Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,151 npm 223,981 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,981 reports · Feed

npm
@qlik/sprout-design-docs 1.0.2
MAL-2026-11805 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/prettier-config 1.0.3
MAL-2026-11801 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/browserslist-config 3.0.2
MAL-2026-11784 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/api 2.14.2
MAL-2026-11783 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
qlik-modifiers 0.10.1
MAL-2026-11983 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/eslint-config-react 0.1.1
MAL-2026-11795 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
qlik-object-conversion 0.17.2
MAL-2026-11984 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/eslint-config-base 0.1.1
MAL-2026-11794 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-listbox 0.19.3
MAL-2026-11576 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
qlik-chart-modules 1.1.1
MAL-2026-11982 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/embed-runtime 1.6.4
MAL-2026-11790 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/carbon-core 2.1.1
MAL-2026-11785 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/carboncopy 1.1.6
MAL-2026-11786 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
example-js-project 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11
MAL-2026-11969 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/sprout-gesture 0.0.13
MAL-2026-11806 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/stardust 7.1.2
MAL-2026-11584 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/cli-serve 7.1.2
MAL-2026-11568 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
picasso-plugin-q 2.11.6
MAL-2026-11978 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/tsconfig 1.0.3
MAL-2026-11810 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/react-native-simple-grid 1.5.5
MAL-2026-11802 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/sdk 0.28.1
MAL-2026-11804 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-slider 0.20.1
MAL-2026-11581 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/eslint-config-svelte 0.1.1
MAL-2026-11796 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/eslint-config 2.0.20
MAL-2026-11793 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/sprout-react-table 0.16.7
MAL-2026-11809 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-shape 1.5.1
MAL-2026-11580 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-org-chart 1.7.1
MAL-2026-11579 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/oxlint-config 0.7.2
MAL-2026-11800 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/theme 0.6.1
MAL-2026-11586 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-tabbed-container 2.4.1
MAL-2026-11582 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/cli-sense 7.1.2
MAL-2026-11567 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/runtime-module-loader 1.5.1
MAL-2026-11803 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
picasso.js 2.11.6
MAL-2026-11979 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/snapshooter 0.6.1
MAL-2026-11583 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-distributionplot 1.0.7
MAL-2026-11573 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
picasso-plugin-hammer 2.11.6
MAL-2026-11977 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-action-button 2.3.1
MAL-2026-11571 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/embed-react 2.5.3
MAL-2026-11789 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/cli 7.1.2
MAL-2026-11565 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/regular-expressions-test 0.0.4, 0.0.5, 0.0.6
MAL-2026-11625 ghsa-malware, amazon-inspector

Aug 4, 2026