Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

npm
@depup/astro 7.1.3-depup.2, 7.2.0-depup.0
MAL-2026-13622 amazon-inspector

Aug 7, 2026
npm
@depup/aws-sdk__credential-provider-process 3.972.59-depup.0, 3.972.63-depup.0, 3.972.66-depup.0, 3.972.62-depup.0
MAL-2026-13623 amazon-inspector

Aug 7, 2026
npm
@decido/backend-core 4.1.18, 4.1.1, 4.1.19, 4.1.12
MAL-2026-13621 amazon-inspector

Aug 7, 2026
npm
@lambda-platform/lambda-vue 3.3.24
MAL-2026-13668 ghsa-malware, amazon-inspector

Aug 7, 2026
npm
@catamania/front-components 1.0.5
MAL-2026-13620 amazon-inspector

Aug 7, 2026
npm
aclade-agent 1.0.5, 1.0.2, 1.0.1, 1.0.6, 1.0.4
MAL-2026-13614 amazon-inspector

Aug 7, 2026
npm
w-screenctl 1.0.6, 1.0.4, 1.0.7
MAL-2026-13618 amazon-inspector

Aug 7, 2026
npm
agenthub-ai 0.20.1, 0.20.2, 0.20.4, 0.20.3
MAL-2026-13615 amazon-inspector

Aug 7, 2026
npm
ts-utility-plus 1.3.2
MAL-2026-13617 amazon-inspector

Aug 7, 2026
npm
hardhat-cap 2.21.1
MAL-2026-13616 amazon-inspector, ghsa-malware

Aug 7, 2026
PyPI
atlas-internal 1.8.1
MAL-2026-13619 amazon-inspector, kam193

Aug 7, 2026
npm
big-tss 5.0.5, 5.0.4
MAL-2026-13613 amazon-inspector

Aug 7, 2026
npm
mangomind-agent 0.1.8, 0.1.2, 0.1.5, 0.1.1, 0.1.0, 0.1.4, 0.1.7, 0.2.0, 0.1.3, 0.2.1, 0.1.6, 0.…
MAL-2026-13611 amazon-inspector

Aug 7, 2026
npm
transform-es2015-unicode-regex 6.24.1
MAL-2026-13612 amazon-inspector, ghsa-malware, reversing-labs

Aug 7, 2026
npm
f-termx 1.2.6
MAL-2026-13610 amazon-inspector

Aug 7, 2026
npm
hardhat-set 2.21.0
MAL-2026-13609 amazon-inspector

Aug 7, 2026
npm
@vertexa/prisma-fetch-engine 7.8.2, 7.8.4, 7.8.5, 7.8.3, 7.8.1, 7.8.0
MAL-2026-13608 amazon-inspector

Aug 7, 2026
npm
yakuza0 2.23.40, 2.23.40-beta.3
MAL-2026-13605 amazon-inspector

Aug 7, 2026
npm
@aster110/cc2wechat 5.1.0
MAL-2026-13520 amazon-inspector

Aug 7, 2026
npm
dojo-rn-interview 1.0.1, 1.1.1
MAL-2026-13549 amazon-inspector, ghsa-malware

Aug 7, 2026
npm
delivery-ci-codeceptjs 35.1.7
MAL-2026-13539 amazon-inspector

Aug 7, 2026
npm
dolyame-ui-inputautocomplete 35.8.1
MAL-2026-13574 amazon-inspector

Aug 7, 2026
npm
devplatform-spa-plugin-remote-module 35.9.6
MAL-2026-13547 amazon-inspector

Aug 7, 2026
npm
dolyame-ui-checkablegroup 35.8.1
MAL-2026-13557 amazon-inspector

Aug 7, 2026
npm
dolyame-ui-inputdate 35.8.1
MAL-2026-13577 amazon-inspector

Aug 7, 2026
npm
delivery-ci-jira 35.5.2
MAL-2026-13542 amazon-inspector

Aug 7, 2026
npm
dolyame-boxy-independent-bnpl-main-title 35.5.6
MAL-2026-13552 amazon-inspector

Aug 7, 2026
npm
dolyame-ui-progressline 35.8.1
MAL-2026-13596 amazon-inspector

Aug 7, 2026
npm
dolyame-ui-inputsearchtagged 35.8.1
MAL-2026-13583 amazon-inspector

Aug 7, 2026
npm
dolyame-ui-deprecatepropshoc 35.8.1
MAL-2026-13566 amazon-inspector

Aug 7, 2026
npm
dolyame-ui-inputcount 35.8.1
MAL-2026-13576 amazon-inspector

Aug 7, 2026
npm
dolyame-ui-datatable 35.8.1
MAL-2026-13565 amazon-inspector

Aug 7, 2026
npm
bigops-shared-product-design 35.9.3
MAL-2026-13526 amazon-inspector

Aug 7, 2026
npm
dolyame-ui-inputtag 35.8.1
MAL-2026-13585 amazon-inspector

Aug 7, 2026
npm
dolyame-ui-tablemobile 35.8.1
MAL-2026-13601 amazon-inspector

Aug 7, 2026
npm
dolyame-ui-collapseblock 35.8.1
MAL-2026-13559 amazon-inspector

Aug 7, 2026
npm
dolyame-ui-contextmenusearchable 35.8.1
MAL-2026-13562 amazon-inspector

Aug 7, 2026
npm
dolyame-ui-inputsearch 35.8.1
MAL-2026-13582 amazon-inspector

Aug 7, 2026
npm
devplatform-stylelint-config 35.7.4
MAL-2026-13548 amazon-inspector

Aug 7, 2026
npm
dolyame-ui-postcsscustomproperties 35.8.1
MAL-2026-13595 amazon-inspector

Aug 7, 2026