Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

npm
dpdgroup-css 2.0.1
MAL-2026-13444 amazon-inspector

Aug 6, 2026
npm
gpt-terminal-cli 1.0.0
MAL-2026-13447 amazon-inspector

Aug 6, 2026
npm
express-chai 3.7.9
MAL-2026-13446 amazon-inspector

Aug 6, 2026
npm
wormgpt-cli 1.0.0, 1.0.3, 1.0.8, 1.0.4, 1.0.7, 1.0.2, 1.0.5, 1.0.1, 1.0.6
MAL-2026-13466 amazon-inspector

Aug 6, 2026
npm
poc-ch4rlygr 1.5.0, 1.3.0, 1.4.0, 1.2.0, 1.1.0, 1.6.0
MAL-2026-13454 amazon-inspector

Aug 6, 2026
npm
sui-migration-audit-cli 1.0.0
MAL-2026-13476 ghsa-malware, amazon-inspector

Aug 6, 2026
npm
sui-graphql-client 0.1.0, 0.2.0
MAL-2026-13475 ghsa-malware, amazon-inspector

Aug 6, 2026
npm
move-bcs-codec 1.0.0, 1.0.1, 1.0.2
MAL-2026-13450 amazon-inspector, ghsa-malware

Aug 6, 2026
npm
svelte-visual-map 1.0.0
MAL-2026-13477 ghsa-malware, amazon-inspector

Aug 6, 2026
npm
@junyoung-kim/reins 0.1.7, 0.1.6
MAL-2026-13432 amazon-inspector

Aug 6, 2026
npm
@lyxa.ai/core 1.0.145-debug, 1.0.144-test, 1.0.16, 1.0.8-debug-1, 1.1.36, 1.1.47, 1.0.201, 1.…
MAL-2026-13434 amazon-inspector

Aug 6, 2026
npm
@itsreduxtm/unpkg-xss-test 1.0.5, 1.0.9
MAL-2026-13431 amazon-inspector

Aug 6, 2026
npm
@ks-video/kwai-player-web 9.1.2
MAL-2026-13433 amazon-inspector

Aug 6, 2026
npm
nms-dashboard-js 9.9.11, 9.9.0
MAL-2026-13451 amazon-inspector, ghsa-malware

Aug 6, 2026
npm
aitable-workflow-server 9.9.9
MAL-2026-13437 amazon-inspector

Aug 6, 2026
npm
lib-frontsga 9.999.999
MAL-2026-13448 amazon-inspector, reversing-labs

Aug 6, 2026
npm
pilgrimage-portal-client 99.0.0
MAL-2026-13453 amazon-inspector, reversing-labs

Aug 6, 2026
npm
wos-library-ui 99.0.0, 999.999.999
MAL-2026-13467 amazon-inspector, ghsa-malware, reversing-labs

Aug 6, 2026
npm
@wbnr/frontend-shared 99.0.0, 99.0.1
MAL-2026-13436 amazon-inspector, reversing-labs

Aug 6, 2026
npm
commonweb-balance 99.9.1
MAL-2026-13439 amazon-inspector, ghsa-malware

Aug 6, 2026
npm
consumerweb-creditcollection 99.9.1
MAL-2026-13441 amazon-inspector, ghsa-malware

Aug 6, 2026
npm
connect-contingency 99.9.1
MAL-2026-13440 amazon-inspector, ghsa-malware

Aug 6, 2026
npm
content-common 99.9.9
MAL-2026-13442 amazon-inspector

Aug 6, 2026
npm
cewe-npm-cops 99.9.9
MAL-2026-13438 amazon-inspector, reversing-labs

Aug 6, 2026
npm
merchantweb-lang-cookie-reset 99.99.99, 1.0.998, 2.0.0, 0.1.999, 0.999.999, 0.1.0, 1.999.999, 1.0.999, 0.0.99…
MAL-2026-13449 amazon-inspector, reversing-labs

Aug 6, 2026
PyPI
alphalend-abi 1.0.0, 1.0.1, 1.1.0
MAL-2026-13472 kam193 1 IOC

Aug 6, 2026
npm
@ch4acko3/frontal-lobe 0.1.12, 0.1.12-preview.2, 0.1.14
MAL-2026-13430 amazon-inspector

Aug 6, 2026
npm
@avi892nash/aegis-grid-runner 0.3.3
MAL-2026-13429 amazon-inspector

Aug 6, 2026
PyPI
alphalend-layouts 4.1.0, 4.0.1, 4.0.0, 4.0.2
MAL-2026-13473 amazon-inspector, kam193 1 IOC

Aug 6, 2026
npm
stretchshop 0.7.5
MAL-2026-13460 amazon-inspector

Aug 6, 2026
npm
streak-map-cache 1.0.0
MAL-2026-13459 amazon-inspector, ghsa-malware

Aug 6, 2026
npm
@love-moon/conductor-cli 0.7.5, 0.7.4, 0.8.0, 0.7.6
MAL-2026-13428 amazon-inspector

Aug 6, 2026
npm
@diezyyasha/libsignal-node all versions
MAL-2026-13474 ghsa-malware

Aug 6, 2026
npm
diezyyasha-baileys 9.0.0, 8.6.59, 8.6.58, 8.6.62, 9.1.3, 8.6.61, 9.1.5, 9.2.0, 8.6.57, 8.6.60, 9.1…
MAL-2026-13443 amazon-inspector, ghsa-malware

Aug 6, 2026
npm
@leejungkiin/awkit 3.6.1, 3.3.9, 3.5.10, 3.4.4, 3.6.2, 3.3.3, 3.5.5, 3.5.0, 3.5.7, 3.4.7, 3.4.6, 3…
MAL-2026-13427 amazon-inspector

Aug 6, 2026
npm
@holocronlab/botruntime-runtime 2.2.5, 2.9.7, 2.2.7, 2.6.1, 2.5.4, 2.4.2, 2.5.0, 2.1.15, 2.6.0, 2.6.3, 2.6.4
MAL-2026-13419 amazon-inspector

Aug 6, 2026
npm
@innocarpe/deepseek-build 1.0.0
MAL-2026-13420 amazon-inspector

Aug 6, 2026
npm
fetchrtds 1.1.0
MAL-2026-13423 amazon-inspector

Aug 6, 2026
npm
tailwindcss-hide-scrollbar 2.5.4, 2.5.3, 1.0.0, 0.0.1
MAL-2026-13424 amazon-inspector, ghsa-malware

Aug 6, 2026
npm
@ccfly/setup-linux-x64 0.1.4, 0.1.3, 0.1.9, 0.1.0, 0.1.1, 0.1.10, 0.1.17, 0.1.19, 0.1.14, 0.1.2
MAL-2026-13418 amazon-inspector

Aug 6, 2026