Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,168 npm 223,991 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,991 reports · Feed

npm
new-ts-helper 9.0.2
MAL-2026-6227 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
chai-as-forgeted 9.24.6
MAL-2026-6219 amazon-inspector

Jun 19, 2026
npm
ts-esys 0.0.5
MAL-2026-6205 ghsa-malware, amazon-inspector

Jun 19, 2026
npm
ts-ecro-helper 0.0.1
MAL-2026-6204 ghsa-malware, amazon-inspector

Jun 19, 2026
npm
mongoose-jsonify all versions
MAL-2026-6203 ghsa-malware

Jun 19, 2026
npm
eth-util 7.1.5
MAL-2026-6201 ghsa-malware, amazon-inspector

Jun 19, 2026
npm
assert-kit 4.3.2
MAL-2026-6200 ghsa-malware, amazon-inspector

Jun 19, 2026
npm
ethereum-gas-reporter 0.2.27
MAL-2026-6202 ghsa-malware, amazon-inspector

Jun 19, 2026
npm
build-tracker-n5p1 1.0.0
MAL-2026-6196 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
ts-big-ecro 0.1.0, 3.8.1
MAL-2026-6199 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
new-ecro-1 0.3.9, 0.1.9, 0.2.9
MAL-2026-6198 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
new-ecro 0.0.7, 0.0.6, 0.0.9
MAL-2026-6197 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
node-slot 1.0.7, 1.0.9, 1.0.8
MAL-2026-6191 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
ordered-btree 3.2.2
MAL-2026-6193 amazon-inspector

Jun 19, 2026
npm
@mep-exp/api-tools 2.0.3, 0.0.1
MAL-2026-6183 amazon-inspector, ghsa-malware, reversing-labs

Jun 19, 2026
npm
@qlab/component-intelligence 2.0.6
MAL-2026-6184 amazon-inspector

Jun 19, 2026
npm
nodepathbalance54 1.1.0
MAL-2026-6192 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
conversa-sdk 2.0.2, 1.0.9, 2.0.4, 2.0.3, 2.0.0, 1.0.8, 1.0.6, 1.0.5, 1.0.4, 1.0.0
MAL-2026-6185 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
electron-internal-utils 1.0.0
MAL-2026-6186 amazon-inspector, reversing-labs

Jun 19, 2026
npm
eyee 1.0.0
MAL-2026-6189 amazon-inspector

Jun 19, 2026
npm
portloop 1.6.0, 1.14.0
MAL-2026-6194 amazon-inspector

Jun 19, 2026
npm
ts-linter-builders 1.0.4
MAL-2026-6195 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
eslint-helper-1 5.0.4
MAL-2026-6188 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
mjs-eslint-helper 4.0.1
MAL-2026-6190 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
eslint-helper 4.0.1, 4.0.2
MAL-2026-6187 amazon-inspector, ghsa-malware

Jun 19, 2026
npm
node-vfs-polyfill 2.0.5, 2.0.7
MAL-2026-6143 amazon-inspector, ghsa-malware

Jun 18, 2026
npm
db-connector-log 1.0.0, 1.0.1
MAL-2026-6142 amazon-inspector, ghsa-malware

Jun 18, 2026
npm
runtime-query 1.6.6
MAL-2026-6144 amazon-inspector, ghsa-malware

Jun 18, 2026
npm
clx-cookie-signature 1.2.1
MAL-2026-6141 amazon-inspector, ghsa-malware, reversing-labs

Jun 18, 2026
npm
@httpactions/strict-uri-encode 1.0.1
MAL-2026-6140 amazon-inspector

Jun 18, 2026
npm
@httpactions/encode-url 1.0.0, 1.0.1
MAL-2026-6139 amazon-inspector

Jun 18, 2026
npm
@gbrlxvi/ts-project-lint 1.1.0
MAL-2026-6121 amazon-inspector, ghsa-malware

Jun 18, 2026
npm
react-error-lint 1.1.6
MAL-2026-6137 amazon-inspector

Jun 18, 2026
npm
ratelimitsucks 1.7.7, 1.1.7, 2.0.0, 1.1.2
MAL-2026-6135 amazon-inspector, ghsa-malware, reversing-labs

Jun 18, 2026
npm
ratelimitsucks6 1.1.7, 2.0.0, 1.7.7
MAL-2026-6136 amazon-inspector, ghsa-malware

Jun 18, 2026
npm
abuden221 1.7.7, 1.1.7, 2.0.0
MAL-2026-6130 amazon-inspector, ghsa-malware

Jun 18, 2026
npm
abuden22 1.7.7, 2.0.0, 1.1.7
MAL-2026-6129 amazon-inspector, ghsa-malware

Jun 18, 2026
npm
abuden218 1.7.7, 1.1.7, 2.0.0
MAL-2026-6128 amazon-inspector, ghsa-malware

Jun 18, 2026
npm
panrouter-admin 5.0.0
MAL-2026-6134 amazon-inspector

Jun 18, 2026
npm
panrouter 5.0.1, 5.0.0
MAL-2026-6133 amazon-inspector

Jun 18, 2026