Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,168 npm 223,991 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,991 reports · Feed

npm
ai-chat-helper 1.0.9, 1.0.2, 1.0.1
MAL-2026-6086 amazon-inspector

Jun 17, 2026
npm
@hotcappuccino/nodepull 1.0.0, 1.0.1
MAL-2026-6085 amazon-inspector, ghsa-malware

Jun 17, 2026
npm
@array-util/nodepull 1.1.1, 1.0.0, 1.1.0, 1.0.3, 1.0.4, 1.0.2, 1.0.1, 1.1.3, 1.1.2
MAL-2026-6084 amazon-inspector, ghsa-malware

Jun 17, 2026
npm
pino-slite 4.1.16, 4.1.12
MAL-2026-6078 amazon-inspector, reversing-labs

Jun 17, 2026
npm
set-proto-chain 1.0.3
MAL-2026-6079 amazon-inspector, ghsa-malware

Jun 17, 2026
npm
ebpf-tracker-action 1.0.1
MAL-2026-6077 amazon-inspector

Jun 17, 2026
npm
opt-archetype-check 9.9.1, 9.99.4, 9.9.0
MAL-2026-6075 amazon-inspector, ghsa-malware

Jun 17, 2026
npm
nano-perf 2.2.0, 2.0.1, 2.1.0, 2.0.0, 1.0.1, 1.1.0, 1.0.0
MAL-2026-11204 amazon-inspector, ghsa-malware

Jun 17, 2026
npm
@civitatis/bot-ui 15.12.11, 14.12.11
MAL-2026-6069 amazon-inspector

Jun 17, 2026
npm
libsc-runtime-telemetry 0.1.0
MAL-2026-6070 amazon-inspector

Jun 17, 2026
npm
@mastra/observability 1.14.2
MAL-2026-6073 ghsa-malware, amazon-inspector

Jun 17, 2026
npm
@mastra/loggers 1.1.3
MAL-2026-6072 ghsa-malware, amazon-inspector

Jun 17, 2026
npm
@mastra/redis 1.1.3
MAL-2026-6074 ghsa-malware, amazon-inspector

Jun 17, 2026
npm
n8n-nodes-security-test-poc 1.0.5, 1.0.4, 1.0.1, 1.0.2, 1.0.3
MAL-2026-6071 amazon-inspector

Jun 17, 2026
npm
lab-services 99.0.0
MAL-2026-6065 amazon-inspector

Jun 17, 2026
npm
scan-only 0.4.2, 0.4.3, 0.2.0, 0.4.1, 0.4.0, 0.4.4, 0.3.0, 0.5.0, 0.4.9, 0.4.5, 0.4.8, 0.…
MAL-2026-6067 amazon-inspector, ghsa-malware

Jun 17, 2026
npm
swift-parse-stream 1.0.2, 1.0.0
MAL-2026-6068 amazon-inspector, ghsa-malware

Jun 17, 2026
npm
quirky-token 1.0.2, 1.0.1, 1.0.0
MAL-2026-6066 amazon-inspector, ghsa-malware

Jun 17, 2026
npm
sodel-pych 1.0.121, 1.0.122
MAL-2026-6062 ghsa-malware, amazon-inspector

Jun 17, 2026
npm
sort-btree 2.1.6, 2.2.0
MAL-2026-6063 ghsa-malware, amazon-inspector

Jun 17, 2026
npm
@ignacionunez91/keccak24 all versions
MAL-2026-6058 ghsa-malware

Jun 17, 2026
npm
tailwindcss-animates-css all versions
MAL-2026-6064 ghsa-malware

Jun 17, 2026
npm
qrcode-generator-node all versions
MAL-2026-6061 ghsa-malware

Jun 17, 2026
npm
qrcode-express all versions
MAL-2026-6060 ghsa-malware

Jun 17, 2026
npm
express-validates all versions
MAL-2026-6059 ghsa-malware

Jun 17, 2026
npm
virtualization-compression-collapse 1.0.0, 2.0.0
MAL-2026-6181 2 IOCs

Jun 17, 2026
npm
userinterface-machinelearning 1.0.0
MAL-2026-6180 2 IOCs

Jun 17, 2026
npm
touchid-images 1.0.0
MAL-2026-6179 2 IOCs

Jun 17, 2026
npm
streaming-downloads 1.0.0, 2.0.0
MAL-2026-6178 2 IOCs

Jun 17, 2026
npm
socket-network 1.0.0
MAL-2026-6177 2 IOCs

Jun 17, 2026
npm
request-tracking-sqlite 1.0.0, 2.0.0
MAL-2026-6176 2 IOCs

Jun 17, 2026
npm
request-performance 1.0.0
MAL-2026-6175 2 IOCs

Jun 17, 2026
npm
pushnotifications-gesturerecognition 1.0.0
MAL-2026-6174 2 IOCs

Jun 17, 2026
npm
profiling-keychain 1.0.0
MAL-2026-6173 2 IOCs

Jun 17, 2026
npm
platformspecific-webgl 1.0.0
MAL-2026-6172 2 IOCs

Jun 17, 2026
npm
personal-custom-button 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6
MAL-2026-6171 2 IOCs

Jun 17, 2026
npm
onesignal-hooks 1.0.0, 2.0.0
MAL-2026-6170 2 IOCs

Jun 17, 2026
npm
notificationcenter-enzyme-jest 1.0.0
MAL-2026-6169 2 IOCs

Jun 17, 2026
npm
macos-contentprovider-optimizingassets 1.0.0
MAL-2026-6168 2 IOCs

Jun 17, 2026
npm
lazyloading-haptics 1.0.0, 2.0.0
MAL-2026-6167 2 IOCs

Jun 17, 2026