Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,383 npm 223,244 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,383 reports · Feed

npm
react-scroll-disable 2.5.2
MAL-2026-12189 amazon-inspector

Aug 5, 2026
npm
accounts-offers 0.0.1
MAL-2026-12135 amazon-inspector

Aug 5, 2026
npm
accounts-appointment 33.2.6, 0.0.2
MAL-2026-12129 amazon-inspector

Aug 5, 2026
npm
accounts-card-design-picker 33.5.1, 0.0.2
MAL-2026-12130 amazon-inspector

Aug 5, 2026
npm
accounts-constants 0.0.2, 33.1.7
MAL-2026-12131 amazon-inspector

Aug 5, 2026
npm
accounts-ddos-shield 33.3.8, 0.0.2
MAL-2026-12132 amazon-inspector

Aug 5, 2026
npm
accounts-limits 0.0.2, 33.6.6
MAL-2026-12134 amazon-inspector

Aug 5, 2026
npm
tailwind-animation-founder 2.5.7
MAL-2026-12218 amazon-inspector

Aug 5, 2026
npm
accounts-forms 0.0.2, 33.2.6
MAL-2026-12133 amazon-inspector

Aug 5, 2026
npm
tailwindcss-form-components 1.5.1, 1.5.0, 1.4.1, 1.4.0
MAL-2026-12223 amazon-inspector, ghsa-malware, reversing-labs

Aug 5, 2026
npm
tailwind-opentype 1.2.3
MAL-2026-12222 amazon-inspector

Aug 5, 2026
npm
tailwind-custom-forms 0.5.2, 0.5.0, 0.5.1
MAL-2026-12221 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tailwind-animationpack 2.3.7
MAL-2026-12220 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tailwind-animationgroup 2.3.7
MAL-2026-12219 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
fb-insurance--boxified-form-vzr-test 20.3.7
MAL-2026-12179 amazon-inspector

Aug 5, 2026
npm
1239i32049i 0.1.0
MAL-2026-12117 amazon-inspector

Aug 5, 2026
npm
tailwind-animate-plugin 1.1.0
MAL-2026-12217 amazon-inspector

Aug 5, 2026
npm
tinkoff-fb-fieldset-car-reference-kasko 20.7.7
MAL-2026-12241 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-jumptaxi.feature.contacts 20.6.6
MAL-2026-12265 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-boxy-mobile-documents 20.1.7
MAL-2026-12234 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-boxy-independent-kasko-form 20.1.3
MAL-2026-12233 amazon-inspector

Aug 5, 2026
npm
tinkoff-boxy-gitlab-labels 20.5.4
MAL-2026-12232 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-leasing.admin.events 20.7.7
MAL-2026-12266 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-pwa-confac-types 20.7.7
MAL-2026-12252 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-fb-app-frame-page-height-dippy 20.8.4
MAL-2026-12240 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-eventea.projects.finhealthwebmicroblocks 20.4.7
MAL-2026-12259 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-fb-service-prefill-profile-contact 20.2.3
MAL-2026-12243 amazon-inspector

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events 20.1.8
MAL-2026-12263 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-coretech.statist.mobile.ci 20.1.2
MAL-2026-12256 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-itsa.corporatemessenger.clientv1.web.events 20.9.9
MAL-2026-12264 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics 20.2.7
MAL-2026-12272 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-sme.rko.authorization.common 20.5.5
MAL-2026-12273 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-art.apps.reporegistry 20.9.7
MAL-2026-12253 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-volna-zustate 20.9.2
MAL-2026-12284 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-web-typed-client-test.golden.retriever 20.4.4
MAL-2026-12279 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-boxy-desktop-mgm-product-filter 20.1.8
MAL-2026-12229 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-mb.product.tgeofencing 20.9.6
MAL-2026-12268 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-sme.rko.conversionpayments.web 20.3.8
MAL-2026-12274 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-mutual-mgm-form 20.2.9
MAL-2026-12244 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-pfp-block-desktop-tabs 20.5.3
MAL-2026-12247 amazon-inspector, ghsa-malware

Aug 5, 2026