Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,349 npm 223,211 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,349 reports · Feed

npm
cloudflare_module 3.0.0, 1.0.1, 1.0.0, 99.0.1
MAL-2026-17768 amazon-inspector

Oct 11, 2026
npm
@coopeuch/button 1.999.999
MAL-2026-17759 amazon-inspector, ghsa-malware

Oct 11, 2026
npm
deposit-limit-fe 100.100.106, 100.100.101, 100.100.102
MAL-2026-17769 amazon-inspector

Oct 11, 2026
npm
nitro-cjs-requirer 1.0.0, 0.0.1, 1.1.0, 2.0.0, 99.0.1, 3.0.0
MAL-2026-17775 amazon-inspector

Oct 11, 2026
npm
@coopeuch/config 1.999.999
MAL-2026-17762 amazon-inspector, ghsa-malware

Oct 11, 2026
npm
nitro-bundled-dep 99.0.1, 2.0.1, 1.1.0, 0.0.1, 1.0.0
MAL-2026-17774 amazon-inspector

Oct 11, 2026
RubyGems
eth-gas-oracle 0.9.1
MAL-2026-17786 amazon-inspector

Oct 11, 2026
RubyGems
multichain-rpc 0.9.1
MAL-2026-17791 amazon-inspector

Oct 11, 2026
RubyGems
web3-signer-kit 0.9.1
MAL-2026-17801 amazon-inspector

Oct 11, 2026
RubyGems
mev-sandwich-detect 0.9.1
MAL-2026-17790 amazon-inspector

Oct 11, 2026
RubyGems
crypto-tax-export 0.9.1
MAL-2026-17782 amazon-inspector

Oct 11, 2026
RubyGems
airdrop-eligibility-check 0.9.1
MAL-2026-17779 amazon-inspector

Oct 11, 2026
RubyGems
btc-fee-estimator 0.9.1
MAL-2026-17781 amazon-inspector

Oct 11, 2026
RubyGems
defi-yield-calculator 0.9.1
MAL-2026-17783 amazon-inspector

Oct 11, 2026
npm
orderly-plugin-liquidity-heatmap 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.6, 0.0.0-stage
MAL-2026-17848 ghsa-malware, amazon-inspector

Oct 11, 2026
RubyGems
staking-apr-fetcher 0.9.1
MAL-2026-17796 amazon-inspector, ossf-package-analysis

Oct 11, 2026
RubyGems
seed-phrase-validator 0.9.1
MAL-2026-17794 amazon-inspector, ossf-package-analysis

Oct 11, 2026
RubyGems
erc20-approve-audit 0.9.1
MAL-2026-17785 amazon-inspector, ossf-package-analysis

Oct 11, 2026
RubyGems
evm-tx-decoder 0.9.1
MAL-2026-17787 amazon-inspector, ossf-package-analysis

Oct 11, 2026
npm
react-dropzone-v4 99.0.0
MAL-2026-17758 ossf-package-analysis, amazon-inspector, ghsa-malware

Oct 11, 2026
RubyGems
tron-trc20-utils 0.9.1
MAL-2026-17798 amazon-inspector, ossf-package-analysis

Oct 11, 2026
RubyGems
nft-metadata-resolver 0.9.1
MAL-2026-17792 amazon-inspector, ossf-package-analysis

Oct 11, 2026
RubyGems
hd-wallet-generator 0.9.1
MAL-2026-17789 amazon-inspector, ossf-package-analysis

Oct 11, 2026
RubyGems
wallet-balance-scanner 0.9.1
MAL-2026-17799 amazon-inspector, ossf-package-analysis

Oct 11, 2026
RubyGems
ton-jetton-tools 0.9.1
MAL-2026-17797 amazon-inspector, ossf-package-analysis

Oct 11, 2026
RubyGems
dex-router-abis 0.9.1
MAL-2026-17784 amazon-inspector, ossf-package-analysis

Oct 11, 2026
RubyGems
wallet-hd-derive 0.9.1
MAL-2026-17800 amazon-inspector, ossf-package-analysis

Oct 11, 2026
RubyGems
perp-funding-rates 0.9.1
MAL-2026-17793 amazon-inspector, ossf-package-analysis

Oct 11, 2026
RubyGems
block-explorer-api 0.9.1
MAL-2026-17780 amazon-inspector, ossf-package-analysis

Oct 11, 2026
RubyGems
xrp-ledger-utils 0.9.1
MAL-2026-17802 amazon-inspector, ossf-package-analysis

Oct 11, 2026
RubyGems
sol-mint-utils 0.9.1
MAL-2026-17795 amazon-inspector, ossf-package-analysis

Oct 11, 2026
RubyGems
gas-refuel-bridge 0.9.1
MAL-2026-17788 amazon-inspector, ossf-package-analysis

Oct 11, 2026
PyPI
agent-vx 0.1.0
MAL-2026-17755 kam193, amazon-inspector 4 IOCs

Oct 10, 2026
PyPI
pafer 0.9.7, 0.9.8
MAL-2026-17756 kam193 2 IOCs

Oct 10, 2026
PyPI
webreader 2.3.8
MAL-2026-17757 kam193 2 IOCs

Oct 10, 2026
npm
@library-wide/library-shell 99.9.1
MAL-2026-17754 ossf-package-analysis, amazon-inspector, ghsa-malware

Oct 10, 2026
PyPI
media-manager5 0.1.0
MAL-2026-17753 kam193, amazon-inspector 4 IOCs

Oct 10, 2026
PyPI
agentaix 0.1.0, 0.2.0
MAL-2026-17752 kam193, amazon-inspector 4 IOCs

Oct 10, 2026
npm
passwordcracker 1.1.1, 1.0.0
MAL-2026-17864 amazon-inspector, ghsa-malware 5 IOCs

Oct 10, 2026
npm
passwordcrackv2 1.1.1, 1.1.0
MAL-2026-17865 amazon-inspector, ghsa-malware 5 IOCs

Oct 9, 2026