Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,488 npm 223,320 PyPI 12,018 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,320 reports · Feed

  • npm
    @servicetitan/grid 0.0.63, 0.0.64, 0.0.65, 0.0.66, 0.0.67, 0.0.68, 0.0.69
    MAL-2026-11872 ghsa-malware, amazon-inspector
  • npm
    editable-contracts 0.0.12, 0.0.13, 0.0.14, 0.0.15, 0.0.16, 0.0.17, 0.0.18, 0.0.19, 0.0.20, 0.0.21,…
    MAL-2026-11967 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/unit-tests 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8
    MAL-2026-11947 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/titan-chatbot-api 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7
    MAL-2026-11939 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/titan-chat-ui 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9
    MAL-2026-11935 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil2-illustrations 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8
    MAL-2026-11828 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/mpa-components 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5, 2.5.6, 2.5.7
    MAL-2026-11907 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/cp-ui 1.115.1, 1.115.2, 1.115.3, 1.115.4, 1.115.5, 1.115.6, 1.115.7
    MAL-2026-11847 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/intl 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7
    MAL-2026-11880 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/carto-react-kit 0.8.4, 0.8.5, 0.8.6, 0.8.7, 0.8.8, 0.8.9, 0.8.10
    MAL-2026-11835 ghsa-malware, amazon-inspector
  • npm
    @onereach/salesforce-miaw-client 0.0.3, 0.0.4, 0.0.5
    MAL-2026-11627 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/carto-rn-kit 0.0.10, 0.0.11, 0.0.12, 0.0.13, 0.0.14, 0.0.15, 0.0.16
    MAL-2026-11836 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/titan-chatbot-ui 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9
    MAL-2026-11941 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/marketing-email-components 20.2.3, 20.2.4, 20.2.5, 20.2.6, 20.2.7, 20.2.8, 20.2.9
    MAL-2026-11891 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/skeleton 9.2.4, 9.2.5, 9.2.6, 9.2.7, 9.2.8, 9.2.9, 9.2.10
    MAL-2026-11917 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/microfront-utils 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7
    MAL-2026-11904 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/dte-pdf-editor 1.76.1, 1.76.2, 1.76.3, 1.76.4, 1.76.5, 1.76.6, 1.76.7
    MAL-2026-11856 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/titan-chatbot-ui-anvil2 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7
    MAL-2026-11942 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil-icon 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7
    MAL-2026-11817 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/titan-chatbot-ui-cypress 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7
    MAL-2026-11943 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/titan-chatbot-client 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9
    MAL-2026-11940 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/titan-chat-ui-anvil2 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7
    MAL-2026-11936 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/temporal-lite 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.7
    MAL-2026-11931 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/microfront-tests 0.0.11, 0.0.12, 0.0.13, 0.0.14, 0.0.15, 0.0.16, 0.0.17
    MAL-2026-11903 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/time-zones 3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.8.5, 3.8.6, 3.8.7
    MAL-2026-11934 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/modularpayments-webfields 1.0.53, 1.0.54, 1.0.55, 1.0.56, 1.0.57, 1.0.58, 1.0.59
    MAL-2026-11905 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/cp-react-hooks 1.115.1, 1.115.2, 1.115.3, 1.115.4, 1.115.5, 1.115.6, 1.115.7
    MAL-2026-11846 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/admin-layout 2.4.3, 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9
    MAL-2026-11812 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/marketing-direct-mail-components 20.1.1, 20.1.2, 20.1.3, 20.1.4, 20.1.5, 20.1.6, 20.1.7
    MAL-2026-11890 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/marketing-ui 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.3.5, 9.3.6, 9.3.7
    MAL-2026-11896 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/eslint-plugin-processors-stub 12.8.15, 12.8.16, 12.8.17, 12.8.18, 12.8.19, 12.8.20, 12.8.21
    MAL-2026-11865 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/cp-mfe 1.115.1, 1.115.2, 1.115.3, 1.115.4, 1.115.5, 1.115.6, 1.115.7
    MAL-2026-11844 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/startup 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11923 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/lazy-module 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11885 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/cp-mfe-dev 1.115.1, 1.115.2, 1.115.3, 1.115.4, 1.115.5, 1.115.6, 1.115.7
    MAL-2026-11845 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/admin-sql-table 1.0.14, 1.0.15, 1.0.16, 1.0.17, 1.0.18, 1.0.19, 1.0.20
    MAL-2026-11813 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil2-ext-common 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.7.7
    MAL-2026-11826 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/link-item 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11888 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/notifications 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11909 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/ko-bridge 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11883 ghsa-malware, amazon-inspector