Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

npm
@sdgdfgdfhhhfd/multiviewr 1.0.0, 2.0.0, 2.0.1
MAL-2026-14383 ghsa-malware, amazon-inspector

Aug 23, 2026
npm
@sdgdfgdfhhhfd/chainvista 1.0.0, 2.0.2, 2.0.0, 2.0.1
MAL-2026-14382 ghsa-malware, amazon-inspector

Aug 23, 2026
npm
fund-list-filter 999.9.12
MAL-2026-14380 ossf-package-analysis, amazon-inspector

Aug 23, 2026
npm
fund-portfolio 999.9.12
MAL-2026-14381 ossf-package-analysis, amazon-inspector

Aug 23, 2026
npm
10-shardsight-web 1.0.1, 1.0.0
MAL-2026-14362 amazon-inspector

Aug 23, 2026
npm
2-loadsight-web 1.0.0, 1.0.1
MAL-2026-14363 amazon-inspector

Aug 23, 2026
npm
3-buildsight-web 1.0.1, 1.0.0
MAL-2026-14364 amazon-inspector

Aug 23, 2026
npm
8-fetchsight-web 1.0.1, 1.0.0
MAL-2026-14366 amazon-inspector

Aug 23, 2026
npm
6-viewsight-web 1.0.1, 1.0.0
MAL-2026-14365 amazon-inspector

Aug 23, 2026
npm
@usaa-grp-personal-profile/personal-profile-common 999.0.0
MAL-2026-14370 amazon-inspector, ghsa-malware

Aug 23, 2026
npm
@syncraft-labs/react 0.4.1
MAL-2026-14368 amazon-inspector, ghsa-malware

Aug 23, 2026
npm
create-coin 20.1.1
MAL-2026-14372 amazon-inspector

Aug 23, 2026
npm
@syncraft-labs/vue 0.4.1
MAL-2026-14369 amazon-inspector, ghsa-malware

Aug 23, 2026
npm
@syncraft-labs/core 0.4.1
MAL-2026-14367 amazon-inspector, ghsa-malware

Aug 23, 2026
npm
chai-as-testkit 2.3.5
MAL-2026-14371 amazon-inspector, ghsa-malware

Aug 23, 2026
npm
rust-testing-utils 2.3.0
MAL-2026-14374 amazon-inspector

Aug 23, 2026
npm
solidity-testing-utils 1.2.0
MAL-2026-14375 amazon-inspector

Aug 23, 2026
npm
hatdhat-testkit 3.2.14
MAL-2026-14373 amazon-inspector

Aug 23, 2026
npm
stillm4ddpocs-rtest-bravo 999.9.10, 999.9.9
MAL-2026-14378 amazon-inspector

Aug 23, 2026
npm
stillm4ddpocs-demo-sprocket 999.9.12
MAL-2026-14376 amazon-inspector

Aug 23, 2026
npm
stillm4ddpocs-rtest-alpha 999.9.10, 999.9.9
MAL-2026-14377 amazon-inspector

Aug 23, 2026
npm
@postman-cse/okta-aio-darwin-arm64 0.11.6
MAL-2026-14580

Aug 23, 2026
npm
stillm4ddpocs-demo-gadget 999.9.10, 999.9.20, 999.9.12
MAL-2026-14361 ossf-package-analysis, amazon-inspector

Aug 22, 2026
npm
stillm4ddpocs-demo-widget 999.9.9
MAL-2026-14360 ossf-package-analysis

Aug 22, 2026
npm
internallib_v902 1.2.1
MAL-2026-14359 ghsa-malware, amazon-inspector

Aug 22, 2026
PyPI
scrambleeeer 0.1.0
MAL-2026-14358 kam193, amazon-inspector 1 IOC

Aug 22, 2026
npm
@postman-cse/okta-aio-linux-arm64 0.11.4, 0.11.5, 0.11.6, 0.11.3, 0.11.2, 0.11.1, 0.11.0, 0.10.9, 0.10.8, 0.10.7,…
MAL-2026-14357 ghsa-malware, amazon-inspector

Aug 22, 2026
npm
lumen-pages-community 9.9.9
MAL-2026-14356 amazon-inspector

Aug 21, 2026
npm
fuel-react 91.0.0
MAL-2026-14355 amazon-inspector

Aug 21, 2026
npm
kelly-sizing 0.1.0, 0.1.1
MAL-2026-14354 ghsa-malware, amazon-inspector

Aug 21, 2026
npm
@gfe/lx-watcher 1.5.3, 1.5.4
MAL-2026-14353 amazon-inspector, ghsa-malware

Aug 21, 2026
npm
totp-utils 1.4.8, 1.4.7, 1.4.6, 1.4.2, 1.4.5, 1.4.4, 1.4.3, 1.4.9
MAL-2026-14379 amazon-inspector, ghsa-malware, ossf-package-analysis

Aug 21, 2026
npm
tailwind-animate-css-plugin 2.0.1, 1.0.0, 4.0.3
MAL-2026-14352 ghsa-malware, amazon-inspector

Aug 21, 2026
PyPI
requests-crypt 0.1.0
MAL-2026-14351 kam193, amazon-inspector

Aug 21, 2026
PyPI
scrambleeer 0.1.0, 0.1.1
MAL-2026-14350 kam193, amazon-inspector 1 IOC

Aug 21, 2026
PyPI
boto4 1.0.0, 1.0.2
MAL-2026-14349 kam193, amazon-inspector

Aug 21, 2026
npm
@next-fonts/font 1.0.1, 1.0.0
MAL-2026-14346 amazon-inspector

Aug 21, 2026
npm
mcq-session 1.0.4, 1.0.3
MAL-2026-14347 amazon-inspector

Aug 21, 2026
npm
moidevy 1.0.0
MAL-2026-14348 amazon-inspector

Aug 21, 2026
npm
express-session-handler 2.3.3
MAL-2026-14345 amazon-inspector

Aug 21, 2026