Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

  • npm
    @or-sdk/account-settings 1.3.6, 1.3.7, 1.3.8
    MAL-2026-11665 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/views 3.1.5, 3.1.6, 3.1.7
    MAL-2026-11737 ghsa-malware, amazon-inspector
  • npm
    @onereach/step-components 0.1.37, 0.1.38, 0.1.39
    MAL-2026-11652 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-validated-timestring-input 0.3.5, 0.3.6, 0.3.7
    MAL-2026-11649 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/table 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11929 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/deployer 1.7.5, 1.7.6, 1.7.7
    MAL-2026-11687 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/standalone-root 1.11.3, 1.11.4, 1.11.5, 1.11.6, 1.11.7, 1.11.8, 1.11.9
    MAL-2026-11920 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil2-mcp 0.0.9, 0.0.10, 0.0.11, 0.0.12, 0.0.13, 0.0.14, 0.0.15
    MAL-2026-11829 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/docs-uikit 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11854 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/card-templates 2.2.5, 2.2.6, 2.2.7
    MAL-2026-11679 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil-css-utilities 14.5.4, 14.5.5, 14.5.6, 14.5.7, 14.5.8, 14.5.9, 14.5.10
    MAL-2026-11815 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-text-message 0.4.5, 0.4.6, 0.4.7
    MAL-2026-11647 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/assist-ui 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7
    MAL-2026-11830 ghsa-malware, amazon-inspector
  • npm
    @onereach/orest-cli 2.4.1, 2.4.2, 2.4.3
    MAL-2026-11614 ghsa-malware, amazon-inspector
  • npm
    @thiennq/docs-viewer 1.6.2, 1.6.3, 1.6.4
    MAL-2026-11952 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/install 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11879 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/eslint-plugin 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11861 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/hammer-icon 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7
    MAL-2026-11873 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil-icons 14.5.4, 14.5.5, 14.5.6, 14.5.7, 14.5.8, 14.5.9, 14.5.10
    MAL-2026-11818 ghsa-malware, amazon-inspector
  • npm
    @hubsync/web-sdk-react 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.3.15, 6.3.16, 6.…
    MAL-2026-11564 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil-themes 14.5.4, 14.5.5, 14.5.6, 14.5.7, 14.5.8, 14.5.9, 14.5.10
    MAL-2026-11820 ghsa-malware, amazon-inspector
  • npm
    @qlik/sprout-react 6.45.3
    MAL-2026-11808 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/marketing-widgets 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7
    MAL-2026-11897 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/web-components 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11949 ghsa-malware, amazon-inspector
  • npm
    @picsart/gen-ai 2.55.11
    MAL-2026-11782 ghsa-malware, amazon-inspector
  • npm
    @ornikar/graphql-config 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9, 1.1.10, 1.1.11
    MAL-2026-11756 ghsa-malware, amazon-inspector
  • npm
    @ornikar/eslint-plugin-neverthrow 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7, 1.3.8, 1.3.9, 1.3.10, 1.3.11, …
    MAL-2026-11754 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/chat 0.3.1, 0.3.2, 0.3.3
    MAL-2026-11682 ghsa-malware, amazon-inspector
  • npm
    @onereach/get-version-data 3.1.2, 3.1.3, 3.1.4
    MAL-2026-11600 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/library-categories 0.2.6, 0.2.7, 0.2.8
    MAL-2026-11707 ghsa-malware, amazon-inspector
  • npm
    @onereach/cb-schema-translator 1.3.1, 1.3.2, 1.3.3
    MAL-2026-11591 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/graph 1.10.5, 1.10.6, 1.10.7
    MAL-2026-11696 ghsa-malware, amazon-inspector
  • npm
    @onereach/styles 27.0.2, 27.0.3, 27.0.4
    MAL-2026-11656 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/log-service 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11889 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/library-types-v2 9.0.1, 9.0.2, 9.0.3
    MAL-2026-11710 ghsa-malware, amazon-inspector
  • npm
    @onereach/idw-contracts 0.1.2, 0.1.3, 0.1.4
    MAL-2026-11602 ghsa-malware, amazon-inspector
  • npm
    rwc-client 0.29.10, 0.29.11, 0.29.12, 0.29.13, 0.29.14, 0.29.15, 0.29.16, 0.29.17, 0.29.18…
    MAL-2026-11985 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/hammer-token 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7
    MAL-2026-11875 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/toolbelt-shared-registry 1.14.1, 1.14.2, 1.14.3, 1.14.4, 1.14.5, 1.14.6, 1.14.7
    MAL-2026-11945 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-checkbox 0.6.5, 0.6.6, 0.6.7
    MAL-2026-11630 ghsa-malware, amazon-inspector