Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,407 npm 223,265 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,407 reports · Feed

npm
datdbs all versions
MAL-2026-11275 ghsa-malware

Jul 30, 2026
npm
d3-bbox all versions
MAL-2026-11273 ghsa-malware

Jul 30, 2026
npm
cross-sell all versions
MAL-2026-11271 ghsa-malware

Jul 30, 2026
npm
confetti-rebuilds all versions
MAL-2026-11268 ghsa-malware

Jul 30, 2026
npm
columns_changed all versions
MAL-2026-11266 ghsa-malware

Jul 30, 2026
npm
cocktail-lib all versions
MAL-2026-11265 ghsa-malware

Jul 30, 2026
npm
canvas-to all versions
MAL-2026-11254 ghsa-malware

Jul 30, 2026
npm
cancelling all versions
MAL-2026-11253 ghsa-malware

Jul 30, 2026
npm
build-time-metrics all versions
MAL-2026-11252 ghsa-malware

Jul 30, 2026
npm
broccoli-watcher-siphon all versions
MAL-2026-11251 ghsa-malware

Jul 30, 2026
npm
bn.js-5 all versions
MAL-2026-11250 ghsa-malware

Jul 30, 2026
npm
bn.js-4 all versions
MAL-2026-11249 ghsa-malware

Jul 30, 2026
npm
baofdadbybmqeefeeginweoamxlphrjq all versions
MAL-2026-11245 ghsa-malware

Jul 30, 2026
npm
bajkvahzv8allnltvr7x4s5hdxkjvyji all versions
MAL-2026-11244 ghsa-malware

Jul 30, 2026
npm
aven_shared all versions
MAL-2026-11243 ghsa-malware

Jul 30, 2026
npm
apihost all versions
MAL-2026-11238 ghsa-malware

Jul 30, 2026
npm
pullingpackageeeeeeeeeee all versions
MAL-2026-11360 ghsa-malware

Jul 30, 2026
npm
pullingpackageeeeeeeeee all versions
MAL-2026-11359 ghsa-malware

Jul 30, 2026
npm
pullingpackageeeeeeeee all versions
MAL-2026-11358 ghsa-malware

Jul 30, 2026
npm
pullingpackageeeeeeee all versions
MAL-2026-11357 ghsa-malware

Jul 30, 2026
npm
pullingpackageeeeeee all versions
MAL-2026-11356 ghsa-malware

Jul 30, 2026
npm
pullingpackageeee all versions
MAL-2026-11355 ghsa-malware

Jul 30, 2026
npm
pullingpackageee all versions
MAL-2026-11354 ghsa-malware

Jul 30, 2026
npm
pullingpackagee all versions
MAL-2026-11353 ghsa-malware

Jul 30, 2026
npm
pullingpackaged all versions
MAL-2026-11352 ghsa-malware

Jul 30, 2026
npm
pullingpackage all versions
MAL-2026-11351 ghsa-malware

Jul 30, 2026
npm
@dotconf-pro/dotenv all versions
MAL-2026-11209 ghsa-malware

Jul 30, 2026
npm
@dotconf-pro/dotconf-pro all versions
MAL-2026-11208 ghsa-malware

Jul 30, 2026
npm
rumjs all versions
MAL-2026-11375 ghsa-malware

Jul 30, 2026
npm
@404c3s4r/testxxx 9.2.0
MAL-2026-11207 ghsa-malware, reversing-labs

Jul 30, 2026
npm
svelte-metric-map 1.0.0, 1.0.1
MAL-2026-11390 ghsa-malware, amazon-inspector

Jul 30, 2026
npm
streak-metrics-math 1.0.0, 1.0.1
MAL-2026-11388 ghsa-malware, amazon-inspector

Jul 30, 2026
npm
svelte-streak-metric 1.0.0
MAL-2026-11391 ghsa-malware, amazon-inspector

Jul 30, 2026
npm
streak-metrics-core all versions
MAL-2026-11387 ghsa-malware

Jul 30, 2026
npm
thedata 1.0.6, 1.0.0, 1.0.11, 1.0.10, 1.0.8, 1.0.13, 1.0.12, 1.0.2, 1.0.4, 1.0.7, 1.0.5…
MAL-2026-11400 ghsa-malware, amazon-inspector

Jul 30, 2026
npm
switchpaymentsapiserv-paypal 2.3.4
MAL-2026-11392 ghsa-malware, amazon-inspector

Jul 30, 2026
npm
consumerweb-risk 3.4.3
MAL-2026-11269 ghsa-malware, amazon-inspector

Jul 30, 2026
PyPI
mcp-search-server 1.0.0, 2.0.0, 2.0.1
MAL-2026-11198 kam193, amazon-inspector

Jul 30, 2026
PyPI
ai-perf-toolkit 2.4.2
MAL-2026-11197 kam193, amazon-inspector

Jul 30, 2026
npm
create-backend-scaffold 1.1.2, 1.1.1, 1.1.0, 1.0.5, 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0
MAL-2026-11270 ghsa-malware, amazon-inspector

Jul 30, 2026