Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,371 npm 223,233 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,371 reports · Feed

npm
zeal-utils 0.0.0
MAL-2026-16542 reversing-labs, amazon-inspector

Sep 22, 2026
npm
zeal-util-hooks 0.0.0
MAL-2026-16541 reversing-labs, amazon-inspector

Sep 22, 2026
npm
style-class-utils 1.0.0
MAL-2026-16540 reversing-labs

Sep 22, 2026
npm
speaker_tagging_media_player 9999.0.0
MAL-2026-16539 reversing-labs

Sep 22, 2026
npm
spark-rpc 1.0.0
MAL-2026-16538 reversing-labs

Sep 22, 2026
npm
spark-common 1.0.0
MAL-2026-16537 reversing-labs

Sep 22, 2026
npm
mx-www-locales-common 99.0.0
MAL-2026-16536 reversing-labs

Sep 22, 2026
npm
mercuriusdream-oidc-replay-probe 1.0.0
MAL-2026-16535 reversing-labs

Sep 22, 2026
npm
eslint-config-compact-utils 1.0.2, 1.0.0
MAL-2026-16417 amazon-inspector, ossf-package-analysis

Sep 22, 2026
npm
halali-sample 999.9.14
MAL-2026-16534 reversing-labs

Sep 22, 2026
npm
exodus-firestore-synchronize 0.0.1
MAL-2026-16533 reversing-labs, amazon-inspector

Sep 22, 2026
npm
@yuva2210/poc-depconf 1.0.0, 1.0.1
MAL-2026-16532 reversing-labs

Sep 22, 2026
npm
@yuva2210/okx-poc-preinstall 1.0.0, 1.0.1
MAL-2026-16531 reversing-labs

Sep 22, 2026
npm
@ssgw/background-transition 9.999.999
MAL-2026-16530 reversing-labs

Sep 22, 2026
npm
@larocas-bbresearch/tp-probe-e29834ce 1.0.0, 1.0.1
MAL-2026-16529 reversing-labs, amazon-inspector

Sep 22, 2026
npm
@larocas-bbresearch/tp-probe-dc7a3670 1.0.0
MAL-2026-16528 reversing-labs

Sep 22, 2026
npm
@larocas-bbresearch/tombstone-probe-odvz5y 0.0.1
MAL-2026-16527 reversing-labs, amazon-inspector

Sep 22, 2026
npm
@larocas-bbresearch/tombstone-probe-live-z6xz56 0.0.1
MAL-2026-16526 reversing-labs, amazon-inspector

Sep 22, 2026
npm
@larocas-bbresearch/tombstone-probe-8ejnsa 0.0.1
MAL-2026-16525 reversing-labs, amazon-inspector

Sep 22, 2026
npm
@ks-cqc/h5-sig4 2.99.99
MAL-2026-16524 reversing-labs

Sep 22, 2026
npm
@ks-cqc/fingerprint-generator 1.99.99
MAL-2026-16523 reversing-labs

Sep 22, 2026
npm
@egencia/uitk-react-text 99.9.9
MAL-2026-16522 reversing-labs

Sep 22, 2026
npm
@egencia/uitk-react-spacing 99.99.9
MAL-2026-16521 reversing-labs

Sep 22, 2026
npm
@egencia/uitk-react-layout-flex 99.99.9
MAL-2026-16520 reversing-labs

Sep 22, 2026
npm
@egencia/uitk-react-foundation 99.9.9
MAL-2026-16519 reversing-labs

Sep 22, 2026
npm
@egencia/uitk-react 99.99.9
MAL-2026-16518 reversing-labs

Sep 22, 2026
npm
@egencia/uitk-global-styles-6 99.99.9
MAL-2026-16517 reversing-labs

Sep 22, 2026
npm
@egencia/uitk-global-styles 99.9.9
MAL-2026-16516 reversing-labs

Sep 22, 2026
npm
@egencia/design-tokens 99.99.9
MAL-2026-16515 reversing-labs

Sep 22, 2026
npm
@client-web-next/utils 0.0.1
MAL-2026-16514 reversing-labs

Sep 22, 2026
npm
@client-web-next/ui-business 0.0.1
MAL-2026-16513 reversing-labs

Sep 22, 2026
npm
@client-web-next/ui 9.999.2, 9.999.3
MAL-2026-16512 reversing-labs

Sep 22, 2026
npm
@client-web-next/ua-parser 0.0.1
MAL-2026-16511 reversing-labs

Sep 22, 2026
npm
@client-web-next/transfer-state 0.0.1
MAL-2026-16510 reversing-labs

Sep 22, 2026
npm
@client-web-next/timer 0.0.1
MAL-2026-16509 reversing-labs

Sep 22, 2026
npm
@client-web-next/tarjeta-button 0.0.1
MAL-2026-16508 reversing-labs

Sep 22, 2026
npm
@client-web-next/providers 0.0.1
MAL-2026-16507 reversing-labs

Sep 22, 2026
npm
@client-web-next/origination-microfront 0.0.1
MAL-2026-16506 reversing-labs

Sep 22, 2026
npm
@client-web-next/navigation-link 0.0.1
MAL-2026-16505 reversing-labs

Sep 22, 2026
npm
@client-web-next/logger 0.0.1
MAL-2026-16504 reversing-labs

Sep 22, 2026