Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,377 npm 223,238 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,377 reports · Feed

npm
btree-range-store 1.0.2
MAL-2026-15876 ghsa-malware, amazon-inspector

Sep 3, 2026
npm
btree-lru-cache 2.1.0
MAL-2026-15875 ghsa-malware, amazon-inspector

Sep 3, 2026
npm
btree-leaderboard 2.3.1
MAL-2026-15874 ghsa-malware, amazon-inspector

Sep 3, 2026
npm
btree-core 3.2.2, 3.2.1, 3.2.3, 3.2.4
MAL-2026-15873 ghsa-malware, amazon-inspector

Sep 3, 2026
npm
indexed-btree 2.1.1, 2.1.2
MAL-2026-15888 ghsa-malware, amazon-inspector

Sep 3, 2026
npm
cbc97b7a 1.1788006723.0, 1.1787999998.0, 1.1788016922.0, 1.1788423886.0, 1.1788000497.0,…
MAL-2026-15878 ghsa-malware, amazon-inspector

Sep 3, 2026
npm
guci-wxrout all versions
MAL-2026-15886 ghsa-malware

Sep 3, 2026
npm
guci-main all versions
MAL-2026-15885 ghsa-malware

Sep 3, 2026
npm
fullcalendar-windos all versions
MAL-2026-15883 ghsa-malware

Sep 3, 2026
npm
element-utils-guci 1.0.0
MAL-2026-15882 ghsa-malware, amazon-inspector

Sep 3, 2026
npm
element-icon-guci all versions
MAL-2026-15881 ghsa-malware

Sep 3, 2026
npm
element-guci-util 12.12.1, 9.1.1, 11.11.11, 10.3.3, 12.11.13, 9.9.9, 10.0.0, 9.1.2, 10.1.1, 10.2.…
MAL-2026-15880 ghsa-malware, amazon-inspector

Sep 3, 2026
npm
guci-date all versions
MAL-2026-15884 ghsa-malware

Sep 3, 2026
npm
google-internal-cloud-audit-security-check 99.9.1777210552, 99.9.1777210553
MAL-2026-15842 ghsa-malware, reversing-labs

Sep 3, 2026
npm
google-cloud-mono-repo-helper all versions
MAL-2026-15841 ghsa-malware

Sep 3, 2026
npm
google-cloud-internal-core-utils all versions
MAL-2026-15840 ghsa-malware

Sep 3, 2026
npm
google-cloud-internal-build-helper all versions
MAL-2026-15839 ghsa-malware

Sep 3, 2026
npm
frank-apple-utils 1.0.0
MAL-2026-15838 ghsa-malware, reversing-labs

Sep 3, 2026
npm
frank-apple-sync-service all versions
MAL-2026-15837 ghsa-malware

Sep 3, 2026
npm
apple-internal-test-utility all versions
MAL-2026-15834 ghsa-malware

Sep 3, 2026
npm
apple-cktool-internal-api-v9 99.9.9
MAL-2026-15833 ghsa-malware, reversing-labs

Sep 3, 2026
PyPI
company-sdk 0.0.1
MAL-2026-15827 kam193, amazon-inspector

Sep 3, 2026
PyPI
env-validator-tool 1.0.0, 1.0.1, 1.0.2
MAL-2026-15828 kam193, amazon-inspector 2 IOCs

Sep 3, 2026
PyPI
telemetry-helper 1.0.1, 2.0.0, 1.1.0, 1.0.0, 1.0.2, 1.2.0, 1.3.0, 2.0.1
MAL-2026-15829 amazon-inspector, kam193 2 IOCs

Sep 3, 2026
npm
tailwindcss-fluid-styles 2.0.7
MAL-2026-15826 amazon-inspector

Sep 2, 2026
npm
real-router-utils 1.0.0
MAL-2026-15825 amazon-inspector

Sep 2, 2026
npm
@stellarshift/token-units 1.0.1, 1.0.3, 1.0.0
MAL-2026-15824 amazon-inspector, ghsa-malware

Sep 2, 2026
npm
@stellarshift/evm-address-kit 1.0.1, 1.0.3, 1.0.0
MAL-2026-15823 amazon-inspector, ghsa-malware

Sep 2, 2026
npm
@stellarshift/chain-metadata 1.0.1, 1.0.3, 1.0.0
MAL-2026-15822 amazon-inspector, ghsa-malware

Sep 2, 2026
npm
@stellarshift/abi-tools 1.0.1, 1.0.3, 1.0.0
MAL-2026-15821 amazon-inspector, ghsa-malware

Sep 2, 2026
npm
onceaction 5.1.2
MAL-2026-15844 ghsa-malware, amazon-inspector

Sep 2, 2026
npm
is-generator-check 2.1.0
MAL-2026-15843 ghsa-malware, amazon-inspector

Sep 2, 2026
npm
daisypick 1.2.0, 1.1.0, 1.0.0, 2.0.0
MAL-2026-15835 ghsa-malware, amazon-inspector

Sep 2, 2026
npm
tailwind-theme-engine 3.1.0, 1.1.0, 2.0.0, 3.0.0, 1.0.0, 4.0.0, 2.1.0
MAL-2026-15846 ghsa-malware, amazon-inspector

Sep 2, 2026
npm
eyiouss 3.0.21, 3.0.22, 4.0.1
MAL-2026-15836 ghsa-malware, amazon-inspector

Sep 2, 2026
npm
vitest-cli-pro 10.0.7
MAL-2026-15818 amazon-inspector

Sep 2, 2026
npm
peertube-plugin-poc-marker 1.0.0
MAL-2026-15817 amazon-inspector

Sep 2, 2026
npm
cminhouse-api-gateway-nodejs 999.0.0, 999.0.1
MAL-2026-15815 amazon-inspector

Sep 2, 2026
npm
eslint-rxjs 1.0.1, 1.0.0
MAL-2026-15812 ossf-package-analysis, amazon-inspector

Sep 2, 2026
npm
chromatitle-dev 1.0.0
MAL-2026-15814 amazon-inspector

Sep 2, 2026