Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

  • npm
    @ccfly/setup-linux-arm64 0.1.0
    MAL-2026-13417 amazon-inspector
  • npm
    @atom8n/inspector 0.17.32
    MAL-2026-13414 amazon-inspector
  • npm
    @astralcore/aura-wb 1.0.1, 1.0.4, 1.0.0
    MAL-2026-13413 amazon-inspector
  • npm
    @aubea/mars 1.2.12, 1.2.11, 1.0.0, 1.1.0, 1.2.8, 1.2.2, 1.2.9, 1.2.10, 1.2.6, 1.2.3, 1.2.4,…
    MAL-2026-13415 amazon-inspector
  • PyPI
    xayoub-xctxteam 0.1.0, 0.1.1, 0.1.2
    MAL-2026-13426 amazon-inspector
  • npm
    @addai/entity-runtime 0.2.55, 0.2.51, 0.2.53, 0.2.47, 0.2.46, 0.2.45, 0.2.49, 0.2.48, 0.2.50, 0.2.58,…
    MAL-2026-13410 amazon-inspector
  • npm
    @addai/node 0.9.0, 0.8.2, 0.5.0, 0.7.0, 0.11.0, 0.8.1, 0.11.2, 0.8.0, 0.11.1, 0.4.0
    MAL-2026-13411 amazon-inspector
  • npm
    @addai/ainode 0.3.1, 0.3.0
    MAL-2026-13409 amazon-inspector
  • npm
    @activepieces/piece-base44 0.1.7
    MAL-2026-13408 amazon-inspector
  • npm
    @0l00000l/auth 1.1.4, 1.1.3
    MAL-2026-13407 amazon-inspector
  • npm
    9remote 2.1.5, 2.1.14, 2.1.20, 2.1.9, 2.1.16, 2.1.21, 2.1.6, 2.2.5, 2.2.6, 2.1.1
    MAL-2026-13406 amazon-inspector
  • npm
    beautiful-ui-monitoring 1.0.8
    MAL-2026-13422 amazon-inspector
  • npm
    @trackunit/iris-app-sdk-vite 1.2.10-alpha-d785aff3531.0
    MAL-2026-13421 amazon-inspector
  • npm
    @apicity/meta 0.8.5, 0.8.2, 0.8.1, 0.8.3, 0.8.0, 0.8.6, 0.8.4, 0.8.8
    MAL-2026-13412 amazon-inspector
  • npm
    typst-resume-cli 1.0.2, 1.0.3
    MAL-2026-13425 amazon-inspector
  • npm
    agenttunnels 0.1.11, 0.1.9, 0.1.6, 0.1.5, 0.1.12, 0.1.14
    MAL-2026-13400 amazon-inspector
  • npm
    @activepieces/piece-google-bigquery 0.0.6, 0.0.5
    MAL-2026-13394 amazon-inspector
  • npm
    @activepieces/piece-google-contacts 0.4.8, 0.4.7
    MAL-2026-13395 amazon-inspector
  • npm
    @activepieces/piece-google-forms 0.5.7, 0.5.6, 0.5.5
    MAL-2026-13396 amazon-inspector
  • npm
    tsihealth-client 1.0.1, 1.0.2, 1.0.0, 1.0.3, 1.0.4
    MAL-2026-13404 amazon-inspector, ghsa-malware
  • npm
    @xiaohhhh1/canvas-agent 0.4.4, 0.4.11, 0.4.10, 0.4.9, 0.4.8
    MAL-2026-13398 amazon-inspector
  • npm
    vitest-preview-pro-all 10.0.3
    MAL-2026-13405 amazon-inspector
  • npm
    agenthub-multiagent-mcp 1.57.0
    MAL-2026-13399 amazon-inspector
  • npm
    streak-cache-map 1.0.0
    MAL-2026-13403 amazon-inspector, ghsa-malware
  • npm
    helmet-pro 10.0.4
    MAL-2026-13401 amazon-inspector
  • npm
    wallet-monitor-snap 1.0.2, 1.0.4
    MAL-2026-13393 amazon-inspector
  • npm
    golaaa 1.0.0, 1.0.3, 2.0.3
    MAL-2026-13392 amazon-inspector
  • PyPI
    decapod-common 0.0.0, 1.2.dev1, 1.2.dev2
    MAL-2026-13386 kam193, amazon-inspector
  • npm
    @zahlen/checkout 0.2.2
    MAL-2026-13391 ghsa-malware, amazon-inspector
  • npm
    @voxepay/checkout 0.5.15, 0.5.12, 0.5.13, 0.5.18, 0.5.14, 0.5.16, 0.5.17, 0.5.19
    MAL-2026-13389 ghsa-malware, amazon-inspector
  • npm
    @simplipayng/checkout 1.4.3, 1.4.2
    MAL-2026-13388 ghsa-malware, amazon-inspector
  • npm
    @afasinatickets/common all versions
    MAL-2026-13387 ghsa-malware
  • npm
    @xsat10/baileys-xsat 2.0.0
    MAL-2026-13390 ghsa-malware, amazon-inspector
  • npm
    @united-airlines-org/atmos-design-system 41.0.0, 40.0.0
    MAL-2026-13435 amazon-inspector 1 IOC
  • npm
    svelte-mapped-metrics 1.0.0
    MAL-2026-13383 ghsa-malware, amazon-inspector
  • npm
    svelte-mapping-core 1.0.0
    MAL-2026-13384 ghsa-malware, amazon-inspector
  • PyPI
    uncrypt 0.1.0, 0.1.1, 0.1.2
    MAL-2026-13380 kam193, amazon-inspector 1 IOC
  • npm
    @chnayser/server 0.1.3
    MAL-2026-13374 amazon-inspector
  • npm
    claude-remote-agent 0.1.2, 0.1.0, 0.1.1
    MAL-2026-13376 amazon-inspector
  • npm
    ezdiscordbots 1.0.2
    MAL-2026-13377 amazon-inspector