Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

npm
docker-api-client 2.0.2
MAL-2026-13280 amazon-inspector

Aug 5, 2026
npm
@zzzcrypto/solana-spl-token 0.4.0
MAL-2026-13214 amazon-inspector

Aug 5, 2026
npm
@zzzcrypto/xrp-lib 2.14.0
MAL-2026-13215 amazon-inspector

Aug 5, 2026
npm
@zzzcrypto/playwrite 1.48.0
MAL-2026-13213 amazon-inspector

Aug 5, 2026
npm
@zzzcrypto/bitcoin-lib 6.1.7
MAL-2026-13211 amazon-inspector

Aug 5, 2026
npm
@zzzcrypto/etherjs 6.15.4
MAL-2026-13212 amazon-inspector

Aug 5, 2026
npm
devplatform-test-pvm-is-even 35.9.5
MAL-2026-13267 amazon-inspector

Aug 5, 2026
npm
aws-sdk-v4 3.650.0
MAL-2026-13218 amazon-inspector

Aug 5, 2026
npm
devplatform-spa-use-track 35.5.3
MAL-2026-13263 amazon-inspector

Aug 5, 2026
npm
devplatform-spa-ui 35.8.2
MAL-2026-13262 amazon-inspector

Aug 5, 2026
npm
devplatform-spa-plugin-s3 35.5.9
MAL-2026-13260 amazon-inspector

Aug 5, 2026
npm
devplatform-supafetch 35.2.1
MAL-2026-13265 amazon-inspector

Aug 5, 2026
npm
devplatform-vite-plugin-gle 35.3.9
MAL-2026-13273 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
devplatform-utils 35.5.2
MAL-2026-13271 amazon-inspector

Aug 5, 2026
npm
devplatform-test-pvm-is-odd 35.3.9
MAL-2026-13268 amazon-inspector

Aug 5, 2026
npm
devplatform-ui-kit 35.6.2
MAL-2026-13269 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
dolyame-boxy-atom-bnpl-button 35.8.3
MAL-2026-13283 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
devplatform-ui-notification 35.3.6
MAL-2026-13270 amazon-inspector

Aug 5, 2026
npm
devplatform-vite-plugin-preserve-css-modules 35.6.8
MAL-2026-13274 amazon-inspector

Aug 5, 2026
npm
dolyame-boxy-atom-bnpl-badge 35.2.3
MAL-2026-13282 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
docsmate-docsmate-core 35.9.3
MAL-2026-13281 amazon-inspector

Aug 5, 2026
npm
dippy-invertor 35.1.6
MAL-2026-13276 amazon-inspector

Aug 5, 2026
npm
devplatform-zod-wip-api 35.9.3
MAL-2026-13275 amazon-inspector

Aug 5, 2026
npm
docflow-cryptopro 35.1.6
MAL-2026-13279 amazon-inspector

Aug 5, 2026
npm
dolyame-boxy-atom-bnpl-dangerously-html 35.5.4
MAL-2026-13285 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
dlp-dlp-core 35.1.3
MAL-2026-13278 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
dolyame-boxy-atom-bnpl-dolyame-button 35.7.3
MAL-2026-13286 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
dolyame-boxy-atom-bnpl-card 35.5.5
MAL-2026-13284 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
dolyame-boxy-atom-bnpl-image-card 35.7.7
MAL-2026-13287 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
dolyame-boxy-atom-bnpl-popup 35.9.3
MAL-2026-13289 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
dolyame-boxy-atom-bnpl-store-button-set 35.9.5
MAL-2026-13290 amazon-inspector

Aug 5, 2026
npm
dolyame-boxy-atom-bnpl-info-card 35.5.5
MAL-2026-13288 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
dolyame-boxy-atom-bnpl-text 35.8.7
MAL-2026-13291 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
dolyame-boxy-atom-desktop-bnpl-dangerously-html 35.4.8
MAL-2026-13294 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
dolyame-boxy-atom-desktop-bnpl-container 35.3.3
MAL-2026-13293 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
dolyame-boxy-atom-desktop-bnpl-text 35.4.8
MAL-2026-13296 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
dolyame-boxy-block 35.5.2
MAL-2026-13298 amazon-inspector

Aug 5, 2026
npm
dolyame-boxy-atom-desktop-bnpl-highlighted-text 35.5.6
MAL-2026-13295 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
dolyame-boxy-atom-container 35.3.2
MAL-2026-13292 amazon-inspector

Aug 5, 2026
npm
dolyame-boxy-desktop-bnpl-card-gallery 35.5.2
MAL-2026-13301 amazon-inspector, ghsa-malware

Aug 5, 2026