Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,152 npm 223,982 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,982 reports · Feed

  • npm
    @servicetitan/confirm 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11839 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/bot-templates 2.2.5, 2.2.6, 2.2.7
    MAL-2026-11677 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/confirm-navigation 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11840 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-dropdown-simple 0.4.5, 0.4.6, 0.4.7
    MAL-2026-11638 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/idw-skill 1.4.1, 1.4.2, 1.4.3
    MAL-2026-11701 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/billing 27.2.1, 27.2.2, 27.2.3
    MAL-2026-11675 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/cards 1.2.5, 1.2.6, 1.2.7
    MAL-2026-11680 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/library-types-v1 9.0.1, 9.0.2, 9.0.3
    MAL-2026-11709 ghsa-malware, amazon-inspector
  • npm
    @onereach/or-pro 1.13.1, 1.13.2, 1.13.3
    MAL-2026-11612 ghsa-malware, amazon-inspector
  • npm
    @onereach/v-event-calendar 0.1.22, 0.1.23, 0.1.24
    MAL-2026-11663 ghsa-malware, amazon-inspector
  • npm
    @onereach/or-browser-next 0.0.11, 0.0.12, 0.0.13
    MAL-2026-11609 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-divider 0.4.11, 0.4.12, 0.4.13
    MAL-2026-11636 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/keys 1.2.6, 1.2.7, 1.2.8
    MAL-2026-11704 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-alert 0.4.11, 0.4.12, 0.4.13
    MAL-2026-11629 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-dropdown-advanced 0.4.5, 0.4.6, 0.4.7
    MAL-2026-11637 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-switch 0.4.5, 0.4.6, 0.4.7
    MAL-2026-11646 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-header 0.4.11, 0.4.12, 0.4.13, 0.4.14
    MAL-2026-11639 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/source 2.1.5, 2.1.6, 2.1.7
    MAL-2026-11727 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/druid 1.4.7, 1.4.8, 1.4.9
    MAL-2026-11690 ghsa-malware, amazon-inspector
  • npm
    @onereach/ssml-editor 2.0.12, 2.0.13, 2.0.14
    MAL-2026-11651 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-list 0.7.4, 0.7.5, 0.7.6
    MAL-2026-11640 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-copyable-text 0.4.11, 0.4.12, 0.4.13
    MAL-2026-11634 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/api-tokens-lambda 1.4.2, 1.4.3, 1.4.4
    MAL-2026-11670 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/permissions 2.8.1, 2.8.2, 2.8.3
    MAL-2026-11717 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/library 0.5.6, 0.5.7, 0.5.8
    MAL-2026-11706 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/view-templates 2.2.5, 2.2.6, 2.2.7
    MAL-2026-11736 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/password 1.3.6, 1.3.7, 1.3.8
    MAL-2026-11715 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-radio-group 0.3.5, 0.3.6, 0.3.7
    MAL-2026-11642 ghsa-malware, amazon-inspector
  • npm
    @onereach/billing-shared 27.2.1, 27.2.2, 27.2.3
    MAL-2026-11590 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/sku-builder 2.5.1, 2.5.2, 2.5.3
    MAL-2026-11726 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/payments 3.2.5, 3.2.6, 3.2.7
    MAL-2026-11716 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/content-request 0.2.6, 0.2.7, 0.2.8
    MAL-2026-11684 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-textinput 0.5.5, 0.5.6, 0.5.7
    MAL-2026-11648 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/event-manager 1.1.5, 1.1.6, 1.1.7
    MAL-2026-11691 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/deployments 2.1.5, 2.1.6, 2.1.7
    MAL-2026-11688 ghsa-malware, amazon-inspector
  • npm
    @onereach/channel-transformers 0.0.5, 0.0.6, 0.0.7
    MAL-2026-11593 ghsa-malware, amazon-inspector
  • npm
    @onereach/condition-builder 1.0.8, 1.0.9, 1.0.10
    MAL-2026-11595 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/key-value-storage 0.28.6, 0.28.7, 0.28.8
    MAL-2026-11703 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/step-templates 2.2.5, 2.2.6, 2.2.7
    MAL-2026-11729 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/discovery 1.12.1, 1.12.2, 1.12.3
    MAL-2026-11689 ghsa-malware, amazon-inspector