Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,160 npm 223,989 PyPI 12,021 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

  • npm
    @luminarycloudinternal/lcvis-st 9999.0.1, 9999.0.2, 9999.0.3
    MAL-2026-6987 amazon-inspector, ghsa-malware
  • npm
    bytefaas-sdk 9999.0.0
    MAL-2026-6993 amazon-inspector
  • npm
    searchresults 999.0.0
    MAL-2026-7003 amazon-inspector, ghsa-malware
  • npm
    thunder-rony 99.9.9
    MAL-2026-7004 amazon-inspector
  • npm
    ronyfortest 99.9.9
    MAL-2026-7002 amazon-inspector
  • npm
    rony-test 99.9.9
    MAL-2026-7001 amazon-inspector
  • npm
    higherlogic-ocfe 99.9.1
    MAL-2026-6998 amazon-inspector, ghsa-malware
  • npm
    babel-eslint-parser-legacy 99.9.1
    MAL-2026-6992 amazon-inspector, ghsa-malware
  • npm
    ag-charts-test 99.9.1
    MAL-2026-6989 amazon-inspector, ghsa-malware
  • npm
    visa-cli-tools 99.9.1
    MAL-2026-7005 amazon-inspector, ghsa-malware
  • npm
    ai-gen-ai-opt-in 99.0.0
    MAL-2026-6990 amazon-inspector
  • npm
    @luminarycloudinternal/frodo 9999.0.1, 9999.0.2, 9999.0.3
    MAL-2026-6986 amazon-inspector, ghsa-malware
  • npm
    promo-helper 1.0.4, 1.0.7, 1.0.0, 1.0.6, 1.0.5, 1.0.8, 1.0.3, 1.0.14
    MAL-2026-6985 ghsa-malware, amazon-inspector
  • npm
    @vite-ln/build-ts 5.15.10, 5.17.0
    MAL-2026-6984 ghsa-malware, amazon-inspector
  • npm
    paysafe-cards 1.0.0
    MAL-2026-6982 amazon-inspector
  • npm
    domains-billing-types 99.91.1
    MAL-2026-6980 ossf-package-analysis, amazon-inspector
  • npm
    @vwfs-its/sf-sac-frontend 20.1.1
    MAL-2026-6972 ossf-package-analysis, amazon-inspector
  • npm
    dependency_confusions 99.9.9
    MAL-2026-10085 amazon-inspector 2 IOCs
  • npm
    gitlens 9.4.0, 9.4.1
    MAL-2026-6973 ossf-package-analysis, ghsa-malware, amazon-inspector
  • npm
    rony-testing 99.9.9
    MAL-2026-6968 ghsa-malware, amazon-inspector
  • npm
    nam-os-a-man 99.9.9
    MAL-2026-6967 ghsa-malware, amazon-inspector
  • npm
    na-rony-test-karem all versions
    MAL-2026-6966 ghsa-malware
  • npm
    na-rony-test all versions
    MAL-2026-6965 ghsa-malware
  • npm
    na-rony 1.1.2, 1.1.4, 1.1.5, 1.1.3
    MAL-2026-6964 ghsa-malware, amazon-inspector
  • npm
    karem-dp all versions
    MAL-2026-6963 ghsa-malware
  • npm
    vite-json-pwa 1.1.2, 1.1.1
    MAL-2026-6969 ghsa-malware, amazon-inspector
  • npm
    gas-log 1.1.0, 1.1.1
    MAL-2026-6962 ghsa-malware, amazon-inspector
  • npm
    nodemon-node all versions
    MAL-2026-6957 ghsa-malware
  • npm
    ts-await all versions
    MAL-2026-6958 ghsa-malware
  • npm
    rio-design-tokens 99.99.100, 99.99.99
    MAL-2026-6956 ossf-package-analysis, ghsa-malware, amazon-inspector
  • npm
    hello244b 1.0.0
    MAL-2026-6955 ossf-package-analysis
  • npm
    whs4_npm_test 1.0.1, 1.0.0, 1.0.3, 1.0.2
    MAL-2026-6952 ghsa-malware, amazon-inspector
  • npm
    @whs4/whs4_npm all versions
    MAL-2026-6946 ghsa-malware
  • npm
    wsh4_npm 1.0.0
    MAL-2026-6954 ghsa-malware, amazon-inspector
  • npm
    whs4_pnm 1.0.0
    MAL-2026-6953 ghsa-malware, amazon-inspector
  • npm
    whs4_npm 1.0.0
    MAL-2026-6951 ghsa-malware, amazon-inspector
  • npm
    whs4_nmp 1.0.0, 1.0.1
    MAL-2026-6950 ghsa-malware, amazon-inspector
  • npm
    runtimedev-link 1.0.13, 1.0.12, 1.0.14, 1.0.2, 1.0.11, 1.0.10, 1.0.8, 1.0.3, 1.0.5, 1.0.1, 1.0.…
    MAL-2026-6948 ghsa-malware, amazon-inspector
  • npm
    polytrade 2.4.1
    MAL-2026-6939 ghsa-malware, amazon-inspector
  • npm
    evm-typechain 0.5.4
    MAL-2026-6932 ghsa-malware, amazon-inspector