Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

  • npm
    @cacheable/memory 2.2.1
    MAL-2026-11558 ghsa-malware, amazon-inspector
  • npm
    @cacheable/node-cache 3.1.2
    MAL-2026-11560 ghsa-malware, amazon-inspector
  • npm
    ecto 5.0.1
    MAL-2026-11966 ghsa-malware, amazon-inspector
  • npm
    cacheable 2.5.1
    MAL-2026-11963 ghsa-malware, amazon-inspector
  • npm
    keyv 6.0.0
    MAL-2026-11524 amazon-inspector, ghsa-malware
  • npm
    cache-manager 7.2.10
    MAL-2026-11523 amazon-inspector, ghsa-malware
  • npm
    flat-cache 6.1.24
    MAL-2026-11971 ghsa-malware
  • npm
    cacheable-request 13.0.20
    MAL-2026-11964 ghsa-malware, amazon-inspector
  • npm
    exnesss 0.0.1
    MAL-2026-11518 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    internallib_v688 1.0.3, 1.0.2, 1.0.1
    MAL-2026-11517 ghsa-malware, amazon-inspector
  • npm
    @zzzgenesis00/bip39-generator 3.1.2
    MAL-2026-11515 ossf-package-analysis, amazon-inspector
  • npm
    internallib_v524 1.0.2, 1.0.1
    MAL-2026-11512 ghsa-malware, amazon-inspector
  • npm
    simple-date-formatter-new-1 1.0.0
    MAL-2026-11502 ossf-package-analysis, amazon-inspector
  • npm
    internallib_v568 1.0.1
    MAL-2026-11513 ghsa-malware, amazon-inspector
  • npm
    beaver-ui-items-with-more 12.2.6, 34.1.2
    MAL-2026-11509 ghsa-malware, amazon-inspector
  • npm
    beaver-ui-header 12.3.9, 34.6.3
    MAL-2026-11508 ghsa-malware, amazon-inspector
  • npm
    bigops-chat-messages 19.9.8
    MAL-2026-11511 ghsa-malware, amazon-inspector
  • npm
    beaver-ui-date-range-picker 34.5.9, 12.5.3
    MAL-2026-11506 ghsa-malware, amazon-inspector
  • npm
    accounts-final-form 9.9.9, 9.9.12, 9.9.11, 34.2.5, 12.5.5, 9.9.10, 0.0.1
    MAL-2026-11504 ghsa-malware, amazon-inspector
  • npm
    lifestyle-test-utils 20.7.2
    MAL-2026-11514 ghsa-malware, amazon-inspector
  • npm
    beaver-ui-layout 12.9.6, 34.2.3
    MAL-2026-11510 ghsa-malware, amazon-inspector
  • npm
    beaver-ui-grid 12.7.3, 34.6.4
    MAL-2026-11507 ghsa-malware, amazon-inspector
  • npm
    accounts-loading-state 12.5.7, 8.9.6, 34.7.7, 8.9.3, 8.9.5, 8.9.4, 0.0.1
    MAL-2026-11505 ghsa-malware, amazon-inspector
  • npm
    simple-date-formatter-util-5 1.0.0
    MAL-2026-11501 ossf-package-analysis, amazon-inspector
  • npm
    tailwind-anim 1.2.5, 1.1.0, 1.2.3, 1.2.4, 1.2.0, 1.0.0, 0.0.1, 1.1.1, 1.2.1
    MAL-2026-11500 ghsa-malware, amazon-inspector
  • npm
    list-issue-predecessor-dependencies-block 99.0.0
    MAL-2026-11430 ossf-package-analysis, amazon-inspector
  • npm
    tailwindcss-anim 1.3.3, 1.3.5, 1.1.1, 1.1.0, 1.0.0, 1.2.2, 1.2.1, 0.0.1
    MAL-2026-11487 ghsa-malware, amazon-inspector
  • npm
    simple-date-formatter-util-2 1.0.0
    MAL-2026-11485 ghsa-malware, amazon-inspector
  • npm
    simple-date-formatter-util 1.0.0
    MAL-2026-11483 ghsa-malware, amazon-inspector
  • npm
    simple-date-formatter-util-1 1.0.0
    MAL-2026-11484 ghsa-malware, ossf-package-analysis, amazon-inspector
  • npm
    @custombots/custombot 1.0.0, 2.0.1, 2.0.2, 2.0.0
    MAL-2026-11498 ossf-package-analysis, amazon-inspector
  • npm
    pp-react-worldready 1.0.0
    MAL-2026-11427 ossf-package-analysis, amazon-inspector
  • npm
    test-dev-host 0.1.0
    MAL-2026-11491 ghsa-malware, amazon-inspector
  • npm
    test-dev-boot 0.1.0
    MAL-2026-11488 ghsa-malware, amazon-inspector
  • npm
    test-dev-watch 0.1.0
    MAL-2026-11495 ghsa-malware, amazon-inspector
  • npm
    test-dev-sync 0.1.0
    MAL-2026-11494 ghsa-malware, amazon-inspector
  • npm
    test-dev-store 0.1.0
    MAL-2026-11493 ghsa-malware, amazon-inspector
  • npm
    test-dev-link 0.1.0
    MAL-2026-11492 ghsa-malware, amazon-inspector
  • npm
    test-dev-exec 0.1.0
    MAL-2026-11490 ghsa-malware, amazon-inspector
  • npm
    test-dev-dispatch 0.1.0
    MAL-2026-11489 ghsa-malware, amazon-inspector