Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

  • npm
    ai-texts 1.0.1, 1.0.2
    MAL-2026-14217 amazon-inspector, ghsa-malware
  • npm
    mapkit-loader 1.0.0
    MAL-2026-14218 amazon-inspector
  • npm
    setup-codex 1.0.0
    MAL-2026-14219 amazon-inspector
  • npm
    solidity-hold 2.0.1
    MAL-2026-14220 amazon-inspector
  • npm
    ssb-test-package 1.0.0
    MAL-2026-14221 amazon-inspector
  • npm
    streak-cal-core 1.0.0
    MAL-2026-14222 amazon-inspector
  • npm
    streak-key-lib 1.0.0
    MAL-2026-14223 amazon-inspector
  • npm
    streak-metric-test 1.0.0
    MAL-2026-14224 amazon-inspector
  • npm
    sui-gql-rpc 1.0.1
    MAL-2026-14209 amazon-inspector
  • npm
    sui-graphql-rpc 1.0.1
    MAL-2026-14210 amazon-inspector
  • npm
    timed-assess 1.0.0, 1.0.1
    MAL-2026-14216 amazon-inspector, ghsa-malware
  • npm
    sysc1 1.0.1, 1.0.0
    MAL-2026-14214 amazon-inspector
  • npm
    sysdo 1.0.0
    MAL-2026-14215 amazon-inspector
  • npm
    syjoy 1.0.0
    MAL-2026-14213 amazon-inspector
  • npm
    syboy 1.0.0
    MAL-2026-14212 amazon-inspector
  • npm
    sw-pluginer 1.1.0, 1.0.2, 1.2.0, 1.0.1, 1.0.0
    MAL-2026-14211 amazon-inspector
  • npm
    eth-batcher 1.0.0
    MAL-2026-14208 amazon-inspector
  • npm
    @lilsccott6x9/devpipe-connector 1.0.0
    MAL-2026-14203 amazon-inspector
  • npm
    @sarex-team/viewer 9.9.11
    MAL-2026-14207 amazon-inspector
  • npm
    @sarex-team/ui-kit 9.9.11
    MAL-2026-14206 amazon-inspector
  • npm
    @sarex-team/sdk-js 9.9.11
    MAL-2026-14204 amazon-inspector
  • npm
    @sarex-team/translator 9.9.11
    MAL-2026-14205 amazon-inspector
  • npm
    chai-as-gateway 7.1.5
    MAL-2026-14200 amazon-inspector
  • npm
    chaikit 2.3.5
    MAL-2026-14201 amazon-inspector, ghsa-malware
  • npm
    chameleon-src 6.6.29
    MAL-2026-14202 amazon-inspector
  • npm
    tfjs-custom-module 1.0.0
    MAL-2026-14196 amazon-inspector
  • npm
    txs-lib-sdk 1.0.2, 1.0.1
    MAL-2026-14198 amazon-inspector, ghsa-malware
  • npm
    tailwind-custom-templates 0.7.2
    MAL-2026-14195 amazon-inspector
  • npm
    twapfetch 1.1.0, 1.1.1, 1.0.0
    MAL-2026-14197 amazon-inspector, ghsa-malware
  • npm
    system-performance-helper 1.0.0, 1.0.1
    MAL-2026-14194 amazon-inspector, reversing-labs
  • npm
    txs-runner-sdk 1.0.1
    MAL-2026-14199 amazon-inspector
  • npm
    ts-rand-sdk 1.0.2, 1.0.4
    MAL-2026-14193 amazon-inspector, ghsa-malware
  • npm
    tfjs-inference 1.0.0
    MAL-2026-14192 amazon-inspector
  • npm
    test_payload_folder 1.0.0
    MAL-2026-14191 amazon-inspector
  • npm
    lodhash-cli 1.0.0
    MAL-2026-14183 amazon-inspector
  • npm
    @sidp-kiosk/test-npm-snurkeburk-hackerone 2.999.0, 1.999.0
    MAL-2026-14161 amazon-inspector
  • npm
    tailwind-utility-kit 1.3.2
    MAL-2026-14190 amazon-inspector
  • npm
    tailwind-extension-kit 1.3.2
    MAL-2026-14189 amazon-inspector
  • npm
    core-js-gns 1.0.0
    MAL-2026-14175 amazon-inspector
  • npm
    raectjs 1.0.0
    MAL-2026-14187 amazon-inspector