Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,432 npm 223,271 PyPI 12,012 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,432 reports · Feed

  • npm
    date-kit-lite 1.0.0
    MAL-2026-10101 amazon-inspector
  • npm
    pxpure8 1.0.2
    MAL-2026-10105 amazon-inspector
  • npm
    px8my 1.0.32, 1.0.23, 1.0.13, 1.0.35, 1.0.22, 1.0.36, 1.0.54, 1.0.53, 1.0.52, 1.0.51,…
    MAL-2026-10104 amazon-inspector, ghsa-malware
  • npm
    validator-string 13.15.36
    MAL-2026-10109 amazon-inspector
  • npm
    url-func-registry 1.0.4
    MAL-2026-10108 amazon-inspector
  • npm
    security-node 1.1.4
    MAL-2026-10107 amazon-inspector, ghsa-malware
  • npm
    optimize-regex 1.2.1
    MAL-2026-10103 amazon-inspector, ghsa-malware
  • npm
    rallycoding 3.2.0
    MAL-2026-10106 amazon-inspector, ghsa-malware
  • npm
    polipoli-pak 1.0.1, 1.0.2
    MAL-2026-10099 amazon-inspector, ghsa-malware
  • npm
    @kl-starfish/test-01 2.0.0
    MAL-2026-10097 ghsa-malware, amazon-inspector
  • PyPI
    proxy-check-i 0.1.0, 0.1.1
    MAL-2026-10100 amazon-inspector, kam193
  • npm
    fastify-addone 5.1.0, 5.1.1
    MAL-2026-10098 amazon-inspector
  • npm
    guest-app-ui 99.0.0
    MAL-2026-10096 amazon-inspector
  • npm
    fury_frontend-andes-ui 99.9.5, 99.9.6
    MAL-2026-10095 amazon-inspector
  • npm
    @equansservices/setup 1.0.1, 1.0.0, 1.0.2, 1.0.3
    MAL-2026-10094 amazon-inspector
  • npm
    @andrewstory18/is-real-odd 2.0.3
    MAL-2026-10093 amazon-inspector
  • npm
    vite-pwa-config 1.1.1, 1.1.2
    MAL-2026-10092 amazon-inspector
  • npm
    dl-pp-latm 80.4.2
    MAL-2026-10086 amazon-inspector
  • npm
    neon-poly-utls 1.3.1
    MAL-2026-10089 amazon-inspector, ghsa-malware
  • npm
    chain-async-dom 1.3.6
    MAL-2026-10082 amazon-inspector, reversing-labs
  • npm
    clob-math-v2 2.0.1
    MAL-2026-10083 amazon-inspector
  • npm
    conversionvaluemanager 3.0.0
    MAL-2026-10084 amazon-inspector, reversing-labs
  • npm
    lovable-tager 1.4.0, 1.4.1
    MAL-2026-10088 amazon-inspector
  • PyPI
    qlinforge 0.3.2
    MAL-2026-10091 kam193, amazon-inspector, ossf-package-analysis, reversing-labs 3 IOCs
  • npm
    eslint-plus 6.0.5, 6.0.4
    MAL-2026-10087 amazon-inspector
  • npm
    nonenull1 1.2.0, 1.3.0, 1.4.0, 1.0.0, 1.5.2, 1.5.0, 1.6.0, 1.5.5, 1.5.4, 1.5.6
    MAL-2026-10090 amazon-inspector, ossf-package-analysis
  • npm
    cookie-js-ease 2.1.7
    MAL-2026-10058 amazon-inspector
  • npm
    cookie-parser-es 1.0.7
    MAL-2026-10059 amazon-inspector
  • npm
    cookie-parser-js 1.4.8, 1.4.9, 1.5.0, 1.0.8, 1.5.3, 1.5.2, 1.5.1
    MAL-2026-10060 amazon-inspector
  • npm
    multer-orm 2.0.6, 2.0.2, 2.0.7, 2.0.5, 2.0.4, 2.0.3
    MAL-2026-10064 amazon-inspector
  • npm
    express-router-engine 3.6.5, 3.6.6, 3.6.7, 3.6.8
    MAL-2026-10063 amazon-inspector
  • npm
    chunk-parser 1.0.0
    MAL-2026-10057 amazon-inspector
  • npm
    type-slint 3.3.7, 3.3.8
    MAL-2026-10077 amazon-inspector, ghsa-malware
  • npm
    nps-retrieval-diagnostics 9.9.9
    MAL-2026-10066 amazon-inspector
  • npm
    cursed-ecto-d3ab00 1.0.1, 2.0.1, 2.0.0, 1.0.0
    MAL-2026-10061 amazon-inspector, ghsa-malware
  • npm
    polymarket-apis 1.1.0
    MAL-2026-10067 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    polymarket-trader-apis 0.1.0, 2.1.0
    MAL-2026-10072 amazon-inspector, ghsa-malware
  • npm
    polymarket-kelly-math 3.5.2
    MAL-2026-10068 amazon-inspector
  • npm
    polymarket-kelly-stake-math 3.6.1
    MAL-2026-10070 amazon-inspector, ghsa-malware
  • npm
    polymarket-kit 2.4.1
    MAL-2026-10071 amazon-inspector