Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,383 npm 223,244 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,383 reports · Feed

npm
shopping-shared-atom-mobile-cart-counter 20.6.6
MAL-2026-12070 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@zzzgenesis00/spl-token-utils 1.4.2
MAL-2026-12058 amazon-inspector

Aug 5, 2026
npm
tinkoff-boxy-mobile-vivid-heading 20.7.5
MAL-2026-12075 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-cache-path 20.8.3
MAL-2026-12076 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
statist-browser-typed-client-nfs.grocery.mobile.events 20.3.3
MAL-2026-12074 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
bigops-customer 35.1.1
MAL-2026-12038 amazon-inspector

Aug 5, 2026
npm
statist-browser-typed-client-hra.workplacer.events 20.9.1
MAL-2026-12045 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
bigops-create-manifest 35.2.4
MAL-2026-12037 amazon-inspector

Aug 5, 2026
npm
tui-react-mobile-styles 20.8.7
MAL-2026-12053 amazon-inspector

Aug 5, 2026
npm
beaver-ui-form-modal 34.6.3, 12.7.6
MAL-2026-12034 amazon-inspector

Aug 5, 2026
npm
statist-browser-typed-client-test.jumpwork.circuitbreaker 20.8.2
MAL-2026-12046 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-boxy-desktop-features-banner 20.2.4
MAL-2026-12048 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
bigops-auth-utils 35.4.5
MAL-2026-12035 amazon-inspector

Aug 5, 2026
npm
platform-ui-island 20.5.9
MAL-2026-12042 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
forge-extended 1.0.1, 1.0.2
MAL-2026-12040 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
specials-mvno-client 20.9.8
MAL-2026-12044 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-ui-action 20.5.7
MAL-2026-12051 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
aedes_clusters 1.0.1, 1.1.1
MAL-2026-12033 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tramvai-tinkoff-module-legacy-popup 20.4.9
MAL-2026-12052 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
tinkoff-component-infopanel 20.8.3
MAL-2026-12049 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
streak-day-utils 1.0.0
MAL-2026-12047 amazon-inspector

Aug 5, 2026
npm
data-format-helper 1.0.1, 1.0.0
MAL-2026-12039 amazon-inspector

Aug 5, 2026
npm
tinkoff-statist-browser-typed-client-sme.reporting.reporting 20.5.4
MAL-2026-12050 amazon-inspector, ghsa-malware 9 IOCs

Aug 5, 2026
npm
add-two-numbers-x7q9m 1.0.0, 1.0.1
MAL-2026-12032 amazon-inspector

Aug 5, 2026
npm
bigops-chat-tmsg 35.8.5
MAL-2026-12036 amazon-inspector

Aug 5, 2026
npm
platform-ui-codemods 20.6.7
MAL-2026-12041 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
@zzzgenesis00/ethers-wallet 6.13.5
MAL-2026-12031 amazon-inspector

Aug 5, 2026
npm
sextant-cli-linux-arm64 0.0.1-rc12, 0.0.1-rc11, 0.0.1-rc25, 0.0.1-rc29, 0.0.1-rc19, 0.0.1-rc20, 0.0.1-r…
MAL-2026-12043 amazon-inspector

Aug 5, 2026
npm
@zzzgenesis00/bip39-mnemonic 2.3.1
MAL-2026-12030 amazon-inspector

Aug 5, 2026
npm
uibabai 5.7.5
MAL-2026-12054 amazon-inspector

Aug 5, 2026
npm
sextant-cli-darwin-amd64 0.0.1-rc34, 0.0.1-rc31, 0.0.1-rc10, 0.0.1-rc16, 0.0.1-rc11, 0.0.1-rc12, 0.0.1-r…
MAL-2026-12028 amazon-inspector

Aug 5, 2026
npm
sextant-cli-linux-amd64 0.0.1-rc34, 0.0.1-rc26, 0.0.1-rc32, 0.0.1-rc13, 0.0.1-rc18, 0.0.1-rc28, 0.0.1-r…
MAL-2026-12029 amazon-inspector

Aug 5, 2026
npm
streak-map-metrics 1.0.0
MAL-2026-11999 amazon-inspector

Aug 5, 2026
npm
streak-metricsazb 1.0.0
MAL-2026-12002 amazon-inspector

Aug 5, 2026
npm
streak-metricazbd 1.0.0
MAL-2026-12001 amazon-inspector

Aug 5, 2026
npm
streak-test-mathcore 1.0.0
MAL-2026-12003 amazon-inspector

Aug 5, 2026
npm
streak-math-metrics 1.0.0
MAL-2026-12000 amazon-inspector, ghsa-malware

Aug 5, 2026
npm
sextant-cli-darwin-arm64 0.0.1-rc24, 0.0.1-rc31, 0.0.1-rc14, 0.0.1-rc19, 0.0.1-rc23, 0.0.1-rc25, 0.0.1-r…
MAL-2026-11997 amazon-inspector

Aug 5, 2026
npm
approval-guardian 1.0.1, 1.0.6, 1.0.5, 1.0.2, 1.0.3
MAL-2026-11995 amazon-inspector

Aug 4, 2026
npm
@tuluax/errb 3.0.1
MAL-2026-11993 amazon-inspector

Aug 4, 2026