Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,151 npm 223,981 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,981 reports · Feed

  • npm
    @servicetitan/eh-module-communication 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7
    MAL-2026-11858 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/quick-actions 1.15.2, 1.15.3, 1.15.4, 1.15.5, 1.15.6, 1.15.7, 1.15.8
    MAL-2026-11911 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/marketing-route 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7
    MAL-2026-11895 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/kendo-theme 0.0.27, 0.0.28, 0.0.29, 0.0.30, 0.0.31, 0.0.32, 0.0.33
    MAL-2026-11882 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/html-sketchapp 4.2.8, 4.2.9, 4.2.10, 4.2.11, 4.2.12, 4.2.13, 4.2.14
    MAL-2026-11878 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil-token 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7
    MAL-2026-11821 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/startup-jest 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7
    MAL-2026-11924 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/eslint-plugin-mobx-6 12.8.15, 12.8.16, 12.8.17, 12.8.18, 12.8.19, 12.8.20
    MAL-2026-11864 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/carto-tokens 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.3.7
    MAL-2026-11837 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/startup-utils 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11926 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/react-hooks 7.7.1, 7.7.2, 7.7.3, 7.7.4, 7.7.5, 7.7.6, 7.7.7
    MAL-2026-11912 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/marketing-form 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8
    MAL-2026-11892 ghsa-malware, amazon-inspector
  • npm
    verdaccio-tarball-local-storage 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7, 38.1.8, 38.1.9, 38.1.10…
    MAL-2026-11991 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/marketing-global-route 1.14.1, 1.14.2, 1.14.3, 1.14.4, 1.14.5, 1.14.6, 1.14.7
    MAL-2026-11893 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/document-title 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.5, 2.4.6, 2.4.7
    MAL-2026-11855 ghsa-malware, amazon-inspector
  • npm
    verdaccio-okta-oauth 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7, 38.1.8, 38.1.9, 38.1.10…
    MAL-2026-11990 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/measure-sheet-data 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7
    MAL-2026-11898 ghsa-malware, amazon-inspector
  • npm
    @onereach/ui-components 27.0.2, 27.0.3, 27.0.4
    MAL-2026-11660 ghsa-malware, amazon-inspector
  • npm
    @onereach/orest-vue-demi-vue2 0.0.4, 0.0.5, 0.0.6
    MAL-2026-11617 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/docs-anvil-uikit-contrib 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11853 ghsa-malware, amazon-inspector
  • npm
    @onereach/or-browser 0.0.48, 0.0.49, 0.0.50
    MAL-2026-11608 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/json-render-react 0.4.6, 0.4.7, 0.4.8, 0.4.9, 0.4.10, 0.4.11, 0.4.12
    MAL-2026-11881 ghsa-malware, amazon-inspector
  • npm
    @onereach/idw-sdk 0.1.2, 0.1.3, 0.1.4
    MAL-2026-11604 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/eslint-plugin-folder-schema 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11863 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/ld-type-generator 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7
    MAL-2026-11886 ghsa-malware, amazon-inspector
  • npm
    @onereach/idw-apps 0.1.3, 0.1.4, 0.1.5
    MAL-2026-11601 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/uikit-docs 22.11.1, 22.11.2, 22.11.3, 22.11.4, 22.11.5, 22.11.6, 22.11.7
    MAL-2026-11946 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/standalone-ui 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.9, 2.2.10
    MAL-2026-11922 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/hash-browser-router 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11876 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/markdowner 0.5.1, 0.5.2, 0.5.3
    MAL-2026-11712 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/component-usage 28.5.1, 28.5.2, 28.5.3, 28.5.4, 28.5.5, 28.5.6, 28.5.7
    MAL-2026-11838 ghsa-malware, amazon-inspector
  • npm
    @onereach/orest-vue3 0.0.4, 0.0.5, 0.0.6
    MAL-2026-11619 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/react-ioc 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11913 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/navigation 14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7
    MAL-2026-11908 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/dte-unlayer 0.150.1, 0.150.2, 0.150.3, 0.150.4, 0.150.5, 0.150.6, 0.150.7
    MAL-2026-11857 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/datetime-utils 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11851 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/accounts 2.3.5, 2.3.6, 2.3.7
    MAL-2026-11666 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/restrict-imports 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11915 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/cp-api 1.115.1, 1.115.2, 1.115.3, 1.115.4, 1.115.5, 1.115.6, 1.115.7
    MAL-2026-11843 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/confirm 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11839 ghsa-malware, amazon-inspector