Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,370 npm 223,232 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,370 reports · Feed

npm
monitoring-agent 1.0.1
MAL-2026-17515 amazon-inspector, ghsa-malware

Oct 4, 2026
npm
postcss-gap-fallback-util 1.0.0
MAL-2026-17518 amazon-inspector

Oct 4, 2026
npm
popover-anchor-polyfill 1.0.0
MAL-2026-17517 amazon-inspector

Oct 4, 2026
npm
tiny-viewport-unit-calc 1.0.0
MAL-2026-17528 amazon-inspector

Oct 4, 2026
npm
promises-dotenv3 1.0.0
MAL-2026-17519 amazon-inspector

Oct 4, 2026
npm
rgx33-css-grid-utils 1.0.0
MAL-2026-17520 amazon-inspector

Oct 4, 2026
npm
studiocode_tools 1.0.1
MAL-2026-17523 amazon-inspector

Oct 4, 2026
npm
studiocode_eligibility 1.0.1
MAL-2026-17522 amazon-inspector

Oct 4, 2026
npm
rgx33-flex-layout-core 1.0.0
MAL-2026-17521 amazon-inspector

Oct 4, 2026
npm
tiny-css-token-parser 1.0.0
MAL-2026-17525 amazon-inspector

Oct 4, 2026
npm
tiny-dom-focus-trap 1.0.0
MAL-2026-17526 amazon-inspector

Oct 4, 2026
npm
tailwindcss-forms-styles 0.5.1
MAL-2026-17524 amazon-inspector

Oct 4, 2026
npm
tiny-focusgroup-helper 1.0.0
MAL-2026-17527 amazon-inspector

Oct 4, 2026
npm
wcag-color-a11y-helpers 1.0.0
MAL-2026-17530 amazon-inspector

Oct 4, 2026
npm
ultimate-websocket 1.0.0
MAL-2026-17529 amazon-inspector

Oct 4, 2026
npm
@bellaxchuu/crystalred 0.1.2
MAL-2026-17343 amazon-inspector, ghsa-malware

Oct 4, 2026
npm
@xatancchii/velycxbail 1.1.0
MAL-2026-17383 amazon-inspector

Oct 4, 2026
npm
saturn-baileys 1.0.0
MAL-2026-17404 amazon-inspector

Oct 4, 2026
npm
shadowmd 8.6.87
MAL-2026-17405 amazon-inspector

Oct 4, 2026
npm
@kibt/www-nuxt-i18n 99.0.1, 1.0.0, 0.1.0, 0.0.1, 1.1.0, 1.0.1, 3.0.0, 2.0.1
MAL-2026-17498 amazon-inspector, ghsa-malware

Oct 4, 2026
npm
@angulra/core 1.0.67
MAL-2026-17496 amazon-inspector

Oct 4, 2026
npm
@angulra/cli 22.2.1
MAL-2026-17495 amazon-inspector

Oct 4, 2026
npm
botmaker-cli 0.1.19
MAL-2026-17502 amazon-inspector

Oct 4, 2026
npm
chai-as-testmode 1.4.7
MAL-2026-17473 amazon-inspector

Oct 4, 2026
npm
css-scroll-state-polyfill 1.0.0
MAL-2026-17486 amazon-inspector

Oct 4, 2026
npm
css-snap-target-polyfill 1.0.0
MAL-2026-17487 amazon-inspector

Oct 4, 2026
npm
css-starting-style-polyfill 1.0.0
MAL-2026-17488 amazon-inspector

Oct 4, 2026
npm
core-js-gnz 1.0.0
MAL-2026-17474 amazon-inspector

Oct 4, 2026
npm
css-reading-flow-polyfill 1.0.0
MAL-2026-17483 amazon-inspector

Oct 4, 2026
npm
css-scroll-anchor-polyfill 1.0.0
MAL-2026-17485 amazon-inspector

Oct 4, 2026
npm
css-light-dark-polyfill 1.0.0
MAL-2026-17481 amazon-inspector

Oct 4, 2026
npm
css-interop-observer-polyfill 1.0.0
MAL-2026-17480 amazon-inspector

Oct 4, 2026
npm
css-relative-color-util 1.0.0
MAL-2026-17484 amazon-inspector

Oct 4, 2026
npm
css-logical-prop-shim 1.0.0
MAL-2026-17482 amazon-inspector

Oct 4, 2026
npm
css-field-sizing-polyfill 1.0.0
MAL-2026-17478 amazon-inspector

Oct 4, 2026
npm
css-env-function-shim 1.0.0
MAL-2026-17477 amazon-inspector

Oct 4, 2026
npm
css-gap-decorations-polyfill 1.0.0
MAL-2026-17479 amazon-inspector

Oct 4, 2026
npm
css-anchor-pos-fallback 1.0.0
MAL-2026-17476 amazon-inspector

Oct 4, 2026
npm
css-a11y-contrast-utils 1.0.0
MAL-2026-17475 amazon-inspector

Oct 4, 2026
npm
focus-visible-polyfill-lite 1.0.0
MAL-2026-17491 amazon-inspector

Oct 4, 2026