Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,006 npm 222,874 PyPI 11,991 RubyGems 4,315 NuGet 782 crates.io 21 Go 20 Maven 2 Packagist 1

Compromised well-known packages

Legitimate, widely used packages that had malicious versions published (account takeover, hijacked releases).

222,874 reports · Feed

npm
@htooayelwinict/travis234 3.3.2
MAL-2026-18757 ghsa-malware

Nov 8, 2026
npm
dsh-notify-focus 0.7.0, 0.5.0, 0.7.1
MAL-2026-18748 ghsa-malware

Nov 7, 2026
npm
@cherrydotfun/miniapp-sdk 0.1.22, 0.1.23
MAL-2026-18737 ghsa-malware

Nov 6, 2026
npm
tailwind-animationfound all versions
MAL-2026-18740 ghsa-malware

Nov 6, 2026
npm
modelsdesk 0.4.2
MAL-2026-18739 ghsa-malware

Nov 6, 2026
npm
kampodine 0.8.0
MAL-2026-18738 ghsa-malware

Nov 6, 2026
npm
automic-style-engine all versions
MAL-2026-18736 ghsa-malware

Nov 6, 2026
npm
monobomber all versions
MAL-2026-18732 ghsa-malware

Nov 6, 2026
npm
monopw all versions
MAL-2026-18733 ghsa-malware

Nov 6, 2026
npm
tw-motion-css all versions
MAL-2026-18734 ghsa-malware

Nov 6, 2026
npm
wisdomtreetest all versions
MAL-2026-18730 ghsa-malware

Nov 6, 2026
npm
@noinheritdoc/n all versions
MAL-2026-18722 ghsa-malware

Nov 6, 2026
npm
@sideeffects/n all versions
MAL-2026-18723 ghsa-malware

Nov 6, 2026
npm
@site-cms/ssr all versions
MAL-2026-18724 ghsa-malware

Nov 6, 2026
npm
@ts-expect-error/n all versions
MAL-2026-18725 ghsa-malware

Nov 6, 2026
npm
@needsaudit/n all versions
MAL-2026-18720 ghsa-malware

Nov 6, 2026
npm
@needsaudit/nexport all versions
MAL-2026-18721 ghsa-malware

Nov 6, 2026
npm
@smart-dev-wa/baileys 1.0.0
MAL-2026-17442 ghsa-malware

Nov 6, 2026
npm
zero2-baileys all versions
MAL-2026-18731 ghsa-malware

Nov 6, 2026
npm
arc-contracts all versions
MAL-2026-18726 ghsa-malware

Nov 6, 2026
npm
evmos-contracts all versions
MAL-2026-18727 ghsa-malware

Nov 6, 2026
npm
securedrop-app all versions
MAL-2026-18729 ghsa-malware

Nov 6, 2026
npm
kc-kline-chart all versions
MAL-2026-18728 ghsa-malware

Nov 6, 2026
npm
@kora20030101/test-pkg-delete-me all versions
MAL-2026-18719 ghsa-malware

Nov 6, 2026
npm
@exclipz/baileys all versions
MAL-2026-18717 ghsa-malware

Nov 6, 2026
npm
@exclipz/bails all versions
MAL-2026-18718 ghsa-malware

Nov 6, 2026
npm
talk-lang all versions
MAL-2026-18715 ghsa-malware

Nov 5, 2026
npm
plain-lang all versions
MAL-2026-18714 ghsa-malware

Nov 5, 2026
npm
test1817 all versions
MAL-2026-18709 ghsa-malware

Nov 5, 2026
npm
@gemshell/win32-x64 1.2.1
MAL-2026-18708 ghsa-malware

Nov 5, 2026
npm
dsh-purge 1.2.1
MAL-2026-18707 ghsa-malware

Nov 5, 2026
npm
@nuri.yavuz.tr.2/my-unique-pinger 1.0.2
MAL-2026-18716 ossf-package-analysis

Nov 5, 2026
npm
synapse-hub 3.1.0, 3.1.1, 3.1.2, 3.2.0
MAL-2026-18703 ghsa-malware

Nov 5, 2026
npm
@secauditb20y/sec-test-b1 all versions
MAL-2026-18651 ghsa-malware

Nov 4, 2026
npm
@secaudita10x/sec-test-a1 all versions
MAL-2026-18650 ghsa-malware

Nov 4, 2026
npm
thththtbhthhth all versions
MAL-2026-18656 ghsa-malware

Nov 4, 2026
npm
nannnnnnnnn all versions
MAL-2026-18655 ghsa-malware

Nov 4, 2026
npm
heheheshsds all versions
MAL-2026-18654 ghsa-malware

Nov 4, 2026
npm
dogmans-afterglow all versions
MAL-2026-18653 ghsa-malware

Nov 4, 2026
npm
doghack-afterglow all versions
MAL-2026-18652 ghsa-malware

Nov 4, 2026