Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,431 npm 223,271 PyPI 12,011 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,431 reports · Feed

npm
fetchcraft 1.0.1, 1.0.0
MAL-2026-10435 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
netspeedutil 1.0.13
MAL-2026-10438 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
jest-formatter 1.0.0
MAL-2026-10436 amazon-inspector

Jul 13, 2026
npm
env-fast 1.0.0
MAL-2026-10434 amazon-inspector

Jul 13, 2026
npm
@tailwind-ts/eslint-plugin 0.3.0, 0.2.0, 0.1.0
MAL-2026-10431 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
type-context 3.2.7, 3.2.8, 3.2.9, 3.2.11
MAL-2026-10440 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
react-hot-svg 1.1.5, 1.1.4, 1.1.8, 1.1.7
MAL-2026-10439 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
chain-guardian 1.1.0
MAL-2026-10433 amazon-inspector

Jul 13, 2026
npm
animated-css-kit 1.0.1, 1.0.3
MAL-2026-10432 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
jsonfb 1.1.0, 1.1.0-beta.1, 1.1.0-beta.2, 1.1.1, 1.0.9, 1.0.7, 1.0.8, 1.0.0, 1.0.1, 1.…
MAL-2026-10437 amazon-inspector, ghsa-malware, reversing-labs

Jul 13, 2026
PyPI
turbocalcng 0.1.0, 0.2.0
MAL-2026-10441 kam193, amazon-inspector 1 IOC

Jul 13, 2026
npm
@nsub/nitxe 1.0.1, 1.0.0
MAL-2026-10429 ghsa-malware, amazon-inspector

Jul 13, 2026
npm
prettier-plugin-base 1.0.0
MAL-2026-10430 ghsa-malware, amazon-inspector

Jul 13, 2026
npm
sysb1 1.0.0, 1.0.2, 1.0.1, 1.0.4, 1.0.5, 1.0.3
MAL-2026-10428 amazon-inspector

Jul 13, 2026
npm
svg-fetcher 2.4.1
MAL-2026-10427 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
chai-log 1.1.0
MAL-2026-10426 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
@ica-gaming/slot-engine 1.1.0
MAL-2026-10404 amazon-inspector

Jul 13, 2026
npm
frontend-regulations 99.9.1
MAL-2026-10415 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
notifications-broadcast 99.9.1
MAL-2026-10419 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
portway 99.9.1
MAL-2026-10421 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
sso-users-detection 99.9.1
MAL-2026-10422 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
path-addon-extend 1.0.7, 1.0.8, 1.0.10
MAL-2026-10420 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
cold-debug-elevator 1.0.4, 1.0.1, 1.0.3, 1.0.2
MAL-2026-10409 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
supertokens-web 1.16.0, 1.0.0
MAL-2026-10423 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
env-stream 1.0.1, 1.0.2
MAL-2026-10412 amazon-inspector

Jul 13, 2026
npm
express-request-engine 3.6.3
MAL-2026-10414 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
trinity-scheme 20.0.0
MAL-2026-10425 amazon-inspector

Jul 13, 2026
npm
minigptcore 4.0.8
MAL-2026-10417 amazon-inspector

Jul 13, 2026
npm
@torbeck/heap 4.3.14, 4.3.11, 4.3.10, 4.3.8, 4.3.12
MAL-2026-10405 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
eth-base 1.0.0
MAL-2026-10413 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
terminal-mascot 3.5.2, 3.5.3, 1.0.3, 1.0.2, 1.0.1, 1.0.0
MAL-2026-10424 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
awesome-terminal 1.0.3, 1.0.4, 1.0.2, 1.0.1
MAL-2026-10407 amazon-inspector, ghsa-malware

Jul 13, 2026
npm
async-chain-dom 1.3.5
MAL-2026-10406 amazon-inspector

Jul 13, 2026
npm
chain-js-utils 2.1.1
MAL-2026-10408 amazon-inspector

Jul 13, 2026
npm
note-utilities 2.1.2
MAL-2026-10418 amazon-inspector

Jul 13, 2026
npm
cookie-phase 2.3.5
MAL-2026-10410 amazon-inspector

Jul 13, 2026
npm
cookie-sign 2.3.5
MAL-2026-10411 amazon-inspector

Jul 13, 2026
npm
tipsen-last-pls 1.0.0
MAL-2026-10392 ghsa-malware, amazon-inspector

Jul 13, 2026
npm
tipsen-poc-again 1.0.0
MAL-2026-10393 ghsa-malware, amazon-inspector

Jul 13, 2026
npm
tipsen-last 1.0.0
MAL-2026-10391 ghsa-malware, amazon-inspector

Jul 13, 2026