Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,407 npm 223,265 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,407 reports · Feed

npm
cloud-config-fetcher all versions
MAL-2026-11165 ghsa-malware

Jul 28, 2026
npm
smart-config-manager all versions
MAL-2026-11169 ghsa-malware

Jul 28, 2026
npm
simple-probe-utils 1.0.1, 1.0.0
MAL-2026-11147 amazon-inspector

Jul 28, 2026
npm
korvica 1.0.0
MAL-2026-11140 amazon-inspector

Jul 28, 2026
npm
streak-core-lib 1.0.0
MAL-2026-11148 amazon-inspector

Jul 28, 2026
PyPI
vtranalytic 9.0.1, 9.0.4
MAL-2026-11156 amazon-inspector

Jul 28, 2026
npm
color-convert-helper 1.0.0
MAL-2026-11134 amazon-inspector

Jul 28, 2026
npm
json-schema-inspector 1.1.5, 1.1.7, 1.1.6, 1.1.4
MAL-2026-11138 amazon-inspector

Jul 28, 2026
npm
bianira-ui 1.27.0
MAL-2026-11132 amazon-inspector

Jul 28, 2026
npm
streak-core-math 1.0.0
MAL-2026-11149 amazon-inspector

Jul 28, 2026
npm
@crbrc/xbt 1.1.2, 1.1.1, 1.2.1, 1.1.3, 1.1.4, 1.1.0
MAL-2026-11122 amazon-inspector

Jul 28, 2026
npm
kordyn 0.9.16, 0.9.18, 0.9.10, 0.9.17, 0.9.11, 0.9.14, 0.9.15
MAL-2026-11139 amazon-inspector

Jul 28, 2026
npm
rollup-runtime-core-polyfills 0.0.1, 0.13.0
MAL-2026-11145 amazon-inspector

Jul 28, 2026
npm
react-puller 1.0.0
MAL-2026-11144 amazon-inspector

Jul 28, 2026
npm
blots 2.1.0, 2.1.1
MAL-2026-11158 ossf-package-analysis, amazon-inspector

Jul 28, 2026
npm
array-node-utils 1.0.9
MAL-2026-11130 amazon-inspector

Jul 28, 2026
npm
text-line-parser 1.0.0
MAL-2026-11151 amazon-inspector

Jul 28, 2026
npm
sigchain-js 1.0.1, 1.0.0
MAL-2026-11146 amazon-inspector, ghsa-malware

Jul 28, 2026
npm
@apexfnd/apex 1.0.0, 1.0.1, 1.0.3, 1.0.4
MAL-2026-11121 amazon-inspector

Jul 28, 2026
npm
node-array-plus 1.0.9, 1.1.9
MAL-2026-11142 amazon-inspector

Jul 28, 2026
npm
streak-daily-lib 1.0.0
MAL-2026-11150 amazon-inspector

Jul 28, 2026
npm
parallely 10.0.3, 10.0.4
MAL-2026-11143 amazon-inspector, ghsa-malware

Jul 28, 2026
npm
ethers-secure 1.0.0
MAL-2026-11135 amazon-inspector

Jul 28, 2026
npm
tidal-embed-player 1.0.1, 1.0.2
MAL-2026-11152 amazon-inspector, ghsa-malware

Jul 28, 2026
npm
basic-vite 1.0.0
MAL-2026-11131 amazon-inspector

Jul 28, 2026
npm
triage_bot_using_sdkv3 2.0.1, 2.0.2
MAL-2026-11153 amazon-inspector, ghsa-malware, reversing-labs

Jul 28, 2026
npm
jobber-app-template-react 1.0.1, 1.1.1
MAL-2026-11137 amazon-inspector, ghsa-malware

Jul 28, 2026
npm
@yancyyu/agentcli 1.9.32, 1.9.42, 1.9.35, 1.9.27, 1.9.52, 1.9.43, 1.9.61, 1.9.66, 1.9.67, 1.9.48,…
MAL-2026-11123 amazon-inspector

Jul 28, 2026
npm
xerohub-discord-voice-v3 3.0.2, 3.0.0, 3.0.3, 3.0.1
MAL-2026-11155 amazon-inspector

Jul 28, 2026
npm
xerohub-discord-voice-v2 1.8.0, 1.7.0, 2.1.0, 2.3.0, 1.6.0, 2.5.0, 2.6.0, 2.2.0, 2.4.0, 2.7.0, 1.2.0, 1.…
MAL-2026-11154 amazon-inspector

Jul 28, 2026
npm
lib-streak-math 1.0.0
MAL-2026-11141 amazon-inspector

Jul 28, 2026
npm
@ai_/autoprefixers 1.2.0, 1.0.0, 1.1.0
MAL-2026-11120 amazon-inspector

Jul 28, 2026
npm
app-sim-layer 2.1.6
MAL-2026-11126 amazon-inspector

Jul 28, 2026
npm
app-sima-layer 2.1.6
MAL-2026-11127 amazon-inspector

Jul 28, 2026
npm
app-svm-layer 2.1.6
MAL-2026-11129 amazon-inspector

Jul 28, 2026
npm
api-rust-sdk 2.1.6
MAL-2026-11125 amazon-inspector

Jul 28, 2026
npm
api-node-sdk 2.1.6
MAL-2026-11124 amazon-inspector

Jul 28, 2026
npm
fluid-type-ui 2.0.8, 2.0.9
MAL-2026-11136 amazon-inspector, ghsa-malware

Jul 28, 2026
npm
chain-analyze 1.0.2, 1.0.4, 1.0.3, 1.0.1, 1.0.5
MAL-2026-11133 amazon-inspector, ghsa-malware

Jul 28, 2026
npm
toll_free 1.0.1, 1.0.2
MAL-2026-11159 ossf-package-analysis, amazon-inspector

Jul 28, 2026