Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

  • npm
    @radivi-ui/react-dialog 1.1.3, 1.1.4
    MAL-2026-10605 amazon-inspector
  • npm
    chain-sdk-js 1.0.3, 1.0.5, 1.0.4, 1.0.2, 1.0.6
    MAL-2026-10608 amazon-inspector, ghsa-malware
  • npm
    chai-as-act 1.0.2
    MAL-2026-10607 amazon-inspector
  • npm
    base58-utils 1.0.3, 1.0.5, 1.0.4, 1.0.0, 1.0.1
    MAL-2026-10606 amazon-inspector
  • npm
    monitoring-service-util 1.0.0
    MAL-2026-10598 ghsa-malware, amazon-inspector
  • npm
    monitoring-service all versions
    MAL-2026-10597 ghsa-malware
  • npm
    @ayunlove/bails all versions
    MAL-2026-10596 ghsa-malware
  • npm
    nodemon-plint 3.1.13
    MAL-2026-10595 ghsa-malware, amazon-inspector
  • npm
    async-mutex-v2 2.1.0
    MAL-2026-10582 amazon-inspector, ghsa-malware
  • npm
    nodeaxois 1.0.0
    MAL-2026-10589 amazon-inspector
  • npm
    dayjscore 1.0.0
    MAL-2026-10587 amazon-inspector
  • npm
    chalkdevx 2.0.0
    MAL-2026-10584 amazon-inspector
  • npm
    chalkdev 1.0.0
    MAL-2026-10583 amazon-inspector
  • npm
    momenntjs 1.0.0
    MAL-2026-10588 amazon-inspector
  • npm
    yargsplus 1.0.0
    MAL-2026-10594 amazon-inspector
  • npm
    cheeriobox 1.0.0
    MAL-2026-10585 amazon-inspector
  • npm
    twiliobox 1.0.0
    MAL-2026-10593 amazon-inspector
  • npm
    openaiwrapper 1.0.0
    MAL-2026-10590 amazon-inspector
  • npm
    stripedev 1.0.0
    MAL-2026-10592 amazon-inspector
  • npm
    crypto-validate-lib 1.0.1, 1.0.2, 1.0.3, 1.0.0
    MAL-2026-10586 amazon-inspector
  • npm
    solana-key-utils 1.0.2, 1.0.1, 1.0.3, 1.0.0
    MAL-2026-10591 amazon-inspector
  • npm
    bimi-maker 8.2.4
    MAL-2026-10579 amazon-inspector
  • npm
    ethers-core 6.13.7, 6.13.5
    MAL-2026-10580 amazon-inspector
  • npm
    process-status-widget 99.9.1
    MAL-2026-10581 amazon-inspector, ghsa-malware
  • npm
    @sqlite-group/sql-creator 1.0.7
    MAL-2026-10578 ghsa-malware, amazon-inspector
  • npm
    @sqlite-clone/nodesql 1.0.2
    MAL-2026-10577 ghsa-malware, amazon-inspector
  • npm
    @wrenfield/viem 2.53.4, 2.53.3, 2.53.1, 2.53.2
    MAL-2026-10571 amazon-inspector, ghsa-malware
  • npm
    vite-plugin-config-paths 1.4.2
    MAL-2026-10574 amazon-inspector
  • npm
    harpoon-package 1.1.0, 1.0.0, 1.2.0
    MAL-2026-10573 amazon-inspector
  • npm
    web-pop 2.3.5
    MAL-2026-10575 amazon-inspector
  • npm
    eth-wallet-helpers 1.0.0, 1.0.2, 1.0.1, 1.0.3
    MAL-2026-10572 amazon-inspector
  • npm
    akshajrawat.utils 1.0.1, 1.0.0
    MAL-2026-10558 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    @akshajrawat/plugin-repo-cli 1.0.0, 1.0.1
    MAL-2026-10554 ghsa-malware, amazon-inspector
  • npm
    eth-dev 1.0.1, 1.0.0, 1.0.2, 1.0.3, 1.0.4
    MAL-2026-10552 amazon-inspector
  • npm
    abi-encode 1.0.2, 1.0.0, 1.0.1, 1.0.3, 1.0.4
    MAL-2026-10549 amazon-inspector
  • npm
    micro-ui-loader 2.0.0, 6.0.0
    MAL-2026-10564 ghsa-malware, amazon-inspector
  • npm
    @cw-ui/micro-ui-loader 2.0.0
    MAL-2026-10557 ghsa-malware, amazon-inspector
  • npm
    @cw-ui/asio-neon-themes 2.0.0
    MAL-2026-10556 ghsa-malware, amazon-inspector
  • npm
    elsisi-cli 9.9.9
    MAL-2026-10551 amazon-inspector
  • npm
    home-mp-commons 999.0.1, 999.0.3
    MAL-2026-10553 amazon-inspector