Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,408 npm 223,266 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,408 reports · Feed

npm
twilio-serverless 99.99.99, 99.99.100
MAL-2026-10937 amazon-inspector

Jul 20, 2026
npm
twilio-platform-request 99.99.100, 99.99.99
MAL-2026-10936 amazon-inspector

Jul 20, 2026
npm
twilio-platform-async-data-fetch 99.99.100, 99.99.99
MAL-2026-10935 amazon-inspector

Jul 20, 2026
npm
twilio-internal 99.99.99, 99.99.100
MAL-2026-10934 amazon-inspector

Jul 20, 2026
npm
twilio-deploy 99.99.99, 99.99.100
MAL-2026-10933 amazon-inspector

Jul 20, 2026
npm
twilio-assets 99.99.99, 99.99.100
MAL-2026-10932 amazon-inspector

Jul 20, 2026
npm
org-twilio-phone-numbers-utils 99.99.99, 99.99.100
MAL-2026-10931 amazon-inspector

Jul 20, 2026
npm
zoom-widget-xss-poc-paresh 1.0.0
MAL-2026-10782 ghsa-malware, amazon-inspector

Jul 19, 2026
npm
chart-animation-helper 1.0.0
MAL-2026-10781 ghsa-malware, amazon-inspector

Jul 19, 2026
PyPI
data-parser-utils 2.4.1
MAL-2026-10780 kam193, amazon-inspector 14 IOCs

Jul 19, 2026
PyPI
tinkoff-cloud-apis-internal 0.0.1, 8.5.3, 8.5.4
MAL-2026-10917 kam193, amazon-inspector 8 IOCs

Jul 18, 2026
PyPI
python-devplatform-client 0.0.1, 8.5.3, 8.5.4
MAL-2026-10916 kam193, amazon-inspector 8 IOCs

Jul 18, 2026
PyPI
mlflow-ui 2.7.1, 2.7.2, 2.7.3
MAL-2026-10779 kam193, amazon-inspector 7 IOCs

Jul 18, 2026
npm
relativity-pdfjs-dist 5.8.2, 99.9.9
MAL-2026-10778 ossf-package-analysis, amazon-inspector

Jul 18, 2026
npm
telemetry-axios 0.1.5, 0.1.6
MAL-2026-10773 ghsa-malware, amazon-inspector

Jul 17, 2026
npm
axios-native 1.16.4, 1.16.1, 1.16.3
MAL-2026-10772 ghsa-malware, amazon-inspector

Jul 17, 2026
PyPI
dwh-kafka-client 0.0.1
MAL-2026-10915 kam193, amazon-inspector 8 IOCs

Jul 17, 2026
PyPI
trongridme 0.0.1
MAL-2026-10771 kam193 4 IOCs

Jul 17, 2026
PyPI
govpkg 0.1.0, 0.2.0
MAL-2026-10770 kam193, amazon-inspector 2 IOCs

Jul 17, 2026
npm
n8n-nodes-final-mile 1.0.5, 1.0.1, 1.0.3, 1.0.4, 1.0.0, 1.0.2
MAL-2026-10776 ossf-package-analysis, amazon-inspector

Jul 17, 2026
npm
n8n-nodes-devops-utils 1.0.7, 1.0.0, 1.0.5, 1.0.4, 1.0.6, 1.0.3, 1.0.2, 1.0.1
MAL-2026-10775 ossf-package-analysis, amazon-inspector

Jul 17, 2026
npm
n8n-nodes-probe 1.0.6, 1.0.2, 1.0.1, 1.0.5, 1.0.0, 1.0.3, 1.0.4
MAL-2026-10777 ossf-package-analysis, amazon-inspector

Jul 17, 2026
npm
easyway2 1.0.3, 1.0.7, 1.0.11, 1.0.0, 1.0.8, 1.0.2, 1.0.6, 1.0.5, 1.0.10, 1.0.1, 1.0.9
MAL-2026-10769 ossf-package-analysis, amazon-inspector

Jul 17, 2026
npm
n8n-nodes-api-finder 1.0.0, 1.0.2, 1.0.1
MAL-2026-10774 ossf-package-analysis, amazon-inspector

Jul 17, 2026
PyPI
trongridev 0.0.1
MAL-2026-10768 kam193 4 IOCs

Jul 17, 2026
npm
my-tailwind-gutenberg-block 0.1.2, 0.1.4, 0.1.3, 0.1.5, 0.1.0
MAL-2026-10761 ghsa-malware, amazon-inspector

Jul 16, 2026
PyPI
abseil-py 0.1.0
MAL-2026-10760 kam193, amazon-inspector

Jul 16, 2026
npm
@ai-support-agent/cli 0.3.2-beta.1, 0.4.2, 0.3.2-beta.15, 0.3.2-beta.9, 0.3.2-beta.2, 0.3.5-beta.5, 0…
MAL-2026-10707 amazon-inspector

Jul 16, 2026
PyPI
mfq-private-encoder 1.0.0
MAL-2026-10758 amazon-inspector

Jul 16, 2026
npm
@cyberrant-rantai/rantai 1.0.15
MAL-2026-10709 amazon-inspector

Jul 16, 2026
npm
channel-worker 2.5.39
MAL-2026-10729 amazon-inspector

Jul 16, 2026
npm
memtry-cli 1.0.4
MAL-2026-10736 amazon-inspector

Jul 16, 2026
npm
bvm-core 1.1.43, 1.1.42
MAL-2026-10728 amazon-inspector

Jul 16, 2026
npm
@whalent/agent 0.3.231, 0.3.283, 0.3.295, 0.3.282, 0.3.280, 0.3.296, 0.3.277, 0.3.297, 0.3.272…
MAL-2026-10721 amazon-inspector

Jul 16, 2026
npm
@agentvox/host 0.1.5
MAL-2026-10706 amazon-inspector

Jul 16, 2026
npm
@thepayulink/server 2.0.0
MAL-2026-10719 amazon-inspector

Jul 16, 2026
npm
axios-test-one 1.19.0, 1.19.1, 1.19.6, 1.19.5, 1.19.2, 1.19.4, 1.19.7, 1.19.3
MAL-2026-10727 amazon-inspector

Jul 16, 2026
npm
telemetry-metrics 0.2.1, 0.2.5, 0.2.3, 0.2.4, 0.2.2
MAL-2026-10750 amazon-inspector

Jul 16, 2026
npm
codeam-cli 2.61.1, 2.61.3
MAL-2026-10730 amazon-inspector

Jul 16, 2026
npm
@yeaft/webchat-agent 1.0.171, 1.0.199, 1.0.325, 1.0.376, 1.0.189, 1.0.283, 1.0.252, 1.0.238, 1.0.243…
MAL-2026-10723 amazon-inspector

Jul 16, 2026