Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,460 npm 223,294 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,294 reports · Feed

npm
bt2-api-gateway-node-js 999.0.1, 999.0.0
MAL-2026-15813 amazon-inspector, ossf-package-analysis

Sep 1, 2026
npm
react-mongoose 1.0.3, 1.0.5, 1.0.0, 1.0.2, 1.0.1
MAL-2026-15845 ghsa-malware, amazon-inspector

Sep 1, 2026
npm
@yane88/workbuddy-03 1.0.3, 1.0.1, 1.0.2, 1.0.0
MAL-2026-15667 ghsa-malware, amazon-inspector

Sep 1, 2026
npm
@yane88/workbuddy-02 1.0.3, 1.0.2, 1.0.0, 1.0.1
MAL-2026-15666 ghsa-malware, amazon-inspector

Sep 1, 2026
npm
@yane88/workbuddy-01 1.0.2, 1.0.0, 1.0.1
MAL-2026-15665 ghsa-malware, amazon-inspector

Sep 1, 2026
npm
@yane88/workbuddy 1.0.1, 1.0.3, 1.0.2, 1.0.0
MAL-2026-15664 ghsa-malware, amazon-inspector

Sep 1, 2026
npm
@yane88/term-reqable-02 all versions
MAL-2026-15663 ghsa-malware

Sep 1, 2026
npm
@yane88/term-reqable-01 all versions
MAL-2026-15662 ghsa-malware

Sep 1, 2026
npm
@yane88/term-reqable all versions
MAL-2026-15661 ghsa-malware

Sep 1, 2026
npm
@yane88/ripgrep-win all versions
MAL-2026-15660 ghsa-malware

Sep 1, 2026
npm
@yane88/listary-02 1.0.1, 1.0.0
MAL-2026-15659 ghsa-malware, amazon-inspector

Sep 1, 2026
npm
@yane88/listary-01 1.0.1, 1.0.0
MAL-2026-15658 ghsa-malware, amazon-inspector

Sep 1, 2026
npm
@yane88/listary 1.0.0, 1.0.1
MAL-2026-15657 ghsa-malware, amazon-inspector

Sep 1, 2026
npm
@yane88/hexhub-client all versions
MAL-2026-15649 ghsa-malware

Sep 1, 2026
npm
@yane88/idea-2026.2-06 1.0.0
MAL-2026-15656 ghsa-malware, amazon-inspector

Sep 1, 2026
npm
@yane88/idea-2026.2-05 all versions
MAL-2026-15655 ghsa-malware

Sep 1, 2026
npm
@yane88/idea-2026.2-04 all versions
MAL-2026-15654 ghsa-malware

Sep 1, 2026
npm
@yane88/idea-2026.2-03 all versions
MAL-2026-15653 ghsa-malware

Sep 1, 2026
npm
@yane88/idea-2026.2-02 all versions
MAL-2026-15652 ghsa-malware

Sep 1, 2026
npm
@yane88/idea-2026.2-01 all versions
MAL-2026-15651 ghsa-malware

Sep 1, 2026
npm
@yane88/idea-2026.2 all versions
MAL-2026-15650 ghsa-malware

Sep 1, 2026
npm
matrix-by-lmx all versions
MAL-2026-15670 ghsa-malware

Sep 1, 2026
npm
randomunblockedwebsite 1.0.1, 1.0.0, 1.0.2
MAL-2026-15672 ghsa-malware, amazon-inspector

Sep 1, 2026
npm
quartz-core 99.1.9, 99.9.9, 10.1.9
MAL-2026-15671 ghsa-malware, amazon-inspector

Sep 1, 2026
npm
kendo-angular-window 19.10.13
MAL-2026-15669 ghsa-malware, amazon-inspector

Sep 1, 2026
npm
core_main 10.9.9
MAL-2026-15668 ghsa-malware, amazon-inspector

Sep 1, 2026
npm
@fdr-mar/promos-types 10.10.9
MAL-2026-15648 ghsa-malware, amazon-inspector

Sep 1, 2026
npm
@systemzero/baileys 1.1.2
MAL-2026-15820 amazon-inspector, ghsa-malware 1 IOC

Sep 1, 2026
npm
@mrlegendbot/baileys 1.2.4, 1.2.5, 1.2.7, 7.0.0-rc14, 1.0.0, 1.1.0, 1.1.1, 1.2.0, 1.2.1, 1.2.3, 1.2.6
MAL-2026-15819 ghsa-malware 1 IOC

Sep 1, 2026
npm
@testrelic/appium-analytics 1.1.1-next.88
MAL-2026-15647 ghsa-malware, amazon-inspector

Aug 31, 2026
npm
claude-channel-telegram 9.9.9
MAL-2026-15624 amazon-inspector

Aug 31, 2026
npm
nextjsupdater 1.2.1, 1.0.0, 1.2.2
MAL-2026-15631 amazon-inspector

Aug 31, 2026
npm
mfaatest 1.0.0
MAL-2026-15629 amazon-inspector

Aug 31, 2026
npm
hyperliquid-composer 1.0.0
MAL-2026-15627 amazon-inspector, ghsa-malware

Aug 31, 2026
npm
test__123q2 2.1.1
MAL-2026-15638 amazon-inspector

Aug 31, 2026
npm
spc-grafeno-login 1.0.0
MAL-2026-15633 amazon-inspector

Aug 31, 2026
npm
node-request-utils 1.0.0
MAL-2026-15632 amazon-inspector

Aug 31, 2026
npm
tailwind-minanimated 2.3.7
MAL-2026-15634 amazon-inspector

Aug 31, 2026
npm
mfafix 1.1.1, 1.1.0, 1.0.0
MAL-2026-15630 amazon-inspector

Aug 31, 2026
npm
tailwind-modernanimation 2.3.8
MAL-2026-15635 amazon-inspector

Aug 31, 2026