Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,383 npm 223,244 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,383 reports · Feed

npm
chai-as-rendered 1.2.0
MAL-2026-12348 amazon-inspector, reversing-labs

Aug 5, 2026
npm
eth-codegen 0.5.4
MAL-2026-12371 amazon-inspector

Aug 5, 2026
npm
vscode-designer-14 14.0.1
MAL-2026-12497 amazon-inspector, reversing-labs

Aug 5, 2026
npm
wagmi-react 1.0.0
MAL-2026-12498 amazon-inspector

Aug 5, 2026
npm
cors-security 1.0.1
MAL-2026-12357 amazon-inspector

Aug 5, 2026
npm
shift-sdk-v5 5.0.1
MAL-2026-12436 amazon-inspector

Aug 5, 2026
npm
react-native-ui-message 1.0.0
MAL-2026-12424 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
table-ui-new 2.7.5, 2.7.2, 2.7.4, 2.7.1
MAL-2026-12473 amazon-inspector

Aug 5, 2026
npm
com.db.dbk.ui-forms 99.0.0, 99.0.1
MAL-2026-12355 amazon-inspector, reversing-labs

Aug 5, 2026
npm
@offa/offa-uwk 999.0.1, 999.0.0
MAL-2026-12326 amazon-inspector, reversing-labs

Aug 5, 2026
npm
gekko-trading-bot 4.2.0
MAL-2026-12388 amazon-inspector

Aug 5, 2026
npm
express-middle 5.5.1
MAL-2026-12376 amazon-inspector

Aug 5, 2026
npm
caldora 1.0.0
MAL-2026-12344 amazon-inspector

Aug 5, 2026
npm
chai-assertions-plus 6.0.6, 6.0.5
MAL-2026-12349 amazon-inspector

Aug 5, 2026
PyPI
numpyp 0.7.7
MAL-2026-12503 amazon-inspector

Aug 5, 2026
npm
wallet-analytics 1.4.8
MAL-2026-12499 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
ventrix-kit 0.5.2, 1.5.2
MAL-2026-12494 amazon-inspector, reversing-labs

Aug 5, 2026
npm
@ccfly/setup-darwin-x64 0.1.7, 0.1.16, 0.1.6, 0.1.0, 0.1.14, 0.1.1, 0.1.9, 0.1.3, 0.1.13, 0.1.8, 0.1.15
MAL-2026-12313 amazon-inspector

Aug 5, 2026
npm
new-native-tools-linux-x64-gnu 3.1.41-origin-chrom-468-delete-windows-32-bit-changelog-fix-408-1785838091, 3.1…
MAL-2026-12402 amazon-inspector

Aug 5, 2026
npm
streak-bucket-core 1.0.0
MAL-2026-12457 amazon-inspector

Aug 5, 2026
npm
prokit-core 20.6.6
MAL-2026-12420 amazon-inspector

Aug 5, 2026
npm
pfp-block-mobile-past-meetup-list 20.5.1
MAL-2026-12409 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
pfa-errors 20.4.9
MAL-2026-12406 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-sme.platform.mobile.voip.common.events 20.9.4
MAL-2026-12452 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
fb-forms-form-boilerplate-contacts 20.7.1
MAL-2026-12380 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@wololasod/tiny-id 0.1.1, 0.1.3, 0.1.0, 0.1.2
MAL-2026-12331 amazon-inspector

Aug 5, 2026
npm
viem-toolkit 1.0.0
MAL-2026-12495 amazon-inspector

Aug 5, 2026
npm
pfp-block-mobile-vacancy-description 20.4.1
MAL-2026-12411 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@agenthub-ai/agent 0.5.1, 0.9.2, 0.14.2, 0.14.1, 0.12.2, 0.10.1, 0.9.5, 0.9.4, 0.9.3, 0.9.1, 0.9.0…
MAL-2026-12312 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
streak-math-lib 1.0.0
MAL-2026-12469 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@mgor/fw-canary-3333 0.0.1, 0.0.2
MAL-2026-12322 amazon-inspector

Aug 5, 2026
npm
streak-core-insights 1.0.0
MAL-2026-12459 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
pfa-prettier-config 20.9.1
MAL-2026-12407 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tui-react-tooltip 20.5.4
MAL-2026-12489 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
pfp-forms-sme-loan 20.2.1
MAL-2026-12414 amazon-inspector, ghsa-malware 7 IOCs

Aug 5, 2026
npm
tcb-web-header 20.5.7
MAL-2026-12476 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
streak-day-primitives 1.0.0
MAL-2026-12463 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@zahlen/checkout-angular 0.1.4
MAL-2026-12332 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
streak-daybucket 1.0.0
MAL-2026-12464 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
github-app-sts-action 1.0.1
MAL-2026-12389 amazon-inspector, ghsa-malware

Aug 5, 2026