Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,159 npm 223,989 PyPI 12,020 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

  • npm
    uncaxss 1.3.5, 1.3.4
    MAL-2026-10176 amazon-inspector
  • npm
    @injectivelabs/sdk-ts 1.20.21
    MAL-2026-10165 amazon-inspector, ghsa-malware 1 IOC
  • npm
    paysafe-vault 1.0.0
    MAL-2026-10173 amazon-inspector
  • npm
    paysafe-payments 1.0.0
    MAL-2026-10172 amazon-inspector
  • npm
    paysafe-node 1.0.0
    MAL-2026-10171 amazon-inspector
  • npm
    paysafe-kyc 1.0.0
    MAL-2026-10170 amazon-inspector
  • npm
    paysafe-fraud 1.0.0
    MAL-2026-10168 amazon-inspector
  • npm
    paysafe-js 1.0.0
    MAL-2026-10169 amazon-inspector
  • npm
    paysafe-checkout 1.0.0
    MAL-2026-10167 amazon-inspector
  • npm
    paysafe-api 1.0.0
    MAL-2026-10166 amazon-inspector
  • npm
    type-atob 3.3.7
    MAL-2026-10174 amazon-inspector, ghsa-malware
  • npm
    llama-tokenizer 1.2.2
    MAL-2026-10163 amazon-inspector, ghsa-malware
  • npm
    type-async 3.3.7
    MAL-2026-10164 amazon-inspector, ghsa-malware
  • npm
    @bcryptln/becryptjs 3.0.8, 3.0.10, 3.0.11, 3.0.9
    MAL-2026-10162 amazon-inspector, ghsa-malware
  • npm
    rollup-packages-polyfill-core 0.13.8, 0.13.7, 0.14.1, 0.13.9, 0.14.0, 0.13.5, 0.13.6, 0.13.4, 0.0.0, 0.5.0, 0…
    MAL-2026-10160 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    buffer-util-internal 1.0.13, 1.0.14
    MAL-2026-10151 amazon-inspector
  • npm
    ap3-components-ui 9.999.0
    MAL-2026-10150 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    notify-utilities 1.3.5
    MAL-2026-10158 amazon-inspector
  • npm
    notify-logs 1.3.5
    MAL-2026-10156 amazon-inspector
  • npm
    notify-theme 1.3.5, 1.3.6, 1.3.7
    MAL-2026-10157 amazon-inspector
  • npm
    notify-dist 1.3.7
    MAL-2026-10154 amazon-inspector
  • npm
    notify-funcs 1.3.5, 1.3.6
    MAL-2026-10155 amazon-inspector
  • npm
    notifier-log 1.3.5
    MAL-2026-10153 amazon-inspector
  • npm
    notifier-funcs 1.3.4
    MAL-2026-10152 amazon-inspector
  • npm
    npm-rce-safe-proof-yourname 1.0.0
    MAL-2026-10159 amazon-inspector
  • npm
    sidecar-mcp 1.0.1, 1.0.0, 1.0.4, 1.0.2, 1.0.3
    MAL-2026-10161 amazon-inspector, ghsa-malware
  • npm
    @genie-auth/config all versions
    MAL-2026-10141 ghsa-malware
  • npm
    @amtrav/webservice all versions
    MAL-2026-10140 ghsa-malware
  • npm
    ng-search-api 99.9.1
    MAL-2026-10146 ghsa-malware, reversing-labs
  • npm
    motiondnb 99.9.1
    MAL-2026-10145 ghsa-malware, reversing-labs
  • npm
    react-jsonwebtoken 9.0.3, 9.0.5, 9.0.4
    MAL-2026-10132 amazon-inspector
  • npm
    theta-sdk-js 1.2.16, 1.2.15, 1.2.14, 1.2.17
    MAL-2026-10135 amazon-inspector, ghsa-malware
  • npm
    polygon-gamma-apis 2.0.0, 1.5.2
    MAL-2026-10148 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    polygon-gama-apis 1.4.1
    MAL-2026-10147 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    mdb-vite 1.5.2
    MAL-2026-10144 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    polymarket-gamma-apis all versions
    MAL-2026-10149 ghsa-malware
  • npm
    marked-prettier 1.0.5, 1.0.4
    MAL-2026-10143 ghsa-malware, amazon-inspector
  • npm
    eslint-jest 4.0.5, 4.0.6, 4.0.4
    MAL-2026-10142 ghsa-malware, amazon-inspector
  • npm
    stella-ai-cli 2.0.0, 3.0.1, 3.0.0, 2.2.2, 2.2.1, 2.2.0, 2.1.0, 1.0.0
    MAL-2026-10133 amazon-inspector, ghsa-malware
  • npm
    stella-coder 5.0.0, 5.1.0, 5.1.1, 4.0.0, 5.0.1, 5.1.2, 5.2.0, 5.3.3, 5.3.4, 5.3.5, 5.3.6
    MAL-2026-10134 amazon-inspector