Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,377 npm 223,238 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,377 reports · Feed

PyPI
bq-build-probe-vrp-2026 0.2.0
MAL-2026-16098 amazon-inspector

Sep 9, 2026
npm
matrixkit-js 1.0.0
MAL-2026-16095 amazon-inspector

Sep 9, 2026
npm
gmgn-trading-kit 1.7.0, 1.7.1, 1.7.2
MAL-2026-16094 amazon-inspector

Sep 9, 2026
npm
twilio-hackerone-poc-b8f21a 1.0.1, 1.0.0
MAL-2026-16097 amazon-inspector

Sep 9, 2026
npm
soltinel-pro 0.2.1, 0.2.2, 0.2.0
MAL-2026-16096 amazon-inspector

Sep 9, 2026
npm
sams-text-style all versions
MAL-2026-16091 ghsa-malware

Sep 9, 2026
npm
sams-run-style all versions
MAL-2026-16090 ghsa-malware

Sep 9, 2026
npm
graphql-js-client-transform 6.14.0
MAL-2026-16086 ghsa-malware, reversing-labs

Sep 9, 2026
npm
@staticj/cropperxmjs 1.6.0
MAL-2026-16081 amazon-inspector

Sep 9, 2026
npm
@umschool/platform 999.0.2, 999.0.1, 999.0.0
MAL-2026-16082 amazon-inspector

Sep 9, 2026
npm
vinnleys 1.0.0, 1.0.1
MAL-2026-16092 ghsa-malware, amazon-inspector

Sep 9, 2026
npm
xbailsync 1.0.4, 1.0.6, 1.0.5, 1.0.1, 1.0.3, 1.0.0, 2.0.0, 1.0.2, 1.0.7
MAL-2026-16093 ghsa-malware, amazon-inspector

Sep 9, 2026
npm
amprem-activator 1.0.0, 1.0.2, 1.0.1
MAL-2026-16084 ghsa-malware, amazon-inspector

Sep 9, 2026
npm
@vnxsync/libsignal-node all versions
MAL-2026-16083 ghsa-malware

Sep 9, 2026
npm
raydium-clmm-sdk 0.0.1, 0.0.2
MAL-2026-16089 ghsa-malware 2 IOCs

Sep 9, 2026
npm
pumpswap-sdk-v1 0.0.1
MAL-2026-16088 ghsa-malware 2 IOCs

Sep 9, 2026
npm
polygon-toolkits-validator 1.1.4
MAL-2026-16087 ghsa-malware, amazon-inspector 2 IOCs

Sep 9, 2026
npm
crypto-validates 0.0.2
MAL-2026-16085 ghsa-malware 2 IOCs

Sep 9, 2026
PyPI
websetup 0.1.0
MAL-2026-16121 amazon-inspector 1 IOC

Sep 9, 2026
PyPI
databricks-webapp-navigation-homepage 999.0.0
MAL-2026-16080 kam193

Sep 9, 2026
npm
server-authorized-cleanup 1.1.0
MAL-2026-16079 amazon-inspector

Sep 9, 2026
npm
cache-cleanup-module 2.6.0, 2.5.0
MAL-2026-16078 amazon-inspector

Sep 9, 2026
npm
chai-as-sleek 7.1.2
MAL-2026-16077 amazon-inspector

Sep 9, 2026
npm
external_deps_enjoyer 1.0.0
MAL-2026-16076 amazon-inspector

Sep 9, 2026
npm
easypanel-agent 1.0.0
MAL-2026-16072 amazon-inspector

Sep 9, 2026
npm
cat-sis2go-utils 99.1.0, 99.0.0
MAL-2026-16071 amazon-inspector 2 IOCs

Sep 9, 2026
npm
easypanel-deploy 1.0.0
MAL-2026-16074 amazon-inspector

Sep 9, 2026
npm
easypanel-api-client 1.0.0
MAL-2026-16073 amazon-inspector

Sep 9, 2026
npm
easypanel-hosting 1.0.0
MAL-2026-16075 amazon-inspector

Sep 9, 2026
npm
@fyxzpediaa/baileys 8.1.2, 9.1.0
MAL-2026-16070 amazon-inspector, ghsa-malware

Sep 9, 2026
npm
reactlogo-load 1.0.0
MAL-2026-16069 amazon-inspector, ghsa-malware

Sep 9, 2026
npm
@versacode/baileys 1.4.5-beta.2, 1.4.5-beta.0, 1.4.5-beta.1
MAL-2026-16068 ghsa-malware, amazon-inspector

Sep 9, 2026
npm
@vallensofficial/baileys 10.0.0-beta.1, 9.4.6, 9.4.7
MAL-2026-16067 ghsa-malware, amazon-inspector

Sep 9, 2026
npm
@haimiya/baileys 9.4.6, 9.4.5
MAL-2026-16066 ghsa-malware, amazon-inspector

Sep 9, 2026
npm
@yongot/canary-mcp-isolation 1.0.1, 1.0.0, 1.0.2
MAL-2026-16061 amazon-inspector

Sep 9, 2026
npm
express-session-timer 1.0.0, 1.0.1, 1.0.13, 1.0.14, 1.0.16, 1.0.11, 1.0.15
MAL-2026-16065 amazon-inspector

Sep 9, 2026
npm
bx-ui-view 1.0.0
MAL-2026-16064 amazon-inspector

Sep 9, 2026
npm
@yongot/canary-mcp-test 3.0.0, 2.0.0, 4.0.0, 1.0.0
MAL-2026-16062 amazon-inspector

Sep 9, 2026
npm
alloy-graphql 1.0.1
MAL-2026-16063 amazon-inspector

Sep 9, 2026
npm
selfcerts 1.0.0
MAL-2026-16060 amazon-inspector

Sep 9, 2026