Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

npm
@jplopezy/connectivity-test-do-not-install 0.0.0-test
MAL-2026-10220 ghsa-malware, amazon-inspector

Jul 13, 2026
npm
chai-as-precision 7.0.6
MAL-2026-10219 amazon-inspector

Jul 13, 2026
npm
pure-folder-three 0.7.3, 0.7.1, 0.7.0, 0.6.0, 0.5.0
MAL-2026-10218 ghsa-malware, amazon-inspector

Jul 13, 2026
npm
dotnet-runtime-base 1.0.5, 1.0.4
MAL-2026-10217 ghsa-malware, amazon-inspector

Jul 13, 2026
npm
node-sysmetrics 1.0.0, 1.0.1
MAL-2026-10216 ghsa-malware, amazon-inspector

Jul 13, 2026
npm
slds-lsp-client 2026.7.11
MAL-2026-10234 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
salesforce-vscode-slds 2026.7.11
MAL-2026-10232 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
chat-adapter-zoom 12.1.31
MAL-2026-10228 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
babel-preset-lib-client 4.9.10, 4.9.9, 4.9.11, 1.0.0
MAL-2026-10214 amazon-inspector, ghsa-malware

Jul 12, 2026
npm
auto-debug-tool 1.0.3, 1.0.2, 1.0.0
MAL-2026-10209 amazon-inspector, ghsa-malware

Jul 12, 2026
npm
vuln-package 99.9.11, 99.9.14, 99.9.9, 99.9.10
MAL-2026-10212 amazon-inspector

Jul 12, 2026
npm
mcp-notes-server-poc-praetorian 0.1.0
MAL-2026-10210 amazon-inspector, ghsa-malware

Jul 12, 2026
npm
@meziizana/frontend-logger 10.0.0
MAL-2026-10208 amazon-inspector

Jul 12, 2026
npm
react-next-vite 1.2.9
MAL-2026-10211 amazon-inspector

Jul 12, 2026
npm
nullrift 1.0.0
MAL-2026-10206 amazon-inspector

Jul 12, 2026
npm
chain-await-dom 1.3.4
MAL-2026-10202 amazon-inspector

Jul 12, 2026
npm
react-dom-v17 15.0.1
MAL-2026-10207 amazon-inspector

Jul 12, 2026
npm
library-explorer 25.2.1
MAL-2026-10205 amazon-inspector, reversing-labs

Jul 12, 2026
npm
giantswarm 22.0.1
MAL-2026-10203 amazon-inspector

Jul 12, 2026
npm
api-changelly 19.2.11
MAL-2026-10200 amazon-inspector, reversing-labs

Jul 12, 2026
npm
gptcore 4.0.6, 4.0.7, 4.0.8
MAL-2026-10204 amazon-inspector

Jul 12, 2026
npm
bugexploit 99.9.9
MAL-2026-10201 amazon-inspector

Jul 12, 2026
npm
polylabel-web-lib 99.9.1
MAL-2026-10198 amazon-inspector, ghsa-malware

Jul 12, 2026
npm
polymarket-kelly-math-stake 3.6.2
MAL-2026-10199 amazon-inspector, ghsa-malware

Jul 12, 2026
npm
tinymask-js 1.0.2
MAL-2026-10189 amazon-inspector, ghsa-malware

Jul 11, 2026
npm
awesome-ts-jest 29.4.12
MAL-2026-10188 amazon-inspector, ghsa-malware

Jul 11, 2026
npm
tinyparrot 0.4.1
MAL-2026-10190 amazon-inspector, ghsa-malware

Jul 11, 2026
npm
google-caja-bower 1000.80.20, 20.20.20, 999.99.20, 999.999.20, 1000.800.20, 1000.801.20, 999.20.20
MAL-2026-10186 amazon-inspector, ghsa-malware

Jul 11, 2026
npm
authvaultx 1.7.1
MAL-2026-10185 ghsa-malware, amazon-inspector

Jul 11, 2026
npm
polymarket-mcp-v2 2.1.6
MAL-2026-10481 amazon-inspector 6 IOCs

Jul 11, 2026
npm
jscrambler 8.16.0, 8.14.0, 8.20.0, 8.18.0, 8.17.0
MAL-2026-10187 amazon-inspector, ghsa-malware

Jul 11, 2026
npm
@uwr/colors 1.3.6
MAL-2026-10179 amazon-inspector, reversing-labs

Jul 10, 2026
npm
fkext-browser-min 1.0.14
MAL-2026-10183 amazon-inspector, reversing-labs

Jul 10, 2026
npm
@broadpeak/smartlib-ad 24.1.10
MAL-2026-10178 amazon-inspector

Jul 10, 2026
npm
consumerweb 2200.4.2
MAL-2026-10181 amazon-inspector, reversing-labs

Jul 10, 2026
npm
express-guardian 1.4.1, 1.4.3
MAL-2026-10182 amazon-inspector

Jul 10, 2026
npm
mongoose-schema-unique 4.0.4, 4.0.3, 4.0.2
MAL-2026-10184 amazon-inspector

Jul 10, 2026
npm
auth-next-gen 1.6.29, 1.7.11, 1.7.2
MAL-2026-10180 amazon-inspector, ghsa-malware

Jul 10, 2026
npm
@jaymara/jsononifier 1.0.0, 1.0.2, 1.0.1
MAL-2026-10177 amazon-inspector

Jul 10, 2026
npm
chai-as-doc 2.3.5
MAL-2026-10175 amazon-inspector

Jul 10, 2026