Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,377 npm 223,238 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,377 reports · Feed

npm
confx1789550882 1.0.0
MAL-2026-16260 amazon-inspector

Sep 17, 2026
npm
randompkge all versions
MAL-2026-16259 ghsa-malware

Sep 17, 2026
npm
randompkgd all versions
MAL-2026-16258 ghsa-malware

Sep 17, 2026
npm
randompkgc all versions
MAL-2026-16257 ghsa-malware

Sep 17, 2026
npm
randompkgb 1.0.1
MAL-2026-16256 ghsa-malware, amazon-inspector

Sep 17, 2026
npm
randompkga 1.0.9, 1.0.11, 1.0.4, 1.0.22, 1.0.15, 1.0.13, 1.0.16, 1.0.7, 1.0.14, 1.0.5, 1.0…
MAL-2026-16255 ghsa-malware, amazon-inspector

Sep 17, 2026
npm
pulse-pwn-9f3a2 1.0.0
MAL-2026-16254 amazon-inspector, ghsa-malware

Sep 17, 2026
npm
ragacateslikodi 1.0.6, 1.0.4, 1.0.3, 1.0.5, 1.0.1, 1.0.0, 1.0.2
MAL-2026-16252 amazon-inspector, ghsa-malware

Sep 17, 2026
npm
tailwindcss-contact-form 0.5.1, 0.5.5
MAL-2026-16251 amazon-inspector, ghsa-malware

Sep 17, 2026
PyPI
marketing-mcp 0.1.0
MAL-2026-16250 kam193, amazon-inspector 1 IOC

Sep 17, 2026
npm
kartykgithub-takedown-b 1.0.0
MAL-2026-16249 ghsa-malware

Sep 17, 2026
npm
kartykgithub-takedown-a 1.0.2, 1.0.1, 1.0.3, 1.0.0
MAL-2026-16248 ghsa-malware

Sep 17, 2026
npm
laycot 1.3.10
MAL-2026-16253 amazon-inspector 4 IOCs

Sep 16, 2026
npm
pkg-rollback-dreed-viced-sonic-ponds all versions
MAL-2026-16247 ghsa-malware

Sep 16, 2026
npm
kartyk-github-token-pkg 1.0.4, 1.0.3
MAL-2026-16246 ghsa-malware

Sep 16, 2026
npm
kartyk-github-single-ver-pkg all versions
MAL-2026-16245 ghsa-malware

Sep 16, 2026
npm
kartyk-github-oidc-test-pkg 1.0.2, 1.0.1, 1.0.4
MAL-2026-16244 ghsa-malware

Sep 16, 2026
PyPI
trongappy 0.0.1
MAL-2026-16242 kam193, amazon-inspector 4 IOCs

Sep 16, 2026
PyPI
rak-lab-yoav-orca-zrktd2cp5hjmo4x7 9.9.9
MAL-2026-16241 kam193, amazon-inspector

Sep 16, 2026
PyPI
praetorian-mind-rce-test-2026 0.0.1, 0.0.2, 0.0.3
MAL-2026-16240 kam193, ossf-package-analysis, amazon-inspector 1 IOC

Sep 16, 2026
npm
idx_form_script 999.0.4, 999.0.2
MAL-2026-16243 ossf-package-analysis, amazon-inspector

Sep 16, 2026
npm
@traktis/core 99.99.2, 99.99.1
MAL-2026-16222 amazon-inspector

Sep 16, 2026
npm
@traktis/environment 99.99.1, 99.99.2
MAL-2026-16223 amazon-inspector

Sep 16, 2026
npm
strapi-plugin-os-rec 3.6.8
MAL-2026-16234 amazon-inspector

Sep 16, 2026
npm
strapi-plugin-ccrev-meeb 3.6.8
MAL-2026-16228 amazon-inspector

Sep 16, 2026
npm
strapi-plugin-osag 3.6.8
MAL-2026-16235 amazon-inspector

Sep 16, 2026
npm
strapi-plugin-ccrec-meeb 3.6.8
MAL-2026-16227 amazon-inspector

Sep 16, 2026
npm
strapi-plugin-cccon-meeb 3.6.8
MAL-2026-16225 amazon-inspector

Sep 16, 2026
npm
strapi-plugin-persh-meeb 3.6.8
MAL-2026-16237 amazon-inspector

Sep 16, 2026
npm
strapi-plugin-pysh-meeb 3.6.8
MAL-2026-16239 amazon-inspector

Sep 16, 2026
npm
strapi-plugin-perev-meeb 3.6.8
MAL-2026-16236 amazon-inspector

Sep 16, 2026
npm
strapi-plugin-ccip-meeb 3.6.8
MAL-2026-16226 amazon-inspector

Sep 16, 2026
npm
strapi-plugin-honey-meeb 3.6.8
MAL-2026-16231 amazon-inspector

Sep 16, 2026
npm
strapi-plugin-conresh-meeb 3.6.8
MAL-2026-16229 amazon-inspector

Sep 16, 2026
npm
strapi-plugin-feedmeeb 3.6.8
MAL-2026-16230 amazon-inspector

Sep 16, 2026
npm
strapi-plugin-portcc-meeb 3.6.8
MAL-2026-16238 amazon-inspector

Sep 16, 2026
npm
strapi-plugin-maylog-meeb 3.6.8
MAL-2026-16233 amazon-inspector

Sep 16, 2026
npm
strapi-plugin-listcc-meeb 3.6.8
MAL-2026-16232 amazon-inspector

Sep 16, 2026
npm
process-mite 1.1.79
MAL-2026-16224 amazon-inspector 4 IOCs

Sep 16, 2026
PyPI
licloud 0.2.7a0, 0.2.8
MAL-2026-16219 kam193, amazon-inspector

Sep 16, 2026