Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

  • npm
    install-native-host 1.0.0
    MAL-2026-11468 ghsa-malware, amazon-inspector
  • npm
    goldenflow-js 1.0.0
    MAL-2026-11463 ghsa-malware, amazon-inspector
  • npm
    iac-scanner 1.0.0, 0.0.2
    MAL-2026-11467 ghsa-malware, amazon-inspector
  • npm
    ai-backup-script 1.0.2, 1.0.0, 0.0.2
    MAL-2026-11454 ghsa-malware, amazon-inspector
  • npm
    @404c3s4r/lodash 9.0.0
    MAL-2026-11434 ghsa-malware, reversing-labs
  • npm
    eth-bridge 1.0.1, 1.0.0
    MAL-2026-11461 ghsa-malware, amazon-inspector
  • npm
    vite-tsconfig-svg 1.1.4
    MAL-2026-11497 ghsa-malware, amazon-inspector
  • npm
    rollup-plugin-polyfill-hold 1.0.5
    MAL-2026-11479 ghsa-malware, amazon-inspector
  • npm
    @0xlr/test-callback 1.0.0
    MAL-2026-11433 ghsa-malware, amazon-inspector
  • npm
    @0xlr/question-types all versions
    MAL-2026-11432 ghsa-malware
  • npm
    @0xlr/dep-confusion-poc 0.0.1
    MAL-2026-11431 ghsa-malware, amazon-inspector
  • npm
    vite-config-svg 1.1.7
    MAL-2026-11496 ghsa-malware, amazon-inspector
  • npm
    rollup-plugin-polyfill-helper 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.5, 1.0.0
    MAL-2026-11478 ghsa-malware, amazon-inspector
  • npm
    @peptide-packets/peptide-modify all versions
    MAL-2026-11448 ghsa-malware
  • npm
    @peptide-packets/js-unimode 1.1.1
    MAL-2026-11447 ghsa-malware, amazon-inspector
  • npm
    socketi 1.0.1
    MAL-2026-11382 ghsa-malware, reversing-labs
  • npm
    soccketio 1.0.1
    MAL-2026-11381 ghsa-malware, reversing-labs
  • npm
    asdsafsafdasdsaasdasda all versions
    MAL-2026-11242 ghsa-malware
  • npm
    vcse 1.0.0, 1.0.1
    MAL-2026-11408 ghsa-malware, reversing-labs
  • npm
    socktio all versions
    MAL-2026-11383 ghsa-malware
  • npm
    scketio all versions
    MAL-2026-11376 ghsa-malware
  • npm
    passtpor 1.0.1
    MAL-2026-11345 ghsa-malware, reversing-labs
  • npm
    passsport1 1.0.1
    MAL-2026-11344 ghsa-malware, reversing-labs
  • npm
    moontose all versions
    MAL-2026-11334 ghsa-malware
  • npm
    mongostose all versions
    MAL-2026-11333 ghsa-malware
  • npm
    asdsafsadad 1.0.1
    MAL-2026-11241 ghsa-malware, reversing-labs
  • npm
    rlp.git all versions
    MAL-2026-11372 ghsa-malware
  • npm
    rlp-master all versions
    MAL-2026-11371 ghsa-malware
  • npm
    node-fs-extra-master all versions
    MAL-2026-11340 ghsa-malware
  • npm
    fsextrra all versions
    MAL-2026-11313 ghsa-malware
  • npm
    fs-extra-master all versions
    MAL-2026-11312 ghsa-malware
  • npm
    ethersss 6.15.0
    MAL-2026-11300 ghsa-malware, reversing-labs
  • npm
    ethers.json 6.15.0
    MAL-2026-11298 ghsa-malware, reversing-labs
  • npm
    ethers-io-ethers 6.15.0
    MAL-2026-11296 ghsa-malware, reversing-labs
  • npm
    ethe.json 6.15.0
    MAL-2026-11295 ghsa-malware, reversing-labs
  • npm
    ethers.jsonn 6.15.0
    MAL-2026-11299 ghsa-malware, reversing-labs
  • npm
    ethe 99.15.0
    MAL-2026-11294 ghsa-malware, reversing-labs
  • npm
    eth.json 6.15.0
    MAL-2026-11293 ghsa-malware, reversing-labs
  • npm
    thoughtgear all versions
    MAL-2026-11401 ghsa-malware
  • npm
    sunpro-3dmodel-renderer all versions
    MAL-2026-11389 ghsa-malware