Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,383 npm 223,244 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,383 reports · Feed

npm
@wethenorth12/ethers-wallet 6.13.5
MAL-2026-12094 amazon-inspector

Aug 5, 2026
npm
@wethenorth12/ethers-signer 3.2.1
MAL-2026-12093 amazon-inspector

Aug 5, 2026
npm
@wethenorth12/hdkey-wallet 2.1.0
MAL-2026-12096 amazon-inspector

Aug 5, 2026
npm
@wethenorth12/near-api 3.0.1
MAL-2026-12098 amazon-inspector

Aug 5, 2026
npm
@wethenorth12/web3-provider-engine 16.0.5
MAL-2026-12106 amazon-inspector

Aug 5, 2026
npm
@wethenorth12/mnemonic-to-key 1.2.0
MAL-2026-12097 amazon-inspector

Aug 5, 2026
npm
tailwind-hide-scrollbar 2.1.5, 2.2.0, 0.0.1, 2.2.1
MAL-2026-12116 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
streak-calc-math 1.0.0
MAL-2026-12114 amazon-inspector

Aug 5, 2026
npm
@ccfly/setup-darwin-arm64 0.1.20, 0.1.5, 0.1.10, 0.1.14, 0.1.9, 0.1.2, 0.1.8, 0.1.13, 0.1.7
MAL-2026-12084 amazon-inspector

Aug 5, 2026
npm
streak-math-calc 1.0.0
MAL-2026-12115 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
bip32-js 1.0.1, 1.0.2, 1.0.0
MAL-2026-12109 amazon-inspector

Aug 5, 2026
npm
python-bitcoinlib 1.0.3, 1.0.1, 1.0.0, 1.0.2
MAL-2026-12113 amazon-inspector

Aug 5, 2026
npm
mnemonic-utils 1.0.1, 1.0.2, 1.0.0
MAL-2026-12112 amazon-inspector

Aug 5, 2026
npm
ethereum-sign-utils 1.0.1, 1.0.0, 1.0.2
MAL-2026-12110 amazon-inspector

Aug 5, 2026
npm
ethers-lib 1.0.0, 1.0.4, 1.0.2, 1.0.1, 1.0.3
MAL-2026-12111 amazon-inspector

Aug 5, 2026
npm
alipclutch-baileys 8.6.60, 8.6.58, 8.6.59, 8.6.75, 8.6.77, 8.6.63, 8.6.70, 8.6.71, 8.6.64, 8.6.66,…
MAL-2026-12108 amazon-inspector, ghsa-malware

Aug 5, 2026
PyPI
crypto-wallet-sdk 1.8.3
MAL-2026-12083 kam193 1 IOC

Aug 5, 2026
PyPI
crypto-trading-toolkit 3.2.0
MAL-2026-12082 kam193 1 IOC

Aug 5, 2026
PyPI
bitcoinlib-py 0.9.0
MAL-2026-12081 kam193 1 IOC

Aug 5, 2026
PyPI
bip39-py 1.0.6
MAL-2026-12080 kam193 1 IOC

Aug 5, 2026
npm
@zzzgenesis00/mnemonic-to-key 1.2.0
MAL-2026-12056 amazon-inspector

Aug 5, 2026
npm
volna-boxy-di-test 20.3.8
MAL-2026-12079 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@zzzgenesis00/docker-api-client 2.0.2
MAL-2026-12055 amazon-inspector

Aug 5, 2026
npm
beaver-ui-card-large 12.4.3, 9.6.4, 9.6.5, 9.6.3, 9.6.2
MAL-2026-12060 amazon-inspector

Aug 5, 2026
npm
trezor-lib 1.0.0, 1.0.2, 1.0.1, 1.0.3
MAL-2026-12078 ossf-package-analysis, amazon-inspector

Aug 5, 2026
npm
hwi-lib 1.0.1, 1.0.0, 1.0.2
MAL-2026-12067 ossf-package-analysis, amazon-inspector

Aug 5, 2026
npm
ckcc-protocol 1.0.0, 1.0.3, 1.0.2, 1.0.1
MAL-2026-12064 ossf-package-analysis, amazon-inspector

Aug 5, 2026
npm
bcore-bravo-eslint-config 12.5.7, 9.5.7, 9.5.9, 9.5.8, 9.5.6
MAL-2026-12059 amazon-inspector

Aug 5, 2026
npm
ledger-lib 1.0.0, 1.0.1, 1.0.3, 1.0.2
MAL-2026-12068 ossf-package-analysis, amazon-inspector

Aug 5, 2026
npm
sso-tramvai-module-context-auth 20.4.5
MAL-2026-12073 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
boardwalk-js-tests 1.1.1, 1.1.2
MAL-2026-12062 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@zzzgenesis00/playwrite 1.48.0
MAL-2026-12057 amazon-inspector

Aug 5, 2026
npm
checkout-create-pos-order-am 20.9.5
MAL-2026-12063 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
hubert-appointment-v2-task-create-am 20.4.4
MAL-2026-12066 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
bigops-eslint 35.9.5
MAL-2026-12061 amazon-inspector

Aug 5, 2026
npm
greatcall-customers-commandapi 99.0.0
MAL-2026-12065 amazon-inspector

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-sme.compliance.web.events 20.4.4
MAL-2026-12077 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
specials-obid-webpack 20.5.4
MAL-2026-12072 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
sotqa-test 20.3.8
MAL-2026-12071 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
nxify-unic 20.3.2
MAL-2026-12069 amazon-inspector, ghsa-malware

Aug 5, 2026