Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,465 npm 223,299 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,299 reports · Feed

npm
commandor-cli 1.0.0
MAL-2026-14172 amazon-inspector

Aug 18, 2026
npm
comander-lib 1.0.0
MAL-2026-14171 amazon-inspector

Aug 18, 2026
npm
dev-env-check 1.0.3
MAL-2026-14176 amazon-inspector

Aug 18, 2026
npm
axois-http 1.0.0
MAL-2026-14163 amazon-inspector

Aug 18, 2026
npm
loadashjs 1.0.0
MAL-2026-14179 amazon-inspector

Aug 18, 2026
npm
ladash-cli 1.0.0
MAL-2026-14178 amazon-inspector

Aug 18, 2026
npm
commandorjs 1.0.0
MAL-2026-14174 amazon-inspector

Aug 18, 2026
npm
bqq1 1.0.0
MAL-2026-14164 amazon-inspector

Aug 18, 2026
npm
pump-segments-sdk 20.1.1
MAL-2026-14186 amazon-inspector

Aug 18, 2026
npm
comander-cli 1.0.0
MAL-2026-14170 amazon-inspector

Aug 18, 2026
npm
axious-core 1.0.0
MAL-2026-14162 amazon-inspector

Aug 18, 2026
npm
lodahsjs 1.0.0
MAL-2026-14181 amazon-inspector

Aug 18, 2026
npm
mutex-thread 1.3.0
MAL-2026-14185 amazon-inspector

Aug 18, 2026
npm
@library-dev-team/data-sanitizer 1.3.0
MAL-2026-14160 amazon-inspector

Aug 18, 2026
npm
fast-glob-fast 11.0.0, 9.0.0, 4.0.1, 10.0.0, 0.2.0, 8.0.0
MAL-2026-14177 amazon-inspector

Aug 18, 2026
npm
testingsmthb1g 1.0.0
MAL-2026-14142 amazon-inspector

Aug 18, 2026
npm
test-npm-snurkeburk-hackerone 1.999.0
MAL-2026-14141 amazon-inspector

Aug 18, 2026
npm
typscript-core 1.0.0
MAL-2026-14157 amazon-inspector

Aug 18, 2026
npm
typscript-cli 1.0.0
MAL-2026-14156 amazon-inspector

Aug 18, 2026
npm
typesript-cli 1.0.0
MAL-2026-14154 amazon-inspector

Aug 18, 2026
npm
typesript-core 1.0.0
MAL-2026-14155 amazon-inspector

Aug 18, 2026
npm
typescrit-cli 1.0.0
MAL-2026-14153 amazon-inspector

Aug 18, 2026
npm
typescriptt-core 1.0.0
MAL-2026-14152 amazon-inspector

Aug 18, 2026
npm
typescirpt-core 1.0.0
MAL-2026-14149 amazon-inspector

Aug 18, 2026
npm
typescrip-cli 1.0.0
MAL-2026-14150 amazon-inspector

Aug 18, 2026
npm
typescirpt-cli 1.0.0
MAL-2026-14148 amazon-inspector

Aug 18, 2026
npm
typescriptt-cli 1.0.0
MAL-2026-14151 amazon-inspector

Aug 18, 2026
npm
tyepescript-core 1.0.0
MAL-2026-14144 amazon-inspector

Aug 18, 2026
npm
typecript-cli 1.0.0
MAL-2026-14145 amazon-inspector

Aug 18, 2026
npm
typescipt-core 1.0.0
MAL-2026-14147 amazon-inspector

Aug 18, 2026
npm
typescipt-cli 1.0.0
MAL-2026-14146 amazon-inspector

Aug 18, 2026
npm
tyepescript-cli 1.0.0
MAL-2026-14143 amazon-inspector

Aug 18, 2026
npm
@mohamed_nowisar/token3-check 0.0.1
MAL-2026-14135 amazon-inspector

Aug 18, 2026
npm
@mohamed_nowisar/depconf-canary-test 0.0.1
MAL-2026-14134 amazon-inspector

Aug 18, 2026
npm
agora402-payment-utils 1.0.0
MAL-2026-14136 amazon-inspector, ghsa-malware

Aug 18, 2026
npm
mtslink-depconf-probe-profileusername 1.0.0
MAL-2026-14137 amazon-inspector

Aug 18, 2026
npm
optimizely-starter-kit-for-fastly-compute 1.0.1, 1.1.1
MAL-2026-14138 amazon-inspector, ghsa-malware

Aug 18, 2026
npm
prism-registry 1.0.1, 1.1.1
MAL-2026-14139 amazon-inspector, ghsa-malware

Aug 18, 2026
npm
vite-svg-config 1.1.0
MAL-2026-14140 amazon-inspector

Aug 18, 2026
npm
plugin-react-vite 2.1.2, 2.1.3
MAL-2026-14129 ghsa-malware, amazon-inspector

Aug 18, 2026