Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,408 npm 223,266 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

223,266 reports · Feed

npm
pxnpm 7.0.0-beta.6, 7.0.0-beta.8, 7.0.0, 7.0.1, 7.0.2
MAL-2026-17710 amazon-inspector 5 IOCs

Oct 9, 2026
npm
wix-reg-poc-bypass 1.0.0
MAL-2026-17711 amazon-inspector

Oct 9, 2026
npm
@galicia-toolkit-nestjs-20-lite/paas 1.0.20, 1.0.24, 1.0.21, 1.0.22
MAL-2026-17730 amazon-inspector 2 IOCs

Oct 9, 2026
npm
@galicia-toolkit-nestjs-20-lite/commons 999.0.2, 999.0.3, 999.0.1
MAL-2026-17729 amazon-inspector 2 IOCs

Oct 9, 2026
npm
@galicia-toolkit-nestjs-20-lite/archetype 999.0.5, 999.0.2, 999.0.1, 999.0.3
MAL-2026-17728 amazon-inspector 2 IOCs

Oct 9, 2026
npm
@galicia-toolkit-nestjs-20/paas 3.0.3, 3.0.5, 3.0.7, 3.0.6, 999.0.1
MAL-2026-17727 amazon-inspector 2 IOCs

Oct 9, 2026
npm
@galicia-toolkit-nestjs-20/commons 999.0.2, 999.0.3, 999.0.1
MAL-2026-17726 amazon-inspector 2 IOCs

Oct 9, 2026
npm
@galicia-toolkit-nestjs-20/archetype 999.0.2, 999.0.1
MAL-2026-17725 amazon-inspector 2 IOCs

Oct 9, 2026
npm
@galicia-toolkit-nestjs/swagger 999.0.3, 999.0.2, 999.0.1
MAL-2026-17724 amazon-inspector 2 IOCs

Oct 9, 2026
npm
@galicia-toolkit-nestjs/paas 999.0.4, 999.0.3, 999.0.5, 999.0.6
MAL-2026-17723 amazon-inspector 2 IOCs

Oct 9, 2026
npm
@galicia-toolkit-nestjs/commons 999.0.7, 999.0.1, 999.0.8, 999.0.6, 3.0.1
MAL-2026-17722 amazon-inspector 2 IOCs

Oct 9, 2026
npm
@galicia-toolkit-nestjs/archetype 999.0.6, 999.0.5, 999.0.1
MAL-2026-17721 amazon-inspector 2 IOCs

Oct 9, 2026
npm
@galicia-toolkit-cheques-nc/front 999.0.1, 999.0.3, 999.0.2
MAL-2026-17720 amazon-inspector 2 IOCs

Oct 9, 2026
npm
@brick-v2/tour 999.0.1, 999.0.3, 999.0.2
MAL-2026-17719 amazon-inspector 2 IOCs

Oct 9, 2026
npm
@brick-v2/table 999.0.3, 999.0.2, 999.0.1
MAL-2026-17718 amazon-inspector 2 IOCs

Oct 9, 2026
npm
@brick-v2/icons 999.0.1, 999.0.3, 999.0.2
MAL-2026-17717 amazon-inspector 2 IOCs

Oct 9, 2026
npm
@brick-v2/form 999.0.1, 999.0.3
MAL-2026-17716 amazon-inspector 2 IOCs

Oct 9, 2026
npm
@brick-v2/core 999.0.2, 999.0.1
MAL-2026-17715 amazon-inspector 2 IOCs

Oct 9, 2026
npm
@brick-v2/brand 999.0.1, 999.0.3, 999.0.2
MAL-2026-17714 amazon-inspector 2 IOCs

Oct 9, 2026
npm
revine 2.4.0
MAL-2026-17709 ghsa-malware

Oct 8, 2026
npm
testrrrd 1.0.0, 0.0.1, 3.0.0, 99.0.1, 2.0.1, 1.1.0, 2.0.0
MAL-2026-17706 amazon-inspector

Oct 8, 2026
npm
@wxwxtest/testrrrdd 2.0.1, 2.0.0, 0.0.1, 3.0.0, 0.1.0, 1.0.0, 1.0.1
MAL-2026-17704 amazon-inspector

Oct 8, 2026
npm
wie888r 1.0.0, 99.0.1, 1.1.0, 0.0.1, 2.0.0, 3.0.0, 2.0.1, 1.0.1
MAL-2026-17707 amazon-inspector

Oct 8, 2026
npm
xblaxw 2.0.0, 1.0.1, 99.0.1, 1.0.0, 2.0.1, 3.0.0, 1.1.0
MAL-2026-17708 amazon-inspector

Oct 8, 2026
npm
css-overscroll-contain 1.0.1, 1.0.2, 1.0.3, 1.0.0
MAL-2026-17705 amazon-inspector, ghsa-malware

Oct 8, 2026
npm
@kxafunc/xbails 0.0.8
MAL-2026-17701 amazon-inspector

Oct 8, 2026
npm
@bitwardne/jslib 1.1.0
MAL-2026-17694 amazon-inspector

Oct 8, 2026
npm
@bitwardne/cli 1.0.1
MAL-2026-17693 amazon-inspector

Oct 8, 2026
npm
clickfix_npm_delivery 1.0.2, 1.0.0
MAL-2026-17692 ghsa-malware, amazon-inspector

Oct 8, 2026
npm
@galicia-toolkit/core all versions
MAL-2026-17688 ghsa-malware

Oct 8, 2026
npm
tailwindcss-ui-extensions all versions
MAL-2026-17687 ghsa-malware

Oct 8, 2026
npm
tailwindcss-effects-kit all versions
MAL-2026-17686 ghsa-malware

Oct 8, 2026
npm
@galicia-toolkit/error-master 999.0.3
MAL-2026-17689 ghsa-malware, amazon-inspector 4 IOCs

Oct 8, 2026
npm
@galicia-toolkit/tag-manager 999.0.6, 999.0.3, 999.0.5
MAL-2026-17691 ghsa-malware, amazon-inspector 5 IOCs

Oct 8, 2026
npm
@galicia-toolkit/spa-build-config 999.0.3, 999.0.5, 999.0.6
MAL-2026-17690 ghsa-malware, amazon-inspector 6 IOCs

Oct 8, 2026
npm
system-driver all versions
MAL-2026-17685 ghsa-malware

Oct 8, 2026
npm
node-gyp-runtime all versions
MAL-2026-17684 ghsa-malware

Oct 8, 2026
npm
node-fetch-lite all versions
MAL-2026-17683 ghsa-malware

Oct 8, 2026
npm
connector-agent all versions
MAL-2026-17682 ghsa-malware

Oct 8, 2026
npm
node-env-resolve 1.2.3
MAL-2026-17681 amazon-inspector, ghsa-malware

Oct 8, 2026