Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,383 npm 223,244 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,383 reports · Feed

npm
emulative 1.0.1
MAL-2026-11996 amazon-inspector

Aug 4, 2026
npm
webdev-conf 5.0.0
MAL-2026-12005 amazon-inspector

Aug 4, 2026
npm
vitest-preview-pro 10.0.3, 10.0.7, 10.0.5, 10.0.6
MAL-2026-12004 amazon-inspector, ghsa-malware

Aug 4, 2026
npm
simple-date-formatter-util-7 1.0.0
MAL-2026-11998 amazon-inspector

Aug 4, 2026
npm
@zzzgenesis00/web3-provider-engine 16.0.5
MAL-2026-11994 amazon-inspector

Aug 4, 2026
npm
@zzzgenesis00/etherjs 6.15.0
MAL-2026-11530 amazon-inspector

Aug 4, 2026
npm
@zzzgenesis00/crypto-config 2.0.1
MAL-2026-11529 amazon-inspector

Aug 4, 2026
npm
@zzzgenesis00/solana-web3 2.1.0
MAL-2026-11533 amazon-inspector

Aug 4, 2026
npm
hubert-application-get-document-preview-am 20.4.6
MAL-2026-11540 amazon-inspector, ghsa-malware

Aug 4, 2026
npm
@zzzgenesis00/solana-wallet-adapter 0.18.0
MAL-2026-11532 amazon-inspector

Aug 4, 2026
npm
bigops-backend 35.8.3
MAL-2026-11535 amazon-inspector

Aug 4, 2026
npm
eacq-payform-core 20.3.6
MAL-2026-11538 amazon-inspector, ghsa-malware

Aug 4, 2026
npm
twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer 20.5.3
MAL-2026-11550 amazon-inspector, ghsa-malware

Aug 4, 2026
npm
entropyeasybots 2.0.2
MAL-2026-11539 amazon-inspector

Aug 4, 2026
npm
@zzzgenesis00/hdkey-wallet 2.1.0
MAL-2026-11531 amazon-inspector

Aug 4, 2026
npm
@zzzgenesis00/xrp-lib 2.14.0
MAL-2026-11534 amazon-inspector

Aug 4, 2026
npm
simple-date-formatter-util-6 1.0.0
MAL-2026-11546 amazon-inspector

Aug 4, 2026
npm
simple-date-formatter-util-10 1.0.0
MAL-2026-11544 amazon-inspector

Aug 4, 2026
npm
simple-date-formatter-util-9 1.0.0
MAL-2026-11547 amazon-inspector

Aug 4, 2026
npm
discord-vibegrations-api-helpers 1.0.0
MAL-2026-11536 amazon-inspector

Aug 4, 2026
npm
tinkoff-terminal-kit-carousel 20.6.3
MAL-2026-11549 amazon-inspector, ghsa-malware

Aug 4, 2026
npm
streak-math-abz 1.0.0
MAL-2026-11548 amazon-inspector

Aug 4, 2026
npm
nagixjs 2.1.6
MAL-2026-11541 amazon-inspector

Aug 4, 2026
npm
discord-vibegrations-api-natives 1.0.5
MAL-2026-11537 amazon-inspector

Aug 4, 2026
npm
simple-date-formatter-new-5 1.0.0
MAL-2026-11543 amazon-inspector

Aug 4, 2026
npm
osinthell 1.9.5, 1.0.1, 1.6.9, 1.0.5, 1.9.1, 1.6.6
MAL-2026-11542 amazon-inspector

Aug 4, 2026
npm
simple-date-formatter-util-15 1.0.0
MAL-2026-11545 amazon-inspector

Aug 4, 2026
npm
@ks-openclaw/kim 99.0.0, 99.0.1
MAL-2026-11528 amazon-inspector

Aug 4, 2026
npm
streak-metricsaz 1.0.0
MAL-2026-11527 amazon-inspector

Aug 4, 2026
npm
beaver-ui-form 34.9.1, 12.6.1
MAL-2026-11522 amazon-inspector

Aug 4, 2026
npm
nagix-nodejs 2.1.6
MAL-2026-11526 amazon-inspector

Aug 4, 2026
npm
nagix-node 2.1.6
MAL-2026-11525 amazon-inspector

Aug 4, 2026
npm
umadev 1.0.74
MAL-2026-11989 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@umacloud/knowledge 1.0.74
MAL-2026-11960 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@umacloud/cli-win32-x64 1.0.74
MAL-2026-11959 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@umacloud/cli-linux-x64 1.0.74
MAL-2026-11958 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@umacloud/cli-linux-musl-x64 1.0.74
MAL-2026-11957 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@umacloud/cli-linux-musl-arm64 1.0.74
MAL-2026-11956 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@umacloud/cli-linux-arm64 1.0.74
MAL-2026-11955 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@umacloud/cli-darwin-x64 1.0.74
MAL-2026-11954 ghsa-malware, amazon-inspector

Aug 4, 2026