Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,151 npm 223,981 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,981 reports · Feed

  • npm
    @qlik/oxfmt-config 0.1.6
    MAL-2026-11799 ghsa-malware, amazon-inspector
  • npm
    @nebula.js/test-utils 0.6.1
    MAL-2026-11585 ghsa-malware, amazon-inspector
  • npm
    @qlik/embed-web-components 1.7.3
    MAL-2026-11792 ghsa-malware, amazon-inspector
  • npm
    @qlik/design-tokens 1.3.13
    MAL-2026-11787 ghsa-malware, amazon-inspector
  • npm
    @nebula.js/locale 0.6.2
    MAL-2026-11569 ghsa-malware, amazon-inspector
  • npm
    @nebula.js/sn-map 0.12.7
    MAL-2026-11577 ghsa-malware, amazon-inspector
  • npm
    @nebula.js/sn-nav-menu 0.14.2
    MAL-2026-11578 ghsa-malware, amazon-inspector
  • npm
    @nebula.js/sn-animator 2.13.1
    MAL-2026-11572 ghsa-malware, amazon-inspector
  • npm
    hamus.js 0.4.1
    MAL-2026-11974 ghsa-malware, amazon-inspector
  • npm
    @onereach/postcss-scoped-selector 1.2.1, 1.2.2, 1.2.3
    MAL-2026-11622 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/feature-spotlight 3.9.1, 3.9.2, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7
    MAL-2026-11867 ghsa-malware, amazon-inspector
  • npm
    tslint-folder-schema 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0…
    MAL-2026-11988 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/startup-mfe-compat 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7
    MAL-2026-11925 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/microfront 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8
    MAL-2026-11901 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/examples 1.2.5, 1.2.6, 1.2.7, 1.2.8, 1.2.9, 1.2.10, 1.2.11
    MAL-2026-11866 ghsa-malware, amazon-inspector
  • npm
    folder-lint 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0…
    MAL-2026-11972 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/standalone-core-feature-gates 1.11.4, 1.11.5, 1.11.6, 1.11.7, 1.11.8, 1.11.9, 1.11.10
    MAL-2026-11918 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/microfront-auth 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.0.10, 0.0.11
    MAL-2026-11902 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/carto-charts-rn 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8
    MAL-2026-11834 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/standalone-feature-flags 2.3.2, 2.3.3, 2.3.4, 2.3.5, 2.3.6, 2.3.7, 2.3.8
    MAL-2026-11919 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil2-codemods 0.11.2, 0.11.3, 0.11.4, 0.11.5, 0.11.6, 0.11.7, 0.11.8
    MAL-2026-11823 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/grid 0.0.63, 0.0.64, 0.0.65, 0.0.66, 0.0.67, 0.0.68, 0.0.69
    MAL-2026-11872 ghsa-malware, amazon-inspector
  • npm
    editable-contracts 0.0.12, 0.0.13, 0.0.14, 0.0.15, 0.0.16, 0.0.17, 0.0.18, 0.0.19, 0.0.20, 0.0.21,…
    MAL-2026-11967 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/unit-tests 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8
    MAL-2026-11947 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/titan-chatbot-api 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7
    MAL-2026-11939 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/titan-chat-ui 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9
    MAL-2026-11935 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil2-illustrations 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8
    MAL-2026-11828 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/mpa-components 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5, 2.5.6, 2.5.7
    MAL-2026-11907 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/cp-ui 1.115.1, 1.115.2, 1.115.3, 1.115.4, 1.115.5, 1.115.6, 1.115.7
    MAL-2026-11847 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/intl 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7
    MAL-2026-11880 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/carto-react-kit 0.8.4, 0.8.5, 0.8.6, 0.8.7, 0.8.8, 0.8.9, 0.8.10
    MAL-2026-11835 ghsa-malware, amazon-inspector
  • npm
    @onereach/salesforce-miaw-client 0.0.3, 0.0.4, 0.0.5
    MAL-2026-11627 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/carto-rn-kit 0.0.10, 0.0.11, 0.0.12, 0.0.13, 0.0.14, 0.0.15, 0.0.16
    MAL-2026-11836 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/titan-chatbot-ui 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9
    MAL-2026-11941 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/marketing-email-components 20.2.3, 20.2.4, 20.2.5, 20.2.6, 20.2.7, 20.2.8, 20.2.9
    MAL-2026-11891 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/skeleton 9.2.4, 9.2.5, 9.2.6, 9.2.7, 9.2.8, 9.2.9, 9.2.10
    MAL-2026-11917 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/microfront-utils 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7
    MAL-2026-11904 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/dte-pdf-editor 1.76.1, 1.76.2, 1.76.3, 1.76.4, 1.76.5, 1.76.6, 1.76.7
    MAL-2026-11856 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/titan-chatbot-ui-anvil2 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7
    MAL-2026-11942 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil-icon 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7
    MAL-2026-11817 ghsa-malware, amazon-inspector