Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,408 npm 223,266 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,408 reports · Feed

npm
streak-calendar 1.0.1, 1.0.0
MAL-2026-10981 ghsa-malware, amazon-inspector

Jul 21, 2026
npm
@apexfdn/apex 1.0.32, 1.0.31, 1.0.30, 1.0.29, 1.0.28, 1.0.27, 1.0.26, 1.0.25, 1.0.24, 1.0.23,…
MAL-2026-10979 ghsa-malware, amazon-inspector

Jul 21, 2026
PyPI
comp-colors 0.1.5
MAL-2026-10986 kam193, amazon-inspector 3 IOCs

Jul 21, 2026
npm
veskra 1.0.0, 1.0.1, 1.0.2, 1.0.3
MAL-2026-10984 ghsa-malware, amazon-inspector

Jul 21, 2026
npm
nolby 1.0.3, 1.0.2, 1.0.1, 1.0.0
MAL-2026-10980 ghsa-malware, amazon-inspector

Jul 21, 2026
npm
react-tabulix-ui 0.1.1, 0.1.0, 0.1.2
MAL-2026-10988 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 21, 2026
PyPI
animated-octo-spoon 0.1.0, 0.1.1
MAL-2026-10985 kam193, amazon-inspector

Jul 21, 2026
npm
react-tabulix-virtual 0.1.1, 0.1.0
MAL-2026-10989 ossf-package-analysis, amazon-inspector

Jul 21, 2026
npm
react-tabulix-core 0.1.3, 0.1.1, 0.1.2, 0.1.0
MAL-2026-10987 ossf-package-analysis, ghsa-malware, amazon-inspector

Jul 21, 2026
PyPI
reimagined-broccoli 0.1.0
MAL-2026-10978 kam193, amazon-inspector

Jul 21, 2026
PyPI
lebinfmt 1.0.0
MAL-2026-10977 kam193, amazon-inspector 4 IOCs

Jul 21, 2026
PyPI
colorstack 0.1.0, 0.1.1
MAL-2026-10976 kam193, amazon-inspector 3 IOCs

Jul 21, 2026
PyPI
rasterkit 1.0.0, 1.0.2, 1.0.4
MAL-2026-10974 kam193, amazon-inspector 4 IOCs

Jul 21, 2026
PyPI
rasterkit-demo 0.1.0
MAL-2026-10975 kam193, amazon-inspector 4 IOCs

Jul 21, 2026
PyPI
fluffy-octo-broccoli 0.1.0
MAL-2026-10973 kam193, amazon-inspector

Jul 21, 2026
npm
commonweb-rewards 99.9.1
MAL-2026-10968 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 21, 2026
npm
consumerweb-calurls 99.9.1
MAL-2026-10970 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 21, 2026
npm
commonweb-card 99.9.1
MAL-2026-10966 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 21, 2026
npm
commonweb-moneymovement 99.9.1
MAL-2026-10967 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 21, 2026
npm
signzy-field-level-encrypter 12.9.13, 12.9.12
MAL-2026-10972 ossf-package-analysis, amazon-inspector

Jul 21, 2026
npm
commonweb-wallet 99.9.1
MAL-2026-10969 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 21, 2026
npm
cxpw-offers 99.9.1
MAL-2026-10971 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 21, 2026
npm
requestor-util 99.9.1
MAL-2026-10965 ossf-package-analysis, amazon-inspector, ghsa-malware

Jul 21, 2026
npm
chai-leaf 1.4.5, 1.4.7, 1.4.6, 1.4.8
MAL-2026-10940 ghsa-malware, amazon-inspector, reversing-labs

Jul 21, 2026
npm
chai-as-reddit 7.0.2, 7.0.4, 7.0.3
MAL-2026-10939 ghsa-malware, amazon-inspector, reversing-labs

Jul 21, 2026
npm
faust-cont 1.0.0
MAL-2026-11042 amazon-inspector 2 IOCs

Jul 21, 2026
npm
date-format-utils-xz 1.0.3, 1.0.4, 1.0.0, 1.0.1, 1.0.2
MAL-2026-11001 amazon-inspector 2 IOCs

Jul 21, 2026
npm
ts-vitest 1.1.1, 1.1.3, 1.0.8, 1.1.2, 1.1.0, 1.0.9, 1.0.7
MAL-2026-10990 amazon-inspector, ghsa-malware 3 IOCs

Jul 21, 2026
PyPI
trongridmy 0.0.1
MAL-2026-10930 kam193 4 IOCs

Jul 20, 2026
PyPI
trongrider 0.0.1
MAL-2026-10929 kam193, amazon-inspector 4 IOCs

Jul 20, 2026
npm
upjsma 1.0.62, 1.0.65, 1.0.61, 1.0.64, 1.0.60, 1.0.63, 1.0.58, 1.0.66, 1.0.59
MAL-2026-10928 ghsa-malware, amazon-inspector

Jul 20, 2026
PyPI
roles-royce 2.1.1, 2.1.0
MAL-2026-10927 amazon-inspector, kam193 4 IOCs

Jul 20, 2026
PyPI
defi-kit 2.1.1
MAL-2026-10926 amazon-inspector, kam193 4 IOCs

Jul 20, 2026
npm
tilaver-mfa 1.0.0
MAL-2026-10925 amazon-inspector, ghsa-malware

Jul 20, 2026
npm
s3-lambda-dynamodb-cdk all versions
MAL-2026-10924 ghsa-malware

Jul 20, 2026
npm
lwc-slds-lbc 18.9.41
MAL-2026-10923 ghsa-malware, amazon-inspector

Jul 20, 2026
npm
lambda-cloudwatch-cdk 0.0.0
MAL-2026-10922 ghsa-malware, amazon-inspector

Jul 20, 2026
npm
iot-kfh-s3 17.3.23
MAL-2026-10921 ghsa-malware, amazon-inspector

Jul 20, 2026
npm
alb-lambda-cdk 18.2.22
MAL-2026-10920 ghsa-malware, amazon-inspector

Jul 20, 2026
PyPI
automatic-octo-invention 0.1.0, 0.1.1, 0.1.2, 0.1.3
MAL-2026-10918 kam193, amazon-inspector

Jul 20, 2026