Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,377 npm 223,238 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,377 reports · Feed

npm
keroeltopkk 99.99.99
MAL-2026-16335 amazon-inspector

Sep 21, 2026
npm
my-cdn-script 1.0.0
MAL-2026-16337 amazon-inspector

Sep 21, 2026
npm
pf25262 1.0.0
MAL-2026-16340 amazon-inspector, ghsa-malware

Sep 21, 2026
npm
homestack-cheer 1.1.9, 1.1.8, 1.1.7, 1.1.6, 1.1.5, 1.1.3, 1.1.2, 1.1.1, 1.1.0, 1.0.2, 1.0.1, 1.…
MAL-2026-16333 amazon-inspector, ghsa-malware

Sep 21, 2026
npm
@asenfotech/unplugin-element-plus 2.9.5, 2.9.3
MAL-2026-16318 amazon-inspector

Sep 21, 2026
npm
feed-widget-helper 1.0.0, 1.0.8, 1.0.6
MAL-2026-16332 amazon-inspector, ghsa-malware

Sep 21, 2026
npm
element-plus-vite-cli 2.9.3, 2.9.5
MAL-2026-16331 amazon-inspector

Sep 21, 2026
npm
catwrestlingbird 1.0.0
MAL-2026-16327 amazon-inspector

Sep 21, 2026
npm
sorrawit-dev-helper 1.0.0
MAL-2026-16344 amazon-inspector

Sep 21, 2026
npm
catwrestlinghuman 1.0.0
MAL-2026-16328 amazon-inspector

Sep 21, 2026
npm
action-slack-message-root 1.0.1
MAL-2026-16323 amazon-inspector, ghsa-malware

Sep 21, 2026
npm
bulk-add-sdk 1.99.99
MAL-2026-16325 amazon-inspector

Sep 21, 2026
npm
better-envforge 1.0.0
MAL-2026-16324 amazon-inspector, ghsa-malware

Sep 21, 2026
npm
chai-as-viem 1.1.3
MAL-2026-16329 amazon-inspector, ghsa-malware

Sep 21, 2026
npm
byted-commerce-materials 1.0.0
MAL-2026-16326 amazon-inspector

Sep 21, 2026
npm
siriusbeyond 1.0.0
MAL-2026-16343 amazon-inspector

Sep 21, 2026
npm
@siriusbeyond/ui 99.0.0
MAL-2026-16321 amazon-inspector

Sep 21, 2026
npm
@siriusbeyond/utils 99.0.0
MAL-2026-16322 amazon-inspector

Sep 21, 2026
npm
@dbbhk/ui-components 99.0.0
MAL-2026-16319 amazon-inspector

Sep 21, 2026
npm
commerce-materials 1.0.0
MAL-2026-16330 amazon-inspector

Sep 21, 2026
npm
test1sdsd2 99.99.99
MAL-2026-16316 amazon-inspector

Sep 21, 2026
npm
testmgkregme 1.0.1
MAL-2026-16317 amazon-inspector, ghsa-malware

Sep 21, 2026
npm
test12vv36 99.99.99
MAL-2026-16311 amazon-inspector

Sep 21, 2026
npm
test1ro 999.99.99, 99.99.99
MAL-2026-16315 amazon-inspector

Sep 21, 2026
npm
test1df23 99.99.99
MAL-2026-16312 amazon-inspector

Sep 21, 2026
npm
test1hh235 99.99.99
MAL-2026-16314 amazon-inspector

Sep 21, 2026
npm
test1gg234 99.99.99
MAL-2026-16313 amazon-inspector

Sep 21, 2026
npm
npx-test-ma980 1.0.1
MAL-2026-16310 amazon-inspector

Sep 21, 2026
npm
chai-testing 1.1.4
MAL-2026-16307 amazon-inspector

Sep 21, 2026
npm
@baanx/solana-lib 9.9.10, 9.9.9
MAL-2026-16300 amazon-inspector, ghsa-malware

Sep 21, 2026
npm
@nimbusedge2/authxsas 1.1.0
MAL-2026-16303 amazon-inspector

Sep 21, 2026
npm
@nimbusedge2/auth 1.1.1
MAL-2026-16302 amazon-inspector

Sep 21, 2026
npm
@nimbusedge2/authxsas1 1.1.0
MAL-2026-16304 amazon-inspector

Sep 21, 2026
npm
npmscript_tesstalert_unpkg 1.0.2, 1.0.1, 1.1.8, 1.1.7
MAL-2026-16309 amazon-inspector, ghsa-malware

Sep 21, 2026
npm
chat-adapter-matrix 99.99.99
MAL-2026-16308 amazon-inspector

Sep 21, 2026
npm
@nimbusedge2/x 1.1.1
MAL-2026-16305 amazon-inspector

Sep 21, 2026
npm
@nimbusedge2/xa 1.1.0
MAL-2026-16306 amazon-inspector

Sep 21, 2026
npm
@nimbsuedge3/xar 1.1.1
MAL-2026-16301 amazon-inspector

Sep 21, 2026
npm
@pwaplatform/module-sso-integration 99.0.0, 99.0.1
MAL-2026-16299 ossf-package-analysis, amazon-inspector, ghsa-malware

Sep 20, 2026
npm
@siriusbeyond/auth 99.0.0
MAL-2026-16320 amazon-inspector, ossf-package-analysis

Sep 20, 2026