Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,160 npm 223,989 PyPI 12,021 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

npm
dl-pp-latm 80.4.2
MAL-2026-10086 amazon-inspector

Jul 9, 2026
npm
neon-poly-utls 1.3.1
MAL-2026-10089 amazon-inspector, ghsa-malware

Jul 9, 2026
npm
chain-async-dom 1.3.6
MAL-2026-10082 amazon-inspector, reversing-labs

Jul 9, 2026
npm
clob-math-v2 2.0.1
MAL-2026-10083 amazon-inspector

Jul 9, 2026
npm
conversionvaluemanager 3.0.0
MAL-2026-10084 amazon-inspector, reversing-labs

Jul 9, 2026
npm
lovable-tager 1.4.0, 1.4.1
MAL-2026-10088 amazon-inspector

Jul 9, 2026
npm
eslint-plus 6.0.5, 6.0.4
MAL-2026-10087 amazon-inspector

Jul 9, 2026
npm
nonenull1 1.2.0, 1.3.0, 1.4.0, 1.0.0, 1.5.2, 1.5.0, 1.6.0, 1.5.5, 1.5.4, 1.5.6
MAL-2026-10090 amazon-inspector, ossf-package-analysis

Jul 9, 2026
npm
cookie-js-ease 2.1.7
MAL-2026-10058 amazon-inspector

Jul 9, 2026
npm
cookie-parser-es 1.0.7
MAL-2026-10059 amazon-inspector

Jul 9, 2026
npm
cookie-parser-js 1.4.8, 1.4.9, 1.5.0, 1.0.8, 1.5.3, 1.5.2, 1.5.1
MAL-2026-10060 amazon-inspector

Jul 9, 2026
npm
multer-orm 2.0.6, 2.0.2, 2.0.7, 2.0.5, 2.0.4, 2.0.3
MAL-2026-10064 amazon-inspector

Jul 9, 2026
npm
express-router-engine 3.6.5, 3.6.6, 3.6.7, 3.6.8
MAL-2026-10063 amazon-inspector

Jul 9, 2026
npm
chunk-parser 1.0.0
MAL-2026-10057 amazon-inspector

Jul 9, 2026
npm
type-slint 3.3.7, 3.3.8
MAL-2026-10077 amazon-inspector, ghsa-malware

Jul 9, 2026
npm
nps-retrieval-diagnostics 9.9.9
MAL-2026-10066 amazon-inspector

Jul 9, 2026
npm
cursed-ecto-d3ab00 1.0.1, 2.0.1, 2.0.0, 1.0.0
MAL-2026-10061 amazon-inspector, ghsa-malware

Jul 9, 2026
npm
polymarket-apis 1.1.0
MAL-2026-10067 amazon-inspector, ghsa-malware, reversing-labs

Jul 9, 2026
npm
polymarket-trader-apis 0.1.0, 2.1.0
MAL-2026-10072 amazon-inspector, ghsa-malware

Jul 9, 2026
npm
polymarket-kelly-math 3.5.2
MAL-2026-10068 amazon-inspector

Jul 9, 2026
npm
polymarket-kelly-stake-math 3.6.1
MAL-2026-10070 amazon-inspector, ghsa-malware

Jul 9, 2026
npm
polymarket-kit 2.4.1
MAL-2026-10071 amazon-inspector

Jul 9, 2026
npm
polymarket-kelly-maths 3.5.3
MAL-2026-10069 amazon-inspector

Jul 9, 2026
npm
es6-codify 1.2.0, 2.2.0, 2.0.0, 1.0.1, 2.1.0, 1.3.0, 1.1.0, 1.4.0, 1.0.0
MAL-2026-10062 amazon-inspector, ghsa-malware

Jul 9, 2026
npm
webrix-docs1 10.2.11
MAL-2026-10081 amazon-inspector

Jul 9, 2026
npm
webrix-docs 20.2.11
MAL-2026-10080 amazon-inspector

Jul 9, 2026
npm
vybscan-testbed-obfuscated-postinstall 1.0.0
MAL-2026-10079 amazon-inspector, ghsa-malware

Jul 9, 2026
npm
vybscan-testbed-inert-postinstall 1.0.0
MAL-2026-10078 amazon-inspector, ghsa-malware

Jul 9, 2026
npm
ts-eslint-jest 1.0.0
MAL-2026-10076 amazon-inspector, ghsa-malware

Jul 9, 2026
npm
nodemon-gulp 3.1.16, 3.1.14, 3.1.15
MAL-2026-10065 amazon-inspector, ghsa-malware

Jul 9, 2026
npm
chai-as-modified 6.0.4
MAL-2026-10043 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chai-as-buffered 3.7.24, 7.2.5
MAL-2026-10041 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chai-await-dom 1.3.7
MAL-2026-10049 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chai-as-staged 6.0.4
MAL-2026-10047 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chain-chai-async 1.3.5
MAL-2026-10055 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chai-as-align 7.1.0
MAL-2026-10039 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chai-promised-test 1.3.5
MAL-2026-10052 amazon-inspector

Jul 9, 2026
npm
chain-chai-await 1.3.6, 1.3.7, 1.3.5
MAL-2026-10056 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chai-as-serialized 7.0.8
MAL-2026-10044 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chai-as-thread 7.0.8
MAL-2026-10048 amazon-inspector, ghsa-malware

Jul 9, 2026