Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,408 npm 223,266 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,408 reports · Feed

PyPI
ml-core-airflow-auth 0.0.1
MAL-2026-10919 kam193, amazon-inspector 8 IOCs

Jul 20, 2026
npm
your-unique-package-name1337 1.0.0
MAL-2026-10906 reversing-labs

Jul 20, 2026
npm
win-build-utils 1.0.0
MAL-2026-10905 reversing-labs, amazon-inspector

Jul 20, 2026
npm
solana-web3-v1 1.0.0
MAL-2026-10904 reversing-labs, amazon-inspector

Jul 20, 2026
npm
solana-web3-stable 1.0.0
MAL-2026-10903 reversing-labs, amazon-inspector

Jul 20, 2026
npm
solana-web3-patched 1.0.0
MAL-2026-10902 reversing-labs, amazon-inspector

Jul 20, 2026
npm
solana-web3-lts 1.0.0
MAL-2026-10901 reversing-labs, amazon-inspector

Jul 20, 2026
npm
solana-web3-fork 1.0.0
MAL-2026-10900 reversing-labs, amazon-inspector

Jul 20, 2026
npm
solana-web3-fixed 1.0.0
MAL-2026-10899 reversing-labs, amazon-inspector

Jul 20, 2026
npm
solana-rpc-client 1.0.0
MAL-2026-10898 reversing-labs, amazon-inspector

Jul 20, 2026
npm
golan125-homepage-test 1.0.0
MAL-2026-10897 reversing-labs, amazon-inspector

Jul 20, 2026
npm
flow-eslint-oxidized 0.0.1, 74.2.1
MAL-2026-10896 reversing-labs

Jul 20, 2026
npm
exodus-payments 99.0.0-canary.1
MAL-2026-10895 reversing-labs, amazon-inspector

Jul 20, 2026
npm
exodus-checkout 99.0.0-canary.1
MAL-2026-10894 reversing-labs, amazon-inspector

Jul 20, 2026
npm
ecto-cargo-wk1tm59a 99.0.0
MAL-2026-10893 reversing-labs, amazon-inspector

Jul 20, 2026
npm
claude-code-timer 1.0.0
MAL-2026-10892 reversing-labs, amazon-inspector

Jul 20, 2026
npm
bytecraft 1.5.0, 2.0.0
MAL-2026-10891 reversing-labs, amazon-inspector

Jul 20, 2026
npm
analysis-chart 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16, 2.0.17, 2…
MAL-2026-10890

Jul 20, 2026
npm
@public-for-cdao/utils 99.99.99
MAL-2026-10889 reversing-labs

Jul 20, 2026
npm
@public-for-cdao/signer 99.99.99
MAL-2026-10888 reversing-labs

Jul 20, 2026
npm
@public-for-cdao/sdk 99.99.99
MAL-2026-10887 reversing-labs

Jul 20, 2026
npm
@public-for-cdao/deploy 99.99.99
MAL-2026-10886 reversing-labs

Jul 20, 2026
npm
@public-for-cdao/core 99.99.99
MAL-2026-10885 reversing-labs

Jul 20, 2026
npm
@public-for-cdao/contracts 99.99.99
MAL-2026-10884 reversing-labs

Jul 20, 2026
npm
@public-for-cdao/bot 99.99.99
MAL-2026-10883 reversing-labs

Jul 20, 2026
npm
@public-for-cdao/backend 99.99.99
MAL-2026-10882 reversing-labs

Jul 20, 2026
npm
@irys-solutions/odesa-main 1.0.0
MAL-2026-10881 reversing-labs, amazon-inspector

Jul 20, 2026
npm
@examplecorptest/hearsay-design-system-test 9.5.0
MAL-2026-10880 reversing-labs

Jul 20, 2026
npm
@dxcl/user-js 99.99.99
MAL-2026-10879 reversing-labs

Jul 20, 2026
npm
@dxcl/transaction-js 99.99.99
MAL-2026-10878 reversing-labs

Jul 20, 2026
npm
@dxcl/log-function-js 99.99.99
MAL-2026-10877 reversing-labs

Jul 20, 2026
npm
@dxcl/indicators-js 99.99.99
MAL-2026-10876 reversing-labs

Jul 20, 2026
npm
@dxcl/http-common-js 99.99.99
MAL-2026-10875 reversing-labs

Jul 20, 2026
npm
@dxcl/fund-js 99.99.99
MAL-2026-10874 reversing-labs

Jul 20, 2026
npm
@dxcl/customer-js 99.99.99
MAL-2026-10873 reversing-labs

Jul 20, 2026
npm
@dxcl/account-js 99.99.99
MAL-2026-10872 reversing-labs

Jul 20, 2026
npm
@azure-lab-services/ml-ts 99.0.0
MAL-2026-10871 reversing-labs

Jul 20, 2026
npm
@atlaskit-internal_.smart-card/hover-card 99.0.0
MAL-2026-10870 reversing-labs

Jul 20, 2026
RubyGems
my_shoaib_gem 0.1.0, 1.0.1, 1.1.1, 1.1.2, 1.2.2
MAL-2026-10914 reversing-labs

Jul 20, 2026
RubyGems
ike-artifactory-ruby 90002.0
MAL-2026-10913 reversing-labs

Jul 20, 2026