Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,377 npm 223,238 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,377 reports · Feed

PyPI
metricboxlite 1.0, 2.0
MAL-2026-15931 kam193, amazon-inspector

Sep 4, 2026
PyPI
olympuslib 99.99.0
MAL-2026-15928 kam193, amazon-inspector 1 IOC

Sep 4, 2026
PyPI
pymaas 99.99.0
MAL-2026-15929 kam193, amazon-inspector 1 IOC

Sep 4, 2026
PyPI
tpu-raiden-jax 99.99.0
MAL-2026-15930 kam193, amazon-inspector 1 IOC

Sep 4, 2026
npm
@crysnovax/plug all versions
MAL-2026-15946 ghsa-malware

Sep 4, 2026
npm
@crysnovax/baileys-stable all versions
MAL-2026-15945 ghsa-malware

Sep 4, 2026
npm
@crysnovax/baileys-fixed all versions
MAL-2026-15944 ghsa-malware

Sep 4, 2026
PyPI
qoeoe 0.1.0
MAL-2026-15927 kam193, amazon-inspector

Sep 4, 2026
PyPI
astlsi 0.1.0
MAL-2026-15926 kam193, amazon-inspector

Sep 4, 2026
npm
tailwind-contact-forms 0.5.12, 0.5.1, 0.5.5, 0.5.9, 0.5.8
MAL-2026-15925 amazon-inspector

Sep 4, 2026
npm
box-sign-client-poc 1.0.0
MAL-2026-15921 amazon-inspector

Sep 4, 2026
npm
box-sign-client 1.0.0
MAL-2026-15920 amazon-inspector

Sep 4, 2026
npm
claude-channel-discord 9.9.9
MAL-2026-15922 amazon-inspector

Sep 4, 2026
npm
real-router-telemetry 1.0.1, 1.0.4
MAL-2026-15924 amazon-inspector

Sep 4, 2026
npm
line-through 1.0.0
MAL-2026-15923 amazon-inspector

Sep 4, 2026
npm
taskforge-9xv 1.3.0
MAL-2026-15914 amazon-inspector

Sep 4, 2026
npm
taskforge-8xv 1.2.0
MAL-2026-15913 amazon-inspector

Sep 4, 2026
npm
text-transform-plus 1.2.4
MAL-2026-15915 amazon-inspector

Sep 4, 2026
npm
tailwind-aspect 0.4.2
MAL-2026-15912 amazon-inspector

Sep 4, 2026
npm
2nestjs 0.0.1
MAL-2026-15911 amazon-inspector

Sep 4, 2026
npm
xcryption 1.0.0, 1.0.1, 1.0.3, 1.0.2
MAL-2026-15916 amazon-inspector

Sep 4, 2026
PyPI
timeweave 1.6.0, 1.9.0, 1.7.0, 1.4.0, 1.8.0, 1.2.0, 1.1.0, 1.3.0, 1.0.0, 1.5.0
MAL-2026-15910 amazon-inspector, kam193 2 IOCs

Sep 4, 2026
npm
net-util-y8 1.1788432509.0
MAL-2026-15901 amazon-inspector

Sep 4, 2026
npm
easypanel-ctl 1.0.0
MAL-2026-15898 amazon-inspector

Sep 4, 2026
npm
tailwindcss-3d-styles 1.2.4
MAL-2026-15905 amazon-inspector

Sep 4, 2026
npm
easypanel-core 1.0.0
MAL-2026-15897 amazon-inspector

Sep 4, 2026
npm
easypanel-client 1.0.0
MAL-2026-15896 amazon-inspector

Sep 4, 2026
npm
easypanel-app 1.0.0
MAL-2026-15895 amazon-inspector

Sep 4, 2026
npm
easypanel-docker 1.0.0
MAL-2026-15899 amazon-inspector

Sep 4, 2026
npm
tailwindcss-animate-styles 1.0.9
MAL-2026-15906 amazon-inspector

Sep 4, 2026
npm
peertube-plugin-video-views-counter 1.0.2
MAL-2026-15902 amazon-inspector

Sep 4, 2026
npm
tailwind-scrollbar-styles 4.0.3
MAL-2026-15904 amazon-inspector

Sep 4, 2026
npm
tiny-folder-tree 0.1.0
MAL-2026-15907 amazon-inspector

Sep 4, 2026
npm
tailwind-container-queries 0.1.1
MAL-2026-15903 amazon-inspector

Sep 4, 2026
npm
hydration-ui-pkg 1.0.0
MAL-2026-15900 amazon-inspector

Sep 4, 2026
npm
wallet-watcher 1.0.2
MAL-2026-15871 amazon-inspector, ghsa-malware

Sep 4, 2026
npm
vitest-cli-dev 10.0.7
MAL-2026-15870 amazon-inspector

Sep 4, 2026
npm
mcp-consultasdeveiculos-client 0.1.1, 0.0.2, 0.1.0
MAL-2026-15869 amazon-inspector

Sep 4, 2026
npm
@bx-ui-framework/authentication 1.2.0, 15.0.0, 16.0.0
MAL-2026-15866 amazon-inspector

Sep 4, 2026
npm
@bx-ui-framework/microfrontend 15.0.0
MAL-2026-15868 amazon-inspector

Sep 4, 2026