Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

npm
chai-as-promised-plus 6.1.3
MAL-2026-13703 amazon-inspector

Aug 10, 2026
npm
chai-as-deployer 2.3.6, 2.3.5
MAL-2026-13700 amazon-inspector, ghsa-malware, reversing-labs

Aug 10, 2026
npm
chai-as-bench 7.0.3
MAL-2026-13699 amazon-inspector

Aug 10, 2026
npm
chai-as-map 2.3.5
MAL-2026-13702 amazon-inspector

Aug 10, 2026
npm
chai-tracker 1.2.1, 1.1.0, 1.1.1, 1.1.2, 1.1.3
MAL-2026-13704 amazon-inspector, ghsa-malware

Aug 10, 2026
npm
iconova-react 1.30.0, 1.30.1
MAL-2026-13705 amazon-inspector, ghsa-malware

Aug 10, 2026
npm
@kuperka/chainguard-sdk 1.0.1, 1.0.2
MAL-2026-13688 amazon-inspector

Aug 10, 2026
npm
@rblxts/services 1.6.2, 1.6.0
MAL-2026-13691 amazon-inspector

Aug 10, 2026
npm
postcss-initial-provider 3.0.4
MAL-2026-13696 amazon-inspector, ghsa-malware

Aug 10, 2026
npm
chai-jsonss 3.7.7
MAL-2026-13692 amazon-inspector

Aug 10, 2026
npm
@noobaihome/amis-simple-area-widget 1.0.0
MAL-2026-13689 amazon-inspector

Aug 10, 2026
npm
@noobaihome/amis-uni-area-widget 1.0.7, 1.0.8, 1.0.11, 1.0.1, 1.0.4, 1.0.6, 1.0.0, 1.0.2, 1.0.5, 1.0.10
MAL-2026-13690 amazon-inspector

Aug 10, 2026
npm
cryptostock 1.0.1, 1.0.0
MAL-2026-13693 amazon-inspector

Aug 10, 2026
npm
env-local 18.4.2, 18.4.3
MAL-2026-13694 amazon-inspector

Aug 10, 2026
npm
simple-date-formatter-new-9 1.0.0
MAL-2026-13698 amazon-inspector

Aug 10, 2026
npm
simple-date-formatter-new-10 1.0.0
MAL-2026-13697 amazon-inspector

Aug 10, 2026
npm
tokocrytodev 1.0.0, 1.0.1
MAL-2026-13687 amazon-inspector

Aug 10, 2026
PyPI
chaintest 0.1.0
MAL-2026-13686 kam193, amazon-inspector 2 IOCs

Aug 10, 2026
PyPI
pytablute 1.0.3
MAL-2026-13685 kam193 9 IOCs

Aug 10, 2026
npm
@ssgw/icon 9.999.999
MAL-2026-13684 ossf-package-analysis

Aug 10, 2026
PyPI
btcflx 0.1.0
MAL-2026-13682 kam193, amazon-inspector

Aug 10, 2026
PyPI
btcflip 0.1.0
MAL-2026-13681 kam193, amazon-inspector

Aug 10, 2026
PyPI
kotoraka 0.1.0
MAL-2026-13683 kam193, amazon-inspector

Aug 10, 2026
npm
hex-encode-utils 1.0.5, 1.0.1, 1.0.2, 1.0.3, 1.0.0, 1.0.4
MAL-2026-13695 amazon-inspector 3 IOCs

Aug 10, 2026
PyPI
kotanku 0.1.0
MAL-2026-13667 kam193

Aug 9, 2026
PyPI
cubesat-upstream-driver 1.0.1
MAL-2026-13666 kam193, amazon-inspector

Aug 9, 2026
PyPI
riakcs 0.0.1, 0.5.0
MAL-2026-13665 kam193

Aug 8, 2026
npm
test-noexist-xyz-99 all versions
MAL-2026-13680 ghsa-malware

Aug 8, 2026
npm
statist-browser-typed-client-eventea.projects.tdevice 0.0.1
MAL-2026-13675 ghsa-malware, amazon-inspector

Aug 8, 2026
npm
statist-browser-typed-client-eventea.projects.tdeal 0.0.1
MAL-2026-13674 ghsa-malware, amazon-inspector

Aug 8, 2026
npm
statist-browser-typed-client-eventea.projects.pwakasko 0.0.1
MAL-2026-13673 ghsa-malware, amazon-inspector

Aug 8, 2026
npm
statist-browser-typed-client-eventea.projects.pwainsurance 0.0.1
MAL-2026-13672 ghsa-malware, amazon-inspector

Aug 8, 2026
npm
statist-browser-typed-client-eventea.projects.pwahelp 35.8.0
MAL-2026-13671 ghsa-malware, amazon-inspector

Aug 8, 2026
npm
statist-browser-typed-client-eventea.projects.pwafamily 35.8.0
MAL-2026-13670 ghsa-malware, amazon-inspector

Aug 8, 2026
npm
specials-resources-server 35.8.1
MAL-2026-13669 ghsa-malware, amazon-inspector

Aug 8, 2026
npm
svelte-kit-cache 1.0.0
MAL-2026-13677 ghsa-malware, amazon-inspector

Aug 8, 2026
npm
svelte-streak-kit 1.0.0
MAL-2026-13679 ghsa-malware, amazon-inspector

Aug 8, 2026
npm
@coralxyz/anchor 0.30.2
MAL-2026-13629 amazon-inspector

Aug 8, 2026
npm
titan-exchange-shared-permissions 99.9.9
MAL-2026-13664 amazon-inspector

Aug 8, 2026
npm
modern-localization 1.1.1, 1.2.1
MAL-2026-13633 amazon-inspector

Aug 8, 2026