Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,168 npm 223,991 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,991 reports · Feed

npm
@dexwilt/node-fetch 2.7.3
MAL-2026-11203 amazon-inspector

Jun 22, 2026
npm
fork-angular-daterangepicker 11.0.0, 9.0.0, 10.0.0
MAL-2026-6255 ossf-package-analysis, amazon-inspector

Jun 21, 2026
npm
hyperpure-core 1.0.0
MAL-2026-6250 ossf-package-analysis, amazon-inspector

Jun 21, 2026
npm
blinkit-core 1.0.0
MAL-2026-6249 ossf-package-analysis, amazon-inspector

Jun 21, 2026
npm
zomato-sushi 1.0.0
MAL-2026-6254 ossf-package-analysis, amazon-inspector

Jun 21, 2026
npm
zomato-logger 1.0.0
MAL-2026-6252 ossf-package-analysis, amazon-inspector

Jun 21, 2026
npm
zomato-server 1.0.0
MAL-2026-6253 ossf-package-analysis, amazon-inspector

Jun 21, 2026
npm
zomato-config 1.0.0
MAL-2026-6251 ossf-package-analysis, amazon-inspector

Jun 21, 2026
npm
sf-storybook 1.0.0
MAL-2026-6261 ossf-package-analysis, amazon-inspector

Jun 20, 2026
npm
free-anthropic-claude 5.0.0, 5.0.4, 5.1.5, 5.2.0, 5.0.6, 5.0.3, 5.1.3, 4.7.9, 5.1.2, 5.0.7, 5.0.8, 5.…
MAL-2026-6260 ossf-package-analysis, amazon-inspector, ghsa-malware

Jun 20, 2026
npm
atlasora-config 1.0.0
MAL-2026-6239 amazon-inspector

Jun 20, 2026
npm
atlasora-shared 1.0.0
MAL-2026-6241 amazon-inspector

Jun 20, 2026
npm
atlasora-api 1.0.0
MAL-2026-6237 amazon-inspector

Jun 20, 2026
npm
atlasora-types 1.0.0
MAL-2026-6242 amazon-inspector

Jun 20, 2026
npm
atlasora-utils 1.0.0
MAL-2026-6243 amazon-inspector

Jun 20, 2026
npm
atlasora-sdk 1.0.0
MAL-2026-6240 amazon-inspector

Jun 20, 2026
npm
atlasora-client 1.0.0
MAL-2026-6238 amazon-inspector

Jun 20, 2026
npm
@withgoogle/stitch-sdk 0.1.5, 0.1.4, 0.1.1, 0.1.3, 0.1.2
MAL-2026-6256 amazon-inspector, ghsa-malware

Jun 20, 2026
npm
yian666aikf 1.0.3
MAL-2026-6234 amazon-inspector

Jun 20, 2026
npm
yianzzkf6687 1.0.3
MAL-2026-6235 amazon-inspector

Jun 20, 2026
npm
free-claude 1.1.0, 1.0.0, 1.0.1
MAL-2026-6232 ossf-package-analysis, ghsa-malware, amazon-inspector

Jun 19, 2026
npm
base_parts_ai 1.0.52, 1.0.50
MAL-2026-6228 amazon-inspector

Jun 19, 2026
npm
routecraft 5.0.0, 4.2.0
MAL-2026-6229 amazon-inspector, ghsa-malware, reversing-labs

Jun 19, 2026
npm
aikaf668897 1.0.3
MAL-2026-6216 amazon-inspector

Jun 19, 2026
npm
aikaf6688812 1.0.3
MAL-2026-6215 amazon-inspector

Jun 19, 2026
npm
aikaf788812 1.0.3
MAL-2026-6217 amazon-inspector

Jun 19, 2026
npm
create-mono-package 0.0.0
MAL-2026-6222 amazon-inspector

Jun 19, 2026
npm
@chunklab/hexparse 1.1.7, 1.1.5, 1.1.6, 1.0.7, 1.1.4
MAL-2026-6214 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
@bytemend/mfebus 1.4.3, 1.4.4, 1.4.1, 1.4.5, 1.4.0, 1.4.2
MAL-2026-6213 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
@briskforge/envcheck 0.5.5, 0.5.2, 0.5.4, 0.5.3
MAL-2026-6212 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
@apexcraft/nano-key 1.3.8, 1.3.4, 1.3.6, 1.2.5, 1.3.2, 1.3.5, 1.3.7, 1.2.4, 1.3.3
MAL-2026-6210 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
@apiwizards/auth-middleware 4.7.0, 5.1.2
MAL-2026-6211 amazon-inspector

Jun 19, 2026
npm
@antoncarlos1/nodelamp 1.0.1, 1.0.0
MAL-2026-6209 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
chai-assert-kit 3.8.1
MAL-2026-6221 amazon-inspector

Jun 19, 2026
npm
chai-as-attested 6.0.3
MAL-2026-6218 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
chai-as-uphelded 6.11.4
MAL-2026-6220 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
new-mjs-eslint 7.0.6
MAL-2026-6226 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
mjs-eslint 7.0.5, 7.0.6, 7.0.7
MAL-2026-6223 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
new-eslint-1 7.0.6
MAL-2026-6225 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
new-eslint 7.0.5, 7.0.6
MAL-2026-6224 amazon-inspector, ghsa-malware

Jun 19, 2026