Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

  • npm
    electron-sessions 0.1.5
    MAL-2026-14266 amazon-inspector
  • npm
    arb-kit 1.0.1
    MAL-2026-14263 amazon-inspector
  • npm
    postcss-initialize-provider 3.0.4
    MAL-2026-14261 amazon-inspector
  • npm
    pump-fun-skills 20.1.1
    MAL-2026-14262 amazon-inspector
  • npm
    modsync 5.0.2
    MAL-2026-14257 amazon-inspector
  • npm
    api-rs-tuils 2.1.6
    MAL-2026-14256 amazon-inspector
  • npm
    ranux-dev 5.0.0
    MAL-2026-14259 amazon-inspector
  • npm
    ranux-cloud 1.0.0
    MAL-2026-14258 amazon-inspector
  • npm
    ranux-pro 2.0.0
    MAL-2026-14260 amazon-inspector
  • npm
    react-dom-helpers 3.3.3
    MAL-2026-14253 amazon-inspector
  • npm
    saaa9 1.0.0
    MAL-2026-14254 amazon-inspector
  • npm
    secp256k1-lib 1.0.0, 1.0.2, 1.0.1, 1.0.3
    MAL-2026-14255 amazon-inspector
  • npm
    localize-extract 1.0.0
    MAL-2026-14249 amazon-inspector
  • npm
    luluking1 0.0.1
    MAL-2026-14250 amazon-inspector
  • npm
    npm-wold 1.1.1, 1.1.2
    MAL-2026-14252 amazon-inspector
  • npm
    ngsw-config 1.0.0
    MAL-2026-14251 amazon-inspector
  • npm
    nice-utils-helper 1.0.0
    MAL-2026-14248 amazon-inspector
  • npm
    flydev 0.0.1
    MAL-2026-14243 amazon-inspector
  • npm
    dxrs-dos 0.1.3
    MAL-2026-14241 amazon-inspector
  • npm
    dxr-dos 0.1.2
    MAL-2026-14240 amazon-inspector
  • npm
    electro-session 0.1.1, 0.1.4, 0.1.3, 0.1.0
    MAL-2026-14242 amazon-inspector
  • npm
    magika-js 4.1.1
    MAL-2026-14247 amazon-inspector
  • npm
    hardhat-hold 2.0.1, 2.21.0
    MAL-2026-14246 amazon-inspector, ghsa-malware
  • npm
    github-policy-bot 1.0.0
    MAL-2026-14245 amazon-inspector
  • npm
    gemini-cli-a2a-server 1.0.0
    MAL-2026-14244 amazon-inspector
  • npm
    gaarf-node-bq 1.0.0
    MAL-2026-14239 amazon-inspector
  • npm
    gaarf-node 1.0.0
    MAL-2026-14238 amazon-inspector
  • npm
    gaarf-bq 1.0.0
    MAL-2026-14237 amazon-inspector
  • npm
    gaarf 3.2.1
    MAL-2026-14236 amazon-inspector
  • npm
    config-helper-kit 1.3.2
    MAL-2026-14235 amazon-inspector
  • npm
    commandor-lib 1.0.0
    MAL-2026-14234 amazon-inspector
  • npm
    code-assist-mcp 1.0.0
    MAL-2026-14233 amazon-inspector
  • npm
    chromeos-webdriver-cli 1.0.0
    MAL-2026-14232 amazon-inspector
  • npm
    chromecast-webdriver-cli 1.0.0
    MAL-2026-14231 amazon-inspector
  • npm
    chrome-enterprise-premium-mcp 1.0.0
    MAL-2026-14230 amazon-inspector
  • npm
    carbon-monorepo 20.1.1
    MAL-2026-14229 amazon-inspector
  • npm
    broadcast-graphics-mcp 1.0.0
    MAL-2026-14228 amazon-inspector
  • npm
    bazelisk 1.0.0
    MAL-2026-14227 amazon-inspector
  • npm
    animate-css-vite 1.0.1
    MAL-2026-14226 amazon-inspector
  • npm
    ambera 1.0.0, 1.0.1
    MAL-2026-14225 amazon-inspector