Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,168 npm 223,991 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,991 reports · Feed

npm
@welcome-onboarding-web/mobile-focus-account-beta-merging 4.28.7
MAL-2026-5923 amazon-inspector

Jun 16, 2026
npm
binproto 1.0.7, 1.0.5
MAL-2026-5924 amazon-inspector

Jun 16, 2026
npm
motion-lib 2.3.5
MAL-2026-5925 amazon-inspector, ghsa-malware

Jun 16, 2026
npm
js-digest 4.2.2
MAL-2026-5912 amazon-inspector

Jun 16, 2026
npm
pretie_x2 3.8.5, 3.8.6, 3.8.7, 3.8.8, 3.8.9
MAL-2026-5920 amazon-inspector, ghsa-malware

Jun 16, 2026
npm
pretie_x1 3.8.5, 3.8.6, 3.8.8, 3.8.7, 3.8.9
MAL-2026-5919 amazon-inspector, ghsa-malware

Jun 16, 2026
npm
nottuff7 1.7.7, 1.1.7, 2.0.0
MAL-2026-5918 amazon-inspector, ghsa-malware

Jun 16, 2026
npm
nottuff23 1.7.7, 1.1.7, 2.0.0
MAL-2026-5915 amazon-inspector, ghsa-malware

Jun 16, 2026
npm
nottuff25 1.7.7, 1.1.7, 2.0.0
MAL-2026-5916 amazon-inspector, ghsa-malware

Jun 16, 2026
npm
nottuff4 1.7.7, 1.1.7, 2.0.0
MAL-2026-5917 amazon-inspector, ghsa-malware

Jun 16, 2026
npm
nottuff15 1.7.7, 2.0.0, 1.1.7
MAL-2026-5914 amazon-inspector, ghsa-malware

Jun 16, 2026
npm
mastraqqq 1.13.1, 1.13.0
MAL-2026-5913 amazon-inspector, ghsa-malware

Jun 16, 2026
npm
proto-bin 2.3.3, 2.5.3, 2.5.1, 2.5.2
MAL-2026-5921 amazon-inspector

Jun 16, 2026
npm
utils-common-helpers 1.0.0
MAL-2026-5911 amazon-inspector, ghsa-malware

Jun 16, 2026
npm
react-hook-use-debounce-throttle-12 1.0.0, 1.0.2, 1.0.1
MAL-2026-5909 amazon-inspector, ghsa-malware

Jun 16, 2026
npm
chai-plugin-helper 1.7.5, 1.7.3, 1.7.6, 1.7.4
MAL-2026-5905 amazon-inspector

Jun 16, 2026
npm
chain-chai-test 1.3.5
MAL-2026-5908 amazon-inspector, ghsa-malware, reversing-labs

Jun 16, 2026
npm
chai-as-polished 7.0.8
MAL-2026-5901 amazon-inspector, ghsa-malware, reversing-labs

Jun 16, 2026
npm
chai-as-tokenized 7.2.3
MAL-2026-5902 amazon-inspector, ghsa-malware

Jun 16, 2026
npm
chai-guid 1.1.5
MAL-2026-5903 amazon-inspector, reversing-labs

Jun 16, 2026
npm
chai-plugin-kit 5.8.1
MAL-2026-5906 amazon-inspector

Jun 16, 2026
npm
chai-plugin 4.5.3, 4.5.5, 4.5.2, 4.5.4
MAL-2026-5904 amazon-inspector

Jun 16, 2026
npm
chai-solidity-testkit 1.6.1, 1.6.4
MAL-2026-5907 amazon-inspector

Jun 16, 2026
npm
chai-as-decrypted 4.2.8
MAL-2026-5900 amazon-inspector, ghsa-malware

Jun 16, 2026
npm
uidai_reusable_components 0.4.3, 0.4.5, 0.4.2, 0.4.6, 0.4.4
MAL-2026-5910 amazon-inspector, ghsa-malware

Jun 16, 2026
npm
easyllmai 4.0.1, 3.0.1
MAL-2026-5895 amazon-inspector

Jun 16, 2026
npm
caspian-day-js 1.11.23
MAL-2026-5892 amazon-inspector

Jun 16, 2026
npm
strict-engine-peer 22.18.0, 1.0.0
MAL-2026-5898 amazon-inspector

Jun 16, 2026
npm
jest-test-plugin-utils 1.0.0, 1.0.2, 1.0.1, 1.0.4, 1.0.3
MAL-2026-5896 amazon-inspector, ghsa-malware

Jun 16, 2026
npm
noderzero 1.0.1, 1.0.2, 1.0.5, 1.0.3
MAL-2026-5897 amazon-inspector

Jun 16, 2026
npm
create-vercel-integration 1.0.0
MAL-2026-5894 amazon-inspector

Jun 16, 2026
npm
@dsft/ft-utils 1.5.8
MAL-2026-5890 amazon-inspector, ghsa-malware

Jun 16, 2026
npm
@dsft/ft-element 2.5.9
MAL-2026-5889 amazon-inspector, ghsa-malware

Jun 16, 2026
npm
stripe-cli-init-plugin 1.0.0
MAL-2026-5899 amazon-inspector

Jun 16, 2026
npm
conducts all versions
MAL-2026-5887 ghsa-malware

Jun 16, 2026
npm
atlassian-forge-skills 29.1.0
MAL-2026-5891 amazon-inspector, ghsa-malware

Jun 16, 2026
npm
claude-jar 0.2.0
MAL-2026-5893 amazon-inspector

Jun 16, 2026
npm
@vantuz/sdk-core all versions
MAL-2026-5886 ghsa-malware

Jun 16, 2026
npm
middleware-jwt 1.0.0
MAL-2026-5888 ghsa-malware, amazon-inspector

Jun 16, 2026
npm
vortnode 1.2.0
MAL-2026-5884 amazon-inspector, ghsa-malware

Jun 16, 2026