Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,168 npm 223,991 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,991 reports · Feed

npm
anthropic-toolkit 1.0.1, 0.5.0, 0.3.1, 0.2.0, 0.6.0, 0.2.1, 1.3.0, 1.2.1, 0.9.0, 0.1.1, 1.2.0, 0.…
MAL-2026-6673 amazon-inspector, ghsa-malware

Jun 30, 2026
npm
ts-bn-proto 5.8.1
MAL-2026-6695 amazon-inspector, ghsa-malware

Jun 30, 2026
npm
thirdwebb 0.0.8
MAL-2026-6694 amazon-inspector, ghsa-malware

Jun 30, 2026
npm
thirdwb 0.0.8
MAL-2026-6693 amazon-inspector, ghsa-malware

Jun 30, 2026
npm
polymarket-trading-developer-tools 0.1.1, 0.1.0
MAL-2026-6692 amazon-inspector

Jun 30, 2026
npm
polymarket-clob-maths 3.3.9, 2.3.9
MAL-2026-6691 amazon-inspector

Jun 30, 2026
npm
log-taker1 0.1.0
MAL-2026-6690 amazon-inspector, ghsa-malware

Jun 30, 2026
npm
decimal-format-core 3.5.3, 3.5.2, 3.2.0, 3.1.0, 3.3.0, 3.5.5, 3.5.4
MAL-2026-6689 amazon-inspector, ghsa-malware

Jun 30, 2026
npm
console-fmt-cli 2.1.0, 2.3.0, 2.5.0, 2.0.0, 2.7.0, 2.2.0, 2.9.0, 2.4.0, 2.8.0, 2.6.0, 2.9.1
MAL-2026-6688 amazon-inspector, ghsa-malware

Jun 30, 2026
npm
@webda-infra-ui/static-images 99.9.1
MAL-2026-6652 ghsa-malware, amazon-inspector, reversing-labs

Jun 29, 2026
npm
@sixt-payment/form-react all versions
MAL-2026-6649 ghsa-malware

Jun 29, 2026
npm
@digitalpharmacist/http-error-util 99.9.1
MAL-2026-6615 ghsa-malware, reversing-labs

Jun 29, 2026
npm
@deel-ui/animation 99.9.1
MAL-2026-6614 ghsa-malware, reversing-labs

Jun 29, 2026
npm
@deel-core/client-payroll-onboarding-types 99.9.1
MAL-2026-6613 ghsa-malware, reversing-labs

Jun 29, 2026
npm
@cseo-hr/trpweb-shared all versions
MAL-2026-6610 ghsa-malware

Jun 29, 2026
npm
@contentprod-authoring/block-manager 99.9.2
MAL-2026-6609 ghsa-malware, reversing-labs

Jun 29, 2026
npm
@concerns/i18n 99.9.1
MAL-2026-6606 ghsa-malware, reversing-labs

Jun 29, 2026
npm
@bscom/styling 99.9.1
MAL-2026-6605 ghsa-malware, reversing-labs

Jun 29, 2026
npm
@bodata/angular-client all versions
MAL-2026-6604 ghsa-malware

Jun 29, 2026
npm
@bc-workspace/utils all versions
MAL-2026-6603 ghsa-malware

Jun 29, 2026
npm
@appsource/utils 99.9.1
MAL-2026-6601 ghsa-malware, reversing-labs

Jun 29, 2026
npm
@alerts/components 99.9.1
MAL-2026-6599 ghsa-malware, reversing-labs

Jun 29, 2026
npm
@tbe-ui/ides all versions
MAL-2026-6651 ghsa-malware

Jun 29, 2026
npm
@report-portal/service-ui all versions
MAL-2026-6644 ghsa-malware

Jun 29, 2026
npm
@react-thee/rapier all versions
MAL-2026-6642 ghsa-malware

Jun 29, 2026
npm
@postman-app-monolith/renderer all versions
MAL-2026-6639 ghsa-malware

Jun 29, 2026
npm
@postidigital-feature/oneaccount-orgadmin-front all versions
MAL-2026-6638 ghsa-malware

Jun 29, 2026
npm
@planetlabs/admin-ng all versions
MAL-2026-6637 ghsa-malware

Jun 29, 2026
npm
@orbis-lr-sdk/orbis-lr-sdk 99.9.1
MAL-2026-6635 ghsa-malware, reversing-labs

Jun 29, 2026
npm
@ms-ows/logging 99.9.1
MAL-2026-6633 ghsa-malware, reversing-labs

Jun 29, 2026
npm
@meego-progressive/cdk 99.9.1
MAL-2026-6632 ghsa-malware, reversing-labs

Jun 29, 2026
npm
@img-hls/vtt.js 99.9.1
MAL-2026-6628 ghsa-malware, reversing-labs

Jun 29, 2026
npm
@hg-aka-prml/tapas-common 99.9.1
MAL-2026-6626 ghsa-malware, reversing-labs

Jun 29, 2026
npm
@fed-sofia/jetify 99.9.1
MAL-2026-6619 ghsa-malware, reversing-labs

Jun 29, 2026
npm
@e50/utils 99.9.1
MAL-2026-6617 ghsa-malware, reversing-labs

Jun 29, 2026
npm
@druidsoft/botframework-directlinejs 99.9.1
MAL-2026-6616 ghsa-malware, reversing-labs

Jun 29, 2026
npm
@ddh-libs/analytics all versions
MAL-2026-6612 ghsa-malware

Jun 29, 2026
npm
@cxp-shared/string-utilities 99.9.1
MAL-2026-6611 ghsa-malware, reversing-labs

Jun 29, 2026
npm
@contenteditor-shared/content-editor-common 99.9.1
MAL-2026-6608 ghsa-malware, reversing-labs

Jun 29, 2026
npm
@content-editor/common 99.9.1
MAL-2026-6607 ghsa-malware, reversing-labs

Jun 29, 2026