Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,472 npm 223,305 PyPI 12,017 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,305 reports · Feed

  • npm
    knowledge-grader 1.0.1, 1.0.2
    MAL-2026-12795 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    the-search 1.0.1, 1.0.0
    MAL-2026-12810 amazon-inspector
  • npm
    dynstrg-howto 1.0.1, 1.1.1
    MAL-2026-12787 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    umber-root 1.1.0, 1.1.2
    MAL-2026-12814 amazon-inspector
  • npm
    ts-toolkit-plus 1.3.2
    MAL-2026-12812 amazon-inspector, ghsa-malware
  • npm
    sc-payment-utils 9999.0.0
    MAL-2026-12801 amazon-inspector
  • npm
    anthropic-setup 1.0.1, 1.0.0
    MAL-2026-12510 amazon-inspector, ghsa-malware
  • npm
    dust-helpers 9999.0.0
    MAL-2026-12786 amazon-inspector
  • npm
    crypto-checkout-api 1.0.0
    MAL-2026-12666 amazon-inspector, ghsa-malware
  • npm
    technical-challenge 1.0.1, 1.1.1
    MAL-2026-12809 amazon-inspector, ghsa-malware
  • npm
    @latlongid/location 1.0.1
    MAL-2026-12506 amazon-inspector
  • npm
    break-after 9999.0.0
    MAL-2026-12518 amazon-inspector
  • npm
    karapace-docs 1.0.1, 1.1.1
    MAL-2026-12794 amazon-inspector, ghsa-malware
  • npm
    shiftmarkets-sdk 2.1.0
    MAL-2026-12803 amazon-inspector
  • npm
    async-mutex-v3 3.1.0
    MAL-2026-12514 amazon-inspector, reversing-labs
  • npm
    poly-bbc-service 3.7.2
    MAL-2026-12799 amazon-inspector, reversing-labs
  • npm
    wolverinechat 1.0.1, 1.1.1
    MAL-2026-12816 amazon-inspector, ghsa-malware
  • npm
    @sapappgyver/appgyver-descriptors 9.9.11, 9.9.0
    MAL-2026-12507 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    streak-grid-core 1.0.0
    MAL-2026-12807 amazon-inspector, ghsa-malware
  • npm
    twilio-functions 99.99.99, 99.99.100
    MAL-2026-12813 amazon-inspector, reversing-labs
  • npm
    sc-font-icons 9999.0.0, 99.9.1
    MAL-2026-12800 amazon-inspector, ossf-package-analysis
  • npm
    store-locator-widget 9999.0.0
    MAL-2026-12804 amazon-inspector
  • npm
    @shiftmarkets/shift-exchange-root 3.9.9, 2.9.9, 1.9.9
    MAL-2026-12509 amazon-inspector
  • npm
    async-mutex-lock 5.3.1
    MAL-2026-12513 amazon-inspector, ghsa-malware
  • npm
    @shiftmarkets/no-brainer-sdk 1.0.18
    MAL-2026-12508 amazon-inspector
  • npm
    dbk-ui-forms 99.0.1, 99.0.0
    MAL-2026-12669 amazon-inspector, reversing-labs
  • npm
    appsignal 9999.0.0
    MAL-2026-12512 amazon-inspector
  • npm
    @cy4dev/cydemo-bg-color 5.0.0, 7.0.0, 6.0.0, 4.0.0
    MAL-2026-12504 amazon-inspector
  • npm
    streak-core-bucket 1.0.0
    MAL-2026-12806 amazon-inspector, ghsa-malware
  • npm
    trailserver 1.0.5
    MAL-2026-12484 amazon-inspector
  • npm
    voicemail 1.0.1, 1.0.2
    MAL-2026-12496 amazon-inspector, reversing-labs
  • npm
    luluking 0.0.1
    MAL-2026-12397 amazon-inspector
  • npm
    alpha-helper 1.3.4
    MAL-2026-12338 amazon-inspector, reversing-labs
  • npm
    @nextco/utils 5.0.0
    MAL-2026-12325 amazon-inspector
  • npm
    streak-daykey-lib 1.0.0
    MAL-2026-12465 amazon-inspector, ghsa-malware
  • npm
    sc-geeksquad-core 9999.0.0, 99.9.1
    MAL-2026-12435 amazon-inspector, ossf-package-analysis
  • npm
    @cryptosrvc/shift-exchange-root 3.9.9, 2.9.9, 1.9.9
    MAL-2026-12316 amazon-inspector
  • npm
    uploader-frontend 9.9.11
    MAL-2026-12491 amazon-inspector
  • npm
    uploader-frontend-legacy 9.9.11
    MAL-2026-12492 amazon-inspector
  • npm
    croft-node 1.1.3, 1.1.2, 1.1.1
    MAL-2026-12358 amazon-inspector