Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,168 npm 223,991 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,991 reports · Feed

npm
polymarket-clob-math 1.0.4
MAL-2026-6556 amazon-inspector, ghsa-malware

Jun 28, 2026
npm
livekit-agents 0.3.0, 0.3.2, 0.3.1, 0.3.4, 0.3.5, 0.2.0, 0.2.2, 0.2.1, 0.2.3, 0.1.0
MAL-2026-6555 amazon-inspector, ghsa-malware

Jun 28, 2026
npm
@k18n/creatormarketplace-admin-language 99.0.0, 99.0.1, 99.0.2
MAL-2026-6550 amazon-inspector

Jun 28, 2026
npm
insomnia-test-util-m4gester 1.0.0, 1.0.1
MAL-2026-6554 amazon-inspector

Jun 28, 2026
npm
insomnia-plugin-poc-m4gester 1.0.0
MAL-2026-6552 amazon-inspector

Jun 28, 2026
npm
insomnia-plugin-poc-m4gester2 1.0.1, 1.0.0
MAL-2026-6553 amazon-inspector

Jun 28, 2026
npm
anthropic-internal-tools 1.0.0, 1.0.2, 1.0.1
MAL-2026-6551 amazon-inspector

Jun 28, 2026
npm
ts-ankle 1.1.0
MAL-2026-6548 amazon-inspector, ghsa-malware

Jun 27, 2026
npm
ryan-pdf-js 99.9.1
MAL-2026-6546 amazon-inspector, ghsa-malware

Jun 27, 2026
npm
react-editable-calendar 0.1.7, 0.1.0, 0.1.1, 0.1.2, 0.1.4, 0.1.3, 0.1.6
MAL-2026-6547 amazon-inspector, ossf-package-analysis

Jun 27, 2026
npm
crossmint-wallets-sdk 1.0.0
MAL-2026-6545 amazon-inspector, ghsa-malware

Jun 27, 2026
npm
chai-as-persisted 4.2.8, 6.1.9
MAL-2026-6544 amazon-inspector, ghsa-malware

Jun 27, 2026
npm
@osmura/treeify 1.1.2, 1.1.3, 1.1.0
MAL-2026-6542 amazon-inspector

Jun 26, 2026
npm
express-initial 12.1.9, 12.1.10, 12.1.8, 12.1.7
MAL-2026-6543 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
db-query-log 1.0.1, 1.0.2
MAL-2026-6539 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
db-rake 1.0.2, 1.0.1
MAL-2026-6540 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
db-plog 1.0.1, 1.0.0
MAL-2026-6538 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
@krentzen/buffer-reverse 1.0.3
MAL-2026-6536 amazon-inspector

Jun 26, 2026
npm
gptmini 4.0.2, 4.0.6
MAL-2026-6537 amazon-inspector

Jun 26, 2026
npm
disksweep 3.0.0, 1.0.0, 2.0.0
MAL-2026-6535 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
@appupdate/cdn-sync 1.0.2, 1.0.3, 1.0.1
MAL-2026-6531 amazon-inspector

Jun 26, 2026
npm
react-dynamic-table-compenent 1.2.7
MAL-2026-6533 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
chai-as-assured 7.1.2, 6.0.4
MAL-2026-6532 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
xrblocks-remote-control 22.0.0
MAL-2026-6530 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
react-dynammic-table-component 1.2.7
MAL-2026-6534 amazon-inspector, ossf-package-analysis, ghsa-malware

Jun 26, 2026
npm
@immobiliarelabs/backstage-plugin-gitlab-backend 6.13.1, 5.2.1, 4.0.2, 3.0.3, 7.0.2
MAL-2026-6527 amazon-inspector

Jun 26, 2026
npm
@immobiliarelabs/backstage-plugin-ldap-auth-backend 3.0.2, 2.0.5, 1.1.3, 5.2.1, 4.3.2
MAL-2026-6529 amazon-inspector

Jun 26, 2026
npm
@immobiliarelabs/backstage-plugin-ldap-auth 3.0.2, 2.0.5, 4.3.2, 5.2.1, 1.1.4
MAL-2026-6528 amazon-inspector

Jun 26, 2026
npm
@immobiliarelabs/backstage-plugin-gitlab 5.2.1, 6.13.1, 3.0.3, 7.0.2, 2.1.2, 4.0.2, 1.0.1
MAL-2026-6526 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
@carvana.authentication-flows/shared 19.2.1
MAL-2026-6521 amazon-inspector

Jun 26, 2026
npm
express-plugin 1.6.6
MAL-2026-6523 amazon-inspector

Jun 26, 2026
npm
ts-einkle 1.0.9, 1.1.2, 1.1.0, 1.1.3
MAL-2026-6524 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
ts-einkle-slot 0.0.8, 0.1.0, 0.0.9, 0.1.1, 0.1.2
MAL-2026-6525 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
@epsteinlovekids483/crossmint-wallets-sdk-pentest 1.0.2-pentest, 1.0.1-pentest, 1.0.0-pentest, 1.0.9-pentest, 1.0.5-pentest, 1.0.…
MAL-2026-6522 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
rollup-plugin-polyfill-connect all versions
MAL-2026-6520 ghsa-malware

Jun 26, 2026
npm
react-icon-svgs all versions
MAL-2026-6519 ghsa-malware

Jun 26, 2026
npm
ai-node-relay 0.0.1, 0.0.2
MAL-2026-6518 ghsa-malware, amazon-inspector

Jun 26, 2026
npm
ai-node-agent 0.0.1, 0.0.3, 0.0.2
MAL-2026-6517 ghsa-malware, amazon-inspector

Jun 26, 2026
npm
dtxto1ols 1.0.2
MAL-2026-6513 ossf-package-analysis, amazon-inspector

Jun 26, 2026
npm
dtxtools 1.0.0, 1.0.1
MAL-2026-6514 ossf-package-analysis, amazon-inspector

Jun 26, 2026