Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

  • npm
    etwl all versions
    MAL-2026-11301 ghsa-malware
  • npm
    pretierr all versions
    MAL-2026-11348 ghsa-malware
  • npm
    malxios all versions
    MAL-2026-11330 ghsa-malware
  • npm
    maalxios all versions
    MAL-2026-11329 ghsa-malware
  • npm
    @sourav_chanduka/oidc-client all versions
    MAL-2026-11231 ghsa-malware
  • npm
    @sourav_chanduka/core-no-ngrok all versions
    MAL-2026-11230 ghsa-malware
  • npm
    @sourav_chanduka/core all versions
    MAL-2026-11229 ghsa-malware
  • npm
    @web3utils/common all versions
    MAL-2026-11234 ghsa-malware
  • npm
    @web3-util/common all versions
    MAL-2026-11233 ghsa-malware
  • npm
    @solana-utils/common all versions
    MAL-2026-11228 ghsa-malware
  • npm
    discord-rsc all versions
    MAL-2026-11279 ghsa-malware
  • npm
    discord-csr all versions
    MAL-2026-11277 ghsa-malware
  • npm
    tailwindcsssss all versions
    MAL-2026-11394 ghsa-malware
  • npm
    tailwindcssss 0.2.0, 1.0.1, 1.0.2, 1.0.3, 1.1.0, 1.1.1, 1.2.0, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.…
    MAL-2026-11393 ghsa-malware, reversing-labs
  • npm
    @relforce-dev/console-log all versions
    MAL-2026-11225 ghsa-malware
  • npm
    @pumpdot-fun/pump-swap-sdk all versions
    MAL-2026-11224 ghsa-malware
  • npm
    @pumpdot-fun/pump-sdk all versions
    MAL-2026-11223 ghsa-malware
  • npm
    @node-console-log/log all versions
    MAL-2026-11216 ghsa-malware
  • npm
    fwf all versions
    MAL-2026-11314 ghsa-malware
  • npm
    @santieich/homebridge-midea-lan all versions
    MAL-2026-11226 ghsa-malware
  • npm
    famshot 1.0.0, 1.0.1
    MAL-2026-11309 ghsa-malware, amazon-inspector
  • npm
    aruda all versions
    MAL-2026-11240 ghsa-malware
  • npm
    @patternfly-4/react-tokens 9.9.9
    MAL-2026-11222 ghsa-malware, reversing-labs
  • npm
    @patternfly-4/react-table 9.9.9
    MAL-2026-11221 ghsa-malware, reversing-labs
  • npm
    @patternfly-4/react-core 9.9.9
    MAL-2026-11220 ghsa-malware, reversing-labs
  • npm
    @patternfly-4/quickstarts 9.9.9
    MAL-2026-11219 ghsa-malware, reversing-labs
  • npm
    node-fetch-core all versions
    MAL-2026-11339 ghsa-malware
  • npm
    @nordea-web/ui all versions
    MAL-2026-11218 ghsa-malware
  • npm
    @nordea-web/core all versions
    MAL-2026-11217 ghsa-malware
  • npm
    ncc-web all versions
    MAL-2026-11338 ghsa-malware
  • npm
    ncc-hyperapp all versions
    MAL-2026-11337 ghsa-malware
  • npm
    ncc-fonts all versions
    MAL-2026-11336 ghsa-malware
  • npm
    hjw-nasa-lib all versions
    MAL-2026-11316 ghsa-malware
  • npm
    dwa-tridion-webapp all versions
    MAL-2026-11284 ghsa-malware
  • npm
    tsetnpmackage all versions
    MAL-2026-11403 ghsa-malware
  • npm
    testsetset all versions
    MAL-2026-11397 ghsa-malware
  • npm
    @meteora-sdk/core all versions
    MAL-2026-11215 ghsa-malware
  • npm
    kajl all versions
    MAL-2026-11325 ghsa-malware
  • npm
    cmd-auth all versions
    MAL-2026-11264 ghsa-malware
  • npm
    react.jd all versions
    MAL-2026-11369 ghsa-malware