Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,383 npm 223,244 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,383 reports · Feed

npm
alpha-helper 1.3.4
MAL-2026-12338 amazon-inspector, reversing-labs

Aug 5, 2026
npm
@nextco/utils 5.0.0
MAL-2026-12325 amazon-inspector

Aug 5, 2026
npm
streak-daykey-lib 1.0.0
MAL-2026-12465 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
sc-geeksquad-core 9999.0.0, 99.9.1
MAL-2026-12435 amazon-inspector, ossf-package-analysis

Aug 5, 2026
npm
@cryptosrvc/shift-exchange-root 3.9.9, 2.9.9, 1.9.9
MAL-2026-12316 amazon-inspector

Aug 5, 2026
npm
uploader-frontend 9.9.11
MAL-2026-12491 amazon-inspector

Aug 5, 2026
npm
uploader-frontend-legacy 9.9.11
MAL-2026-12492 amazon-inspector

Aug 5, 2026
npm
croft-node 1.1.3, 1.1.2, 1.1.1
MAL-2026-12358 amazon-inspector

Aug 5, 2026
npm
jquery.ui.tabs 9999.0.0
MAL-2026-12395 amazon-inspector

Aug 5, 2026
npm
node-cache-multithread 1.1.3
MAL-2026-12403 amazon-inspector

Aug 5, 2026
npm
rollup-plugins-polyfills-rode 0.13.1, 0.13.2, 0.13.3
MAL-2026-12430 amazon-inspector

Aug 5, 2026
npm
jquery.ui.core 9999.0.0
MAL-2026-12394 amazon-inspector

Aug 5, 2026
npm
@kite-js-tools/core 1.0.0
MAL-2026-12319 amazon-inspector

Aug 5, 2026
npm
ach-detail 99.0.2, 99.0.1
MAL-2026-12334 amazon-inspector

Aug 5, 2026
npm
token-list-fetcher 1.0.0, 1.0.1
MAL-2026-12481 amazon-inspector

Aug 5, 2026
npm
express-rate-controller 2.0.1, 2.0.0
MAL-2026-12378 amazon-inspector

Aug 5, 2026
npm
rollup-plugins-check 0.0.1, 0.0.2
MAL-2026-12429 amazon-inspector

Aug 5, 2026
npm
clover-codelab-remote-pay-cloud 99.9.9
MAL-2026-12353 amazon-inspector, reversing-labs

Aug 5, 2026
npm
@mgor/fw-canary-20260725-394b024b 0.0.2
MAL-2026-12321 amazon-inspector

Aug 5, 2026
npm
npm-module-service 3.7.2
MAL-2026-12404 amazon-inspector, reversing-labs

Aug 5, 2026
npm
tool-registry-scripts 1.0.0, 1.0.1
MAL-2026-12482 amazon-inspector, ghsa-malware, reversing-labs

Aug 5, 2026
npm
@shiftmarkets/shift-sdk-v4 1.0.77
MAL-2026-12329 amazon-inspector

Aug 5, 2026
npm
pp-react-worldready-v5 1.0.0
MAL-2026-12419 amazon-inspector

Aug 5, 2026
npm
luluking3 0.0.1
MAL-2026-12399 amazon-inspector

Aug 5, 2026
npm
electrode-ota-ui-app 99.0.1, 99.0.0
MAL-2026-12368 amazon-inspector, reversing-labs

Aug 5, 2026
npm
matlab-azure-devops-extension 1.0.1, 1.1.1
MAL-2026-12400 amazon-inspector, ghsa-malware, reversing-labs

Aug 5, 2026
npm
luluking2 0.0.1
MAL-2026-12398 amazon-inspector

Aug 5, 2026
npm
fastify-client-bundler 1.4.0
MAL-2026-12379 amazon-inspector, reversing-labs

Aug 5, 2026
npm
@cryptosrvc/no-brainer-sdk 1.0.18
MAL-2026-12315 amazon-inspector

Aug 5, 2026
npm
@cryptosrvc/shift-sdk-v4 1.0.77
MAL-2026-12317 amazon-inspector

Aug 5, 2026
npm
hyper-kube-config 1.1.1, 1.1.2
MAL-2026-12392 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
poly-custom-api 5.3.1
MAL-2026-12416 amazon-inspector, reversing-labs

Aug 5, 2026
npm
akamaijs-sensor 3.0.0, 2.0.0
MAL-2026-12337 amazon-inspector

Aug 5, 2026
npm
remote_session_elements 9999.0.0
MAL-2026-12427 amazon-inspector

Aug 5, 2026
npm
content-publisher-sdks 1.0.1, 1.0.2
MAL-2026-12356 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
crypto-javas 2.0.4, 2.0.7, 2.0.8, 2.0.9, 2.0.6
MAL-2026-12359 amazon-inspector

Aug 5, 2026
npm
relativity-foundation-core 6.8.2
MAL-2026-12426 amazon-inspector, reversing-labs

Aug 5, 2026
npm
fundraiserservpp 1.9.0, 2.0.0
MAL-2026-12386 amazon-inspector

Aug 5, 2026
npm
streak-view-core 1.0.0
MAL-2026-12471 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
rpc-endpoint-rotator 1.0.0
MAL-2026-12431 amazon-inspector

Aug 5, 2026