Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

npm
mw-filesystem-events-nodream-es6 0.0.32
MAL-2026-14087 ghsa-malware, reversing-labs

Aug 14, 2026
npm
rtms-manager-dev 1.4.0, 1.3.0
MAL-2026-14093 ghsa-malware, reversing-labs

Aug 14, 2026
npm
expect-bundle 6.3.2
MAL-2026-14080 ghsa-malware, reversing-labs

Aug 14, 2026
npm
nolimitcity 1.0.0
MAL-2026-14088 ghsa-malware

Aug 14, 2026
npm
saps_secplayground_npm_ai 1.0.5, 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0
MAL-2026-14094 ghsa-malware, reversing-labs

Aug 14, 2026
npm
fr-ito-web-react 99.99.99
MAL-2026-14019 ossf-package-analysis, amazon-inspector

Aug 14, 2026
npm
preinstall-hook-webhook-callback-demo 1.0.1, 1.0.0
MAL-2026-14016 amazon-inspector

Aug 13, 2026
npm
wct-st 1.0.0
MAL-2026-13990 amazon-inspector

Aug 13, 2026
npm
webautomation_js 1.0.1, 1.0.0
MAL-2026-13991 amazon-inspector

Aug 13, 2026
npm
@secauditb20y/sec-test-r3b 1.0.0
MAL-2026-13989 amazon-inspector, ghsa-malware

Aug 13, 2026
npm
root-locator 1.2.0, 1.1.0
MAL-2026-14009 ghsa-malware, amazon-inspector

Aug 13, 2026
npm
source-analyzer 0.5.8, 0.5.7, 0.5.9
MAL-2026-14013 ghsa-malware, amazon-inspector

Aug 13, 2026
npm
path-match-js 1.0.7, 1.0.8
MAL-2026-14005 ghsa-malware, amazon-inspector

Aug 13, 2026
npm
react-shield 1.10.3, 1.10.2, 1.10.4
MAL-2026-14007 ghsa-malware, amazon-inspector

Aug 13, 2026
npm
@jacksher/install-exec-poc 1.0.2, 1.0.0, 1.0.3
MAL-2026-13972 amazon-inspector, ghsa-malware

Aug 13, 2026
npm
node-config-svg-contract 1.0.0
MAL-2026-13985 amazon-inspector

Aug 13, 2026
npm
notafollower 1.0.3, 1.0.11, 1.0.8, 1.0.9, 1.0.0, 1.0.2, 1.0.1, 1.0.5, 1.0.4, 1.0.10, 1.0.6, …
MAL-2026-13986 amazon-inspector

Aug 13, 2026
npm
datefmt-util-helper 1.0.1, 1.0.0
MAL-2026-13978 amazon-inspector

Aug 13, 2026
npm
@khaznatech/common 99.0.0
MAL-2026-13973 amazon-inspector

Aug 13, 2026
npm
@khaznatech/utils 99.0.0
MAL-2026-13975 amazon-inspector

Aug 13, 2026
npm
@khaznatech/core 99.0.0
MAL-2026-13974 amazon-inspector

Aug 13, 2026
npm
check-audit 99.9.1
MAL-2026-13976 amazon-inspector, ghsa-malware

Aug 13, 2026
npm
in-install 99.9.1
MAL-2026-13982 amazon-inspector, ghsa-malware

Aug 13, 2026
npm
cspell-esm 99.9.1
MAL-2026-13977 amazon-inspector, ghsa-malware

Aug 13, 2026
npm
napi-raw 99.9.1
MAL-2026-13984 amazon-inspector, ghsa-malware

Aug 13, 2026
npm
eslint-generate-prerelease 99.9.1
MAL-2026-13979 amazon-inspector, ghsa-malware

Aug 13, 2026
npm
knip-bun 99.9.1
MAL-2026-13983 amazon-inspector, ghsa-malware

Aug 13, 2026
npm
eslint-generate-release 99.9.1
MAL-2026-13980 amazon-inspector, ghsa-malware

Aug 13, 2026
npm
eslint-publish-release 99.9.1
MAL-2026-13981 amazon-inspector, ghsa-malware

Aug 13, 2026
npm
resolve-audit 99.9.1
MAL-2026-13987 amazon-inspector, ghsa-malware

Aug 13, 2026
npm
@hzero-front-ui/cfg 99.99.99
MAL-2026-13968 amazon-inspector

Aug 13, 2026
npm
@hzero-front-ui/c7n-ui 99.99.99
MAL-2026-13967 amazon-inspector

Aug 13, 2026
npm
@hzero-front-ui/core 99.99.99
MAL-2026-13969 amazon-inspector

Aug 13, 2026
npm
@hzero-front-ui/hzero-ui 99.99.99
MAL-2026-13970 amazon-inspector

Aug 13, 2026
npm
@hzero-front-ui/themes 99.99.99
MAL-2026-13971 amazon-inspector

Aug 13, 2026
npm
xrblocks-mcp 6.3.1
MAL-2026-13988 amazon-inspector

Aug 13, 2026
npm
tizen-webdriver-cli 1.0.0
MAL-2026-13966 amazon-inspector

Aug 13, 2026
npm
nc-verify-127942 1.0.0
MAL-2026-13965 amazon-inspector

Aug 13, 2026
npm
@solana-js/web3 1.91.3
MAL-2026-13941 amazon-inspector

Aug 13, 2026
npm
external-process-live-log 13.5.2
MAL-2026-13949 amazon-inspector

Aug 13, 2026