Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,371 npm 223,233 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

223,233 reports · Feed

npm
solvit-cli 0.5.0, 0.4.4, 0.4.3, 0.4.2, 0.2.1, 0.1.2, 0.1.1, 0.1.0, 0.0.0-stage
MAL-2026-19097 ghsa-malware

Nov 10, 2026
npm
@rclaude/win32-x64 0.2.1
MAL-2026-19095 ghsa-malware

Nov 10, 2026
npm
react-svg-chunk all versions
MAL-2026-19096 ghsa-malware

Nov 10, 2026
npm
health-relay-client 1.0.4, 1.0.3
MAL-2026-19094 ghsa-malware

Nov 10, 2026
npm
text-regexer 4.3.0
MAL-2026-19093 ghsa-malware

Nov 10, 2026
npm
@lemili9804/mcp-weather-server 1.0.6, 1.0.3
MAL-2026-19085 ghsa-malware

Nov 10, 2026
npm
discord-selfbot-functions all versions
MAL-2026-19089 ghsa-malware

Nov 10, 2026
npm
discordjs-dm-parse all versions
MAL-2026-19091 ghsa-malware

Nov 10, 2026
npm
discord-dm-parser all versions
MAL-2026-19088 ghsa-malware

Nov 10, 2026
npm
direct-message-receiver all versions
MAL-2026-19086 ghsa-malware

Nov 10, 2026
npm
discord-user-parser all versions
MAL-2026-19090 ghsa-malware

Nov 10, 2026
npm
discord-badge-parser all versions
MAL-2026-19087 ghsa-malware

Nov 10, 2026
npm
sms-activate.js all versions
MAL-2026-19092 ghsa-malware

Nov 10, 2026
npm
tchain-api 1.2.5, 1.2.4, 1.2.3, 1.2.2
MAL-2026-19084 ghsa-malware

Nov 10, 2026
npm
agent-trace-kit all versions
MAL-2026-19080 ghsa-malware

Nov 10, 2026
npm
agui-session-recorder all versions
MAL-2026-19081 ghsa-malware

Nov 10, 2026
npm
mcp-contract-tester all versions
MAL-2026-19082 ghsa-malware

Nov 10, 2026
npm
neat-terminal-visualizer-84721 all versions
MAL-2026-19083 ghsa-malware

Nov 10, 2026
npm
@solana-common/utils 2.0.12, 2.0.11, 2.0.10, 2.0.9, 2.0.8, 2.0.7, 2.0.6, 2.0.5, 2.0.4, 2.0.3, 2.0.2,…
MAL-2026-19079 ghsa-malware

Nov 10, 2026
npm
@unipswap/postcss-animate-units all versions
MAL-2026-19075 ghsa-malware

Nov 10, 2026
npm
tailwind-kinetix all versions
MAL-2026-19078 ghsa-malware

Nov 10, 2026
npm
@web3-common/utils 1.0.0
MAL-2026-19076 ghsa-malware

Nov 10, 2026
npm
fapshi 1.1.4
MAL-2026-19077 ghsa-malware

Nov 10, 2026
npm
@erlanzz/baileys 1.0.0
MAL-2026-17440 ghsa-malware

Nov 10, 2026
npm
futrou 2.0.40
MAL-2026-19074 ghsa-malware

Nov 10, 2026
npm
dowload_ebok_pickleball_cpr_coaching_pickleball_readiness_by_claudia_a_fontana_30268 all versions
MAL-2026-19065 ghsa-malware

Nov 10, 2026
npm
dowload_ebok_la_ternura_de_dios_by_papa_francisco_kq4hn all versions
MAL-2026-19063 ghsa-malware

Nov 10, 2026
npm
dowload_ebok_la_historia_universal_en_100_preguntas_by_luis_e_inigo_fernandez_0w097 all versions
MAL-2026-19062 ghsa-malware

Nov 10, 2026
npm
dowload_ebok_frau_holle_die_nordische_gottin_hulle_und_ihr_gef_by_holger_karsten_schmid_1u2dk all versions
MAL-2026-19060 ghsa-malware

Nov 10, 2026
npm
dowload_ebok_mein_fur_immer_by_b_h_bartsch_jjche all versions
MAL-2026-19064 ghsa-malware

Nov 10, 2026
npm
dowload_ebok_ulysse_by_james_joyce_2tbxz all versions
MAL-2026-19066 ghsa-malware

Nov 10, 2026
npm
dowload_ebok_ho_mangiato_abbastanza_by_giorgio_serafini_prosperi_txkvg all versions
MAL-2026-19061 ghsa-malware

Nov 10, 2026
npm
kube-health-tools 2.4.4, 2.4.3, 2.4.2, 2.4.1, 2.4.0, 2.3.1, 2.3.0, 2.2.0, 2.1.0, 2.0.0, 1.0.3, 1.…
MAL-2026-19067 ghsa-malware

Nov 10, 2026
npm
npm-scanner all versions
MAL-2026-19071 ghsa-malware

Nov 10, 2026
npm
moltbook-health all versions
MAL-2026-19069 ghsa-malware

Nov 10, 2026
npm
nodecheck-health all versions
MAL-2026-19070 ghsa-malware

Nov 10, 2026
npm
moltbook-api-helper all versions
MAL-2026-19068 ghsa-malware

Nov 10, 2026
npm
leveldb-edit all versions
MAL-2026-19057 ghsa-malware

Nov 10, 2026
npm
@openyard/vetcode 0.3.1, 0.3.0
MAL-2026-19056 ghsa-malware

Nov 10, 2026
npm
@bestcoolman/dev-mcp all versions
MAL-2026-19052 ghsa-malware

Nov 9, 2026