Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,168 npm 223,991 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,991 reports · Feed

npm
@merceas/cross-fetch 3.1.12
MAL-2026-6510 amazon-inspector

Jun 26, 2026
npm
@merceas/anchor 0.32.1, 0.32.3
MAL-2026-6509 amazon-inspector

Jun 26, 2026
npm
react-context-form-tdsss 9.0.0
MAL-2026-6512 amazon-inspector, ossf-package-analysis, ghsa-malware

Jun 26, 2026
npm
tw-style-utils 0.7.1, 0.7.0
MAL-2026-6508 ghsa-malware, amazon-inspector

Jun 26, 2026
npm
pump-stream-logger 1.0.0
MAL-2026-6507 ghsa-malware, amazon-inspector

Jun 26, 2026
npm
pump-laserstream-parser 2.0.0
MAL-2026-6506 ghsa-malware, amazon-inspector

Jun 26, 2026
npm
pino-zod 1.0.122, 1.0.121
MAL-2026-6505 ghsa-malware, amazon-inspector

Jun 26, 2026
npm
hydanlabs 1.3.2, 1.0.2, 1.3.0, 1.0.3
MAL-2026-6511 amazon-inspector

Jun 26, 2026
npm
js-price-client-node 1.0.0
MAL-2026-6503 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
js-client-node 1.4.0
MAL-2026-6502 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
dttfdsdee 1.0.1, 1.0.3, 1.0.4, 1.0.0, 1.0.2, 1.0.5, 1.0.6
MAL-2026-6498 ossf-package-analysis, amazon-inspector

Jun 26, 2026
npm
chai-as-synced 6.0.3, 7.0.9
MAL-2026-6497 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
set-cookie-ease 1.1.5
MAL-2026-6500 amazon-inspector

Jun 26, 2026
npm
mongoose-json-format 3.0.1, 3.0.0
MAL-2026-6499 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
@dervix/ws 8.21.4, 8.21.3, 8.21.7, 8.21.0, 8.21.1, 8.21.5
MAL-2026-6496 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
wellnpm 3.0.1, 2.0.11, 2.0.10, 3.0.2, 2.0.9, 3.0.0
MAL-2026-6501 ghsa-malware, amazon-inspector

Jun 26, 2026
npm
animatecss-postcss-plugin 1.0.1, 1.0.0
MAL-2026-6495 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
@help-forms/application-aff 3.4.3
MAL-2026-6494 amazon-inspector

Jun 26, 2026
npm
data-parser-utils 3.0.2
MAL-2026-6490 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
prism-silq 1.0.1
MAL-2026-6493 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
hexo-shoka-swiper 0.1.10
MAL-2026-6492 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
hexo-deployer-wrangler 1.0.4
MAL-2026-6491 amazon-inspector, ghsa-malware

Jun 26, 2026
npm
random-string-64 1.0.0, 1.0.1
MAL-2026-6484 amazon-inspector, ghsa-malware

Jun 25, 2026
npm
kelly-stake 3.5.6, 3.5.2, 3.5.4, 3.5.5, 3.5.3, 4.1.0, 3.3.0, 3.2.0, 3.1.0
MAL-2026-6482 amazon-inspector, ghsa-malware

Jun 25, 2026
npm
gx-npm-lib 99.99.99
MAL-2026-6480 amazon-inspector, ghsa-malware

Jun 25, 2026
npm
gx-npm-ui 99.99.99
MAL-2026-6481 amazon-inspector, ghsa-malware

Jun 25, 2026
npm
velocityfix 1.0.0, 1.0.4, 1.0.1, 1.0.3, 1.0.2
MAL-2026-6487 amazon-inspector, ghsa-malware

Jun 25, 2026
npm
log-update-ts 0.1.0
MAL-2026-6483 amazon-inspector, ghsa-malware

Jun 25, 2026
npm
@salem_jalal/osc-components 1981.17.7
MAL-2026-6479 amazon-inspector

Jun 25, 2026
npm
unsafe-malicious-package 1.0.2, 1.0.6, 1.0.8, 1.0.9, 1.0.4, 1.0.0, 2.0.0, 2.0.1
MAL-2026-6486 amazon-inspector, ghsa-malware

Jun 25, 2026
npm
starship-timeline 1.0.1, 1.0.2
MAL-2026-6485 amazon-inspector, ghsa-malware

Jun 25, 2026
npm
runtimekit 1.0.5, 1.0.1, 1.0.3, 1.1.0, 1.0.2
MAL-2026-6477 amazon-inspector, ghsa-malware

Jun 25, 2026
npm
ref-slot 1.0.9
MAL-2026-6474 amazon-inspector, ghsa-malware

Jun 25, 2026
npm
typedecode 1.0.3, 1.0.2, 1.0.1
MAL-2026-6476 amazon-inspector, ghsa-malware

Jun 25, 2026
npm
textshape-css 1.0.0
MAL-2026-6475 amazon-inspector, ghsa-malware

Jun 25, 2026
npm
colorpicker-ui 1.2.4, 1.2.5, 1.2.6
MAL-2026-6473 amazon-inspector

Jun 25, 2026
npm
tailwind-color-shades 1.0.2
MAL-2026-6471 amazon-inspector

Jun 25, 2026
npm
tailwindcss-effector 1.7.0
MAL-2026-6472 amazon-inspector, ghsa-malware

Jun 25, 2026
npm
chlklib 1.2.3, 1.2.2, 1.2.0, 1.2.1
MAL-2026-6470 amazon-inspector, ghsa-malware

Jun 25, 2026
npm
ts-precision 3.7.2
MAL-2026-6469 amazon-inspector, ghsa-malware

Jun 25, 2026