Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,371 npm 223,233 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,371 reports · Feed

npm
secure-env3 1.0.1
MAL-2026-17178 amazon-inspector

Sep 25, 2026
npm
agency-test-exercise 1.0.2
MAL-2026-17170 amazon-inspector

Sep 25, 2026
npm
better-dotenv3 1.0.1
MAL-2026-17172 amazon-inspector

Sep 25, 2026
npm
chromatitle-js 1.0.0
MAL-2026-17174 amazon-inspector

Sep 25, 2026
npm
chromatitle 1.0.0
MAL-2026-17173 amazon-inspector

Sep 25, 2026
PyPI
my-private-pkg 99.1.1, 0.1.1, 99.11.2
MAL-2026-17180 amazon-inspector, kam193 2 IOCs

Sep 25, 2026
PyPI
vercel-runtime-python 0.1.0, 99.99.99, 100.99.99, 100.100.99
MAL-2026-17168 kam193, amazon-inspector

Sep 24, 2026
PyPI
prosocks 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.13, 1…
MAL-2026-17167 kam193, amazon-inspector 1 IOC

Sep 24, 2026
npm
analytics-widget 1.0.0, 1.0.1
MAL-2026-17163 amazon-inspector, ghsa-malware

Sep 24, 2026
npm
building-build 1.0.0
MAL-2026-17164 amazon-inspector, ghsa-malware

Sep 24, 2026
npm
cache-swipper 3.6.0, 3.5.0
MAL-2026-17166 amazon-inspector

Sep 24, 2026
npm
c2-client 1.0.0
MAL-2026-17165 amazon-inspector

Sep 24, 2026
npm
simple-date-formatter-new-16 1.0.0
MAL-2026-17162 amazon-inspector

Sep 24, 2026
npm
eslint-config-compact-base 1.0.0
MAL-2026-17157 amazon-inspector, ghsa-malware

Sep 24, 2026
npm
simple-date-formatter-new-14 1.0.0
MAL-2026-17160 amazon-inspector

Sep 24, 2026
npm
simple-date-formatter-new-13 1.0.0
MAL-2026-17159 amazon-inspector

Sep 24, 2026
npm
aliftech-ui 99.9.9
MAL-2026-17156 amazon-inspector

Sep 24, 2026
npm
@osl-design/react 9.9.10
MAL-2026-17155 amazon-inspector

Sep 24, 2026
npm
simple-date-formatter-new-15 1.0.0
MAL-2026-17161 amazon-inspector

Sep 24, 2026
npm
simple-date-formatter-new-11 1.0.0
MAL-2026-17158 amazon-inspector

Sep 24, 2026
npm
@nf-addons/am-global-header 9.9.10
MAL-2026-17154 amazon-inspector

Sep 24, 2026
npm
@birbalo/aliftech-ui 99.9.9
MAL-2026-17153 amazon-inspector

Sep 24, 2026
npm
@baanx/domain 9.9.9
MAL-2026-16486 ghsa-malware, amazon-inspector

Sep 24, 2026
npm
@baanx/common 9.9.9
MAL-2026-16485 ghsa-malware, amazon-inspector

Sep 24, 2026
npm
@rixxcodex/baileys 8.1.0, 8.2.0, 8.0.16, 8.0.15, 9.0.3, 9.0.0, 9.0.1
MAL-2026-16483 amazon-inspector 2 IOCs

Sep 23, 2026
npm
pino-testkit 10.4.5
MAL-2026-16484 amazon-inspector, ghsa-malware

Sep 23, 2026
npm
internallib_v657 1.0.1
MAL-2026-16482 amazon-inspector

Sep 23, 2026
npm
internallib_v463 1.0.2
MAL-2026-16481 amazon-inspector

Sep 23, 2026
npm
a-onesite 99.9.9
MAL-2026-16480 amazon-inspector

Sep 23, 2026
npm
event-hunter 1.0.0
MAL-2026-16478 amazon-inspector

Sep 23, 2026
npm
simplenewnpmpackage 1.0.2
MAL-2026-16479 amazon-inspector

Sep 23, 2026
npm
com.apple.unityplugin.storekit 1.0.2, 1.0.1
MAL-2026-16477 amazon-inspector, ghsa-malware

Sep 23, 2026
npm
sea-baileys 1.0.2
MAL-2026-16473 amazon-inspector

Sep 23, 2026
npm
vite-dev-launcher 2.9.4
MAL-2026-16474 amazon-inspector

Sep 23, 2026
npm
@test1230504/string-format-helper all versions
MAL-2026-16468 ghsa-malware

Sep 23, 2026
npm
@test1230504/probe-7f3k2m-utils all versions
MAL-2026-16467 ghsa-malware

Sep 23, 2026
npm
@test1230504/test-publish-verify all versions
MAL-2026-16469 ghsa-malware

Sep 23, 2026
npm
z-deno-truth-ya1t4m 1.0.0
MAL-2026-16472 ghsa-malware, amazon-inspector

Sep 23, 2026
npm
z-deno-truth-va499w 1.0.0
MAL-2026-16471 ghsa-malware, amazon-inspector

Sep 23, 2026
npm
z-deno-truth-bwhlsz 2.0.0, 1.0.0
MAL-2026-16470 ghsa-malware, amazon-inspector

Sep 23, 2026