Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

npm
npm-dc-dev 1.1.1
MAL-2026-13378 amazon-inspector

Aug 5, 2026
npm
app-api-sdk 2.1.7
MAL-2026-13375 amazon-inspector

Aug 5, 2026
npm
statist-browser-typed-client-sme.rko.tariffs.web 20.3.8
MAL-2026-13379 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
llm-interceptor 0.3.0, 0.3.1, 0.3.4, 0.3.3, 0.4.0, 0.4.1, 0.3.8
MAL-2026-13370 amazon-inspector

Aug 5, 2026
npm
kepler 1.999.999, 5.999.999, 2.1.999, 4.999.999, 1.0.999, 5.0.999, 2.6.999, 2.2.999, 9…
MAL-2026-13369 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
multi-acct 99.99.99, 3.1.0, 4.999.999, 3.0.999, 3.999.999, 2.0.999, 4.0.0, 2.1.999, 1.0.0,…
MAL-2026-13371 amazon-inspector

Aug 5, 2026
npm
express-dever 5.1.8, 5.1.7
MAL-2026-13368 amazon-inspector

Aug 5, 2026
npm
@cliphijack/santaclaude 1.0.104, 1.0.106, 1.0.100, 1.0.107, 1.0.102, 1.0.103, 1.0.108
MAL-2026-13363 amazon-inspector

Aug 5, 2026
npm
@ikbal_fadilah_vanexa01/vanexa-agent 1.3.10, 1.3.19, 1.3.23, 1.1.53, 1.3.17, 1.3.8, 1.1.54, 1.2.0, 1.1.55, 1.3.34, 1…
MAL-2026-13364 amazon-inspector

Aug 5, 2026
npm
@stageflight-testbed/a 0.1.7
MAL-2026-13365 amazon-inspector

Aug 5, 2026
npm
clawtrl-wallet 1.5.1
MAL-2026-13367 amazon-inspector

Aug 5, 2026
npm
@workoscalif/sudoku 1.4.0, 1.3.0, 1.5.1, 1.5.2, 1.5.0, 1.2.0
MAL-2026-13366 amazon-inspector

Aug 5, 2026
PyPI
solana-sniper-bot 1.4.2
MAL-2026-13373 kam193 1 IOC

Aug 5, 2026
PyPI
eth-account-wallet 0.11.2
MAL-2026-13372 kam193, amazon-inspector 1 IOC

Aug 5, 2026
PyPI
defi-sdk-py 2.5.1
MAL-2026-13361 kam193 1 IOC

Aug 5, 2026
PyPI
mnemonic-py 0.21
MAL-2026-13362 kam193 1 IOC

Aug 5, 2026
npm
uzair-rajput-new 1.0.1, 1.1.0, 1.3.0, 1.2.0
MAL-2026-13360 amazon-inspector

Aug 5, 2026
npm
test-dev-config 0.1.0
MAL-2026-13359 amazon-inspector

Aug 5, 2026
npm
app-kst-engine 2.1.6
MAL-2026-13358 amazon-inspector

Aug 5, 2026
npm
app-hsu-layer 2.1.7, 2.1.6
MAL-2026-13357 amazon-inspector

Aug 5, 2026
npm
chai-foundry 7.0.3, 7.0.2
MAL-2026-13356 amazon-inspector, ghsa-malware, reversing-labs

Aug 5, 2026
npm
@astralcore/sl-aura 1.0.6, 1.0.0, 1.0.5, 1.0.1, 1.0.4
MAL-2026-13355 amazon-inspector

Aug 5, 2026
npm
@ohos-ports/codex 0.140.0-beta.0
MAL-2026-13210 amazon-inspector

Aug 5, 2026
npm
stellarfixer 1.0.0
MAL-2026-13353 amazon-inspector

Aug 5, 2026
npm
ezfnfix 1.0.0
MAL-2026-13344 amazon-inspector

Aug 5, 2026
npm
encrypt-string-safe 2.2.0, 2.1.0
MAL-2026-13342 amazon-inspector

Aug 5, 2026
npm
@guangnao/claude-cli 1.0.5, 1.0.12, 1.0.13
MAL-2026-13209 amazon-inspector

Aug 5, 2026
npm
native-hello-plugin 1.2.0
MAL-2026-13350 amazon-inspector

Aug 5, 2026
npm
akamai-sensorv2 1.0.0
MAL-2026-13217 amazon-inspector

Aug 5, 2026
npm
akamai-sensorv1 1.0.0
MAL-2026-13216 amazon-inspector

Aug 5, 2026
npm
stellar-api-core 1.0.5
MAL-2026-13352 amazon-inspector

Aug 5, 2026
npm
javas-crypto 2.0.4
MAL-2026-13347 amazon-inspector

Aug 5, 2026
npm
lakk-analytics 9.9.11, 9.9.0
MAL-2026-13348 amazon-inspector, ghsa-malware, reversing-labs

Aug 5, 2026
npm
bitcoinjs-wallet 5.4.2
MAL-2026-13258 amazon-inspector

Aug 5, 2026
npm
dlab_workshop 1.0.4, 1.0.6, 1.0.2, 1.0.5, 1.0.3, 1.0.1, 1.0.7, 1.0.8
MAL-2026-13277 amazon-inspector, ossf-package-analysis

Aug 5, 2026
npm
ethers-signer 3.2.1
MAL-2026-13343 amazon-inspector

Aug 5, 2026
npm
hd-key-generator 1.6.3
MAL-2026-13345 amazon-inspector

Aug 5, 2026
npm
hdkey-wallet 2.1.0
MAL-2026-13346 amazon-inspector

Aug 5, 2026
npm
web3-utils-crypto 1.10.4
MAL-2026-13354 amazon-inspector

Aug 5, 2026
npm
bip39-generator 3.1.2
MAL-2026-13257 amazon-inspector

Aug 5, 2026