Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,407 npm 223,265 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

223,265 reports · Feed

npm
w-mousekey 1.0.42, 1.0.41
MAL-2026-18293 ghsa-malware, amazon-inspector

Oct 25, 2026
npm
jshelperdependenceny 99.0.0, 1.0.0, 0.0.0-stage
MAL-2026-18288 amazon-inspector, ghsa-malware

Oct 25, 2026
npm
@fmr-ap153177/apex-kit-icons 99.9.1
MAL-2026-18279 amazon-inspector, ghsa-malware

Oct 25, 2026
npm
@generic-means/ing-feat-scanner-libs 99.9.1
MAL-2026-18281 amazon-inspector, ghsa-malware

Oct 25, 2026
npm
@factoryz/apollo 99.9.1
MAL-2026-18278 amazon-inspector, ghsa-malware

Oct 25, 2026
npm
@jm-telefonica/multibrand-components 99.9.1
MAL-2026-18284 amazon-inspector, ghsa-malware

Oct 25, 2026
npm
@postex/common 99.9.1
MAL-2026-18285 amazon-inspector, ghsa-malware

Oct 25, 2026
npm
sc-hydrate-carousel-price 99.9.1, 0.0.0-stage
MAL-2026-18291 amazon-inspector, ghsa-malware

Oct 25, 2026
npm
@futurae-public/adaptive-js 99.9.1
MAL-2026-18280 amazon-inspector, ghsa-malware

Oct 25, 2026
npm
paychex-pdftron 99.9.1, 0.0.0-stage
MAL-2026-18289 amazon-inspector, ghsa-malware

Oct 25, 2026
npm
@ppa-web-components/ppa-headerfooter 1.0.1, 2.0.1, 1.1.0, 99.0.1, 2.0.0, 3.0.0, 1.0.0, 0.0.0-stage, 0.1.0
MAL-2026-18274 amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
npm
@ppa-web-components/ppa-hotel-collection 99.0.1, 1.1.0, 3.0.0, 1.0.0, 2.0.1, 0.0.0-stage, 0.1.0
MAL-2026-18275 amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
npm
@ppa-web-components/ppa-banner 2.0.0, 2.0.1, 1.0.0, 1.0.1, 0.0.1, 1.1.0, 3.0.0, 0.0.0-stage, 0.1.0
MAL-2026-18272 amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
npm
@ppa-web-components/ppa-builder 99.0.1, 1.0.0, 0.0.1, 2.0.1, 1.0.1, 3.0.0, 0.1.0, 0.0.0-stage
MAL-2026-18273 amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
npm
@ppa-web-components/ppa-searchform 0.0.1, 2.0.1, 3.0.0, 99.0.1, 2.0.0, 1.0.1, 1.0.0, 1.1.0, 0.1.0, 0.0.0-stage
MAL-2026-18287 amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
npm
@ppa-web-components/ppa-navigation 2.0.0, 2.0.1, 1.0.0, 1.0.1, 3.0.0, 99.0.1, 0.0.0-stage, 0.1.0
MAL-2026-18286 amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
npm
tiktok-video-scraper all versions
MAL-2026-18268 ghsa-malware

Oct 25, 2026
npm
sound-cloud-loader-api all versions
MAL-2026-18267 ghsa-malware

Oct 25, 2026
npm
ionic-tiktok-scraper all versions
MAL-2026-18261 ghsa-malware

Oct 25, 2026
npm
ionic-sound-cloud-loader-api all versions
MAL-2026-18260 ghsa-malware

Oct 25, 2026
npm
insta-reel-search all versions
MAL-2026-18258 ghsa-malware

Oct 25, 2026
npm
insta-api-wrapper 1.1.0, 1.2.1, 1.1.4
MAL-2026-18257 ghsa-malware, amazon-inspector

Oct 25, 2026
npm
youtube-search-without-api-key all versions
MAL-2026-18270 ghsa-malware

Oct 25, 2026
npm
youtube-info-streams all versions
MAL-2026-18269 ghsa-malware

Oct 25, 2026
npm
redis-dumper all versions
MAL-2026-18266 ghsa-malware

Oct 25, 2026
npm
ocsp-hashes all versions
MAL-2026-18264 ghsa-malware

Oct 25, 2026
npm
ionic-youtube-streams all versions
MAL-2026-18263 ghsa-malware

Oct 25, 2026
npm
ionic-youtube-search all versions
MAL-2026-18262 ghsa-malware

Oct 25, 2026
npm
ionic-insta-search all versions
MAL-2026-18259 ghsa-malware

Oct 25, 2026
npm
cordova-plugin-geofence-appit all versions
MAL-2026-18256 ghsa-malware

Oct 25, 2026
npm
appit-cordova-plugin-ionic all versions
MAL-2026-18254 ghsa-malware

Oct 25, 2026
npm
appit-cordova-admob all versions
MAL-2026-18253 ghsa-malware

Oct 25, 2026
npm
p12-pem all versions
MAL-2026-18265 ghsa-malware

Oct 25, 2026
npm
cert-infos all versions
MAL-2026-18255 ghsa-malware

Oct 25, 2026
npm
@eforms/forms-api 2.0.0-SNAPSHOT, 99.0.0, 2.99.0, 1.99.0, 2.99.1, 1.99.1, 2.0.99, 0.0.0-stage
MAL-2026-18252 ossf-package-analysis, amazon-inspector, ghsa-malware

Oct 25, 2026
npm
@drone-js-ext/core 99.0.1, 1.0.0, 3.0.0, 2.0.1, 0.0.0-stage, 0.1.0
MAL-2026-18276 amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
npm
@drone-js-ext/vip-badge 99.0.1, 0.0.1, 2.0.0, 1.0.1, 0.1.0, 0.0.0-stage
MAL-2026-18277 amazon-inspector, ghsa-malware 2 IOCs

Oct 25, 2026
npm
tailwind-base-buttons 0.1.0
MAL-2026-18250 ghsa-malware, amazon-inspector

Oct 25, 2026
npm
tailwindcss-theme-kit all versions
MAL-2026-18251 ghsa-malware

Oct 24, 2026
npm
noelc-css-blender 2.2.0, 2.1.11, 2.1.9, 2.2.1
MAL-2026-18249 ghsa-malware, amazon-inspector

Oct 24, 2026