Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,168 npm 223,991 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,991 reports · Feed

npm
@onum-releases/utils 1.0.1, 1.0.2
MAL-2026-6127 amazon-inspector

Jun 18, 2026
npm
@onum-releases/shared-components 1.0.1, 1.0.3, 1.0.2
MAL-2026-6126 amazon-inspector

Jun 18, 2026
npm
@onum-releases/ixel 1.0.2, 1.0.3, 1.0.1
MAL-2026-6124 amazon-inspector

Jun 18, 2026
npm
@onum-releases/sdk 1.0.2, 1.0.1, 1.0.3
MAL-2026-6125 amazon-inspector

Jun 18, 2026
npm
@onum-releases/auth 1.0.3, 1.0.1, 1.0.2
MAL-2026-6123 amazon-inspector

Jun 18, 2026
npm
@onum-releases/api-client 1.0.1, 1.0.3, 1.0.2
MAL-2026-6122 amazon-inspector

Jun 18, 2026
npm
@caspianph/storyteller 1.1.13
MAL-2026-6120 amazon-inspector

Jun 18, 2026
npm
computerrock-babel-preset-react-app 15.12.11
MAL-2026-6131 amazon-inspector

Jun 18, 2026
npm
metavu 99.21.1-1.21.127, 99.21.1-1.21.199
MAL-2026-6132 amazon-inspector

Jun 18, 2026
npm
parket-helper 0.0.1, 5.8.1
MAL-2026-6119 ghsa-malware, amazon-inspector

Jun 18, 2026
npm
@rafaelsene01/agent-flow 1.2.1, 1.9.0, 1.0.4, 1.4.0, 1.3.0, 1.0.3, 1.7.0, 1.2.3, 1.5.0, 1.2.2, 1.5.1, 1.…
MAL-2026-6111 ghsa-malware, amazon-inspector

Jun 18, 2026
npm
stackus 1.0.6
MAL-2026-6098 amazon-inspector, ghsa-malware

Jun 18, 2026
npm
jwtmode 1.0.4
MAL-2026-6093 amazon-inspector

Jun 18, 2026
npm
requests-middleware 1.0.2
MAL-2026-6096 amazon-inspector, reversing-labs

Jun 18, 2026
npm
roblox-api-client 1.0.0
MAL-2026-6097 amazon-inspector, ghsa-malware

Jun 18, 2026
npm
intquery 1.1.5, 1.1.4
MAL-2026-6113 ghsa-malware, amazon-inspector

Jun 18, 2026
npm
oem-agentic-shared 99.9.1
MAL-2026-6095 amazon-inspector, ghsa-malware

Jun 18, 2026
npm
datacamp-light 1.0.0
MAL-2026-6091 amazon-inspector, ghsa-malware

Jun 18, 2026
npm
data-utils-bcf2 1.0.0
MAL-2026-6090 amazon-inspector

Jun 18, 2026
npm
stream-read-35cf 1.0.0
MAL-2026-6099 amazon-inspector

Jun 18, 2026
npm
metrics-probe-88ad all versions
MAL-2026-6114 ghsa-malware

Jun 18, 2026
npm
data-utils-d703 1.0.0
MAL-2026-6112 ghsa-malware, amazon-inspector

Jun 18, 2026
npm
type-check-816d 1.0.0
MAL-2026-6101 amazon-inspector, ghsa-malware

Jun 18, 2026
npm
string-tools-be6c 1.0.0
MAL-2026-6100 amazon-inspector, ghsa-malware

Jun 18, 2026
npm
metrics-probe-f256 1.0.0
MAL-2026-6094 amazon-inspector, ghsa-malware

Jun 18, 2026
npm
fmt-helpers-794b 1.0.0
MAL-2026-6092 amazon-inspector, ghsa-malware

Jun 18, 2026
npm
color-utils-dee0 1.0.0
MAL-2026-6089 amazon-inspector, ghsa-malware

Jun 18, 2026
npm
npm-sandbox-research-f1g2 all versions
MAL-2026-6116 ghsa-malware

Jun 18, 2026
npm
npm-sandbox-research-a1b2 all versions
MAL-2026-6115 ghsa-malware

Jun 18, 2026
npm
@ncurran/sandbox-recon-uac-4e7c all versions
MAL-2026-6110 ghsa-malware

Jun 18, 2026
npm
@ncurran/sandbox-recon-sys-6a3f all versions
MAL-2026-6109 ghsa-malware

Jun 18, 2026
npm
@ncurran/sandbox-recon-sys-5f1b all versions
MAL-2026-6108 ghsa-malware

Jun 18, 2026
npm
@ncurran/sandbox-recon-sys-5b2c all versions
MAL-2026-6107 ghsa-malware

Jun 18, 2026
npm
@ncurran/sandbox-recon-9b2d4f all versions
MAL-2026-6106 ghsa-malware

Jun 18, 2026
npm
@ncurran/sandbox-recon-880538 all versions
MAL-2026-6105 ghsa-malware

Jun 18, 2026
npm
@ncurran/sandbox-recon-7c4e1a all versions
MAL-2026-6104 ghsa-malware

Jun 18, 2026
npm
@ncurran/dc-selftest-ba0ad4 all versions
MAL-2026-6103 ghsa-malware

Jun 18, 2026
npm
@ncurran/dc-selftest-33afb7 all versions
MAL-2026-6102 ghsa-malware

Jun 18, 2026
npm
vite-common-utils 1.0.5, 1.0.4, 1.0.3, 1.0.0, 1.0.1, 1.0.2
MAL-2026-6088 amazon-inspector, ghsa-malware

Jun 17, 2026
npm
uol-simple-api-futebol 4.6.3, 4.6.4, 4.7.0, 4.8.1, 4.8.0, 4.9.0
MAL-2026-6087 amazon-inspector

Jun 17, 2026