Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

npm
pullingpackageeeeeeee all versions
MAL-2026-11357 ghsa-malware

Jul 30, 2026
npm
pullingpackageeeeeee all versions
MAL-2026-11356 ghsa-malware

Jul 30, 2026
npm
pullingpackageeee all versions
MAL-2026-11355 ghsa-malware

Jul 30, 2026
npm
pullingpackageee all versions
MAL-2026-11354 ghsa-malware

Jul 30, 2026
npm
pullingpackagee all versions
MAL-2026-11353 ghsa-malware

Jul 30, 2026
npm
pullingpackaged all versions
MAL-2026-11352 ghsa-malware

Jul 30, 2026
npm
pullingpackage all versions
MAL-2026-11351 ghsa-malware

Jul 30, 2026
npm
@dotconf-pro/dotenv all versions
MAL-2026-11209 ghsa-malware

Jul 30, 2026
npm
@dotconf-pro/dotconf-pro all versions
MAL-2026-11208 ghsa-malware

Jul 30, 2026
npm
rumjs all versions
MAL-2026-11375 ghsa-malware

Jul 30, 2026
npm
@404c3s4r/testxxx 9.2.0
MAL-2026-11207 ghsa-malware, reversing-labs

Jul 30, 2026
npm
svelte-metric-map 1.0.0, 1.0.1
MAL-2026-11390 ghsa-malware, amazon-inspector

Jul 30, 2026
npm
streak-metrics-math 1.0.0, 1.0.1
MAL-2026-11388 ghsa-malware, amazon-inspector

Jul 30, 2026
npm
svelte-streak-metric 1.0.0
MAL-2026-11391 ghsa-malware, amazon-inspector

Jul 30, 2026
npm
streak-metrics-core all versions
MAL-2026-11387 ghsa-malware

Jul 30, 2026
npm
thedata 1.0.6, 1.0.0, 1.0.11, 1.0.10, 1.0.8, 1.0.13, 1.0.12, 1.0.2, 1.0.4, 1.0.7, 1.0.5…
MAL-2026-11400 ghsa-malware, amazon-inspector

Jul 30, 2026
npm
switchpaymentsapiserv-paypal 2.3.4
MAL-2026-11392 ghsa-malware, amazon-inspector

Jul 30, 2026
npm
consumerweb-risk 3.4.3
MAL-2026-11269 ghsa-malware, amazon-inspector

Jul 30, 2026
npm
create-backend-scaffold 1.1.2, 1.1.1, 1.1.0, 1.0.5, 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0
MAL-2026-11270 ghsa-malware, amazon-inspector

Jul 30, 2026
npm
pretty-log-cli 2.9.0, 2.6.0, 2.0.0, 2.8.0, 2.1.0, 2.2.0, 2.3.0, 2.4.0, 2.5.0, 2.7.0
MAL-2026-11349 ghsa-malware, amazon-inspector

Jul 30, 2026
npm
logform-core 3.2.0, 3.1.0, 3.3.0
MAL-2026-11328 ghsa-malware, amazon-inspector

Jul 30, 2026
npm
@wbnr/design 99.3.0, 99.0.0, 99.1.0, 99.0.1
MAL-2026-11196 ossf-package-analysis, amazon-inspector

Jul 30, 2026
npm
react-fast-refresh-helper 1.2.6, 1.2.4, 1.2.5
MAL-2026-11366 ghsa-malware, amazon-inspector

Jul 30, 2026
npm
litespeed-cache 1.1.2, 1.1.1, 1.0.0
MAL-2026-11193 ghsa-malware, amazon-inspector

Jul 30, 2026
npm
n8n-nodes-trust-me-im-totally-safe all versions
MAL-2026-11194 ghsa-malware

Jul 30, 2026
npm
@ai-plus/de-agent-sdk all versions
MAL-2026-11175 ghsa-malware

Jul 29, 2026
npm
@ai-plus/de-agent all versions
MAL-2026-11174 ghsa-malware

Jul 29, 2026
npm
@ai-agent-node/nodesql all versions
MAL-2026-11173 ghsa-malware

Jul 29, 2026
npm
@ai-agent-node/createnode 1.0.1, 1.0.0
MAL-2026-11172 ghsa-malware, amazon-inspector

Jul 29, 2026
npm
@ai-agent-node/agent-node all versions
MAL-2026-11171 ghsa-malware

Jul 29, 2026
npm
@zannstore/baileys 2.4.4, 2.4.3, 2.4.2, 2.4.1, 2.4.0, 2.3.9, 2.3.7, 2.3.6, 2.3.5, 2.3.4, 2.3.3, 2.…
MAL-2026-11179 ghsa-malware, amazon-inspector

Jul 29, 2026
npm
@peptide-unit/peptide-modify 1.0.6, 1.0.7
MAL-2026-11178 ghsa-malware, amazon-inspector

Jul 29, 2026
npm
@peptide-unit/js-unimode 1.1.13, 1.1.12
MAL-2026-11177 ghsa-malware, amazon-inspector

Jul 29, 2026
npm
uniapi-bridge all versions
MAL-2026-11190 ghsa-malware

Jul 29, 2026
npm
test-skill-zip all versions
MAL-2026-11189 ghsa-malware

Jul 29, 2026
npm
lzd-unified-station-sdk all versions
MAL-2026-11187 ghsa-malware

Jul 29, 2026
npm
lwp-web-client all versions
MAL-2026-11186 ghsa-malware

Jul 29, 2026
npm
flight-compare-analyzer all versions
MAL-2026-11185 ghsa-malware

Jul 29, 2026
npm
def-open-client all versions
MAL-2026-11183 ghsa-malware

Jul 29, 2026
npm
colder-cli all versions
MAL-2026-11182 ghsa-malware

Jul 29, 2026