Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,347 npm 223,209 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,347 reports · Feed

npm
@ppa-web-components/ppa-builder 99.0.1, 1.0.0, 0.0.1, 2.0.1, 1.0.1, 3.0.0, 0.1.0, 0.0.0-stage
MAL-2026-18273 amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
npm
@ppa-web-components/ppa-searchform 0.0.1, 2.0.1, 3.0.0, 99.0.1, 2.0.0, 1.0.1, 1.0.0, 1.1.0, 0.1.0, 0.0.0-stage
MAL-2026-18287 amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
npm
@ppa-web-components/ppa-navigation 2.0.0, 2.0.1, 1.0.0, 1.0.1, 3.0.0, 99.0.1, 0.0.0-stage, 0.1.0
MAL-2026-18286 amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
PyPI
fontus 0.0.1, 0.0.2, 0.0.3
MAL-2026-18271 kam193, amazon-inspector 3 IOCs

Oct 25, 2026
npm
tiktok-video-scraper all versions
MAL-2026-18268 ghsa-malware

Oct 25, 2026
npm
sound-cloud-loader-api all versions
MAL-2026-18267 ghsa-malware

Oct 25, 2026
npm
ionic-tiktok-scraper all versions
MAL-2026-18261 ghsa-malware

Oct 25, 2026
npm
ionic-sound-cloud-loader-api all versions
MAL-2026-18260 ghsa-malware

Oct 25, 2026
npm
insta-reel-search all versions
MAL-2026-18258 ghsa-malware

Oct 25, 2026
npm
insta-api-wrapper 1.1.0, 1.2.1, 1.1.4
MAL-2026-18257 ghsa-malware, amazon-inspector

Oct 25, 2026
npm
youtube-search-without-api-key all versions
MAL-2026-18270 ghsa-malware

Oct 25, 2026
npm
youtube-info-streams all versions
MAL-2026-18269 ghsa-malware

Oct 25, 2026
npm
redis-dumper all versions
MAL-2026-18266 ghsa-malware

Oct 25, 2026
npm
ocsp-hashes all versions
MAL-2026-18264 ghsa-malware

Oct 25, 2026
npm
ionic-youtube-streams all versions
MAL-2026-18263 ghsa-malware

Oct 25, 2026
npm
ionic-youtube-search all versions
MAL-2026-18262 ghsa-malware

Oct 25, 2026
npm
ionic-insta-search all versions
MAL-2026-18259 ghsa-malware

Oct 25, 2026
npm
cordova-plugin-geofence-appit all versions
MAL-2026-18256 ghsa-malware

Oct 25, 2026
npm
appit-cordova-plugin-ionic all versions
MAL-2026-18254 ghsa-malware

Oct 25, 2026
npm
appit-cordova-admob all versions
MAL-2026-18253 ghsa-malware

Oct 25, 2026
npm
p12-pem all versions
MAL-2026-18265 ghsa-malware

Oct 25, 2026
npm
cert-infos all versions
MAL-2026-18255 ghsa-malware

Oct 25, 2026
npm
@eforms/forms-api 2.0.0-SNAPSHOT, 99.0.0, 2.99.0, 1.99.0, 2.99.1, 1.99.1, 2.0.99, 0.0.0-stage
MAL-2026-18252 ossf-package-analysis, amazon-inspector, ghsa-malware

Oct 25, 2026
npm
@drone-js-ext/core 99.0.1, 1.0.0, 3.0.0, 2.0.1, 0.0.0-stage, 0.1.0
MAL-2026-18276 amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
npm
@drone-js-ext/vip-badge 99.0.1, 0.0.1, 2.0.0, 1.0.1, 0.1.0, 0.0.0-stage
MAL-2026-18277 amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
npm
tailwind-base-buttons 0.1.0
MAL-2026-18250 ghsa-malware, amazon-inspector

Oct 25, 2026
npm
tailwindcss-theme-kit all versions
MAL-2026-18251 ghsa-malware

Oct 24, 2026
npm
noelc-css-blender 2.2.0, 2.1.11, 2.1.9, 2.2.1
MAL-2026-18249 ghsa-malware, amazon-inspector

Oct 24, 2026
npm
overarch-windows-x64-yr 2.0.0, 1.4.0, 1.5.0
MAL-2026-18248 ghsa-malware, amazon-inspector

Oct 24, 2026
npm
@liauto/win32-x64 0.1.2-b2
MAL-2026-18247 ghsa-malware, amazon-inspector

Oct 24, 2026
npm
@sxm-web/client-sdk-core 0.0.1, 1.0.0, 1.0.1, 2.0.0, 1.1.0, 3.0.0, 13.3.7, 0.0.0-stage, 0.1.0
MAL-2026-18319 amazon-inspector, ghsa-malware 2 IOCs

Oct 23, 2026
npm
@k18k/entrypoint-sdk-darwin-arm64 0.2.0, 0.2.1
MAL-2026-18243 ghsa-malware, amazon-inspector

Oct 23, 2026
npm
orqiva-runtime-win32-x64 0.1.0
MAL-2026-18246 ghsa-malware, amazon-inspector

Oct 23, 2026
npm
@k18k/entrypoint-sdk-linux-x64 0.2.0, 0.2.1
MAL-2026-18245 ghsa-malware, amazon-inspector

Oct 23, 2026
npm
@k18k/entrypoint-sdk-darwin-x64 0.2.0, 0.2.1
MAL-2026-18244 ghsa-malware, amazon-inspector

Oct 23, 2026
npm
@greenlake/session 99.0.1, 3.0.0, 1.0.0, 2.0.0, 0.1.0, 0.0.0-stage
MAL-2026-18283 amazon-inspector, ghsa-malware 2 IOCs

Oct 23, 2026
npm
@greenlake/mfe-login-url 2.0.0, 1.0.0, 3.0.0, 0.1.0, 0.0.0-stage
MAL-2026-18318 amazon-inspector, ghsa-malware 2 IOCs

Oct 23, 2026
npm
@greenlake/context-pane 3.0.0, 1.0.0, 0.0.0-stage, 0.1.0
MAL-2026-18317 amazon-inspector, ghsa-malware 2 IOCs

Oct 23, 2026
npm
@greenlake/common-context 99.0.1, 3.0.0, 0.1.0, 0.0.0-stage
MAL-2026-18282 amazon-inspector, ghsa-malware 2 IOCs

Oct 23, 2026
npm
@greenlake/auth 3.0.0, 0.0.0-stage, 0.1.0
MAL-2026-18316 amazon-inspector, ghsa-malware 2 IOCs

Oct 23, 2026