Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,377 npm 223,238 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,377 reports · Feed

npm
cb-wallet-solana-provider all versions
MAL-2026-16030 ghsa-malware

Sep 7, 2026
npm
cb-wallet-metadata all versions
MAL-2026-16029 ghsa-malware

Sep 7, 2026
npm
cb-wallet-env all versions
MAL-2026-16028 ghsa-malware

Sep 7, 2026
npm
cb-wallet-analytics all versions
MAL-2026-16027 ghsa-malware

Sep 7, 2026
npm
base-app-data all versions
MAL-2026-16023 ghsa-malware

Sep 7, 2026
npm
omni-channel-configurator-wireline-frontend 9999.0.0, 0.0.1
MAL-2026-16009 amazon-inspector 4 IOCs

Sep 7, 2026
npm
b2b-frontend-external-library 0.0.1, 9999.0.0
MAL-2026-16008 amazon-inspector 4 IOCs

Sep 7, 2026
npm
@caliperx2/components all versions
MAL-2026-16007 4 IOCs

Sep 7, 2026
npm
oce-configurator-wireless-frontend 0.0.1, 9999.0.0
MAL-2026-15940 ossf-package-analysis, amazon-inspector

Sep 6, 2026
npm
omni-channel-order-frontend 0.0.1, 9999.0.0
MAL-2026-15942 ossf-package-analysis, amazon-inspector

Sep 6, 2026
npm
ocfe-tv-subscription-center-web 0.0.1, 9999.0.0
MAL-2026-15941 ossf-package-analysis, amazon-inspector

Sep 6, 2026
npm
omni-channel-oid-frontend 0.0.1, 9999.0.0
MAL-2026-15939 ossf-package-analysis, amazon-inspector

Sep 6, 2026
npm
agentrc-security-poc-policy 1.0.0
MAL-2026-16005 ossf-package-analysis

Sep 6, 2026
PyPI
dac-tools 999.0.0
MAL-2026-15938 kam193, ossf-package-analysis, amazon-inspector

Sep 6, 2026
npm
vishal_312pkg 1.0.0
MAL-2026-16006 ossf-package-analysis, amazon-inspector

Sep 6, 2026
PyPI
minecraftmodes 0.3.3
MAL-2026-15937 kam193 4 IOCs

Sep 6, 2026
npm
@liuliang520500/sinataoke_cn_test all versions
MAL-2026-15961 ghsa-malware

Sep 6, 2026
npm
@liuliang520500/sinataoke_cn 2.0.9, 2.0.10, 2.0.8, 2.0.7
MAL-2026-15960 ghsa-malware, amazon-inspector

Sep 6, 2026
npm
@liuliang520500/pdd-sdk-new all versions
MAL-2026-15959 ghsa-malware

Sep 6, 2026
npm
@liuliang520500/pdd-sdk all versions
MAL-2026-15958 ghsa-malware

Sep 6, 2026
npm
@liuliang520500/jd-sdk all versions
MAL-2026-15957 ghsa-malware

Sep 6, 2026
npm
@liuliang520500/taobao-topclient all versions
MAL-2026-15962 ghsa-malware

Sep 6, 2026
npm
@pilllesss/yorn all versions
MAL-2026-15963 ghsa-malware

Sep 6, 2026
npm
dcftunnel 0.4.5
MAL-2026-15975 ghsa-malware, amazon-inspector

Sep 6, 2026
npm
1cattunnel 0.2.0, 0.3.4, 0.5.1, 0.3.0, 0.3.1, 0.1.2-b.1, 0.3.2, 0.1.2-b.3, 0.1.2-b.2
MAL-2026-15943 ghsa-malware, amazon-inspector

Sep 6, 2026
npm
multicore-kit 1.1.5
MAL-2026-15995 ghsa-malware, amazon-inspector

Sep 6, 2026
npm
date-fns-formatter 1.3.8, 1.3.10, 1.4.9, 1.3.9
MAL-2026-15974 ghsa-malware, amazon-inspector

Sep 6, 2026
npm
array-frames 2.3.5, 2.3.6, 2.3.2, 2.3.4, 2.3.3
MAL-2026-15969 ghsa-malware, amazon-inspector

Sep 6, 2026
npm
node-helper 1.5.4, 1.6.4
MAL-2026-15997 ghsa-malware, amazon-inspector

Sep 6, 2026
npm
jwt-logger 2.4.9, 2.1.9, 2.5.0
MAL-2026-15991 ghsa-malware, amazon-inspector

Sep 5, 2026
npm
array-scala 1.2.5, 1.2.4
MAL-2026-15970 ghsa-malware, amazon-inspector

Sep 5, 2026
PyPI
trongridew 0.0.1
MAL-2026-15936 kam193, amazon-inspector 4 IOCs

Sep 5, 2026
npm
@domyjs/throttle all versions
MAL-2026-15956 ghsa-malware

Sep 5, 2026
npm
@domyjs/router all versions
MAL-2026-15955 ghsa-malware

Sep 5, 2026
npm
@domyjs/reactive all versions
MAL-2026-15954 ghsa-malware

Sep 5, 2026
npm
@domyjs/mask all versions
MAL-2026-15953 ghsa-malware

Sep 5, 2026
npm
@domyjs/intersect all versions
MAL-2026-15952 ghsa-malware

Sep 5, 2026
npm
@domyjs/i18n all versions
MAL-2026-15951 ghsa-malware

Sep 5, 2026
npm
tempjs-template all versions
MAL-2026-16002 ghsa-malware

Sep 5, 2026
npm
puppeteer-obscura 1.0.0
MAL-2026-16001 ghsa-malware, amazon-inspector

Sep 5, 2026