Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

npm
@bikli/cli 1.1.1, 1.1.0, 1.0.9
MAL-2026-13779 ghsa-malware, amazon-inspector

Aug 12, 2026
npm
@bikli/bikli 1.1.6, 1.1.10, 1.1.5, 1.1.8
MAL-2026-13778 ghsa-malware, amazon-inspector

Aug 12, 2026
npm
cc-skills-helper 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6
MAL-2026-13933 2 IOCs

Aug 12, 2026
npm
internallib_v164 6.0.9, 4.0.9, 1.0.7, 1.0.9
MAL-2026-13764 ghsa-malware, amazon-inspector

Aug 11, 2026
PyPI
joule-sbx-poc 0.1.0
MAL-2026-13756 kam193 1 IOC

Aug 11, 2026
PyPI
telebot-pro 2.3.7, 2.3.8
MAL-2026-13757 kam193, amazon-inspector

Aug 11, 2026
npm
chapters-core 9.999.999
MAL-2026-13752 amazon-inspector

Aug 11, 2026
npm
bjm-low-code-components 99.0.0
MAL-2026-13751 amazon-inspector

Aug 11, 2026
npm
@dgn-src-click-to-pay-org/srcdcfreleasecert 999.0.1, 374.0.0
MAL-2026-13744 amazon-inspector

Aug 11, 2026
npm
dcfarguscert 999.0.1
MAL-2026-13753 amazon-inspector

Aug 11, 2026
npm
base65-77x 5.0.2
MAL-2026-13750 amazon-inspector

Aug 11, 2026
npm
base65-33x 5.0.2
MAL-2026-13749 amazon-inspector

Aug 11, 2026
npm
base65-15x 5.0.2
MAL-2026-13748 amazon-inspector

Aug 11, 2026
npm
whs4_ued 1.0.0
MAL-2026-13743 amazon-inspector

Aug 11, 2026
npm
zeal-rq-hooks 0.0.0
MAL-2026-13742 amazon-inspector

Aug 11, 2026
npm
svelte-vim-kit 1.0.0
MAL-2026-13769 ghsa-malware, amazon-inspector

Aug 11, 2026
npm
sui-gql-client 0.2.0, 0.1.0
MAL-2026-13768 ghsa-malware, amazon-inspector

Aug 11, 2026
npm
sui-bcs-codec 1.0.2, 1.0.1, 1.0.0
MAL-2026-13767 ghsa-malware, amazon-inspector

Aug 11, 2026
npm
bs58-13 6.0.1
MAL-2026-13760 ghsa-malware, amazon-inspector

Aug 11, 2026
npm
bs58-12 6.0.1
MAL-2026-13759 ghsa-malware, amazon-inspector

Aug 11, 2026
npm
bs58-11 6.0.1
MAL-2026-13758 ghsa-malware, amazon-inspector

Aug 11, 2026
npm
base65-13x 5.0.2
MAL-2026-13747 amazon-inspector, ghsa-malware

Aug 11, 2026
npm
base65-12x 5.0.2
MAL-2026-13746 amazon-inspector, ghsa-malware

Aug 11, 2026
npm
base65-11x 5.0.2
MAL-2026-13745 amazon-inspector, ghsa-malware

Aug 11, 2026
npm
dakumangalsingh_virus 1.3.0, 1.2.0, 1.0.0
MAL-2026-13761 ghsa-malware, amazon-inspector

Aug 11, 2026
npm
@nzeros/codebreak 1.3.0
MAL-2026-13736 amazon-inspector

Aug 11, 2026
npm
@openzeppelin-4/contracts 1.0.1, 1.0.0
MAL-2026-13737 amazon-inspector 1 IOC

Aug 11, 2026
npm
@openzeppelin-5/contracts 1.0.0, 1.0.1
MAL-2026-13738 amazon-inspector 1 IOC

Aug 11, 2026
npm
safe-local-env-loader 1.0.0
MAL-2026-13741 amazon-inspector

Aug 11, 2026
npm
kit-vim-map 1.0.0
MAL-2026-13740 amazon-inspector, ghsa-malware

Aug 11, 2026
npm
node-internal-svg-loader 1.0.1, 1.0.0
MAL-2026-13766 ghsa-malware, amazon-inspector

Aug 11, 2026
npm
developer-dashboard 1.0.2, 1.0.3
MAL-2026-13762 ghsa-malware, amazon-inspector

Aug 11, 2026
npm
newtun 1.0.20, 1.0.14, 1.0.18, 1.0.25, 1.0.12, 1.0.26, 1.0.21, 1.0.1, 1.0.13, 1.0.8, 1…
MAL-2026-13733 amazon-inspector

Aug 11, 2026
PyPI
joule-btp-extension 0.1.6, 0.1.0, 0.1.1, 0.1.3, 0.1.4
MAL-2026-13732 ossf-package-analysis, kam193, amazon-inspector 1 IOC

Aug 11, 2026
npm
ghazaly 99.9.0
MAL-2026-13755 amazon-inspector, ghsa-malware

Aug 11, 2026
npm
dependencyfsdsfdsfg 99.9.0
MAL-2026-13754 amazon-inspector, ghsa-malware

Aug 11, 2026
npm
fetch-runtime 1.5.0, 1.3.0, 1.2.0, 1.4.0
MAL-2026-13763 ghsa-malware, amazon-inspector

Aug 11, 2026
npm
lines-columns 1.2.4
MAL-2026-13765 ghsa-malware, amazon-inspector

Aug 11, 2026
PyPI
euler-sdk 1.0.0
MAL-2026-13730 kam193 1 IOC

Aug 11, 2026
PyPI
morpho-sdk 1.0.0
MAL-2026-13731 kam193 1 IOC

Aug 11, 2026