Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

npm
@sauruslord/baileys all versions
MAL-2026-10657 ghsa-malware

Jul 15, 2026
npm
@debile/require-dir 1.9.1, 1.9.2
MAL-2026-10654 amazon-inspector

Jul 15, 2026
npm
gmail-changer 2.0.2
MAL-2026-10635 amazon-inspector

Jul 15, 2026
npm
monogrok 1.0.30, 1.0.33, 1.0.7, 1.0.8, 1.0.1, 1.0.43, 1.0.31, 1.0.40, 1.0.37, 1.0.11, 1.…
MAL-2026-10638 amazon-inspector, ghsa-malware

Jul 15, 2026
npm
core-dotenv 1.4.1
MAL-2026-10631 amazon-inspector, ghsa-malware

Jul 15, 2026
npm
estore-client 5.0.0
MAL-2026-10634 amazon-inspector

Jul 15, 2026
npm
ogensec-sdk 1.2.1, 1.1.1
MAL-2026-10639 amazon-inspector

Jul 15, 2026
npm
creditgauge 1.0.0
MAL-2026-10633 amazon-inspector

Jul 15, 2026
npm
webpack-session-cache 0.1.4
MAL-2026-10653 ghsa-malware, amazon-inspector

Jul 15, 2026
npm
polygon-toolkit-validator 1.1.2
MAL-2026-10641 amazon-inspector, ghsa-malware

Jul 15, 2026
npm
polygon-toolkit-validation 1.0.9, 1.1.0
MAL-2026-10640 amazon-inspector

Jul 15, 2026
npm
@bcs-mi-ui/test1243npmpacket76 all versions
MAL-2026-10647 ghsa-malware

Jul 15, 2026
npm
@bcs-mi-ui/message-block all versions
MAL-2026-10646 ghsa-malware

Jul 15, 2026
npm
@bcs-mi-ui/message all versions
MAL-2026-10645 ghsa-malware

Jul 15, 2026
npm
leviosa86-test 4.999.0
MAL-2026-10636 amazon-inspector

Jul 15, 2026
npm
ai-explain 0.3.4
MAL-2026-10628 amazon-inspector

Jul 15, 2026
npm
ai-pro-sdk 2.0.3, 2.0.1, 2.0.4, 2.0.2
MAL-2026-10629 amazon-inspector, ghsa-malware

Jul 15, 2026
npm
@hkyyy/portal-widget-helper-0601 1.0.0
MAL-2026-10648 ghsa-malware, amazon-inspector

Jul 15, 2026
npm
@saladin0x1/js-shared-modules all versions
MAL-2026-10649 ghsa-malware

Jul 15, 2026
npm
@leviosa86com/leviosa86-test 6.2.1, 6.0.0, 4.999.0, 5.999.0
MAL-2026-10625 amazon-inspector, ossf-package-analysis

Jul 15, 2026
npm
chai-as-byte 3.1.5, 3.1.6
MAL-2026-10630 amazon-inspector

Jul 15, 2026
npm
@sqlite-frame/nodesql 1.0.3, 1.0.2
MAL-2026-10627 amazon-inspector, ghsa-malware

Jul 15, 2026
npm
@react-case/option 1.0.0
MAL-2026-10626 amazon-inspector

Jul 15, 2026
npm
mc-reg 1.0.3, 1.0.4, 1.0.8, 1.0.6, 1.0.5, 1.0.7, 1.0.2
MAL-2026-10637 amazon-inspector, ghsa-malware

Jul 15, 2026
npm
iwsdk 22.0.0
MAL-2026-10651 ghsa-malware, amazon-inspector

Jul 14, 2026
npm
install-skia 1.0.0
MAL-2026-10650 ghsa-malware, amazon-inspector

Jul 14, 2026
npm
cppt-common 13.1.1
MAL-2026-10632 amazon-inspector

Jul 14, 2026
npm
json-bigint-extend all versions
MAL-2026-10652 ghsa-malware

Jul 14, 2026
npm
@vite-js/vui 7.14.16
MAL-2026-10619 amazon-inspector, ghsa-malware

Jul 14, 2026
npm
chai-as-structured 7.0.5
MAL-2026-10622 amazon-inspector, reversing-labs

Jul 14, 2026
npm
chai-as-hardened 7.0.9
MAL-2026-10621 amazon-inspector

Jul 14, 2026
npm
http-ws-listener 1.0.5
MAL-2026-10623 amazon-inspector

Jul 14, 2026
npm
ahooks-3.7.8 13.1.1
MAL-2026-10620 amazon-inspector

Jul 14, 2026
npm
postcss-selector-minify 2.0.0, 1.0.0
MAL-2026-10614 amazon-inspector, ghsa-malware

Jul 14, 2026
npm
ethereum-lib-utils 1.3.7
MAL-2026-10613 amazon-inspector, ghsa-malware

Jul 14, 2026
npm
assertion-utils-js 2.4.3
MAL-2026-10612 amazon-inspector, ghsa-malware

Jul 14, 2026
npm
smb-common-uikit 15.2.0
MAL-2026-10615 amazon-inspector

Jul 14, 2026
npm
smb-portal-uikit 18.1.1
MAL-2026-10616 amazon-inspector

Jul 14, 2026
npm
@web3-helpers/core 1.0.2, 1.0.1, 1.0.5, 1.0.3, 1.0.0, 1.0.4, 1.0.6
MAL-2026-10611 amazon-inspector

Jul 14, 2026
npm
utils-style-engine 10.2.4
MAL-2026-10609 amazon-inspector

Jul 14, 2026