Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,160 npm 223,989 PyPI 12,021 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

npm
testis-pack 1.0.0
MAL-2026-10074 amazon-inspector 3 IOCs

Jul 9, 2026
npm
antsrcsrctest 1.0.0
MAL-2026-10038 amazon-inspector, ossf-package-analysis 3 IOCs

Jul 9, 2026
npm
@wagni_bot/web3-toolkit 1.2.0, 1.0.0
MAL-2026-10037 amazon-inspector 1 IOC

Jul 9, 2026
npm
@wagni_bot/web3-agent 1.1.4, 1.1.0, 1.1.3, 1.1.5, 1.0.0, 1.1.1, 1.1.2, 1.2.0
MAL-2026-10036 amazon-inspector 1 IOC

Jul 9, 2026
npm
@wagni_bot/solana-sdk 1.0.0, 1.2.0
MAL-2026-10035 amazon-inspector 1 IOC

Jul 9, 2026
npm
@wagni_bot/pumpfun-sdk 1.2.0, 1.0.0
MAL-2026-10034 amazon-inspector 1 IOC

Jul 9, 2026
npm
@wagni_bot/polymarket-sdk 1.1.5, 1.1.1, 1.1.3, 1.0.0, 1.1.4, 1.1.0, 1.2.0, 1.1.2
MAL-2026-10033 amazon-inspector 1 IOC

Jul 9, 2026
npm
@wagni_bot/polygon-sdk 1.1.5, 1.1.4, 1.0.0, 1.1.1, 1.1.0, 1.1.3, 1.2.0, 1.1.2
MAL-2026-10032 amazon-inspector 1 IOC

Jul 9, 2026
npm
@wagni_bot/orca-sdk 1.0.0, 1.2.0
MAL-2026-10031 amazon-inspector 1 IOC

Jul 9, 2026
npm
@wagni_bot/opensea-sdk 1.1.3, 1.1.5, 1.1.0, 1.1.1, 1.1.4, 1.2.0, 1.0.0, 1.0.2, 1.1.2
MAL-2026-10030 amazon-inspector 1 IOC

Jul 9, 2026
npm
@wagni_bot/meteora-sdk 1.0.0, 1.2.0
MAL-2026-10029 amazon-inspector 1 IOC

Jul 9, 2026
npm
@wagni_bot/metemask-sdk 1.1.5, 1.1.1, 1.0.0, 1.2.0, 1.1.4, 1.1.3, 1.1.0, 1.1.2
MAL-2026-10028 amazon-inspector 1 IOC

Jul 9, 2026
npm
@wagni_bot/jupiter-sdk 1.2.0, 1.0.0
MAL-2026-10027 amazon-inspector 1 IOC

Jul 9, 2026
npm
@wagni_bot/hyperliquid-sdk 1.1.5, 1.0.0, 1.1.4, 1.2.0, 1.1.0, 1.1.1, 1.1.3, 1.1.2
MAL-2026-10026 amazon-inspector 1 IOC

Jul 9, 2026
npm
@wagni_bot/ethereum-wallet 1.2.0, 1.0.0
MAL-2026-10025 amazon-inspector 1 IOC

Jul 9, 2026
npm
@wagni_bot/eth-agent 1.2.0, 1.1.3, 1.1.4, 1.0.0, 1.1.5, 1.1.0, 1.1.1, 1.0.2, 1.1.2
MAL-2026-10024 amazon-inspector, reversing-labs 1 IOC

Jul 9, 2026
npm
@wagni_bot/bsc-sdk 1.2.0, 1.1.3, 1.1.1, 1.1.4, 1.1.0, 1.1.5, 1.0.0, 1.1.2
MAL-2026-10023 amazon-inspector 1 IOC

Jul 9, 2026
npm
@wagni_bot/binance-sdk 1.2.0, 1.0.0
MAL-2026-10022 amazon-inspector 1 IOC

Jul 9, 2026
npm
nodemon-sudo 3.1.16
MAL-2026-10014 ghsa-malware, amazon-inspector

Jul 9, 2026
npm
tslint-conf 7.2.1
MAL-2026-7022 amazon-inspector, ghsa-malware

Jul 8, 2026
npm
@vite-js/ui 7.15.16, 7.15.10
MAL-2026-7021 amazon-inspector, ghsa-malware

Jul 8, 2026
npm
n8n-nodes-barcode-generator 1.0.3
MAL-2026-7018 amazon-inspector

Jul 8, 2026
npm
react-v17 20.0.1
MAL-2026-7020 amazon-inspector

Jul 8, 2026
npm
npm-rce-poc 1.0.13
MAL-2026-7019 amazon-inspector, ghsa-malware

Jul 8, 2026
npm
none123s 0.1.7, 1.1.6, 1.1.7, 0.1.9, 1.1.4, 1.1.2, 0.1.1, 0.1.0, 0.1.3, 1.1.1, 0.1.4, 0.…
MAL-2026-7024 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 8, 2026
npm
@vraksha/gh-helper 1.0.0
MAL-2026-7016 amazon-inspector

Jul 8, 2026
npm
crypto-promiser 1.0.1, 1.0.2
MAL-2026-7010 amazon-inspector, ghsa-malware

Jul 8, 2026
npm
vps-new-manager 0.1.4, 0.1.3
MAL-2026-7014 amazon-inspector, ghsa-malware

Jul 8, 2026
npm
events-alias 15.0.1
MAL-2026-7011 amazon-inspector

Jul 8, 2026
npm
chai-as-const 1.4.5, 1.4.6, 1.4.7
MAL-2026-7008 amazon-inspector, ghsa-malware

Jul 8, 2026
npm
configration 2.3.5
MAL-2026-7009 amazon-inspector, reversing-labs

Jul 8, 2026
npm
next-locomotive-init 1.0.4, 1.0.3, 1.0.0, 1.0.2, 1.0.1
MAL-2026-7013 amazon-inspector, ghsa-malware

Jul 8, 2026
npm
@vite-tab/tab 5.7.0, 3.15.10
MAL-2026-6988 amazon-inspector, ghsa-malware

Jul 8, 2026
npm
luludawang-kit 0.0.1
MAL-2026-6999 amazon-inspector, ghsa-malware

Jul 8, 2026
npm
ec-checker 0.0.1
MAL-2026-6996 amazon-inspector

Jul 8, 2026
npm
chai-redirection 0.0.1, 0.0.4, 0.0.3
MAL-2026-6995 amazon-inspector, ghsa-malware

Jul 8, 2026
npm
chai-presentation 0.0.1, 0.0.2, 0.0.4, 0.0.3
MAL-2026-6994 amazon-inspector

Jul 8, 2026
npm
airkey-mfa-react 36.1.1, 20.0.1, 35.1.1, 29.1.1
MAL-2026-6991 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 8, 2026
npm
pipo-sdk 9999.0.0
MAL-2026-7000 amazon-inspector

Jul 8, 2026
npm
goofy-sdk 9999.0.0
MAL-2026-6997 amazon-inspector

Jul 8, 2026