Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

  • npm
    @servicetitan/testing-library 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7
    MAL-2026-11932 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/stylelint-config 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11927 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/form-state 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11871 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/datadog-rum 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11850 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/launchdarkly-service 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11884 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/eslint-config 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11860 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/error-boundary 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11859 ghsa-malware, amazon-inspector
  • npm
    sn-listbox 0.3.3
    MAL-2026-11987 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil2 3.9.1, 3.9.2, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7
    MAL-2026-11822 ghsa-malware, amazon-inspector
  • npm
    @nebula.js/cli-build 7.1.2
    MAL-2026-11566 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil2-ext-atlas 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8
    MAL-2026-11824 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/folder-lint 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11868 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/forge 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7
    MAL-2026-11869 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/titan-chat-ui-common 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7
    MAL-2026-11937 ghsa-malware, amazon-inspector
  • npm
    @nebula.js/nucleus 0.5.1
    MAL-2026-11570 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/onboarding-ui 18.5.1, 18.5.2, 18.5.3, 18.5.4, 18.5.5, 18.5.6, 18.5.7
    MAL-2026-11910 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/contentful-proxy 1.1.12, 1.1.13, 1.1.14, 1.1.15, 1.1.16, 1.1.17, 1.1.18
    MAL-2026-11842 ghsa-malware, amazon-inspector
  • npm
    @keyv/memcache 6.0.0
    MAL-2026-12016 ghsa-malware, amazon-inspector
  • npm
    @keyv/mongo 6.0.0
    MAL-2026-12017 ghsa-malware, amazon-inspector
  • npm
    @keyv/etcd 6.0.0
    MAL-2026-12015 ghsa-malware
  • npm
    @keyv/sqlite 6.0.0
    MAL-2026-12023 ghsa-malware, amazon-inspector
  • npm
    @keyv/valkey 6.0.0
    MAL-2026-12025 ghsa-malware, amazon-inspector
  • npm
    @keyv/redis 6.0.0
    MAL-2026-12020 ghsa-malware, amazon-inspector
  • npm
    @keyv/mysql 6.0.0
    MAL-2026-12018 ghsa-malware, amazon-inspector
  • npm
    @keyv/postgres 6.0.0
    MAL-2026-12019 ghsa-malware, amazon-inspector
  • npm
    @keyv/serialize-msgpackr 6.0.0
    MAL-2026-12021 ghsa-malware, amazon-inspector
  • npm
    @keyv/encrypt-node 6.0.0
    MAL-2026-12013 ghsa-malware, amazon-inspector
  • npm
    @keyv/dynamo 6.0.0
    MAL-2026-12012 ghsa-malware
  • npm
    @keyv/compress-gzip 6.0.0
    MAL-2026-12010 ghsa-malware, amazon-inspector
  • npm
    @keyv/encrypt-web 6.0.0
    MAL-2026-12014 ghsa-malware, amazon-inspector
  • npm
    @keyv/compress-lz4 6.0.0
    MAL-2026-12011 ghsa-malware, amazon-inspector
  • npm
    @keyv/compress-brotli 6.0.0
    MAL-2026-12009 ghsa-malware, amazon-inspector
  • npm
    @keyv/test-suite 6.0.0
    MAL-2026-12024 ghsa-malware, amazon-inspector
  • npm
    @keyv/serialize-superjson 6.0.0
    MAL-2026-12022 ghsa-malware, amazon-inspector
  • npm
    @keyv/cloudflare-kv 6.0.0
    MAL-2026-12008 ghsa-malware, amazon-inspector
  • npm
    @keyv/bigmap 6.0.0
    MAL-2026-12007 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/suppress-warnings 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7, 38.1.0, 38.0.0, 37.0.2,…
    MAL-2026-11928 ghsa-malware, amazon-inspector
  • npm
    file-entry-cache 11.1.6
    MAL-2026-11970 ghsa-malware, amazon-inspector
  • npm
    @cacheable/net 2.1.1
    MAL-2026-11559 ghsa-malware, amazon-inspector
  • npm
    @cacheable/utils 2.5.1
    MAL-2026-11561 ghsa-malware, amazon-inspector