Supply chain
Malicious packages · npm
Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.
Source: OpenSSF Malicious Packages via OSV.dev
223,989 reports · Feed
- npm
- npm
- npm
- npm
- npm
- npm
- npm
- npm
-
npm
@onereach/or-content-builder-renderer 0.0.2, 0.0.3, 0.0.4MAL-2026-11610 ghsa-malware, amazon-inspector
- npm
- npm
- npm
- npm
-
npm
@onereach/content-builder-template-compiler 0.0.3, 0.0.4, 0.0.5MAL-2026-11597 ghsa-malware, amazon-inspector
-
npm
@onereach/ckeditor5-build-classic 30.0.1, 30.0.2, 30.0.3MAL-2026-11594 amazon-inspector, ghsa-malware
- npm
-
npm
@ornikar/prismic-components 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.0.10, 0.0.11, 0.0.12MAL-2026-11767 ghsa-malware, amazon-inspector
-
npm
pob-test-package-in-monorepo 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.2.11, …MAL-2026-11980 ghsa-malware, amazon-inspector
-
npm
@onereach/step-run-snowflake-query 0.1.1, 0.1.2, 0.1.3MAL-2026-11654 ghsa-malware, amazon-inspector
-
npm
@ornikar/eslint-config-babel-use 13.2.1, 13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.9, 13.2.10…MAL-2026-11747 ghsa-malware, amazon-inspector
- npm
- npm
- npm
- npm
- npm
- npm
- npm
- npm
- npm
- npm
- npm
-
npm
conv-context-next 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10MAL-2026-11965 ghsa-malware, amazon-inspector
- npm
- npm
- npm
- npm
-
npm
native-frontend-orb 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9, 1.1.10, 1.1.11, 1.1.12, 1.1.13, 1.1.1…MAL-2026-11976 ghsa-malware, amazon-inspector
- npm
-
npm
@ornikar/babel-preset-react 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14MAL-2026-11742 ghsa-malware, amazon-inspector
-
npm
@ornikar/stylelint-config 14.0.3, 14.0.4, 14.0.5, 14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.0.11, 14.0.…MAL-2026-11778 ghsa-malware, amazon-inspector