Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,465 npm 223,299 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,299 reports · Feed

  • npm
    notafollower1226 1.0.3, 1.0.5, 1.0.2, 1.0.1, 1.0.0, 1.0.4
    MAL-2026-14036 amazon-inspector
  • npm
    alelo-client 99.0.0, 99.0.2
    MAL-2026-14022 amazon-inspector, reversing-labs
  • npm
    notafollower122 1.0.6, 1.0.1, 1.0.4, 1.0.7, 1.0.5, 1.0.2, 1.0.0, 1.0.3
    MAL-2026-14035 amazon-inspector
  • npm
    notafollower1 1.0.1, 1.0.13, 1.0.3, 1.0.8, 1.0.7, 1.0.5, 1.0.11, 1.0.12, 1.0.9, 1.0.4, 1.0.6,…
    MAL-2026-14034 amazon-inspector
  • npm
    heft-storybook-v6-react-tutorial-storykit 1000.0.16, 1000.0.13
    MAL-2026-14083 ghsa-malware, reversing-labs
  • npm
    ak-mal-test-poc 1.0.3
    MAL-2026-14075 ghsa-malware
  • npm
    game_overlay 8.5.8
    MAL-2026-14081 ghsa-malware, reversing-labs
  • npm
    pocbitbarrontest 1.0.0
    MAL-2026-14091 ghsa-malware
  • npm
    zip-bundle 7.3.1
    MAL-2026-14099 ghsa-malware, reversing-labs
  • npm
    dinotech-auth-utils 99.9.9, 10.1.1, 10.1.0, 10.0.8, 10.0.6, 10.0.5, 10.0.0
    MAL-2026-14077 ghsa-malware, reversing-labs
  • npm
    @veertly/web-app 100.0.2, 100.0.0, 99.9.9
    MAL-2026-14073 ghsa-malware, reversing-labs
  • npm
    @vyzensockets/baileys 0.3.2, 0.3.1, 0.2.5-B, 0.2.5, 0.2.4, 0.2.3, 0.2.2, 0.2.1, 0.2.0, 0.1.0
    MAL-2026-14074 ghsa-malware
  • npm
    hrp9872 1.0.0
    MAL-2026-14085 ghsa-malware
  • npm
    hrp9871 1.0.0
    MAL-2026-14084 ghsa-malware
  • npm
    npm_pkg_1094 1.0.7
    MAL-2026-14090 ghsa-malware
  • npm
    npm_pkg_1093 1.0.7, 1.0.6, 1.0.5, 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0
    MAL-2026-14089 ghsa-malware
  • npm
    rimo-env-validator 1.0.1, 1.0.0
    MAL-2026-14092 ghsa-malware, reversing-labs
  • npm
    utils-bundle 8.1.6
    MAL-2026-14098 ghsa-malware, reversing-labs
  • npm
    elf-stats-cranberry-wishlist-933 1.0.2, 1.0.1, 2.0.0
    MAL-2026-14079 ghsa-malware, reversing-labs
  • npm
    elf-stats-caroling-stocking-510 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0
    MAL-2026-14078 ghsa-malware, reversing-labs
  • npm
    thepackagethatworks_ 1.0.2, 1.0.1, 1.0.0
    MAL-2026-14097 ghsa-malware
  • npm
    google-logging-utils-internal 1.1.4, 9.9.9, 1.1.3
    MAL-2026-14082 ghsa-malware, reversing-labs
  • npm
    mw-filesystem-events-nodream-es6 0.0.32
    MAL-2026-14087 ghsa-malware, reversing-labs
  • npm
    rtms-manager-dev 1.4.0, 1.3.0
    MAL-2026-14093 ghsa-malware, reversing-labs
  • npm
    expect-bundle 6.3.2
    MAL-2026-14080 ghsa-malware, reversing-labs
  • npm
    nolimitcity 1.0.0
    MAL-2026-14088 ghsa-malware
  • npm
    saps_secplayground_npm_ai 1.0.5, 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0
    MAL-2026-14094 ghsa-malware, reversing-labs
  • npm
    fr-ito-web-react 99.99.99
    MAL-2026-14019 ossf-package-analysis, amazon-inspector
  • npm
    preinstall-hook-webhook-callback-demo 1.0.1, 1.0.0
    MAL-2026-14016 amazon-inspector
  • npm
    wct-st 1.0.0
    MAL-2026-13990 amazon-inspector
  • npm
    webautomation_js 1.0.1, 1.0.0
    MAL-2026-13991 amazon-inspector
  • npm
    @secauditb20y/sec-test-r3b 1.0.0
    MAL-2026-13989 amazon-inspector, ghsa-malware
  • npm
    root-locator 1.2.0, 1.1.0
    MAL-2026-14009 ghsa-malware, amazon-inspector
  • npm
    source-analyzer 0.5.8, 0.5.7, 0.5.9
    MAL-2026-14013 ghsa-malware, amazon-inspector
  • npm
    path-match-js 1.0.7, 1.0.8
    MAL-2026-14005 ghsa-malware, amazon-inspector
  • npm
    react-shield 1.10.3, 1.10.2, 1.10.4
    MAL-2026-14007 ghsa-malware, amazon-inspector
  • npm
    @jacksher/install-exec-poc 1.0.2, 1.0.0, 1.0.3
    MAL-2026-13972 amazon-inspector, ghsa-malware
  • npm
    node-config-svg-contract 1.0.0
    MAL-2026-13985 amazon-inspector
  • npm
    notafollower 1.0.3, 1.0.11, 1.0.8, 1.0.9, 1.0.0, 1.0.2, 1.0.1, 1.0.5, 1.0.4, 1.0.10, 1.0.6, …
    MAL-2026-13986 amazon-inspector
  • npm
    datefmt-util-helper 1.0.1, 1.0.0
    MAL-2026-13978 amazon-inspector