Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,432 npm 223,271 PyPI 12,012 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,432 reports · Feed

npm
polymarket-kelly-maths 3.5.3
MAL-2026-10069 amazon-inspector

Jul 9, 2026
npm
es6-codify 1.2.0, 2.2.0, 2.0.0, 1.0.1, 2.1.0, 1.3.0, 1.1.0, 1.4.0, 1.0.0
MAL-2026-10062 amazon-inspector, ghsa-malware

Jul 9, 2026
npm
webrix-docs1 10.2.11
MAL-2026-10081 amazon-inspector

Jul 9, 2026
npm
webrix-docs 20.2.11
MAL-2026-10080 amazon-inspector

Jul 9, 2026
npm
vybscan-testbed-obfuscated-postinstall 1.0.0
MAL-2026-10079 amazon-inspector, ghsa-malware

Jul 9, 2026
npm
vybscan-testbed-inert-postinstall 1.0.0
MAL-2026-10078 amazon-inspector, ghsa-malware

Jul 9, 2026
npm
ts-eslint-jest 1.0.0
MAL-2026-10076 amazon-inspector, ghsa-malware

Jul 9, 2026
npm
nodemon-gulp 3.1.16, 3.1.14, 3.1.15
MAL-2026-10065 amazon-inspector, ghsa-malware

Jul 9, 2026
npm
chai-as-modified 6.0.4
MAL-2026-10043 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chai-as-buffered 3.7.24, 7.2.5
MAL-2026-10041 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chai-await-dom 1.3.7
MAL-2026-10049 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chai-as-staged 6.0.4
MAL-2026-10047 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chain-chai-async 1.3.5
MAL-2026-10055 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chai-as-align 7.1.0
MAL-2026-10039 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chai-promised-test 1.3.5
MAL-2026-10052 amazon-inspector

Jul 9, 2026
npm
chain-chai-await 1.3.6, 1.3.7, 1.3.5
MAL-2026-10056 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chai-as-serialized 7.0.8
MAL-2026-10044 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chai-as-thread 7.0.8
MAL-2026-10048 amazon-inspector, ghsa-malware

Jul 9, 2026
npm
chai-as-balanced 2.2.3
MAL-2026-10040 amazon-inspector

Jul 9, 2026
npm
chai-deflect 1.1.5, 1.1.6
MAL-2026-10051 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chai-as-sharpened 7.0.9
MAL-2026-10045 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chai-secure 1.2.3, 1.2.5
MAL-2026-10053 amazon-inspector

Jul 9, 2026
npm
chai-smart 2.3.5
MAL-2026-10054 amazon-inspector, reversing-labs

Jul 9, 2026
npm
chai-as-disarmed 3.2.3
MAL-2026-10042 amazon-inspector

Jul 9, 2026
npm
chai-defender 1.0.2, 1.0.0-beta.1, 1.0.1-beta, 1.0.1, 1.1.0, 1.1.1
MAL-2026-10050 amazon-inspector, ghsa-malware

Jul 9, 2026
npm
tailwind-animate-v4 2.1.1, 2.1.0, 1.1.0, 2.1.2
MAL-2026-10073 amazon-inspector, ghsa-malware

Jul 9, 2026
npm
chai-as-smart 2.3.5
MAL-2026-10046 amazon-inspector

Jul 9, 2026
npm
txs-builder-lib 1.0.2, 1.0.1, 1.0.3
MAL-2026-10021 ghsa-malware, amazon-inspector

Jul 9, 2026
npm
client-cookies-agent 99.9.5, 99.9.6, 99.9.7
MAL-2026-10019 ossf-package-analysis, amazon-inspector

Jul 9, 2026
PyPI
playwrightr 1.0.0, 1.0.1
MAL-2026-10020 kam193, amazon-inspector 4 IOCs

Jul 9, 2026
npm
n8n-nodes-mcputils 0.1.5
MAL-2026-10013 ghsa-malware, amazon-inspector

Jul 9, 2026
npm
mchain-sdk 4.2.5
MAL-2026-10012 ghsa-malware, amazon-inspector

Jul 9, 2026
npm
chain-api-sdk 0.2.11, 0.2.10, 0.2.12
MAL-2026-10009 ghsa-malware, amazon-inspector

Jul 9, 2026
npm
testing-d3do 99.9.9
MAL-2026-10006 ossf-package-analysis, amazon-inspector

Jul 9, 2026
npm
security-console-ui all versions
MAL-2026-10018 ghsa-malware

Jul 9, 2026
npm
rabi-snooze-api all versions
MAL-2026-10017 ghsa-malware

Jul 9, 2026
npm
qlkube 1.0.0
MAL-2026-10016 ghsa-malware, amazon-inspector

Jul 9, 2026
npm
poc-node-npm all versions
MAL-2026-10015 ghsa-malware

Jul 9, 2026
npm
fusion-client all versions
MAL-2026-10011 ghsa-malware

Jul 9, 2026
npm
feedback-api all versions
MAL-2026-10010 ghsa-malware

Jul 9, 2026