Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,460 npm 223,294 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,294 reports · Feed

npm
plogme 1.0.0, 1.0.1, 1.0.2, 1.0.3
MAL-2026-16199 amazon-inspector 2 IOCs

Sep 8, 2026
npm
@cp-shared-14/frontend-ui 6.3.4
MAL-2026-16015 ossf-package-analysis

Sep 7, 2026
npm
@aircanada/navigation-handler all versions
MAL-2026-16020 ghsa-malware

Sep 7, 2026
npm
@aircanada/core all versions
MAL-2026-16019 ghsa-malware

Sep 7, 2026
npm
@aircanada/components all versions
MAL-2026-16018 ghsa-malware

Sep 7, 2026
npm
service-home 0.0.1
MAL-2026-16039 ghsa-malware, amazon-inspector

Sep 7, 2026
npm
op-ts-server-core 0.0.1
MAL-2026-16034 ghsa-malware, amazon-inspector

Sep 7, 2026
npm
@idkruan-10/dpd-depconf-probe all versions
MAL-2026-16021 ghsa-malware

Sep 7, 2026
npm
redis-type-intel 1.10.5, 1.10.6
MAL-2026-16036 ghsa-malware, amazon-inspector

Sep 7, 2026
npm
oscar-redis 6.1.2, 5.11.2, 5.11.3, 5.11.4, 6.1.1
MAL-2026-16035 ghsa-malware, amazon-inspector

Sep 7, 2026
npm
kiki-baileys 1.0.3, 1.0.1, 1.0.2, 1.0.0
MAL-2026-16033 ghsa-malware, amazon-inspector

Sep 7, 2026
npm
feishu-docx-mcp 0.3.2
MAL-2026-16032 ghsa-malware, amazon-inspector

Sep 7, 2026
npm
bmc-translate-utils 1.1.1
MAL-2026-16026 ghsa-malware, amazon-inspector

Sep 7, 2026
npm
bmc-i18n-extract-cli 1.1.1
MAL-2026-16025 ghsa-malware, amazon-inspector

Sep 7, 2026
npm
blueai-cli 0.7.0
MAL-2026-16024 ghsa-malware, amazon-inspector

Sep 7, 2026
npm
scw-mobile all versions
MAL-2026-16038 ghsa-malware

Sep 7, 2026
npm
base-account-core all versions
MAL-2026-16022 ghsa-malware

Sep 7, 2026
npm
wallet-engine-signing all versions
MAL-2026-16041 ghsa-malware

Sep 7, 2026
npm
wallet-cds-web all versions
MAL-2026-16040 ghsa-malware

Sep 7, 2026
npm
scw-core all versions
MAL-2026-16037 ghsa-malware

Sep 7, 2026
npm
cb-wallet-store all versions
MAL-2026-16031 ghsa-malware

Sep 7, 2026
npm
cb-wallet-solana-provider all versions
MAL-2026-16030 ghsa-malware

Sep 7, 2026
npm
cb-wallet-metadata all versions
MAL-2026-16029 ghsa-malware

Sep 7, 2026
npm
cb-wallet-env all versions
MAL-2026-16028 ghsa-malware

Sep 7, 2026
npm
cb-wallet-analytics all versions
MAL-2026-16027 ghsa-malware

Sep 7, 2026
npm
base-app-data all versions
MAL-2026-16023 ghsa-malware

Sep 7, 2026
npm
omni-channel-configurator-wireline-frontend 9999.0.0, 0.0.1
MAL-2026-16009 amazon-inspector 4 IOCs

Sep 7, 2026
npm
b2b-frontend-external-library 0.0.1, 9999.0.0
MAL-2026-16008 amazon-inspector 4 IOCs

Sep 7, 2026
npm
@caliperx2/components all versions
MAL-2026-16007 4 IOCs

Sep 7, 2026
npm
oce-configurator-wireless-frontend 0.0.1, 9999.0.0
MAL-2026-15940 ossf-package-analysis, amazon-inspector

Sep 6, 2026
npm
omni-channel-order-frontend 0.0.1, 9999.0.0
MAL-2026-15942 ossf-package-analysis, amazon-inspector

Sep 6, 2026
npm
ocfe-tv-subscription-center-web 0.0.1, 9999.0.0
MAL-2026-15941 ossf-package-analysis, amazon-inspector

Sep 6, 2026
npm
omni-channel-oid-frontend 0.0.1, 9999.0.0
MAL-2026-15939 ossf-package-analysis, amazon-inspector

Sep 6, 2026
npm
agentrc-security-poc-policy 1.0.0
MAL-2026-16005 ossf-package-analysis

Sep 6, 2026
npm
vishal_312pkg 1.0.0
MAL-2026-16006 ossf-package-analysis, amazon-inspector

Sep 6, 2026
npm
@liuliang520500/sinataoke_cn_test all versions
MAL-2026-15961 ghsa-malware

Sep 6, 2026
npm
@liuliang520500/sinataoke_cn 2.0.9, 2.0.10, 2.0.8, 2.0.7
MAL-2026-15960 ghsa-malware, amazon-inspector

Sep 6, 2026
npm
@liuliang520500/pdd-sdk-new all versions
MAL-2026-15959 ghsa-malware

Sep 6, 2026
npm
@liuliang520500/pdd-sdk all versions
MAL-2026-15958 ghsa-malware

Sep 6, 2026
npm
@liuliang520500/jd-sdk all versions
MAL-2026-15957 ghsa-malware

Sep 6, 2026