Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,408 npm 223,266 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,408 reports · Feed

npm
agentto 0.5.36
MAL-2026-10725 amazon-inspector

Jul 16, 2026
npm
sakuraai 0.0.11
MAL-2026-10746 amazon-inspector

Jul 16, 2026
PyPI
dde-common 0.0.1, 8.5.3, 8.5.4
MAL-2026-10757 amazon-inspector, kam193 8 IOCs

Jul 16, 2026
PyPI
darkglitch 1.2.0, 1.2.9, 1.4.5, 1.4.4
MAL-2026-10756 amazon-inspector

Jul 16, 2026
npm
@sciagent/cli 1.0.68, 1.0.69
MAL-2026-10718 amazon-inspector

Jul 16, 2026
PyPI
a3s-code 5.2.8, 5.3.3
MAL-2026-10753 amazon-inspector

Jul 16, 2026
PyPI
captcha-solve-api 0.0.1, 8.5.3, 8.5.4
MAL-2026-10755 amazon-inspector, kam193 8 IOCs

Jul 16, 2026
PyPI
airflow-provider-spirit 0.0.1, 8.5.3, 8.5.4
MAL-2026-10754 amazon-inspector, kam193 8 IOCs

Jul 16, 2026
npm
sensorium-mcp 3.0.95
MAL-2026-10747 amazon-inspector

Jul 16, 2026
npm
hehehe 2.0.2, 2.0.1
MAL-2026-10732 amazon-inspector, ghsa-malware

Jul 16, 2026
npm
@onescience/onecode 1.14.50-202607161038, 1.14.50-202607161710, 1.14.50-202607161139, 1.14.50-20260…
MAL-2026-10717 amazon-inspector

Jul 16, 2026
npm
@agent-link/agent 0.1.269, 0.1.325, 0.1.319, 0.1.285, 0.1.280, 0.1.272, 0.1.310, 0.1.293, 0.1.283…
MAL-2026-10705 amazon-inspector

Jul 16, 2026
npm
@whalent/agent-core 0.3.230, 0.3.231, 0.3.232, 0.3.233, 0.3.254, 0.3.280, 0.3.298, 0.3.294, 0.3.295…
MAL-2026-10722 amazon-inspector

Jul 16, 2026
npm
netcontrol-agent 1.0.5
MAL-2026-10741 amazon-inspector

Jul 16, 2026
PyPI
ryry-cli 6.28, 6.26
MAL-2026-10759 amazon-inspector

Jul 16, 2026
npm
@vibelet/cli 1.2.154
MAL-2026-10720 amazon-inspector

Jul 16, 2026
npm
vanexa-agent 1.1.10, 1.1.9, 1.1.23, 1.1.46, 1.1.34, 1.1.39, 1.1.27, 1.1.18, 1.1.22, 1.1.28, …
MAL-2026-10751 amazon-inspector

Jul 16, 2026
npm
@yuandc/aica 0.1.4, 0.1.1
MAL-2026-10724 amazon-inspector

Jul 16, 2026
npm
infrastructure-common 99.9.9
MAL-2026-10734 amazon-inspector

Jul 16, 2026
npm
myreviews-core 99.0.0
MAL-2026-10740 amazon-inspector

Jul 16, 2026
npm
mw-server-util 2.0.1, 2.0.0
MAL-2026-10739 amazon-inspector

Jul 16, 2026
npm
date-utils-light 1.0.1
MAL-2026-10731 amazon-inspector

Jul 16, 2026
npm
idlive-document-capture-web 14.2.1
MAL-2026-10733 amazon-inspector

Jul 16, 2026
npm
@equans-services/codex 1.0.0
MAL-2026-10710 amazon-inspector

Jul 16, 2026
npm
mmagrt 0.1.10
MAL-2026-10737 amazon-inspector

Jul 16, 2026
npm
xxdxa 1.0.3, 1.0.2, 1.0.4, 1.0.5, 1.0.7, 1.0.1, 1.0.6
MAL-2026-10752 amazon-inspector

Jul 16, 2026
npm
mui-option 1.0.0
MAL-2026-10738 amazon-inspector

Jul 16, 2026
npm
sync-grove 1.0.2, 1.0.1, 1.0.0
MAL-2026-10749 amazon-inspector

Jul 16, 2026
npm
@hibachi-xyz/common 99.0.0
MAL-2026-10712 amazon-inspector

Jul 16, 2026
npm
isite 2026.7.2, 2026.8.26, 2026.7.1, 2026.6.1, 2026.4.5, 2026.4.4, 2026.4.3, 2026.4.2…
MAL-2026-10735 amazon-inspector, ghsa-malware

Jul 16, 2026
npm
@funny-booth/agent-core 0.1.6, 0.1.1, 0.1.5, 0.1.3, 0.1.4, 0.1.2, 0.1.9, 0.1.7, 0.1.8
MAL-2026-10711 amazon-inspector

Jul 16, 2026
npm
node-as-api 2.1.6
MAL-2026-10742 amazon-inspector

Jul 16, 2026
npm
string-formatter-pro 1.0.1, 1.0.0
MAL-2026-10748 amazon-inspector

Jul 16, 2026
PyPI
discordia-telemetria 0.1.1, 0.1.2
MAL-2026-10702 kam193, amazon-inspector 3 IOCs

Jul 16, 2026
npm
time-format-kit 1.0.2, 1.0.0, 1.0.1
MAL-2026-10700 ossf-package-analysis, amazon-inspector

Jul 16, 2026
PyPI
discord-telemetry 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5
MAL-2026-10701 kam193, amazon-inspector 3 IOCs

Jul 16, 2026
npm
http-req-lite 1.0.0
MAL-2026-10699 ossf-package-analysis

Jul 16, 2026
npm
@across-toolkit/eslint-config 99.0.1, 99.0.0
MAL-2026-10703 amazon-inspector, ossf-package-analysis

Jul 16, 2026
npm
@hibachi-xyz/types 99.0.0
MAL-2026-10715 amazon-inspector, ossf-package-analysis

Jul 16, 2026
npm
@hibachi-xyz/config 99.0.0
MAL-2026-10713 amazon-inspector, ossf-package-analysis

Jul 16, 2026