Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,383 npm 223,244 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,383 reports · Feed

npm
streak-daily-core 1.0.0
MAL-2026-12461 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
react-table-core 2.7.1
MAL-2026-12425 amazon-inspector

Aug 5, 2026
npm
sme-foundation-frame-manager 20.7.8
MAL-2026-12439 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
dolyame-boxy-independent-bnpl-open-api 20.8.9
MAL-2026-12366 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
eventea-diag 20.5.3
MAL-2026-12373 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
eth-crypto-utils 1.0.0
MAL-2026-12372 amazon-inspector

Aug 5, 2026
npm
async-mutex-hook 2.1.0
MAL-2026-12339 amazon-inspector, reversing-labs

Aug 5, 2026
npm
evo-web-base-analytics-data 20.1.5
MAL-2026-12375 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-mb.product.mclaccount 20.2.6
MAL-2026-12447 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
afisha-storybook-default 9.7.11, 9.7.12, 9.7.10, 12.1.1, 9.7.9
MAL-2026-12336 amazon-inspector

Aug 5, 2026
npm
post-css-transfer 0.0.1
MAL-2026-12417 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
gekko-mev-bot 1.0.0
MAL-2026-12387 amazon-inspector, reversing-labs

Aug 5, 2026
npm
fry-page-maker-types 20.6.4
MAL-2026-12385 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
eventea-router 20.2.3
MAL-2026-12374 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-itsa.digitalinterview.events 20.8.2
MAL-2026-12446 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
form-bnpl-dolyame-component-object 20.8.9
MAL-2026-12384 amazon-inspector

Aug 5, 2026
npm
@offa-uwk/offa-uwk 999.0.6
MAL-2026-12327 amazon-inspector, reversing-labs

Aug 5, 2026
npm
bpm-foundation-feature-flags 20.4.2, 35.5.2
MAL-2026-12343 amazon-inspector

Aug 5, 2026
npm
test22221 2.2.7, 2.2.8, 2.2.9
MAL-2026-12478 amazon-inspector, reversing-labs

Aug 5, 2026
npm
deposits-overnight 20.8.5, 35.5.9
MAL-2026-12361 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
fb-hr-sites--boxified-form-meetup-subcribe 20.6.4
MAL-2026-12381 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
streak-math-kit 1.0.0
MAL-2026-12468 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
cardsmobile-collection 20.4.6
MAL-2026-12346 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tracker-radar-detector 1.0.1
MAL-2026-12483 amazon-inspector, reversing-labs

Aug 5, 2026
npm
code-analyzer-mcp 1.0.0
MAL-2026-12354 amazon-inspector

Aug 5, 2026
npm
tms-x-headers 20.2.9
MAL-2026-12480 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tcb-web-images 20.5.3
MAL-2026-12477 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-mb.reliability.android.metrics 20.9.3
MAL-2026-12449 amazon-inspector

Aug 5, 2026
npm
checkout-mobile-pay-button 20.8.3
MAL-2026-12352 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@vboxdev/common 1.0.73
MAL-2026-12330 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
pfp-forms-sme-sitebuilder 20.2.1
MAL-2026-12415 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
pfp-block-independent-iframe 20.4.9
MAL-2026-12408 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-rubliq.platform.keycloak 20.2.5
MAL-2026-12451 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
sme-crm-services-sme-crm-services-core 20.1.4
MAL-2026-12438 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
sso-tramvai-lib-roles 20.8.3
MAL-2026-12442 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
checkout-common-tokens 20.1.6
MAL-2026-12351 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
taiga-ui-proprietary-navigation 20.1.2
MAL-2026-12474 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-risktech.uwfrontantifraud.events 20.1.5
MAL-2026-12450 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
hubert-document-actual-insurance-rules-am 20.5.6
MAL-2026-12390 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
saas-f-lego-landings 20.7.5
MAL-2026-12433 amazon-inspector

Aug 5, 2026