Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,168 npm 223,991 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,991 reports · Feed

npm
@lodash-en/lodash-en 1.4.11, 1.5.0
MAL-2026-6739 ghsa-malware, reversing-labs

Jul 3, 2026
npm
decode-sdks all versions
MAL-2026-6740 ghsa-malware

Jul 3, 2026
npm
@jacobtan/decode-sdk 1.0.0
MAL-2026-6738 ghsa-malware

Jul 3, 2026
npm
epic-internal-tools 99999.0.0
MAL-2026-6737 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 2, 2026
npm
ue-automation-scripts 99999.0.0
MAL-2026-6730 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 2, 2026
npm
robomerge 99999.0.0
MAL-2026-6729 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 2, 2026
npm
unreal-horde-dashboard 99999.0.0
MAL-2026-6732 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 2, 2026
npm
ue-jenkins-buildkite 99999.0.0
MAL-2026-6731 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 2, 2026
npm
@checkrhq/adjudication-api-client 0.0.2
MAL-2026-6789 ossf-package-analysis, amazon-inspector

Jul 2, 2026
npm
tailwind-animates 1.0.1
MAL-2026-6727 ghsa-malware, amazon-inspector

Jul 2, 2026
npm
db-convertor 1.0.5
MAL-2026-6726 ghsa-malware, amazon-inspector

Jul 2, 2026
npm
@modhamanish/rn-mm-template 1.1.3
MAL-2026-6725 ghsa-malware, amazon-inspector

Jul 2, 2026
npm
@marketfront/navbar 7.0.0
MAL-2026-6787 amazon-inspector

Jul 2, 2026
npm
@marketfront/mychatspreloader 7.0.0
MAL-2026-6786 amazon-inspector

Jul 2, 2026
npm
@marketfront/madvpopup 7.0.0
MAL-2026-6785 amazon-inspector

Jul 2, 2026
npm
@marketfront/livestreampreviewpopup 7.0.0
MAL-2026-6784 amazon-inspector

Jul 2, 2026
npm
@marketfront/infopopup 7.0.0
MAL-2026-6783 amazon-inspector

Jul 2, 2026
npm
@marketfront/header 7.0.0
MAL-2026-6782 amazon-inspector

Jul 2, 2026
npm
@marketfront/gotoauthpopup 7.0.0
MAL-2026-6781 amazon-inspector

Jul 2, 2026
npm
@marketfront/footer 7.0.0
MAL-2026-6780 amazon-inspector

Jul 2, 2026
npm
@marketfront/fingerprint all versions
MAL-2026-6779

Jul 2, 2026
npm
@marketfront/fashiononboardingpopup 7.0.0
MAL-2026-6778 amazon-inspector

Jul 2, 2026
npm
@marketfront/errorcounter 7.0.0
MAL-2026-6777 amazon-inspector

Jul 2, 2026
npm
@marketfront/dynamicpageparams 7.0.0
MAL-2026-6776 amazon-inspector

Jul 2, 2026
npm
@marketfront/digitalherobannercarousel 7.0.0
MAL-2026-6775 amazon-inspector

Jul 2, 2026
npm
@marketfront/devtoolsloader 7.0.0
MAL-2026-6774 amazon-inspector

Jul 2, 2026
npm
@marketfront/designsystemdevtool 7.0.0
MAL-2026-6773 amazon-inspector

Jul 2, 2026
npm
@marketfront/customdealsfeed 7.0.0
MAL-2026-6772 amazon-inspector

Jul 2, 2026
npm
@marketfront/commonecommerce 7.0.0
MAL-2026-6771 amazon-inspector

Jul 2, 2026
npm
@marketfront/changefilter all versions
MAL-2026-6770

Jul 2, 2026
npm
@marketfront/captchaservice 7.0.0
MAL-2026-6769 amazon-inspector

Jul 2, 2026
npm
@marketfront/blenderdevtool 7.0.0
MAL-2026-6768 amazon-inspector

Jul 2, 2026
npm
@marketfront/basemarkettemplate 7.0.0
MAL-2026-6767 amazon-inspector

Jul 2, 2026
npm
@marketfront/baobabtech 7.0.0
MAL-2026-6766 amazon-inspector

Jul 2, 2026
npm
@marketfront/bannerpopup 7.0.0
MAL-2026-6765 amazon-inspector

Jul 2, 2026
npm
@marketfront/advertisingdevtool 7.0.0
MAL-2026-6764 amazon-inspector

Jul 2, 2026
npm
@marketfront/actualordersnippetpopup all versions
MAL-2026-6763

Jul 2, 2026
npm
electron-orbit 1.0.21, 1.0.11, 1.0.14, 1.0.4, 1.0.22, 1.0.23, 1.0.13, 1.0.20, 1.0.26, 1.0.10, …
MAL-2026-6723 amazon-inspector

Jul 1, 2026
npm
svgcraft-core 1.0.1, 1.0.2, 1.0.4, 1.0.3, 1.0.6, 1.0.5, 1.0.7, 1.0.0
MAL-2026-6715 amazon-inspector, ghsa-malware

Jul 1, 2026
npm
test-pkg-yarn 1.0.2, 1.0.1, 1.0.0
MAL-2026-6718 amazon-inspector, ghsa-malware

Jul 1, 2026