Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,465 npm 223,299 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,299 reports · Feed

  • npm
    ms_aidc_com_tw 1.0.0
    MAL-2026-13828 ghsa-malware, amazon-inspector
  • npm
    mnchfnvbue1 1.0.0
    MAL-2026-13821 ghsa-malware, amazon-inspector
  • npm
    jhkxcixudnvm1 1.0.1, 1.0.0
    MAL-2026-13817 ghsa-malware, amazon-inspector
  • npm
    hfkcdyuwbdx1 1.0.0
    MAL-2026-13812 ghsa-malware, amazon-inspector
  • npm
    gdwkh6vcbu 1.0.0
    MAL-2026-13810 ghsa-malware, amazon-inspector
  • npm
    fhj8cv9dkwm4 1.0.0
    MAL-2026-13809 ghsa-malware, amazon-inspector
  • npm
    fdhcvriwecv3 1.0.0
    MAL-2026-13807 ghsa-malware, amazon-inspector
  • npm
    dhjksficgwu2 1.0.0
    MAL-2026-13802 ghsa-malware, amazon-inspector
  • npm
    cxcbdjxcmncvfg2 1.0.0
    MAL-2026-13801 ghsa-malware, amazon-inspector
  • npm
    csbcldfvivwfgd4 1.0.0
    MAL-2026-13795 ghsa-malware, amazon-inspector
  • npm
    cjdfswifuem3 1.0.0
    MAL-2026-13793 ghsa-malware, amazon-inspector
  • npm
    chmjdsidwlf5 1.0.0
    MAL-2026-13792 ghsa-malware, amazon-inspector
  • npm
    bvdfhdfvnk3 1.0.0
    MAL-2026-13790 ghsa-malware, amazon-inspector
  • npm
    bcnfjndwbkf2 1.0.0
    MAL-2026-13783 ghsa-malware, amazon-inspector
  • npm
    jkbnwsdf8 1.0.1, 1.0.0, 1.0.2
    MAL-2026-13818 ghsa-malware, amazon-inspector
  • npm
    hngfykuvgh4 1.0.0
    MAL-2026-13815 ghsa-malware, amazon-inspector
  • npm
    hgdvfuflnb 1.0.0
    MAL-2026-13813 ghsa-malware, amazon-inspector
  • npm
    china_airlines 1.0.0
    MAL-2026-13791 ghsa-malware, amazon-inspector
  • npm
    bmgki3g6fh3 1.0.0
    MAL-2026-13789 ghsa-malware, amazon-inspector
  • npm
    bikliwrapper 1.0.0, 1.0.2, 1.0.1
    MAL-2026-13788 ghsa-malware, amazon-inspector
  • npm
    biklirouter 0.5.47, 0.5.46
    MAL-2026-13787 ghsa-malware, amazon-inspector
  • npm
    biklimaster 1.1.4, 1.0.0, 1.1.3
    MAL-2026-13786 ghsa-malware, amazon-inspector
  • npm
    @bikli/cli 1.1.1, 1.1.0, 1.0.9
    MAL-2026-13779 ghsa-malware, amazon-inspector
  • npm
    @bikli/bikli 1.1.6, 1.1.10, 1.1.5, 1.1.8
    MAL-2026-13778 ghsa-malware, amazon-inspector
  • npm
    cc-skills-helper 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6
    MAL-2026-13933 2 IOCs
  • npm
    internallib_v164 6.0.9, 4.0.9, 1.0.7, 1.0.9
    MAL-2026-13764 ghsa-malware, amazon-inspector
  • npm
    chapters-core 9.999.999
    MAL-2026-13752 amazon-inspector
  • npm
    bjm-low-code-components 99.0.0
    MAL-2026-13751 amazon-inspector
  • npm
    @dgn-src-click-to-pay-org/srcdcfreleasecert 999.0.1, 374.0.0
    MAL-2026-13744 amazon-inspector
  • npm
    dcfarguscert 999.0.1
    MAL-2026-13753 amazon-inspector
  • npm
    base65-77x 5.0.2
    MAL-2026-13750 amazon-inspector, ghsa-malware
  • npm
    base65-33x 5.0.2
    MAL-2026-13749 amazon-inspector, ghsa-malware
  • npm
    base65-15x 5.0.2
    MAL-2026-13748 amazon-inspector, ghsa-malware
  • npm
    whs4_ued 1.0.0
    MAL-2026-13743 amazon-inspector
  • npm
    zeal-rq-hooks 0.0.0
    MAL-2026-13742 amazon-inspector
  • npm
    svelte-vim-kit 1.0.0
    MAL-2026-13769 ghsa-malware, amazon-inspector
  • npm
    sui-gql-client 0.2.0, 0.1.0
    MAL-2026-13768 ghsa-malware, amazon-inspector
  • npm
    sui-bcs-codec 1.0.2, 1.0.1, 1.0.0
    MAL-2026-13767 ghsa-malware, amazon-inspector
  • npm
    bs58-13 6.0.1
    MAL-2026-13760 ghsa-malware, amazon-inspector
  • npm
    bs58-12 6.0.1
    MAL-2026-13759 ghsa-malware, amazon-inspector