Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,383 npm 223,244 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,383 reports · Feed

npm
@copilot-mcp/apex 1.0.0, 1.0.4, 1.0.6, 1.0.8, 1.0.2, 1.0.17, 1.0.3, 1.0.16, 1.0.22, 1.0.5, 1.0.7,…
MAL-2026-12314 amazon-inspector

Aug 5, 2026
npm
@zahlen/checkout-react 0.1.1
MAL-2026-12333 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-sme.rko.finance.web 20.7.7
MAL-2026-12453 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-eventea.projects.pfpacquiring 20.5.8
MAL-2026-12445 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
streak-daykit 1.0.0
MAL-2026-12466 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
postcss-animate-css-vars 2.0.3, 1.0.0
MAL-2026-12418 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
dolyame-boxy-atom-bnpl-email-form 20.3.3
MAL-2026-12363 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
hubert-verify-primary-email-am 20.4.6
MAL-2026-12391 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
dolyame-boxy-independent-bnpl-info-images 20.7.2
MAL-2026-12365 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
saas-f-testing 20.4.2
MAL-2026-12434 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@lizhao1/memorax-code-internal 0.1.0, 0.1.1, 0.1.2, 0.1.3
MAL-2026-12320 amazon-inspector

Aug 5, 2026
npm
quorvex 0.2.1, 0.2.0, 0.2.2
MAL-2026-12422 amazon-inspector

Aug 5, 2026
npm
rollup-packages-node-polyfills 0.13.2, 0.0.1, 0.13.1, 0.13.0
MAL-2026-12428 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
warp-drive-internal-tooling 99.9.9
MAL-2026-12500 amazon-inspector

Aug 5, 2026
npm
aegis-runtime 1.0.0
MAL-2026-12335 amazon-inspector

Aug 5, 2026
npm
calendar-streak-core 1.0.0
MAL-2026-12345 amazon-inspector

Aug 5, 2026
npm
ccxt-trading 1.0.0
MAL-2026-12347 amazon-inspector

Aug 5, 2026
npm
@rentwise/common 1.0.36
MAL-2026-12328 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-coretech.web.metrics 20.1.8
MAL-2026-12444 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
utility-kit-ts 1.3.2
MAL-2026-12493 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
dolyame-boxy-atom-bnpl-store-button 20.5.3
MAL-2026-12364 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
sme-rko-finance-front-shared-entity-groups-models 20.2.8
MAL-2026-12440 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
travel-core-utils-object 20.3.4
MAL-2026-12487 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
william-data-formatter-x 1.0.0
MAL-2026-12501 amazon-inspector

Aug 5, 2026
npm
streak-count-core 1.0.0
MAL-2026-12460 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
pfp-block-mobile-steps 20.9.3
MAL-2026-12410 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
express-mongo-santi 1.1.9
MAL-2026-12377 amazon-inspector

Aug 5, 2026
npm
tt-help-cli-ycl 1.4.61, 1.4.59, 1.4.60, 1.4.63, 1.4.64, 1.4.67, 1.4.71, 1.4.65, 1.4.70, 1.4.66,…
MAL-2026-12488 amazon-inspector

Aug 5, 2026
npm
statist-browser-typed-client-sme.platform.web.teasers 20.4.6
MAL-2026-12310 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-jumptaxi.feature.contacts 20.7.7
MAL-2026-12309 amazon-inspector

Aug 5, 2026
npm
streak-calc-metrics 1.0.0
MAL-2026-12311 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
time-utils-helper 1.0.0
MAL-2026-12225 amazon-inspector, reversing-labs

Aug 5, 2026
npm
sme-auth-core 20.9.2
MAL-2026-12207 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
pfp-integration-mobile-heading 20.7.1
MAL-2026-12188 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
arbocrate-sla-prober-arbocrate-sla-prober-core 12.7.1, 7.5.6, 7.5.7, 7.5.8, 7.5.9
MAL-2026-12140 amazon-inspector

Aug 5, 2026
npm
dateuuidv2 1.0.1, 1.0.0, 1.0.2
MAL-2026-12176 amazon-inspector

Aug 5, 2026
npm
geocode-quick 1.0.3, 1.0.2
MAL-2026-12180 amazon-inspector

Aug 5, 2026
npm
statist-browser-typed-client-ddp.mentat.ui.web 20.9.4
MAL-2026-12209 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
time-webkit-tag 20.1.6
MAL-2026-12226 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-mb.product.sme.cards 20.5.9
MAL-2026-12213 amazon-inspector, ghsa-malware

Aug 5, 2026