Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,406 npm 223,265 PyPI 11,995 RubyGems 4,318 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,406 reports · Feed

npm
smart-npv-mcp 1.0.0
MAL-2026-11486 ghsa-malware, amazon-inspector

Jul 31, 2026
npm
routerbase-mcp 1.0.0
MAL-2026-11480 ghsa-malware, amazon-inspector

Jul 31, 2026
npm
polyprompt 1.0.0
MAL-2026-11476 ghsa-malware, amazon-inspector

Jul 31, 2026
npm
install-native-host 1.0.0
MAL-2026-11468 ghsa-malware, amazon-inspector

Jul 31, 2026
npm
goldenflow-js 1.0.0
MAL-2026-11463 ghsa-malware, amazon-inspector

Jul 31, 2026
npm
iac-scanner 1.0.0, 0.0.2
MAL-2026-11467 ghsa-malware, amazon-inspector

Jul 31, 2026
npm
ai-backup-script 1.0.2, 1.0.0, 0.0.2
MAL-2026-11454 ghsa-malware, amazon-inspector

Jul 31, 2026
npm
@404c3s4r/lodash 9.0.0
MAL-2026-11434 ghsa-malware, reversing-labs

Jul 31, 2026
PyPI
asdk-plugin-ai-platform 0.0.1, 9999.0.0
MAL-2026-11421 kam193

Jul 31, 2026
PyPI
asdk-plugin-alphagen 0.0.1, 9999.0.0
MAL-2026-11422 kam193, ossf-package-analysis

Jul 31, 2026
PyPI
asdk-plugin-legacy 0.0.1, 9999.0.0
MAL-2026-11423 kam193

Jul 31, 2026
npm
eth-bridge 1.0.1, 1.0.0
MAL-2026-11461 ghsa-malware, amazon-inspector

Jul 31, 2026
npm
vite-tsconfig-svg 1.1.4
MAL-2026-11497 ghsa-malware, amazon-inspector

Jul 31, 2026
npm
rollup-plugin-polyfill-hold 1.0.5
MAL-2026-11479 ghsa-malware, amazon-inspector

Jul 31, 2026
npm
@0xlr/test-callback 1.0.0
MAL-2026-11433 ghsa-malware, amazon-inspector

Jul 31, 2026
npm
@0xlr/question-types all versions
MAL-2026-11432 ghsa-malware

Jul 31, 2026
npm
@0xlr/dep-confusion-poc 0.0.1
MAL-2026-11431 ghsa-malware, amazon-inspector

Jul 31, 2026
PyPI
aiprepkit 0.1.2
MAL-2026-11417 kam193, amazon-inspector 2 IOCs

Jul 31, 2026
PyPI
ailaunchkit 0.1.2
MAL-2026-11416 kam193, amazon-inspector 2 IOCs

Jul 31, 2026
PyPI
walmart-genai-trace 99.0.0
MAL-2026-11420 kam193

Jul 31, 2026
PyPI
catalogai 0.1.2
MAL-2026-11418 kam193, amazon-inspector 2 IOCs

Jul 31, 2026
PyPI
cognikit 0.1.2
MAL-2026-11419 kam193, amazon-inspector 2 IOCs

Jul 31, 2026
PyPI
aiassistcore 0.1.2
MAL-2026-11414 kam193, amazon-inspector 2 IOCs

Jul 31, 2026
PyPI
aichannel 0.1.2
MAL-2026-11415 kam193, amazon-inspector 2 IOCs

Jul 31, 2026
npm
vite-config-svg 1.1.7
MAL-2026-11496 ghsa-malware, amazon-inspector

Jul 31, 2026
npm
rollup-plugin-polyfill-helper 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.5, 1.0.0
MAL-2026-11478 ghsa-malware, amazon-inspector

Jul 31, 2026
PyPI
reguestsc 2.34.2
MAL-2026-11413 kam193 1 IOC

Jul 31, 2026
npm
@peptide-packets/peptide-modify all versions
MAL-2026-11448 ghsa-malware

Jul 31, 2026
npm
@peptide-packets/js-unimode 1.1.1
MAL-2026-11447 ghsa-malware, amazon-inspector

Jul 31, 2026
npm
socketi 1.0.1
MAL-2026-11382 ghsa-malware, reversing-labs

Jul 31, 2026
npm
soccketio 1.0.1
MAL-2026-11381 ghsa-malware, reversing-labs

Jul 31, 2026
npm
asdsafsafdasdsaasdasda all versions
MAL-2026-11242 ghsa-malware

Jul 31, 2026
npm
vcse 1.0.0, 1.0.1
MAL-2026-11408 ghsa-malware, reversing-labs

Jul 31, 2026
npm
socktio all versions
MAL-2026-11383 ghsa-malware

Jul 31, 2026
npm
scketio all versions
MAL-2026-11376 ghsa-malware

Jul 31, 2026
npm
passtpor 1.0.1
MAL-2026-11345 ghsa-malware, reversing-labs

Jul 31, 2026
npm
passsport1 1.0.1
MAL-2026-11344 ghsa-malware, reversing-labs

Jul 31, 2026
npm
moontose all versions
MAL-2026-11334 ghsa-malware

Jul 31, 2026
npm
mongostose all versions
MAL-2026-11333 ghsa-malware

Jul 31, 2026
npm
asdsafsadad 1.0.1
MAL-2026-11241 ghsa-malware, reversing-labs

Jul 31, 2026