Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

  • npm
    open-worker-cli all versions
    MAL-2026-11188 ghsa-malware
  • npm
    feedback-ai-sdk all versions
    MAL-2026-11184 ghsa-malware
  • npm
    aone-cloud-cli all versions
    MAL-2026-11180 ghsa-malware
  • npm
    zer0code 0.2.0
    MAL-2026-11191 ghsa-malware, amazon-inspector
  • npm
    @finxsecdemo/utils 1.0.2, 1.0.3
    MAL-2026-11170 ossf-package-analysis, amazon-inspector
  • npm
    test2221 2.2.4, 2.2.3, 2.2.6
    MAL-2026-11192 ossf-package-analysis, amazon-inspector
  • npm
    chain-manager 1.0.8, 1.0.10, 1.0.9
    MAL-2026-11181 ghsa-malware, amazon-inspector
  • npm
    @bowozzz/baileys 6.6.7, 8.8.8, 6.6.6, 7.0.0, 7.0.2, 9.9.9, 1.0.0, 7.0.3, 7.7.7, 7.0.1
    MAL-2026-11176 ghsa-malware, amazon-inspector
  • npm
    @mypwn/hawkeye 99.0.0
    MAL-2026-11157 ossf-package-analysis
  • npm
    @types-beta/sdk 0.1.0, 0.1.1, 0.1.2, 0.1.3
    MAL-2026-11499 amazon-inspector
  • npm
    @joyfill/layouts 0.1.2-2773.beta.0
    MAL-2026-11161 ghsa-malware, amazon-inspector
  • npm
    @joyfill/components 4.0.0-rc24-2773-beta.4
    MAL-2026-11160 ghsa-malware, amazon-inspector
  • npm
    postcss-motion-utils 3.2.7
    MAL-2026-11168 ghsa-malware, amazon-inspector
  • npm
    local-config-parser all versions
    MAL-2026-11167 ghsa-malware
  • npm
    lib-mtop all versions
    MAL-2026-11166 ghsa-malware
  • npm
    aone-sandbox all versions
    MAL-2026-11164 ghsa-malware
  • npm
    aone-kit-cli all versions
    MAL-2026-11163 ghsa-malware
  • npm
    aone-kit all versions
    MAL-2026-11162 ghsa-malware
  • npm
    cloud-config-fetcher all versions
    MAL-2026-11165 ghsa-malware
  • npm
    smart-config-manager all versions
    MAL-2026-11169 ghsa-malware
  • npm
    simple-probe-utils 1.0.1, 1.0.0
    MAL-2026-11147 amazon-inspector
  • npm
    korvica 1.0.0
    MAL-2026-11140 amazon-inspector
  • npm
    streak-core-lib 1.0.0
    MAL-2026-11148 amazon-inspector
  • npm
    color-convert-helper 1.0.0
    MAL-2026-11134 amazon-inspector
  • npm
    json-schema-inspector 1.1.5, 1.1.7, 1.1.6, 1.1.4
    MAL-2026-11138 amazon-inspector
  • npm
    bianira-ui 1.27.0
    MAL-2026-11132 amazon-inspector
  • npm
    streak-core-math 1.0.0
    MAL-2026-11149 amazon-inspector
  • npm
    @crbrc/xbt 1.1.2, 1.1.1, 1.2.1, 1.1.3, 1.1.4, 1.1.0
    MAL-2026-11122 amazon-inspector
  • npm
    kordyn 0.9.16, 0.9.18, 0.9.10, 0.9.17, 0.9.11, 0.9.14, 0.9.15
    MAL-2026-11139 amazon-inspector
  • npm
    rollup-runtime-core-polyfills 0.0.1, 0.13.0
    MAL-2026-11145 amazon-inspector
  • npm
    react-puller 1.0.0
    MAL-2026-11144 amazon-inspector
  • npm
    blots 2.1.0, 2.1.1
    MAL-2026-11158 ossf-package-analysis, amazon-inspector
  • npm
    array-node-utils 1.0.9
    MAL-2026-11130 amazon-inspector
  • npm
    text-line-parser 1.0.0
    MAL-2026-11151 amazon-inspector
  • npm
    sigchain-js 1.0.1, 1.0.0
    MAL-2026-11146 amazon-inspector, ghsa-malware
  • npm
    @apexfnd/apex 1.0.0, 1.0.1, 1.0.3, 1.0.4
    MAL-2026-11121 amazon-inspector
  • npm
    node-array-plus 1.0.9, 1.1.9
    MAL-2026-11142 amazon-inspector
  • npm
    streak-daily-lib 1.0.0
    MAL-2026-11150 amazon-inspector
  • npm
    parallely 10.0.3, 10.0.4
    MAL-2026-11143 amazon-inspector, ghsa-malware
  • npm
    ethers-secure 1.0.0
    MAL-2026-11135 amazon-inspector