Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,432 npm 223,271 PyPI 12,012 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,432 reports · Feed

npm
@genie-auth/config all versions
MAL-2026-10141 ghsa-malware

Jul 10, 2026
npm
@amtrav/webservice all versions
MAL-2026-10140 ghsa-malware

Jul 10, 2026
npm
ng-search-api 99.9.1
MAL-2026-10146 ghsa-malware, reversing-labs

Jul 10, 2026
npm
motiondnb 99.9.1
MAL-2026-10145 ghsa-malware, reversing-labs

Jul 10, 2026
npm
react-jsonwebtoken 9.0.3, 9.0.5, 9.0.4
MAL-2026-10132 amazon-inspector

Jul 10, 2026
npm
theta-sdk-js 1.2.16, 1.2.15, 1.2.14, 1.2.17
MAL-2026-10135 amazon-inspector, ghsa-malware

Jul 10, 2026
npm
polygon-gamma-apis 2.0.0, 1.5.2
MAL-2026-10148 ghsa-malware, amazon-inspector, reversing-labs

Jul 10, 2026
npm
polygon-gama-apis 1.4.1
MAL-2026-10147 ghsa-malware, amazon-inspector, reversing-labs

Jul 10, 2026
npm
mdb-vite 1.5.2
MAL-2026-10144 ghsa-malware, amazon-inspector, reversing-labs

Jul 10, 2026
npm
polymarket-gamma-apis all versions
MAL-2026-10149 ghsa-malware

Jul 10, 2026
npm
marked-prettier 1.0.5, 1.0.4
MAL-2026-10143 ghsa-malware, amazon-inspector

Jul 10, 2026
npm
eslint-jest 4.0.5, 4.0.6, 4.0.4
MAL-2026-10142 ghsa-malware, amazon-inspector

Jul 10, 2026
npm
stella-ai-cli 2.0.0, 3.0.1, 3.0.0, 2.2.2, 2.2.1, 2.2.0, 2.1.0, 1.0.0
MAL-2026-10133 amazon-inspector, ghsa-malware

Jul 10, 2026
npm
stella-coder 5.0.0, 5.1.0, 5.1.1, 4.0.0, 5.0.1, 5.1.2, 5.2.0, 5.3.3, 5.3.4, 5.3.5, 5.3.6
MAL-2026-10134 amazon-inspector

Jul 10, 2026
PyPI
turbocalc 0.1.0
MAL-2026-10139 kam193 1 IOC

Jul 10, 2026
npm
uac-package 1.4.5, 1.4.6, 1.4.1, 1.4.3, 1.4.7, 1.4.8, 1.4.4, 1.4.0, 1.3.0, 1.2.1, 1.1.3, 1.…
MAL-2026-10138 amazon-inspector, ghsa-malware

Jul 10, 2026
npm
express-session-kit 1.1.0-beta, 1.18.1, 1.1.1
MAL-2026-10131 ghsa-malware, amazon-inspector

Jul 10, 2026
npm
transform-es2015-sticky-regex 6.24.3
MAL-2026-10136 amazon-inspector, ghsa-malware

Jul 10, 2026
npm
type-elint 3.3.7
MAL-2026-10137 amazon-inspector, ghsa-malware

Jul 10, 2026
npm
ohcm-culture-formatting 5.0.0
MAL-2026-10128 amazon-inspector

Jul 10, 2026
npm
eth-react-redirection 1.0.0, 1.0.1, 1.0.2
MAL-2026-10127 amazon-inspector

Jul 10, 2026
npm
rtc-integration-frontend-sdk 99.9.0
MAL-2026-10129 amazon-inspector

Jul 10, 2026
npm
type-plint 3.3.7
MAL-2026-10130 amazon-inspector, ghsa-malware

Jul 10, 2026
npm
dowload_ebok_superior_spider_man_1_marvel_collection_by_dan_slott_tc3wo all versions
MAL-2026-10125 ghsa-malware

Jul 10, 2026
npm
dowload_ebok_river_of_time_by_naomi_judd_marcia_wilkie_i1ze3 all versions
MAL-2026-10124 ghsa-malware

Jul 10, 2026
npm
dowload_ebok_programming_in_haskell_second_edition_by_graham_hutton_c19wm all versions
MAL-2026-10123 ghsa-malware

Jul 10, 2026
npm
dowload_ebok_leila_a_filha_de_charles_by_denise_correa_de_macedo_arnold_de_numiers_o103j all versions
MAL-2026-10121 ghsa-malware

Jul 10, 2026
npm
dowload_ebok_wrath_of_the_gods_by_j_robert_kennedy_61o88 all versions
MAL-2026-10126 ghsa-malware

Jul 10, 2026
npm
dowload_ebok_murder_in_plain_english_by_michael_arntfield_marcel_danesi_uleto all versions
MAL-2026-10122 ghsa-malware

Jul 10, 2026
npm
dowload_ebok_goodbye_things_by_fumio_sasaki_ptu02 all versions
MAL-2026-10120 ghsa-malware

Jul 10, 2026
npm
execfences 5.0.2, 5.1.1, 5.1.0, 5.0.3, 5.0.4, 5.0.5, 5.0.6
MAL-2026-10118 ghsa-malware, amazon-inspector

Jul 10, 2026
PyPI
sankislayer 1.0.0
MAL-2026-10119 kam193

Jul 10, 2026
npm
nodemon-slint 3.1.13
MAL-2026-10117 ghsa-malware, amazon-inspector

Jul 10, 2026
npm
driftpin 1.0.0
MAL-2026-10114 amazon-inspector

Jul 10, 2026
npm
jwtmethod 1.1.10
MAL-2026-10116 amazon-inspector

Jul 10, 2026
npm
workspace-scripts 0.0.1
MAL-2026-10113 ghsa-malware, reversing-labs

Jul 10, 2026
npm
workspace-lint 0.0.1
MAL-2026-10112 ghsa-malware, reversing-labs

Jul 10, 2026
npm
nodemon-patch 3.1.16, 3.1.15
MAL-2026-10110 ghsa-malware, amazon-inspector

Jul 10, 2026
npm
nodepack-daemon 1.2.9
MAL-2026-10111 ghsa-malware, amazon-inspector

Jul 10, 2026
npm
dc-repro 2.1.2
MAL-2026-10102 amazon-inspector

Jul 9, 2026