Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,431 npm 223,271 PyPI 12,011 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,431 reports · Feed

  • npm
    home-mp-commons 999.0.1, 999.0.3
    MAL-2026-10553 amazon-inspector
  • npm
    valid-scope all versions
    MAL-2026-10570 ghsa-malware
  • npm
    temp-cloak all versions
    MAL-2026-10569 ghsa-malware
  • npm
    sync-logger 1.0.0
    MAL-2026-10568 ghsa-malware, amazon-inspector
  • npm
    string-morph all versions
    MAL-2026-10567 ghsa-malware
  • npm
    sight-bind 0.1.0
    MAL-2026-10566 ghsa-malware, amazon-inspector
  • npm
    relative-time-live 0.1.0
    MAL-2026-10565 ghsa-malware, amazon-inspector
  • npm
    humanize-kit all versions
    MAL-2026-10563 ghsa-malware
  • npm
    duration-kit all versions
    MAL-2026-10562 ghsa-malware
  • npm
    dom-weave all versions
    MAL-2026-10561 ghsa-malware
  • npm
    clipboard-drop 0.1.1
    MAL-2026-10560 ghsa-malware, amazon-inspector
  • npm
    avatar-forge all versions
    MAL-2026-10559 ghsa-malware
  • npm
    @codex2005/logger-core all versions
    MAL-2026-10555 ghsa-malware
  • npm
    better-tailwindcss 4.6.3
    MAL-2026-10550 amazon-inspector, reversing-labs
  • npm
    viteplugiin 1.0.28
    MAL-2026-10546 amazon-inspector
  • npm
    chain-devkit 1.0.0
    MAL-2026-10531 amazon-inspector
  • npm
    my-empty-package 1.0.0
    MAL-2026-10535 amazon-inspector, ghsa-malware
  • PyPI
    pokee-data-utils 1.0.1
    MAL-2026-10547 amazon-inspector
  • npm
    fluterjs 1.0.0
    MAL-2026-10532 amazon-inspector, ghsa-malware
  • npm
    cbr-internal-utils 2.2.2
    MAL-2026-10530 amazon-inspector
  • npm
    neon-postgres 3.5.0, 3.5.1
    MAL-2026-10537 amazon-inspector
  • npm
    lusha-iam-widgets 1.5.2
    MAL-2026-10533 amazon-inspector, ghsa-malware
  • npm
    n8n-nodes-social-facebook 0.1.96, 0.2.0
    MAL-2026-10536 amazon-inspector
  • npm
    proxy-seller-mcp 0.1.7
    MAL-2026-10541 amazon-inspector
  • npm
    skrill-payments 1.0.0
    MAL-2026-10543 amazon-inspector
  • npm
    neteller 1.0.0
    MAL-2026-10538 amazon-inspector
  • npm
    skrill-sdk 1.0.0
    MAL-2026-10544 amazon-inspector
  • npm
    skrill 1.0.0
    MAL-2026-10542 amazon-inspector
  • npm
    postcss-processor-utils 1.0.2, 1.0.3, 1.0.1, 1.0.0
    MAL-2026-10540 amazon-inspector, ghsa-malware
  • npm
    postcss-animatecss 1.0.1, 1.0.2
    MAL-2026-10539 amazon-inspector
  • npm
    vite-plugin-model 1.0.0
    MAL-2026-10545 amazon-inspector, ghsa-malware
  • npm
    motion-pull 2.3.5
    MAL-2026-10534 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    @velkov/isows 1.0.10
    MAL-2026-10524 amazon-inspector
  • npm
    @wrenfield/abitype 1.2.6, 1.2.7, 1.2.4, 1.2.3
    MAL-2026-10529 amazon-inspector, ghsa-malware
  • npm
    @tabrex/bs58 6.0.3
    MAL-2026-10523 amazon-inspector
  • npm
    @vite-mcp/vite-type 6.44.1
    MAL-2026-10525 amazon-inspector, ghsa-malware
  • npm
    @vitets/vite-ts 1.5.10
    MAL-2026-10528 amazon-inspector, ghsa-malware
  • npm
    @vite-ts/vite-ui 6.44.1
    MAL-2026-10527 amazon-inspector, ghsa-malware
  • npm
    @vite-pro/vite-ui 2.5.10
    MAL-2026-10526 amazon-inspector, ghsa-malware
  • npm
    @amedit/vercel-builder-probe 1.0.2, 1.0.3, 1.0.1, 1.0.0
    MAL-2026-10548 ghsa-malware, amazon-inspector, reversing-labs