Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,432 npm 223,271 PyPI 12,012 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,271 reports · Feed

npm
element-plus-vite-cli 2.9.3, 2.9.5
MAL-2026-16331 amazon-inspector

Sep 21, 2026
npm
catwrestlingbird 1.0.0
MAL-2026-16327 amazon-inspector

Sep 21, 2026
npm
sorrawit-dev-helper 1.0.0
MAL-2026-16344 amazon-inspector

Sep 21, 2026
npm
catwrestlinghuman 1.0.0
MAL-2026-16328 amazon-inspector

Sep 21, 2026
npm
action-slack-message-root 1.0.1
MAL-2026-16323 amazon-inspector, ghsa-malware

Sep 21, 2026
npm
bulk-add-sdk 1.99.99
MAL-2026-16325 amazon-inspector

Sep 21, 2026
npm
better-envforge 1.0.0
MAL-2026-16324 amazon-inspector, ghsa-malware

Sep 21, 2026
npm
chai-as-viem 1.1.3
MAL-2026-16329 amazon-inspector, ghsa-malware

Sep 21, 2026
npm
byted-commerce-materials 1.0.0
MAL-2026-16326 amazon-inspector

Sep 21, 2026
npm
siriusbeyond 1.0.0
MAL-2026-16343 amazon-inspector

Sep 21, 2026
npm
@siriusbeyond/ui 99.0.0
MAL-2026-16321 amazon-inspector

Sep 21, 2026
npm
@siriusbeyond/utils 99.0.0
MAL-2026-16322 amazon-inspector

Sep 21, 2026
npm
@dbbhk/ui-components 99.0.0
MAL-2026-16319 amazon-inspector

Sep 21, 2026
npm
commerce-materials 1.0.0
MAL-2026-16330 amazon-inspector

Sep 21, 2026
npm
test1sdsd2 99.99.99
MAL-2026-16316 amazon-inspector

Sep 21, 2026
npm
testmgkregme 1.0.1
MAL-2026-16317 amazon-inspector, ghsa-malware

Sep 21, 2026
npm
test12vv36 99.99.99
MAL-2026-16311 amazon-inspector

Sep 21, 2026
npm
test1ro 999.99.99, 99.99.99
MAL-2026-16315 amazon-inspector

Sep 21, 2026
npm
test1df23 99.99.99
MAL-2026-16312 amazon-inspector

Sep 21, 2026
npm
test1hh235 99.99.99
MAL-2026-16314 amazon-inspector

Sep 21, 2026
npm
test1gg234 99.99.99
MAL-2026-16313 amazon-inspector

Sep 21, 2026
npm
npx-test-ma980 1.0.1
MAL-2026-16310 amazon-inspector

Sep 21, 2026
npm
chai-testing 1.1.4
MAL-2026-16307 amazon-inspector

Sep 21, 2026
npm
@baanx/solana-lib 9.9.10, 9.9.9
MAL-2026-16300 amazon-inspector, ghsa-malware

Sep 21, 2026
npm
@nimbusedge2/authxsas 1.1.0
MAL-2026-16303 amazon-inspector

Sep 21, 2026
npm
@nimbusedge2/auth 1.1.1
MAL-2026-16302 amazon-inspector

Sep 21, 2026
npm
@nimbusedge2/authxsas1 1.1.0
MAL-2026-16304 amazon-inspector

Sep 21, 2026
npm
npmscript_tesstalert_unpkg 1.0.2, 1.0.1, 1.1.8, 1.1.7
MAL-2026-16309 amazon-inspector, ghsa-malware

Sep 21, 2026
npm
chat-adapter-matrix 99.99.99
MAL-2026-16308 amazon-inspector

Sep 21, 2026
npm
@nimbusedge2/x 1.1.1
MAL-2026-16305 amazon-inspector

Sep 21, 2026
npm
@nimbusedge2/xa 1.1.0
MAL-2026-16306 amazon-inspector

Sep 21, 2026
npm
@nimbsuedge3/xar 1.1.1
MAL-2026-16301 amazon-inspector

Sep 21, 2026
npm
@pwaplatform/module-sso-integration 99.0.0, 99.0.1
MAL-2026-16299 ossf-package-analysis, amazon-inspector, ghsa-malware

Sep 20, 2026
npm
@siriusbeyond/auth 99.0.0
MAL-2026-16320 amazon-inspector, ossf-package-analysis

Sep 20, 2026
npm
starbucks-sdk 1.0.0
MAL-2026-16345 amazon-inspector, ossf-package-analysis

Sep 20, 2026
npm
radio-player-theme 6.0.0, 2.0.0, 3.0.0, 5.0.0, 4.0.0, 0.0.0-stage, 1.0.0
MAL-2026-16347 amazon-inspector, ghsa-malware 1 IOC

Sep 19, 2026
npm
keroeltop 99.99.99
MAL-2026-16297 ossf-package-analysis, amazon-inspector

Sep 18, 2026
npm
@shared-web/utils 9.9.10
MAL-2026-16292 amazon-inspector

Sep 18, 2026
npm
chai-as-indexed 7.2.8, 6.0.5
MAL-2026-16293 amazon-inspector

Sep 18, 2026
npm
@insiderintelligence/googleadmanager 9.9.10, 9.9.9
MAL-2026-16290 amazon-inspector, ghsa-malware

Sep 18, 2026