Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,408 npm 223,266 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,408 reports · Feed

  • npm
    process-status-widget 99.9.1
    MAL-2026-10581 amazon-inspector, ghsa-malware
  • npm
    @sqlite-group/sql-creator 1.0.7
    MAL-2026-10578 ghsa-malware, amazon-inspector
  • npm
    @sqlite-clone/nodesql 1.0.2
    MAL-2026-10577 ghsa-malware, amazon-inspector
  • PyPI
    tennacity 1.0.0, 1.2.0, 1.2.2
    MAL-2026-10576 kam193, amazon-inspector 8 IOCs
  • npm
    @wrenfield/viem 2.53.4, 2.53.3, 2.53.1, 2.53.2
    MAL-2026-10571 amazon-inspector, ghsa-malware
  • npm
    vite-plugin-config-paths 1.4.2
    MAL-2026-10574 amazon-inspector
  • npm
    harpoon-package 1.1.0, 1.0.0, 1.2.0
    MAL-2026-10573 amazon-inspector
  • npm
    web-pop 2.3.5
    MAL-2026-10575 amazon-inspector
  • npm
    eth-wallet-helpers 1.0.0, 1.0.2, 1.0.1, 1.0.3
    MAL-2026-10572 amazon-inspector
  • npm
    akshajrawat.utils 1.0.1, 1.0.0
    MAL-2026-10558 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    @akshajrawat/plugin-repo-cli 1.0.0, 1.0.1
    MAL-2026-10554 ghsa-malware, amazon-inspector
  • npm
    eth-dev 1.0.1, 1.0.0, 1.0.2, 1.0.3, 1.0.4
    MAL-2026-10552 amazon-inspector
  • npm
    abi-encode 1.0.2, 1.0.0, 1.0.1, 1.0.3, 1.0.4
    MAL-2026-10549 amazon-inspector
  • npm
    micro-ui-loader 2.0.0, 6.0.0
    MAL-2026-10564 ghsa-malware, amazon-inspector
  • npm
    @cw-ui/micro-ui-loader 2.0.0
    MAL-2026-10557 ghsa-malware, amazon-inspector
  • npm
    @cw-ui/asio-neon-themes 2.0.0
    MAL-2026-10556 ghsa-malware, amazon-inspector
  • npm
    elsisi-cli 9.9.9
    MAL-2026-10551 amazon-inspector
  • npm
    home-mp-commons 999.0.1, 999.0.3
    MAL-2026-10553 amazon-inspector
  • npm
    valid-scope all versions
    MAL-2026-10570 ghsa-malware
  • npm
    temp-cloak all versions
    MAL-2026-10569 ghsa-malware
  • npm
    sync-logger 1.0.0
    MAL-2026-10568 ghsa-malware, amazon-inspector
  • npm
    string-morph all versions
    MAL-2026-10567 ghsa-malware
  • npm
    sight-bind 0.1.0
    MAL-2026-10566 ghsa-malware, amazon-inspector
  • npm
    relative-time-live 0.1.0
    MAL-2026-10565 ghsa-malware, amazon-inspector
  • npm
    humanize-kit all versions
    MAL-2026-10563 ghsa-malware
  • npm
    duration-kit all versions
    MAL-2026-10562 ghsa-malware
  • npm
    dom-weave all versions
    MAL-2026-10561 ghsa-malware
  • npm
    clipboard-drop 0.1.1
    MAL-2026-10560 ghsa-malware, amazon-inspector
  • npm
    avatar-forge all versions
    MAL-2026-10559 ghsa-malware
  • npm
    @codex2005/logger-core all versions
    MAL-2026-10555 ghsa-malware
  • npm
    better-tailwindcss 4.6.3
    MAL-2026-10550 amazon-inspector, reversing-labs
  • npm
    viteplugiin 1.0.28
    MAL-2026-10546 amazon-inspector
  • npm
    chain-devkit 1.0.0
    MAL-2026-10531 amazon-inspector
  • npm
    my-empty-package 1.0.0
    MAL-2026-10535 amazon-inspector, ghsa-malware
  • PyPI
    pokee-data-utils 1.0.1
    MAL-2026-10547 amazon-inspector
  • npm
    fluterjs 1.0.0
    MAL-2026-10532 amazon-inspector, ghsa-malware
  • npm
    cbr-internal-utils 2.2.2
    MAL-2026-10530 amazon-inspector
  • npm
    neon-postgres 3.5.0, 3.5.1
    MAL-2026-10537 amazon-inspector
  • npm
    lusha-iam-widgets 1.5.2
    MAL-2026-10533 amazon-inspector, ghsa-malware
  • npm
    n8n-nodes-social-facebook 0.1.96, 0.2.0
    MAL-2026-10536 amazon-inspector