Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,897 npm 223,728 PyPI 12,019 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,728 reports · Feed

npm
nagix-node 2.1.6
MAL-2026-11525 amazon-inspector

Aug 4, 2026
npm
umadev 1.0.74
MAL-2026-11989 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@umacloud/knowledge 1.0.74
MAL-2026-11960 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@umacloud/cli-win32-x64 1.0.74
MAL-2026-11959 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@umacloud/cli-linux-x64 1.0.74
MAL-2026-11958 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@umacloud/cli-linux-musl-x64 1.0.74
MAL-2026-11957 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@umacloud/cli-linux-musl-arm64 1.0.74
MAL-2026-11956 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@umacloud/cli-linux-arm64 1.0.74
MAL-2026-11955 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@umacloud/cli-darwin-x64 1.0.74
MAL-2026-11954 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@umacloud/cli-darwin-arm64 1.0.74
MAL-2026-11953 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/embed-svelte 1.1.4
MAL-2026-11791 amazon-inspector

Aug 4, 2026
npm
@qlik/dts-bundler 2.0.3
MAL-2026-11788 amazon-inspector

Aug 4, 2026
npm
@deliveroo/reevent 1.0.1
MAL-2026-11563

Aug 4, 2026
npm
@deliveroo/determinator 0.2.1
MAL-2026-11562

Aug 4, 2026
npm
@adminide-stack/clock-tik-browser 12.0.24
MAL-2026-11551 amazon-inspector

Aug 4, 2026
npm
@jsimplify/errno 2.0.7, 2.0.6, 2.0.8, 2.0.5, 2.0.1, 2.0.0
MAL-2026-12006 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
cors-version 1.0.2, 1.0.3, 1.0.5, 1.0.4, 1.0.1, 1.0.0
MAL-2026-12026 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
tailwind-anime 1.1.0, 1.1.1, 1.0.0, 0.0.1
MAL-2026-12027 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
server-hemera-mongo 0.0.12, 0.0.16
MAL-2026-11986 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@adminide-stack/yantra-mobile 12.0.33
MAL-2026-11552 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
workbench-browser-server 0.0.2
MAL-2026-11992 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@workbench-stack/core 3.9.8
MAL-2026-11961 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/nebula-table-utils 2.6.9
MAL-2026-11798 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-line-chart 2.7.1
MAL-2026-11575 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-layout-container 4.4.1
MAL-2026-11574 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/sprout-icons 0.12.3
MAL-2026-11807 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
http-metrics-middleware 2.2.2
MAL-2026-11975 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/sprout-design-docs 1.0.2
MAL-2026-11805 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/prettier-config 1.0.3
MAL-2026-11801 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/browserslist-config 3.0.2
MAL-2026-11784 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/api 2.14.2
MAL-2026-11783 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
qlik-modifiers 0.10.1
MAL-2026-11983 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/eslint-config-react 0.1.1
MAL-2026-11795 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
qlik-object-conversion 0.17.2
MAL-2026-11984 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/eslint-config-base 0.1.1
MAL-2026-11794 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-listbox 0.19.3
MAL-2026-11576 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
qlik-chart-modules 1.1.1
MAL-2026-11982 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/embed-runtime 1.6.4
MAL-2026-11790 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/carbon-core 2.1.1
MAL-2026-11785 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/carboncopy 1.1.6
MAL-2026-11786 ghsa-malware, amazon-inspector

Aug 4, 2026