Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,432 npm 223,271 PyPI 12,012 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,271 reports · Feed

npm
simple-date-formatter-new-14 1.0.0
MAL-2026-17160 amazon-inspector

Sep 24, 2026
npm
simple-date-formatter-new-13 1.0.0
MAL-2026-17159 amazon-inspector

Sep 24, 2026
npm
aliftech-ui 99.9.9
MAL-2026-17156 amazon-inspector

Sep 24, 2026
npm
@osl-design/react 9.9.10
MAL-2026-17155 amazon-inspector

Sep 24, 2026
npm
simple-date-formatter-new-15 1.0.0
MAL-2026-17161 amazon-inspector

Sep 24, 2026
npm
simple-date-formatter-new-11 1.0.0
MAL-2026-17158 amazon-inspector

Sep 24, 2026
npm
@nf-addons/am-global-header 9.9.10
MAL-2026-17154 amazon-inspector

Sep 24, 2026
npm
@birbalo/aliftech-ui 99.9.9
MAL-2026-17153 amazon-inspector

Sep 24, 2026
npm
@baanx/domain 9.9.9
MAL-2026-16486 ghsa-malware, amazon-inspector

Sep 24, 2026
npm
@baanx/common 9.9.9
MAL-2026-16485 ghsa-malware, amazon-inspector

Sep 24, 2026
npm
@rixxcodex/baileys 8.1.0, 8.2.0, 8.0.16, 8.0.15, 9.0.3, 9.0.0, 9.0.1
MAL-2026-16483 amazon-inspector 2 IOCs

Sep 23, 2026
npm
pino-testkit 10.4.5
MAL-2026-16484 amazon-inspector, ghsa-malware

Sep 23, 2026
npm
internallib_v657 1.0.1
MAL-2026-16482 amazon-inspector

Sep 23, 2026
npm
internallib_v463 1.0.2
MAL-2026-16481 amazon-inspector

Sep 23, 2026
npm
a-onesite 99.9.9
MAL-2026-16480 amazon-inspector

Sep 23, 2026
npm
event-hunter 1.0.0
MAL-2026-16478 amazon-inspector

Sep 23, 2026
npm
simplenewnpmpackage 1.0.2
MAL-2026-16479 amazon-inspector

Sep 23, 2026
npm
com.apple.unityplugin.storekit 1.0.2, 1.0.1
MAL-2026-16477 amazon-inspector, ghsa-malware

Sep 23, 2026
npm
sea-baileys 1.0.2
MAL-2026-16473 amazon-inspector

Sep 23, 2026
npm
vite-dev-launcher 2.9.4
MAL-2026-16474 amazon-inspector

Sep 23, 2026
npm
@test1230504/string-format-helper all versions
MAL-2026-16468 ghsa-malware

Sep 23, 2026
npm
@test1230504/probe-7f3k2m-utils all versions
MAL-2026-16467 ghsa-malware

Sep 23, 2026
npm
@test1230504/test-publish-verify all versions
MAL-2026-16469 ghsa-malware

Sep 23, 2026
npm
z-deno-truth-ya1t4m 1.0.0
MAL-2026-16472 ghsa-malware, amazon-inspector

Sep 23, 2026
npm
z-deno-truth-va499w 1.0.0
MAL-2026-16471 ghsa-malware, amazon-inspector

Sep 23, 2026
npm
z-deno-truth-bwhlsz 2.0.0, 1.0.0
MAL-2026-16470 ghsa-malware, amazon-inspector

Sep 23, 2026
npm
hachutis 1.0.6, 1.0.0
MAL-2026-16464 amazon-inspector

Sep 23, 2026
npm
helpersutils-dev-tools 1.0.11
MAL-2026-16465 amazon-inspector, ghsa-malware

Sep 23, 2026
npm
godxxx 1.0.0
MAL-2026-16461 amazon-inspector

Sep 23, 2026
npm
godzz 1.0.0
MAL-2026-16462 amazon-inspector

Sep 23, 2026
npm
godzzz 1.0.0
MAL-2026-16463 amazon-inspector

Sep 23, 2026
npm
some-tool-package 99.0.0
MAL-2026-16455 ghsa-malware, amazon-inspector

Sep 23, 2026
npm
better-md 99.0.0
MAL-2026-16446 ghsa-malware, amazon-inspector

Sep 23, 2026
npm
webp-https-errors all versions
MAL-2026-16459 ghsa-malware

Sep 23, 2026
npm
solo-async-pipe all versions
MAL-2026-16454 ghsa-malware

Sep 23, 2026
npm
semver-bump-io all versions
MAL-2026-16453 ghsa-malware

Sep 23, 2026
npm
iso-datetime-core all versions
MAL-2026-16449 ghsa-malware

Sep 23, 2026
npm
debounce-throttle-base all versions
MAL-2026-16448 ghsa-malware

Sep 23, 2026
npm
moudeva 1.0.0
MAL-2026-16442 amazon-inspector

Sep 23, 2026
npm
moidevl 1.0.0
MAL-2026-16441 amazon-inspector

Sep 23, 2026