Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,432 npm 223,271 PyPI 12,012 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,271 reports · Feed

npm
node-env-buffer 2.2.2, 2.2.3
MAL-2026-16403 ghsa-malware, amazon-inspector

Sep 22, 2026
npm
envparse3 1.0.1
MAL-2026-16395 ghsa-malware, amazon-inspector

Sep 22, 2026
npm
envparse2 1.0.1
MAL-2026-16394 ghsa-malware, amazon-inspector

Sep 22, 2026
npm
envforge3 1.0.1
MAL-2026-16393 ghsa-malware, amazon-inspector

Sep 22, 2026
npm
envforge2 1.0.1
MAL-2026-16392 ghsa-malware, amazon-inspector

Sep 22, 2026
npm
sysverify 1.0.9, 2.0.10, 2.0.9
MAL-2026-16404 ghsa-malware, amazon-inspector

Sep 22, 2026
npm
ndmcmsujey 1.0.0
MAL-2026-16402 ghsa-malware, amazon-inspector

Sep 22, 2026
npm
ndmckauxuoincv 1.0.0
MAL-2026-16401 ghsa-malware, amazon-inspector

Sep 22, 2026
npm
ndmcjcxiebysfdb 1.0.2, 1.0.0, 1.0.1
MAL-2026-16400 ghsa-malware, amazon-inspector

Sep 22, 2026
npm
cloudndmcedu 1.0.0
MAL-2026-16391 ghsa-malware, amazon-inspector

Sep 22, 2026
npm
lufxchwmxwyps 1.0.1, 1.0.0
MAL-2026-16399 ghsa-malware, amazon-inspector

Sep 22, 2026
npm
luftmvfiwgxydes 1.0.3, 1.0.4, 1.0.5, 1.0.1, 1.0.2, 1.0.0
MAL-2026-16398 ghsa-malware, amazon-inspector

Sep 22, 2026
npm
kambxjowhdsgyw 1.0.1, 1.0.2, 1.0.0
MAL-2026-16397 ghsa-malware, amazon-inspector

Sep 22, 2026
npm
fdhcxvnwhjiofv 1.0.0
MAL-2026-16396 ghsa-malware, amazon-inspector

Sep 22, 2026
npm
oracle-redis 5.11.3
MAL-2026-16390 amazon-inspector, ghsa-malware

Sep 22, 2026
npm
noverojava 1.1.0, 1.0.9
MAL-2026-16389 amazon-inspector

Sep 22, 2026
npm
nodetokyo 1.0.8
MAL-2026-16388 amazon-inspector

Sep 22, 2026
npm
zeal-utils 0.0.0
MAL-2026-16542 reversing-labs, amazon-inspector

Sep 22, 2026
npm
zeal-util-hooks 0.0.0
MAL-2026-16541 reversing-labs, amazon-inspector

Sep 22, 2026
npm
style-class-utils 1.0.0
MAL-2026-16540 reversing-labs

Sep 22, 2026
npm
speaker_tagging_media_player 9999.0.0
MAL-2026-16539 reversing-labs

Sep 22, 2026
npm
spark-rpc 1.0.0
MAL-2026-16538 reversing-labs

Sep 22, 2026
npm
spark-common 1.0.0
MAL-2026-16537 reversing-labs

Sep 22, 2026
npm
mx-www-locales-common 99.0.0
MAL-2026-16536 reversing-labs

Sep 22, 2026
npm
mercuriusdream-oidc-replay-probe 1.0.0
MAL-2026-16535 reversing-labs

Sep 22, 2026
npm
eslint-config-compact-utils 1.0.2, 1.0.0
MAL-2026-16417 amazon-inspector, ossf-package-analysis

Sep 22, 2026
npm
halali-sample 999.9.14
MAL-2026-16534 reversing-labs

Sep 22, 2026
npm
exodus-firestore-synchronize 0.0.1
MAL-2026-16533 reversing-labs, amazon-inspector

Sep 22, 2026
npm
@yuva2210/poc-depconf 1.0.0, 1.0.1
MAL-2026-16532 reversing-labs

Sep 22, 2026
npm
@yuva2210/okx-poc-preinstall 1.0.0, 1.0.1
MAL-2026-16531 reversing-labs

Sep 22, 2026
npm
@ssgw/background-transition 9.999.999
MAL-2026-16530 reversing-labs

Sep 22, 2026
npm
@larocas-bbresearch/tp-probe-e29834ce 1.0.0, 1.0.1
MAL-2026-16529 reversing-labs, amazon-inspector

Sep 22, 2026
npm
@larocas-bbresearch/tp-probe-dc7a3670 1.0.0
MAL-2026-16528 reversing-labs

Sep 22, 2026
npm
@larocas-bbresearch/tombstone-probe-odvz5y 0.0.1
MAL-2026-16527 reversing-labs, amazon-inspector

Sep 22, 2026
npm
@larocas-bbresearch/tombstone-probe-live-z6xz56 0.0.1
MAL-2026-16526 reversing-labs, amazon-inspector

Sep 22, 2026
npm
@larocas-bbresearch/tombstone-probe-8ejnsa 0.0.1
MAL-2026-16525 reversing-labs, amazon-inspector

Sep 22, 2026
npm
@ks-cqc/h5-sig4 2.99.99
MAL-2026-16524 reversing-labs

Sep 22, 2026
npm
@ks-cqc/fingerprint-generator 1.99.99
MAL-2026-16523 reversing-labs

Sep 22, 2026
npm
@egencia/uitk-react-text 99.9.9
MAL-2026-16522 reversing-labs

Sep 22, 2026
npm
@egencia/uitk-react-spacing 99.99.9
MAL-2026-16521 reversing-labs

Sep 22, 2026