Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,488 npm 223,320 PyPI 12,018 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,320 reports · Feed

npm
@or-sdk/idw-public 1.6.6, 1.6.7, 1.6.8
MAL-2026-11700 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/adapters 0.3.6, 0.3.7, 0.3.8
MAL-2026-11667 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/messengers-infobip-sdk 0.1.1, 0.1.2, 0.1.3
MAL-2026-11607 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/flows 2.7.8, 2.7.9, 2.7.10
MAL-2026-11695 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/authorizer-helper 0.0.11, 0.0.12, 0.0.13
MAL-2026-11587 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/hitl 0.41.1, 0.41.2, 0.41.3
MAL-2026-11697 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/step-voice 7.0.32, 7.0.33, 7.0.34
MAL-2026-11655 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/lookup 1.25.1, 1.25.2, 1.25.3
MAL-2026-11711 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/billing-dto 27.2.1, 27.2.2, 27.2.3
MAL-2026-11589 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/transcripts 1.2.5, 1.2.6, 1.2.7
MAL-2026-11734 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/si-select 0.1.3, 0.1.4, 0.1.5
MAL-2026-11644 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/agents 4.21.3, 4.21.4, 4.21.5
MAL-2026-11668 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/web-search 0.6.1, 0.6.2, 0.6.3
MAL-2026-11738 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/identifiers 0.27.6, 0.27.7, 0.27.8
MAL-2026-11698 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/apps 1.2.6, 1.2.7, 1.2.8
MAL-2026-11671 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/flow-templates 2.1.5, 2.1.6, 2.1.7
MAL-2026-11694 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/types-contacts-api 9.0.8, 9.0.9, 9.0.10
MAL-2026-11659 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/ts-memoize 1.0.2, 1.0.3, 1.0.4
MAL-2026-11658 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/orest-vue-demi-vue3 0.0.4, 0.0.5, 0.0.6
MAL-2026-11618 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/or-content-builder-renderer 0.0.2, 0.0.3, 0.0.4
MAL-2026-11610 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@arv-bedrock/auth-admin 1.0.2, 1.0.3
MAL-2026-11554 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@picsart/ai-sdk 3.32.2
MAL-2026-11781 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/lambda-invocation 1.2.1, 1.2.2, 1.2.3
MAL-2026-11606 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/files-sync-node 0.1.8, 0.1.9, 0.1.10
MAL-2026-11693 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/content-builder-template-compiler 0.0.3, 0.0.4, 0.0.5
MAL-2026-11597 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/ckeditor5-build-classic 30.0.1, 30.0.2, 30.0.3
MAL-2026-11594 amazon-inspector, ghsa-malware

Aug 4, 2026
npm
@or-sdk/source-api 1.1.1, 1.1.2, 1.1.3
MAL-2026-11728 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@ornikar/prismic-components 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.0.10, 0.0.11, 0.0.12
MAL-2026-11767 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
pob-test-package-in-monorepo 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.2.11, …
MAL-2026-11980 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/step-run-snowflake-query 0.1.1, 0.1.2, 0.1.3
MAL-2026-11654 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@ornikar/eslint-config-babel-use 13.2.1, 13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.9, 13.2.10…
MAL-2026-11747 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/pnpm-audit-junit 1.0.3, 1.0.4, 1.0.5
MAL-2026-11621 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/orest-input-cli 1.18.1, 1.18.2, 1.18.3
MAL-2026-11615 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/mcp-tools 0.5.2, 0.5.3, 0.5.4
MAL-2026-11713 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/permissions-cli 1.4.1, 1.4.2, 1.4.3
MAL-2026-11718 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/notifications 1.7.5, 1.7.6, 1.7.7
MAL-2026-11714 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/time-interpreter 1.0.30, 1.0.31, 1.0.32
MAL-2026-11657 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/si-checkbox-group 0.3.5, 0.3.6, 0.3.7
MAL-2026-11631 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/slack-helpers 1.0.3, 1.0.4, 1.0.5
MAL-2026-11650 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/library-source 0.4.5, 0.4.6, 0.4.7
MAL-2026-11708 ghsa-malware, amazon-inspector

Aug 4, 2026