Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,432 npm 223,271 PyPI 12,012 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,432 reports · Feed

  • npm
    @espn-ping/react-dmed-oauth 666.0.0
    MAL-2026-10401 amazon-inspector, reversing-labs
  • npm
    @db-tools/main-app 2026.6.30
    MAL-2026-10398 amazon-inspector, ghsa-malware
  • npm
    @equansservices/tool 1.0.2, 1.0.0
    MAL-2026-10400 amazon-inspector, ghsa-malware
  • npm
    @equansservices/codex 1.0.1
    MAL-2026-10399 amazon-inspector
  • npm
    @car_loans/dealerships-approval 7.1.5, 7.1.6
    MAL-2026-10397 amazon-inspector, ghsa-malware
  • npm
    @jplopezy/connectivity-test-do-not-install 0.0.0-test
    MAL-2026-10220 ghsa-malware, amazon-inspector
  • npm
    chai-as-precision 7.0.6
    MAL-2026-10219 amazon-inspector
  • npm
    pure-folder-three 0.7.3, 0.7.1, 0.7.0, 0.6.0, 0.5.0
    MAL-2026-10218 ghsa-malware, amazon-inspector
  • npm
    dotnet-runtime-base 1.0.5, 1.0.4
    MAL-2026-10217 ghsa-malware, amazon-inspector
  • npm
    node-sysmetrics 1.0.0, 1.0.1
    MAL-2026-10216 ghsa-malware, amazon-inspector
  • npm
    slds-lsp-client 2026.7.11
    MAL-2026-10234 amazon-inspector, ghsa-malware
  • npm
    salesforce-vscode-slds 2026.7.11
    MAL-2026-10232 amazon-inspector, ghsa-malware
  • npm
    chat-adapter-zoom 12.1.31
    MAL-2026-10228 amazon-inspector, ghsa-malware
  • PyPI
    fast-dotenv 1.0.0
    MAL-2026-10215 kam193, amazon-inspector 1 IOC
  • npm
    babel-preset-lib-client 4.9.10, 4.9.9, 4.9.11, 1.0.0
    MAL-2026-10214 amazon-inspector, ghsa-malware
  • npm
    auto-debug-tool 1.0.3, 1.0.2, 1.0.0
    MAL-2026-10209 amazon-inspector, ghsa-malware
  • npm
    vuln-package 99.9.11, 99.9.14, 99.9.9, 99.9.10
    MAL-2026-10212 amazon-inspector
  • npm
    mcp-notes-server-poc-praetorian 0.1.0
    MAL-2026-10210 amazon-inspector, ghsa-malware
  • PyPI
    pipspeed 0.1.0
    MAL-2026-10213 amazon-inspector, kam193 1 IOC
  • npm
    @meziizana/frontend-logger 10.0.0
    MAL-2026-10208 amazon-inspector
  • npm
    react-next-vite 1.2.9
    MAL-2026-10211 amazon-inspector
  • npm
    nullrift 1.0.0
    MAL-2026-10206 amazon-inspector
  • npm
    chain-await-dom 1.3.4
    MAL-2026-10202 amazon-inspector
  • npm
    react-dom-v17 15.0.1
    MAL-2026-10207 amazon-inspector
  • npm
    library-explorer 25.2.1
    MAL-2026-10205 amazon-inspector, reversing-labs
  • npm
    giantswarm 22.0.1
    MAL-2026-10203 amazon-inspector
  • npm
    api-changelly 19.2.11
    MAL-2026-10200 amazon-inspector, reversing-labs
  • npm
    gptcore 4.0.6, 4.0.7, 4.0.8
    MAL-2026-10204 amazon-inspector
  • npm
    bugexploit 99.9.9
    MAL-2026-10201 amazon-inspector
  • npm
    polylabel-web-lib 99.9.1
    MAL-2026-10198 amazon-inspector, ghsa-malware
  • npm
    polymarket-kelly-math-stake 3.6.2
    MAL-2026-10199 amazon-inspector, ghsa-malware
  • PyPI
    jupiter-sdk 0.1.0, 0.1.1
    MAL-2026-10196 kam193, amazon-inspector 3 IOCs
  • PyPI
    eth-agent 1.0.0, 1.0.1
    MAL-2026-10195 kam193, amazon-inspector 3 IOCs
  • PyPI
    metemask-sdk 1.2.0, 1.2.1
    MAL-2026-10197 kam193, amazon-inspector 3 IOCs
  • PyPI
    solidity-dev 1.3.0
    MAL-2026-10194 kam193, amazon-inspector
  • PyPI
    defi-tools 0.8.0
    MAL-2026-10192 kam193, amazon-inspector
  • PyPI
    data-harvester 0.3.1
    MAL-2026-10191 kam193, amazon-inspector
  • PyPI
    py-base58 2.1.3, 2.1.4
    MAL-2026-10193 kam193, amazon-inspector
  • npm
    tinymask-js 1.0.2
    MAL-2026-10189 amazon-inspector, ghsa-malware
  • npm
    awesome-ts-jest 29.4.12
    MAL-2026-10188 amazon-inspector, ghsa-malware