Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

npm
@js-lib-team/env-parser 1.0.0
MAL-2026-14344 amazon-inspector

Aug 21, 2026
npm
chai-as-soul 2.3.5, 2.3.6
MAL-2026-14343 amazon-inspector

Aug 21, 2026
npm
coin-fees 20.1.1
MAL-2026-14342 amazon-inspector

Aug 21, 2026
PyPI
reqcrypts 0.1.0, 0.1.1, 0.1.2, 0.1.3
MAL-2026-14341 kam193, amazon-inspector

Aug 21, 2026
npm
exam-kit 1.0.2, 1.0.3, 1.0.1, 1.0.0
MAL-2026-14331 ghsa-malware, amazon-inspector

Aug 20, 2026
npm
@pablo_clueless/sniffr 0.1.1, 0.1.0
MAL-2026-14330 ghsa-malware, amazon-inspector

Aug 20, 2026
npm
@pablo_clueless/printr 0.1.4, 0.1.7, 0.1.8, 0.1.2, 0.1.6, 0.1.5
MAL-2026-14329 ghsa-malware, amazon-inspector

Aug 20, 2026
npm
goldstar-api-server all versions
MAL-2026-14328 ghsa-malware

Aug 20, 2026
npm
ethereum-validator all versions
MAL-2026-14327 ghsa-malware

Aug 20, 2026
npm
create-react-app-ux 1.0.0
MAL-2026-14326 ghsa-malware, amazon-inspector

Aug 20, 2026
npm
create-react-app-ui 1.0.0
MAL-2026-14325 ghsa-malware, amazon-inspector

Aug 20, 2026
npm
create-react-app-text 1.0.0
MAL-2026-14324 ghsa-malware, amazon-inspector

Aug 20, 2026
npm
cig-data-patcher all versions
MAL-2026-14323 ghsa-malware

Aug 20, 2026
npm
debug-fnt all versions
MAL-2026-14322 ghsa-malware

Aug 20, 2026
npm
test-flow-entire7 1.0.0
MAL-2026-14321 ghsa-malware, amazon-inspector

Aug 20, 2026
npm
test-flow-entire6 1.0.0
MAL-2026-14320 ghsa-malware, amazon-inspector

Aug 20, 2026
npm
test-flow-1 1.0.0, 1.0.2
MAL-2026-14319 ghsa-malware, amazon-inspector

Aug 20, 2026
npm
frenchworldcupwin 2.0.5, 1.0.0, 1.0.1, 2.0.0
MAL-2026-14318 ghsa-malware, amazon-inspector

Aug 20, 2026
npm
fetch-webjs-script 1.0.0
MAL-2026-14317 ghsa-malware, amazon-inspector

Aug 20, 2026
npm
@httttt/mcp-demo 1.0.0, 1.1.0
MAL-2026-14315 amazon-inspector, ghsa-malware

Aug 20, 2026
npm
expect-dotenv 7.2.1
MAL-2026-14316 amazon-inspector, ghsa-malware

Aug 20, 2026
crates.io
tinymember all versions
MAL-2026-14340

Aug 20, 2026
crates.io
proc-macro-en all versions
MAL-2026-14339

Aug 20, 2026
crates.io
proc-macro1 all versions
MAL-2026-14338 5 IOCs

Aug 20, 2026
crates.io
internment 0.8.7
MAL-2026-14337

Aug 20, 2026
crates.io
arrayref 0.3.10
MAL-2026-14336 5 IOCs

Aug 20, 2026
crates.io
aronenao all versions
MAL-2026-14335

Aug 20, 2026
crates.io
arone all versions
MAL-2026-14334

Aug 20, 2026
crates.io
append-only-vec 0.1.9
MAL-2026-14333

Aug 20, 2026
crates.io
aovine all versions
MAL-2026-14332

Aug 20, 2026
PyPI
libasync 1.0.0
MAL-2026-14308 kam193, amazon-inspector 2 IOCs

Aug 19, 2026
npm
express-route-engine 3.6.3
MAL-2026-14307 amazon-inspector

Aug 19, 2026
PyPI
rc4-secure 1.0.0
MAL-2026-14306 kam193, amazon-inspector

Aug 19, 2026
npm
mc-provider 1.0.10
MAL-2026-14305 amazon-inspector, ghsa-malware

Aug 19, 2026
npm
base99-85x 5.0.2
MAL-2026-14304 amazon-inspector

Aug 19, 2026
npm
x6842179305 1.0.0, 1.0.1
MAL-2026-14303 amazon-inspector

Aug 19, 2026
npm
ai-texts-utils 1.0.3, 1.0.0, 1.0.1, 1.0.2
MAL-2026-14302 amazon-inspector, ghsa-malware

Aug 19, 2026
npm
node-runtime-utils 1.0.0
MAL-2026-14313 ghsa-malware, amazon-inspector

Aug 19, 2026
npm
webpack-cdn-fetcher all versions
MAL-2026-14314 ghsa-malware

Aug 19, 2026
npm
griffin-transliterator all versions
MAL-2026-14312 ghsa-malware

Aug 19, 2026