Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

npm
svelte-streak-metrics 1.0.0
MAL-2026-11038 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
streak-lib-math 1.0.0
MAL-2026-11036 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
svelte-goal-streak 1.0.0
MAL-2026-11037 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
streak-bucket-lib 1.0.0
MAL-2026-11035 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
vitest-axios 1.0.4
MAL-2026-11030 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
fs-extra-core 1.3.4
MAL-2026-11027 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
lychee-norm-cache 22.0.0
MAL-2026-11029 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
create-kumo-project 22.0.0
MAL-2026-11024 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
helix-deploy 110.0.1, 110.0.0
MAL-2026-11028 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
da-sc-sdk 1.2.4, 1.2.3
MAL-2026-11025 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
aio-commerce-lib-app all versions
MAL-2026-11022 ghsa-malware

Jul 23, 2026
npm
ethers-packge all versions
MAL-2026-11026 ghsa-malware

Jul 23, 2026
npm
bs58-88 6.0.1
MAL-2026-11023 ghsa-malware, amazon-inspector

Jul 23, 2026
npm
@bcryptln/bcryptjs all versions
MAL-2026-11021 ghsa-malware

Jul 23, 2026
npm
hardhat-gas-tracker 1.0.1, 1.0.0
MAL-2026-11020 ossf-package-analysis, amazon-inspector

Jul 22, 2026
npm
application-util 2.1.6
MAL-2026-11000 amazon-inspector

Jul 22, 2026
npm
web3-terminal 2.1.6
MAL-2026-11007 amazon-inspector

Jul 22, 2026
npm
habinger 2.1.6
MAL-2026-11002 amazon-inspector

Jul 22, 2026
npm
encryptstringadmincore 1.0.1, 1.1.0
MAL-2026-11013 ghsa-malware, amazon-inspector

Jul 22, 2026
npm
encryptstringadmin 1.2.1, 1.4.2, 1.3.0
MAL-2026-11012 ghsa-malware, amazon-inspector

Jul 22, 2026
npm
encrypt-string-ttak 1.0.1, 1.0.0, 1.0.2
MAL-2026-11011 ghsa-malware, amazon-inspector

Jul 22, 2026
npm
n8n-nodes-net-utils 1.0.2, 1.0.0, 1.0.1
MAL-2026-11003 amazon-inspector

Jul 22, 2026
npm
n8n-nodes-pwn 1.0.6, 1.0.5, 1.0.8, 1.0.7, 1.0.0, 1.0.2, 1.0.1, 1.0.4
MAL-2026-11004 amazon-inspector

Jul 22, 2026
npm
n8n-nodes-quick-utils 1.0.2, 1.0.0, 1.0.1
MAL-2026-11005 amazon-inspector

Jul 22, 2026
npm
n8n-nodes-utils-helper 1.0.0, 1.0.2, 1.0.1
MAL-2026-11006 amazon-inspector

Jul 22, 2026
npm
n8n-nodes-http-probe 1.0.2, 1.0.0, 1.0.1
MAL-2026-10997 amazon-inspector

Jul 22, 2026
npm
n8n-nodes-port-scanner 1.0.2, 1.0.1, 1.0.0
MAL-2026-10998 amazon-inspector

Jul 22, 2026
npm
habingeer 2.1.6
MAL-2026-10995 amazon-inspector

Jul 22, 2026
npm
app-data-ist 2.1.6
MAL-2026-10994 amazon-inspector, ghsa-malware

Jul 22, 2026
npm
init-js-examples 1.0.0
MAL-2026-10996 amazon-inspector

Jul 22, 2026
npm
n8n-nodes-task-runner 1.0.16, 1.0.1, 1.0.7, 1.0.9, 1.0.4, 1.0.2, 1.0.3, 1.0.6, 1.0.8, 1.0.0, 1.0.5, 1…
MAL-2026-10999 amazon-inspector

Jul 22, 2026
npm
kijai 0.0.2
MAL-2026-11014 ghsa-malware, amazon-inspector

Jul 22, 2026
npm
veskr 1.0.0
MAL-2026-11019 ghsa-malware, amazon-inspector

Jul 22, 2026
npm
veldora 1.0.1
MAL-2026-11018 ghsa-malware, amazon-inspector

Jul 22, 2026
npm
vantora 1.0.1, 1.0.0
MAL-2026-11016 ghsa-malware, amazon-inspector

Jul 22, 2026
npm
calvora 1.0.1, 1.0.0
MAL-2026-11010 ghsa-malware, amazon-inspector

Jul 22, 2026
npm
calmora 1.0.1
MAL-2026-11009 ghsa-malware, amazon-inspector

Jul 22, 2026
npm
caldryn 1.0.0
MAL-2026-11008 ghsa-malware, amazon-inspector

Jul 22, 2026
npm
vectormark 1.0.1, 1.0.0
MAL-2026-11017 ghsa-malware, amazon-inspector

Jul 22, 2026
npm
react-tabulix-query 0.1.2, 0.1.0, 0.1.3
MAL-2026-11015 ghsa-malware, amazon-inspector

Jul 22, 2026