Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,408 npm 223,266 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,408 reports · Feed

  • npm
    json-bigint-extend all versions
    MAL-2026-10652 ghsa-malware
  • npm
    @vite-js/vui 7.14.16
    MAL-2026-10619 amazon-inspector, ghsa-malware
  • npm
    chai-as-structured 7.0.5
    MAL-2026-10622 amazon-inspector, reversing-labs
  • npm
    chai-as-hardened 7.0.9
    MAL-2026-10621 amazon-inspector
  • npm
    http-ws-listener 1.0.5
    MAL-2026-10623 amazon-inspector
  • npm
    ahooks-3.7.8 13.1.1
    MAL-2026-10620 amazon-inspector
  • npm
    postcss-selector-minify 2.0.0, 1.0.0
    MAL-2026-10614 amazon-inspector, ghsa-malware
  • PyPI
    tronwe 0.0.1
    MAL-2026-10624 kam193 4 IOCs
  • PyPI
    cosmos-gradio 9999.0.0, 9999.0.1
    MAL-2026-10618 kam193, amazon-inspector
  • PyPI
    cosmos-cuda 9999.0.0, 9999.0.1
    MAL-2026-10617 kam193, amazon-inspector
  • npm
    ethereum-lib-utils 1.3.7
    MAL-2026-10613 amazon-inspector, ghsa-malware
  • npm
    assertion-utils-js 2.4.3
    MAL-2026-10612 amazon-inspector, ghsa-malware
  • npm
    smb-common-uikit 15.2.0
    MAL-2026-10615 amazon-inspector
  • npm
    smb-portal-uikit 18.1.1
    MAL-2026-10616 amazon-inspector
  • npm
    @web3-helpers/core 1.0.2, 1.0.1, 1.0.5, 1.0.3, 1.0.0, 1.0.4, 1.0.6
    MAL-2026-10611 amazon-inspector
  • npm
    utils-style-engine 10.2.4
    MAL-2026-10609 amazon-inspector
  • npm
    @radivi-ui/react-dialog 1.1.3, 1.1.4
    MAL-2026-10605 amazon-inspector
  • npm
    chain-sdk-js 1.0.3, 1.0.5, 1.0.4, 1.0.2, 1.0.6
    MAL-2026-10608 amazon-inspector, ghsa-malware
  • npm
    chai-as-act 1.0.2
    MAL-2026-10607 amazon-inspector
  • npm
    base58-utils 1.0.3, 1.0.5, 1.0.4, 1.0.0, 1.0.1
    MAL-2026-10606 amazon-inspector
  • npm
    monitoring-service-util 1.0.0
    MAL-2026-10598 ghsa-malware, amazon-inspector
  • npm
    monitoring-service all versions
    MAL-2026-10597 ghsa-malware
  • npm
    @ayunlove/bails all versions
    MAL-2026-10596 ghsa-malware
  • PyPI
    proxy-check-ii 0.1.0
    MAL-2026-10610 kam193, amazon-inspector
  • npm
    nodemon-plint 3.1.13
    MAL-2026-10595 ghsa-malware, amazon-inspector
  • npm
    async-mutex-v2 2.1.0
    MAL-2026-10582 amazon-inspector, ghsa-malware
  • npm
    nodeaxois 1.0.0
    MAL-2026-10589 amazon-inspector
  • npm
    dayjscore 1.0.0
    MAL-2026-10587 amazon-inspector
  • npm
    chalkdevx 2.0.0
    MAL-2026-10584 amazon-inspector
  • npm
    chalkdev 1.0.0
    MAL-2026-10583 amazon-inspector
  • npm
    momenntjs 1.0.0
    MAL-2026-10588 amazon-inspector
  • npm
    yargsplus 1.0.0
    MAL-2026-10594 amazon-inspector
  • npm
    cheeriobox 1.0.0
    MAL-2026-10585 amazon-inspector
  • npm
    twiliobox 1.0.0
    MAL-2026-10593 amazon-inspector
  • npm
    openaiwrapper 1.0.0
    MAL-2026-10590 amazon-inspector
  • npm
    stripedev 1.0.0
    MAL-2026-10592 amazon-inspector
  • npm
    crypto-validate-lib 1.0.1, 1.0.2, 1.0.3, 1.0.0
    MAL-2026-10586 amazon-inspector
  • npm
    solana-key-utils 1.0.2, 1.0.1, 1.0.3, 1.0.0
    MAL-2026-10591 amazon-inspector
  • npm
    bimi-maker 8.2.4
    MAL-2026-10579 amazon-inspector
  • npm
    ethers-core 6.13.7, 6.13.5
    MAL-2026-10580 amazon-inspector