Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,383 npm 223,244 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,383 reports · Feed

npm
sui-migration-audit-rules 1.0.0, 1.0.1
MAL-2026-12472 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
sme-scripts-shared-library-webpack-plugin 20.2.9
MAL-2026-12441 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
travel-core-typings-reducers 20.7.8
MAL-2026-12486 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
pfp-forms-independent-sme-glossary-anchor 20.4.4
MAL-2026-12412 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
log-min 1.0.13
MAL-2026-12396 amazon-inspector

Aug 5, 2026
npm
statist-browser-typed-client-mb.product.operations 20.4.9
MAL-2026-12448 amazon-inspector

Aug 5, 2026
npm
finance-business-company-id-models 20.1.5
MAL-2026-12382 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@nasdtickets/common 1.0.23
MAL-2026-12324 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-statist-core 20.9.9
MAL-2026-12456 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@hoteldev/common 1.0.9
MAL-2026-12318 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
simplipayng 1.0.8
MAL-2026-12437 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
block_package 1.0.0
MAL-2026-12340 amazon-inspector

Aug 5, 2026
npm
trapp-configuration 20.5.3
MAL-2026-12485 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
mcp-audit-sync-internal 99.9.9
MAL-2026-12401 amazon-inspector

Aug 5, 2026
npm
eslint-plugin-vitest-ts 1.0.4
MAL-2026-12370 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
streak-calendar-core 1.0.0
MAL-2026-12458 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
bnpl-blocks-independent-bnpl-search 20.2.9
MAL-2026-12341 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@nasddatax/common 1.0.21
MAL-2026-12323 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
uniswap-sdk-v4 1.0.0
MAL-2026-12490 amazon-inspector

Aug 5, 2026
npm
dolyame-ui-form 20.1.7
MAL-2026-12367 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
csv-parser-helper 1.0.0
MAL-2026-12360 amazon-inspector, reversing-labs

Aug 5, 2026
npm
invest-module-cookie 20.8.2
MAL-2026-12393 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
runtime-sentinel 1.0.1, 1.0.2
MAL-2026-12432 amazon-inspector

Aug 5, 2026
npm
elephant-array-utils 1.0.6
MAL-2026-12369 amazon-inspector

Aug 5, 2026
npm
digital-interview-digital-interview-core 20.5.3
MAL-2026-12362 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
time-linters-webapp-eslint-config 20.2.2
MAL-2026-12479 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
chart-data-utils 1.0.0
MAL-2026-12350 amazon-inspector, reversing-labs

Aug 5, 2026
npm
statist-browser-typed-client-automlplatform.nlppl.searchy 20.2.2
MAL-2026-12443 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
react-fontawesome-icons 1.0.6, 1.0.2, 1.0.1, 1.0.4, 1.0.5, 1.0.3
MAL-2026-12423 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
boxy-fixture-allure 20.8.1
MAL-2026-12342 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
streak-int-lib 1.0.0
MAL-2026-12467 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
pvm-autodoc 20.4.6
MAL-2026-12421 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-twork.tsales.nitro.metrics 20.6.2
MAL-2026-12455 amazon-inspector

Aug 5, 2026
npm
streak-metricsa 1.0.0
MAL-2026-12470 amazon-inspector

Aug 5, 2026
npm
foodi 99.99.1
MAL-2026-12383 amazon-inspector

Aug 5, 2026
npm
tcb-web-copy-to-clipboard 20.1.2
MAL-2026-12475 amazon-inspector, ghsa-malware

Aug 5, 2026
PyPI
gcli-control 0.12.2, 0.5.0, 0.12.4, 0.11.1
MAL-2026-12502 amazon-inspector

Aug 5, 2026
npm
streak-day-engine 1.0.0
MAL-2026-12462 amazon-inspector

Aug 5, 2026
npm
statist-browser-typed-client-social.shorts.editor 20.7.1
MAL-2026-12454 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
pfp-forms-mobile-sme-group-tiles 20.3.6
MAL-2026-12413 amazon-inspector, ghsa-malware

Aug 5, 2026