Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

  • npm
    shsk all versions
    MAL-2026-11379 ghsa-malware
  • npm
    shnc all versions
    MAL-2026-11378 ghsa-malware
  • npm
    rshell all versions
    MAL-2026-11374 ghsa-malware
  • npm
    rph-validator all versions
    MAL-2026-11373 ghsa-malware
  • npm
    qserver all versions
    MAL-2026-11362 ghsa-malware
  • npm
    payu-node all versions
    MAL-2026-11346 ghsa-malware
  • npm
    npum all versions
    MAL-2026-11342 ghsa-malware
  • npm
    n158 all versions
    MAL-2026-11335 ghsa-malware
  • npm
    inkalabs all versions
    MAL-2026-11321 ghsa-malware
  • npm
    ideascloud all versions
    MAL-2026-11318 ghsa-malware
  • npm
    host-inspector-module all versions
    MAL-2026-11317 ghsa-malware
  • npm
    files-bucket-server all versions
    MAL-2026-11311 ghsa-malware
  • npm
    express-wrapper all versions
    MAL-2026-11306 ghsa-malware
  • npm
    express-sequelize-wrapper all versions
    MAL-2026-11304 ghsa-malware
  • npm
    express-bubble all versions
    MAL-2026-11303 ghsa-malware
  • npm
    equiviewer all versions
    MAL-2026-11292 ghsa-malware
  • npm
    easyinstaller all versions
    MAL-2026-11286 ghsa-malware
  • npm
    dsilva-react-module-seed all versions
    MAL-2026-11283 ghsa-malware
  • npm
    api-gateway-lambda-router all versions
    MAL-2026-11237 ghsa-malware
  • npm
    android-web-logger all versions
    MAL-2026-11236 ghsa-malware
  • npm
    merg-descripters all versions
    MAL-2026-11331 ghsa-malware
  • npm
    express-test-dependency all versions
    MAL-2026-11305 ghsa-malware
  • npm
    @goodjavascript/dotenv 1.0.0
    MAL-2026-11212 ghsa-malware 3 IOCs
  • npm
    discord-starter all versions
    MAL-2026-11280 ghsa-malware
  • npm
    discord-ms all versions
    MAL-2026-11278 ghsa-malware
  • npm
    react-ag-grid all versions
    MAL-2026-11365 ghsa-malware
  • npm
    lodash-ex all versions
    MAL-2026-11327 ghsa-malware
  • npm
    imut-set all versions
    MAL-2026-11320 ghsa-malware
  • npm
    ag-grid-boost all versions
    MAL-2026-11235 ghsa-malware
  • npm
    wastu all versions
    MAL-2026-11409 ghsa-malware
  • npm
    test-wastu all versions
    MAL-2026-11396 ghsa-malware
  • npm
    scol all versions
    MAL-2026-11377 ghsa-malware
  • npm
    blbird all versions
    MAL-2026-11248 ghsa-malware
  • npm
    zcas all versions
    MAL-2026-11412 ghsa-malware
  • npm
    spectral-wraith all versions
    MAL-2026-11385 ghsa-malware
  • npm
    spectral-corsair 999.999.999, 999.999.1000
    MAL-2026-11384 ghsa-malware, reversing-labs
  • npm
    ecto-logger all versions
    MAL-2026-11287 ghsa-malware
  • npm
    curse-dependent 1.0.0, 9.9.9, 9.9.11, 9.9.12, 9.9.13, 9.9.15, 9.9.16, 9.9.17, 9.9.18, 9.9.19, 9…
    MAL-2026-11272 ghsa-malware, reversing-labs
  • npm
    @spectraltest/loglevel all versions
    MAL-2026-11232 ghsa-malware
  • npm
    puppetewebr all versions
    MAL-2026-11361 ghsa-malware