Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,432 npm 223,271 PyPI 12,012 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,432 reports · Feed

npm
tinyparrot 0.4.1
MAL-2026-10190 amazon-inspector, ghsa-malware

Jul 11, 2026
npm
google-caja-bower 1000.80.20, 20.20.20, 999.99.20, 999.999.20, 1000.800.20, 1000.801.20, 999.20.20
MAL-2026-10186 amazon-inspector, ghsa-malware

Jul 11, 2026
npm
authvaultx 1.7.1
MAL-2026-10185 ghsa-malware, amazon-inspector

Jul 11, 2026
npm
polymarket-mcp-v2 2.1.6
MAL-2026-10481 amazon-inspector 6 IOCs

Jul 11, 2026
npm
jscrambler 8.16.0, 8.14.0, 8.20.0, 8.18.0, 8.17.0
MAL-2026-10187 amazon-inspector, ghsa-malware

Jul 11, 2026
npm
@uwr/colors 1.3.6
MAL-2026-10179 amazon-inspector, reversing-labs

Jul 10, 2026
npm
fkext-browser-min 1.0.14
MAL-2026-10183 amazon-inspector, reversing-labs

Jul 10, 2026
npm
@broadpeak/smartlib-ad 24.1.10
MAL-2026-10178 amazon-inspector

Jul 10, 2026
npm
consumerweb 2200.4.2
MAL-2026-10181 amazon-inspector, reversing-labs

Jul 10, 2026
npm
express-guardian 1.4.1, 1.4.3
MAL-2026-10182 amazon-inspector

Jul 10, 2026
npm
mongoose-schema-unique 4.0.4, 4.0.3, 4.0.2
MAL-2026-10184 amazon-inspector

Jul 10, 2026
npm
auth-next-gen 1.6.29, 1.7.11, 1.7.2
MAL-2026-10180 amazon-inspector, ghsa-malware

Jul 10, 2026
npm
@jaymara/jsononifier 1.0.0, 1.0.2, 1.0.1
MAL-2026-10177 amazon-inspector

Jul 10, 2026
npm
chai-as-doc 2.3.5
MAL-2026-10175 amazon-inspector

Jul 10, 2026
npm
uncaxss 1.3.5, 1.3.4
MAL-2026-10176 amazon-inspector

Jul 10, 2026
npm
@injectivelabs/sdk-ts 1.20.21
MAL-2026-10165 amazon-inspector, ghsa-malware 1 IOC

Jul 10, 2026
npm
paysafe-vault 1.0.0
MAL-2026-10173 amazon-inspector

Jul 10, 2026
npm
paysafe-payments 1.0.0
MAL-2026-10172 amazon-inspector

Jul 10, 2026
npm
paysafe-node 1.0.0
MAL-2026-10171 amazon-inspector

Jul 10, 2026
npm
paysafe-kyc 1.0.0
MAL-2026-10170 amazon-inspector

Jul 10, 2026
npm
paysafe-fraud 1.0.0
MAL-2026-10168 amazon-inspector

Jul 10, 2026
npm
paysafe-js 1.0.0
MAL-2026-10169 amazon-inspector

Jul 10, 2026
npm
paysafe-checkout 1.0.0
MAL-2026-10167 amazon-inspector

Jul 10, 2026
npm
paysafe-api 1.0.0
MAL-2026-10166 amazon-inspector

Jul 10, 2026
npm
type-atob 3.3.7
MAL-2026-10174 amazon-inspector, ghsa-malware

Jul 10, 2026
npm
llama-tokenizer 1.2.2
MAL-2026-10163 amazon-inspector, ghsa-malware

Jul 10, 2026
npm
type-async 3.3.7
MAL-2026-10164 amazon-inspector, ghsa-malware

Jul 10, 2026
npm
@bcryptln/becryptjs 3.0.8, 3.0.10, 3.0.11, 3.0.9
MAL-2026-10162 amazon-inspector, ghsa-malware

Jul 10, 2026
npm
rollup-packages-polyfill-core 0.13.8, 0.13.7, 0.14.1, 0.13.9, 0.14.0, 0.13.5, 0.13.6, 0.13.4, 0.0.0, 0.5.0, 0…
MAL-2026-10160 amazon-inspector, ghsa-malware, reversing-labs

Jul 10, 2026
npm
buffer-util-internal 1.0.13, 1.0.14
MAL-2026-10151 amazon-inspector

Jul 10, 2026
npm
ap3-components-ui 9.999.0
MAL-2026-10150 amazon-inspector, ghsa-malware, reversing-labs

Jul 10, 2026
npm
notify-utilities 1.3.5
MAL-2026-10158 amazon-inspector

Jul 10, 2026
npm
notify-logs 1.3.5
MAL-2026-10156 amazon-inspector

Jul 10, 2026
npm
notify-theme 1.3.5, 1.3.6, 1.3.7
MAL-2026-10157 amazon-inspector

Jul 10, 2026
npm
notify-dist 1.3.7
MAL-2026-10154 amazon-inspector

Jul 10, 2026
npm
notify-funcs 1.3.5, 1.3.6
MAL-2026-10155 amazon-inspector

Jul 10, 2026
npm
notifier-log 1.3.5
MAL-2026-10153 amazon-inspector

Jul 10, 2026
npm
notifier-funcs 1.3.4
MAL-2026-10152 amazon-inspector

Jul 10, 2026
npm
npm-rce-safe-proof-yourname 1.0.0
MAL-2026-10159 amazon-inspector

Jul 10, 2026
npm
sidecar-mcp 1.0.1, 1.0.0, 1.0.4, 1.0.2, 1.0.3
MAL-2026-10161 amazon-inspector, ghsa-malware

Jul 10, 2026