Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

npm
@onereach/si-a-button 0.0.3, 0.0.4, 0.0.5
MAL-2026-11628 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/tanstack-query-mobx 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7
MAL-2026-11930 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/idw-init-account-resources 1.0.1, 1.0.2, 1.0.3
MAL-2026-11603 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/hammer-react 1.42.2, 1.42.3, 1.42.4, 1.42.5, 1.42.6, 1.42.7, 1.42.8
MAL-2026-11874 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/base 0.44.4, 0.44.5, 0.44.6
MAL-2026-11674 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/or-sdk-agent-cli 0.0.6, 0.0.7, 0.0.8
MAL-2026-11613 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/authorizer 0.26.7, 0.26.8, 0.26.9
MAL-2026-11673 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/si-datepicker 0.4.5, 0.4.6, 0.4.7
MAL-2026-11635 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/anvil-fonts 14.5.4, 14.5.5, 14.5.6, 14.5.7, 14.5.8, 14.5.9, 14.5.10
MAL-2026-11816 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/queue-manager 1.4.6, 1.4.7, 1.4.8
MAL-2026-11723 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/channel-transformer 0.0.66, 0.0.67, 0.0.68
MAL-2026-11592 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/permissions-lambda 2.5.1, 2.5.2, 2.5.3
MAL-2026-11719 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/si-collapsible-group 0.6.4, 0.6.5, 0.6.6
MAL-2026-11633 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/idw-ui-components 0.1.2, 0.1.3, 0.1.4
MAL-2026-11605 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/contacts 4.7.5, 4.7.6, 4.7.7
MAL-2026-11683 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/ccp 10.15.4, 10.15.5, 10.15.6
MAL-2026-11681 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/design-system 14.5.4, 14.5.5, 14.5.6, 14.5.7, 14.5.8, 14.5.9, 14.5.10
MAL-2026-11852 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/rwc-client 6.4.7, 6.4.8, 6.4.9
MAL-2026-11626 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/regular-expressions 0.5.23, 0.5.24, 0.5.25
MAL-2026-11624 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/phonenumber-interpreter 0.0.18, 0.0.19, 0.0.20
MAL-2026-11620 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/data-hub-svc 2.3.5, 2.3.6, 2.3.7
MAL-2026-11686 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/sdk-api 0.29.2, 0.29.3, 0.29.4
MAL-2026-11724 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/knowledge-models 0.25.5, 0.25.6, 0.25.7
MAL-2026-11705 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@or-sdk/settings 0.25.6, 0.25.7, 0.25.8
MAL-2026-11725 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/va-mfe-loader 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7
MAL-2026-11948 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/standalone-tm-api 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7
MAL-2026-11921 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/content-builder 0.0.18, 0.0.19, 0.0.20
MAL-2026-11596 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/eslint-config-vue 0.1.1
MAL-2026-11797 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/line-item-editor 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.6, 1.5.7
MAL-2026-11887 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/webform 0.3.13, 0.3.14, 0.3.15
MAL-2026-11664 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/si-merge-tag-input 0.4.5, 0.4.6, 0.4.7
MAL-2026-11641 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/micro-frontend 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.0.10
MAL-2026-11900 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/responsive 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7
MAL-2026-11914 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/moneyout-api-client 1.29.1, 1.29.2, 1.29.3, 1.29.4, 1.29.5, 1.29.6, 1.29.7
MAL-2026-11906 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/form 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
MAL-2026-11870 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/marketing-integration-widgets 1.0.40, 1.0.41, 1.0.42, 1.0.43, 1.0.44, 1.0.45, 1.0.46
MAL-2026-11894 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/orest-jest-presets 0.0.3, 0.0.4, 0.0.5
MAL-2026-11616 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/data-query 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
MAL-2026-11849 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/tokens 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.7
MAL-2026-11944 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/anvil-react 0.11.3, 0.11.4, 0.11.5, 0.11.6, 0.11.7, 0.11.8, 0.11.9
MAL-2026-11819 ghsa-malware, amazon-inspector

Aug 4, 2026