Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,465 npm 223,299 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,299 reports · Feed

  • npm
    passport811 1.0.0
    MAL-2026-13832 ghsa-malware, amazon-inspector
  • npm
    mobicommn 1.0.0
    MAL-2026-13826 ghsa-malware, amazon-inspector
  • npm
    mnteckets 1.0.1, 1.0.0
    MAL-2026-13824 ghsa-malware, amazon-inspector
  • npm
    mnmobicom 1.0.0
    MAL-2026-13823 ghsa-malware, amazon-inspector
  • npm
    egypt0811 1.0.0
    MAL-2026-13806 ghsa-malware, amazon-inspector
  • npm
    egair0810 1.0.1, 1.0.0
    MAL-2026-13805 ghsa-malware, amazon-inspector
  • npm
    dzvchorehui2 1.0.0
    MAL-2026-13804 ghsa-malware, amazon-inspector
  • npm
    dzcvhfruwluwe 1.0.1, 1.0.0
    MAL-2026-13803 ghsa-malware, amazon-inspector
  • npm
    airdzticket 1.0.0
    MAL-2026-13782 ghsa-malware, amazon-inspector
  • npm
    xhjckswqivb 1.0.0
    MAL-2026-13844 ghsa-malware, amazon-inspector
  • npm
    xcnvjfsiewlk9 1.0.0
    MAL-2026-13843 ghsa-malware, amazon-inspector
  • npm
    vlbhvgovbbhfab 1.0.0
    MAL-2026-13842 ghsa-malware, amazon-inspector
  • npm
    vkldhcmieru6 1.0.0
    MAL-2026-13841 ghsa-malware, amazon-inspector
  • npm
    vfgnhlkxchrd 1.0.1, 1.0.0
    MAL-2026-13840 ghsa-malware, amazon-inspector
  • npm
    vczxijghsvizu4 1.0.0
    MAL-2026-13839 ghsa-malware, amazon-inspector
  • npm
    unitel4 1.0.0
    MAL-2026-13838 ghsa-malware, amazon-inspector
  • npm
    unitel3 1.0.0
    MAL-2026-13837 ghsa-malware, amazon-inspector
  • npm
    truecxikdsal 1.0.0
    MAL-2026-13835 ghsa-malware, amazon-inspector
  • npm
    prezdentkxheiw 1.0.1, 1.0.0
    MAL-2026-13833 ghsa-malware, amazon-inspector
  • npm
    nihzvdeowx5 1.0.0
    MAL-2026-13830 ghsa-malware, amazon-inspector
  • npm
    mobicwkgjmx 1.0.0
    MAL-2026-13827 ghsa-malware, amazon-inspector
  • npm
    mnzjgxciwadk 1.0.0
    MAL-2026-13825 ghsa-malware, amazon-inspector
  • npm
    mnhdjoweuq 1.0.0
    MAL-2026-13822 ghsa-malware, amazon-inspector
  • npm
    khanbmnxls 1.0.0
    MAL-2026-13820 ghsa-malware, amazon-inspector
  • npm
    hxckdoeaqjlc8 1.0.0
    MAL-2026-13816 ghsa-malware, amazon-inspector
  • npm
    hlksdcixycvf 1.0.0
    MAL-2026-13814 ghsa-malware, amazon-inspector
  • npm
    hcfguyfrmblp 1.0.0
    MAL-2026-13811 ghsa-malware, amazon-inspector
  • npm
    fghvbmniwu 1.0.1, 1.0.0
    MAL-2026-13808 ghsa-malware, amazon-inspector
  • npm
    cvvkshuelwiu 1.0.0
    MAL-2026-13800 ghsa-malware, amazon-inspector
  • npm
    cvmbxcjiasdg 1.0.0, 1.0.1
    MAL-2026-13799 ghsa-malware, amazon-inspector
  • npm
    cvjwyinkpas all versions
    MAL-2026-13798 ghsa-malware
  • npm
    cvbniydplwe3 1.0.0
    MAL-2026-13797 ghsa-malware, amazon-inspector
  • npm
    cvbmxiowkwqla6 1.0.0
    MAL-2026-13796 ghsa-malware, amazon-inspector
  • npm
    clxofwfjskaz7 1.0.0
    MAL-2026-13794 ghsa-malware, amazon-inspector
  • npm
    bgzxcuite2 1.0.0
    MAL-2026-13785 ghsa-malware, amazon-inspector
  • npm
    bgncvhferucfds 1.0.0, 1.0.1
    MAL-2026-13784 ghsa-malware, amazon-inspector
  • npm
    yangming8 1.0.0
    MAL-2026-13846 ghsa-malware, amazon-inspector
  • npm
    yangming708 1.0.0
    MAL-2026-13845 ghsa-malware, amazon-inspector
  • npm
    thundertiger 1.0.0
    MAL-2026-13834 ghsa-malware, amazon-inspector
  • npm
    nhdxzthponv5 1.0.0
    MAL-2026-13829 ghsa-malware, amazon-inspector