Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,383 npm 223,244 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,383 reports · Feed

npm
tinkoff-terminal-kit-test-commons 20.9.7
MAL-2026-12281 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events 20.6.1
MAL-2026-12276 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-mb.product.restrictions.arrestments 20.8.3
MAL-2026-12267 amazon-inspector

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-dwh.chimera.base 20.2.3
MAL-2026-12258 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-cardsmobile.events.promotest 20.8.7
MAL-2026-12255 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-fb-rf-add-application 20.3.5
MAL-2026-12242 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-eventea.projects.smartcam 20.6.3
MAL-2026-12260 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-boxy-desktop-two-panel-right-image 20.4.8
MAL-2026-12230 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-sme.platform.mobile.dynamicteasers.common 20.8.7
MAL-2026-12270 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-sme.users.origination.web 20.6.2
MAL-2026-12277 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-sme.rko.origsmartphonepaytb.common.mobile.events 20.2.5
MAL-2026-12275 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-investing.product.pulse 20.4.5
MAL-2026-12262 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-investaccounting.events.templatepage.mainpage 20.4.5
MAL-2026-12261 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-automlplatform.nlppl.classica 20.4.1
MAL-2026-12254 amazon-inspector

Aug 5, 2026
npm
tinkoff-test-app-child-app 20.3.8
MAL-2026-12282 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-pfpa-tools 20.3.1
MAL-2026-12251 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-terminal-kit-datetime 20.7.2
MAL-2026-12280 amazon-inspector

Aug 5, 2026
npm
tinkoff-ui-angular-addon-wysiwyg 20.7.8
MAL-2026-12283 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-component-limits 20.4.9
MAL-2026-12238 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-pfp-atom-desktop-carousel 20.8.8
MAL-2026-12245 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-pfp-block-mobile-advert-footer 20.3.3
MAL-2026-12248 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events 20.9.9
MAL-2026-12271 amazon-inspector

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-test.softwarecenter.metrics 20.1.3
MAL-2026-12278 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-codeceptjs-storyshots 20.7.8
MAL-2026-12236 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-boxy-mobile-separator 20.8.8
MAL-2026-12235 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-codeceptjs-storyshots-alpha 20.8.9
MAL-2026-12237 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-boxy-atom-text-link 20.5.9
MAL-2026-12227 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-sme.salary.web.metrics 20.5.9
MAL-2026-12215 amazon-inspector

Aug 5, 2026
npm
tinkoff-pfp-block-mobile-panels 20.2.7
MAL-2026-12249 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-sme.platform.web.productsnavigation.events 20.7.2
MAL-2026-12214 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
pfa-autotests-reporter 20.2.8
MAL-2026-12185 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
pfp-forms-insurance-health 20.2.2
MAL-2026-12186 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-component-page-loader 20.8.2
MAL-2026-12239 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-pfp-integration-mobile-slider-icons 20.2.2
MAL-2026-12250 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-dss.insurance.service 20.3.2
MAL-2026-12257 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
peter-desktop-peter-big-column 20.3.2
MAL-2026-12184 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
retracfix 1.0.1, 1.0.0, 1.0.3
MAL-2026-12190 amazon-inspector

Aug 5, 2026
npm
stellarfix 1.0.3, 1.0.0, 1.0.4
MAL-2026-12216 amazon-inspector

Aug 5, 2026
npm
beaver-ui-ai-chat-layout 0.0.1
MAL-2026-12142 amazon-inspector

Aug 5, 2026
npm
beaver-ui-actions-button 5.4.7, 5.4.8, 12.3.9, 5.4.6, 5.4.9
MAL-2026-12141 amazon-inspector

Aug 5, 2026