Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,407 npm 223,265 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,407 reports · Feed

npm
@ks-radar/radar 22.0.0, 21.0.0, 20.0.0
MAL-2026-11066 ossf-package-analysis, amazon-inspector

Jul 25, 2026
PyPI
blessclient 0.0.1, 0.0.2
MAL-2026-11067 kam193, amazon-inspector

Jul 25, 2026
npm
swiper_angular 5.9999.0, 5.9999.1
MAL-2026-11065 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 25, 2026
npm
whs4_deu 1.0.1, 1.0.0
MAL-2026-11070 ossf-package-analysis, amazon-inspector

Jul 25, 2026
npm
wsh4_edu 1.0.0
MAL-2026-11072 ossf-package-analysis, amazon-inspector

Jul 25, 2026
npm
whs4_eud 1.0.1, 1.0.0
MAL-2026-11071 ossf-package-analysis, amazon-inspector

Jul 25, 2026
npm
page-navigation 1.0.1
MAL-2026-11064 ossf-package-analysis, amazon-inspector

Jul 25, 2026
npm
identityscimapiserv 28.0.0, 4.0.0
MAL-2026-11061 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 25, 2026
npm
xo-member-components 28.0.0, 8.0.0
MAL-2026-11063 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 25, 2026
npm
f0-form-manipulator 28.0.0
MAL-2026-11060 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 25, 2026
npm
preferenceslifecycle-paypal 28.0.0, 24.0.0
MAL-2026-11062 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 25, 2026
npm
merchantprefsservice-paypal 28.0.0, 24.0.0, 4.0.0
MAL-2026-11057 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 25, 2026
npm
gpaas-paypal 28.0.0, 4.0.0
MAL-2026-11056 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 25, 2026
npm
pp-react-ui5 28.0.0, 21.0.0
MAL-2026-11059 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 25, 2026
npm
payoutsvettingserv-paypal 28.0.0, 24.0.0
MAL-2026-11058 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 25, 2026
npm
fundraiserservicepp 1.5.0, 1.7.0
MAL-2026-11055 ossf-package-analysis, amazon-inspector

Jul 25, 2026
PyPI
trongridy 0.0.1
MAL-2026-11051 kam193 4 IOCs

Jul 24, 2026
npm
clerk-next-fix-auth-protection 8.8.8, 7.7.7
MAL-2026-11069 ossf-package-analysis, amazon-inspector

Jul 24, 2026
PyPI
discordnv 0.8.0
MAL-2026-11050 kam193, amazon-inspector 3 IOCs

Jul 24, 2026
npm
app-node-layer 2.1.6
MAL-2026-11054 ghsa-malware, amazon-inspector

Jul 24, 2026
npm
app-data-lts 2.1.6
MAL-2026-11053 ghsa-malware, amazon-inspector

Jul 24, 2026
npm
app-data-layer 2.1.6
MAL-2026-11052 ghsa-malware, amazon-inspector

Jul 24, 2026
PyPI
mrmustard 0.7.4
MAL-2026-11049 kam193, amazon-inspector 2 IOCs

Jul 24, 2026
PyPI
intel-cicd-repo-infrastructure 0.0.0, 1.0.0
MAL-2026-11046 kam193

Jul 24, 2026
PyPI
karpatkit 2.1.0, 2.1.1
MAL-2026-11048 kam193, amazon-inspector 4 IOCs

Jul 24, 2026
PyPI
karpatkey 2.1.1
MAL-2026-11047 kam193, amazon-inspector 4 IOCs

Jul 24, 2026
npm
subapp-pkg-util 99.0.1, 99.0.0
MAL-2026-11045 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 24, 2026
npm
@daylightqc/date-fmt-lite 1.1.1, 1.0.1, 1.0.0, 1.1.2
MAL-2026-11041 ossf-package-analysis, amazon-inspector

Jul 24, 2026
npm
eth-slint 1.0.0
MAL-2026-11034 ghsa-malware, amazon-inspector

Jul 23, 2026
PyPI
govapkg 0.1.0
MAL-2026-11031 kam193, amazon-inspector 3 IOCs

Jul 23, 2026
npm
chai-as-stringify 7.0.2, 7.0.1
MAL-2026-11032 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
yuinpm 2026.7.19-2
MAL-2026-11039 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
eth-codergen 1.0.2, 1.0.1, 1.0.0
MAL-2026-11033 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
svelte-streak-metrics 1.0.0
MAL-2026-11038 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
streak-lib-math 1.0.0
MAL-2026-11036 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
svelte-goal-streak 1.0.0
MAL-2026-11037 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
streak-bucket-lib 1.0.0
MAL-2026-11035 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
vitest-axios 1.0.4
MAL-2026-11030 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
fs-extra-core 1.3.4
MAL-2026-11027 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
lychee-norm-cache 22.0.0
MAL-2026-11029 ghsa-malware, amazon-inspector

Jul 23, 2026