Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,383 npm 223,244 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,383 reports · Feed

npm
beaver-ui-hooks 34.4.2, 12.6.3, 35.3.5
MAL-2026-12146 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
beaver-ui-form-object 34.7.5, 12.1.7, 35.7.3
MAL-2026-12145 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
beaver-ui-icon-lock 12.2.3, 34.8.3
MAL-2026-12147 amazon-inspector

Aug 5, 2026
npm
akamai-sensorv3 1.0.0
MAL-2026-12139 amazon-inspector

Aug 5, 2026
npm
beaver-ui-breadcrumbs 33.1.6, 0.0.2
MAL-2026-12143 amazon-inspector

Aug 5, 2026
npm
tinkoff-pfp-atom-styles-tiles 20.2.8
MAL-2026-12246 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-boxy-form-desktop-sme-registration-ooo 20.4.5
MAL-2026-12231 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-mb.reliability.android.events 20.5.4
MAL-2026-12269 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-boxy-desktop-icons-horizontal 20.1.8
MAL-2026-12228 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
beaver-ui-drawer 11.3.5, 11.3.6, 0.0.1, 9.4.10, 9.4.11, 9.4.12, 9.4.9, 9.4.7, 12.5.2, 9.4.8
MAL-2026-12144 amazon-inspector

Aug 5, 2026
npm
agent-bot-api 1.0.0, 1.0.1
MAL-2026-12138 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
pfp-forms-sme-registration-ooo 20.2.1
MAL-2026-12187 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
twork-products-taiga2-products-investment 20.2.8
MAL-2026-12305 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
nolimit-agent 1.0.343, 1.0.309, 1.0.313, 1.0.318, 1.0.330, 1.0.300, 1.0.339, 1.0.332, 1.0.307…
MAL-2026-12183 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
accounts-timeline 9.6.9, 9.6.10, 9.6.11, 9.6.12, 12.3.7
MAL-2026-12137 amazon-inspector

Aug 5, 2026
npm
devpack-conf 5.0.0
MAL-2026-12177 amazon-inspector

Aug 5, 2026
npm
simple-date-formatter-util-8 1.0.0
MAL-2026-12206 amazon-inspector

Aug 5, 2026
npm
simple-date-formatter-util-4 1.0.1, 1.0.0
MAL-2026-12205 amazon-inspector

Aug 5, 2026
npm
simple-date-formatter-util-12 1.0.0
MAL-2026-12201 amazon-inspector

Aug 5, 2026
npm
simple-date-formatter-util-11 1.0.0
MAL-2026-12200 amazon-inspector

Aug 5, 2026
npm
simple-date-formatter-util-13 1.0.0
MAL-2026-12202 amazon-inspector

Aug 5, 2026
npm
simple-date-formatter-util-14 1.0.0
MAL-2026-12203 amazon-inspector

Aug 5, 2026
npm
simple-date-formatter-util-16 1.0.0
MAL-2026-12204 amazon-inspector

Aug 5, 2026
npm
simple-date-formatter-new-6 1.0.0
MAL-2026-12197 amazon-inspector

Aug 5, 2026
npm
simple-date-formatter-new-2 1.0.0
MAL-2026-12194 amazon-inspector

Aug 5, 2026
npm
simple-date-formatter-new-7 1.0.0
MAL-2026-12198 amazon-inspector

Aug 5, 2026
npm
simple-date-formatter-new-8 1.0.0
MAL-2026-12199 amazon-inspector

Aug 5, 2026
npm
simple-date-formatter-new-3 1.0.0
MAL-2026-12195 amazon-inspector

Aug 5, 2026
npm
simple-date-formatter-new-4 1.0.0
MAL-2026-12196 amazon-inspector

Aug 5, 2026
npm
bigops-api-mobile 35.6.2
MAL-2026-12148 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
bigops-voximplant 20.8.5, 35.4.8
MAL-2026-12172 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
bigops-cobrowsing 35.4.9
MAL-2026-12159 amazon-inspector

Aug 5, 2026
npm
bigops-figma-to-html 35.5.5
MAL-2026-12166 amazon-inspector

Aug 5, 2026
npm
bigops-customer-processing-client 35.1.8
MAL-2026-12162 amazon-inspector

Aug 5, 2026
npm
bigops-informer 35.4.8
MAL-2026-12171 amazon-inspector

Aug 5, 2026
npm
bigops-auth 35.8.6
MAL-2026-12149 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
bigops-auth-cache 35.3.9
MAL-2026-12150 amazon-inspector

Aug 5, 2026
npm
bigops-chat-transfer 35.3.6
MAL-2026-12156 amazon-inspector

Aug 5, 2026
npm
bigops-cobrowsing-client 35.1.9
MAL-2026-12160 amazon-inspector

Aug 5, 2026
npm
bigops-data-storage 35.7.1
MAL-2026-12163 amazon-inspector

Aug 5, 2026