignal 2.0.2
MAL-2026-10659 ghsa-malware, amazon-inspector

Jul 15, 2026
npm
@sauruslord/eslint-config all versions
MAL-2026-10658 ghsa-malware

Jul 15, 2026
npm
zaldy-baileys all versions
MAL-2026-10663 ghsa-malware

Jul 15, 2026
npm
sauruslord-baileys 3.0.0, 3.0.1, 3.0.2
MAL-2026-10661 ghsa-malware, amazon-inspector

Jul 15, 2026
npm
saurus-assets all versions
MAL-2026-10660 ghsa-malware

Jul 15, 2026