Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,160 npm 223,989 PyPI 12,021 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

  • npm
    nuxt-fonts-devtools 99.0.3
    MAL-2026-6937 ghsa-malware, amazon-inspector
  • npm
    load-nuxt-dev 99.0.3
    MAL-2026-6935 ghsa-malware, amazon-inspector
  • npm
    load-nuxt 99.0.3
    MAL-2026-6934 ghsa-malware, amazon-inspector
  • npm
    some-theme 99.0.3
    MAL-2026-6942 ghsa-malware, amazon-inspector
  • npm
    shopify-internel 99.0.1
    MAL-2026-6941 ghsa-malware, amazon-inspector
  • npm
    rnx-align-deps 99.0.7
    MAL-2026-6940 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    nonexistent-package 99.0.3
    MAL-2026-6936 ghsa-malware, amazon-inspector
  • npm
    hook-augmenting-module 99.0.3
    MAL-2026-6933 ghsa-malware, amazon-inspector
  • npm
    annotator-harvardx 9.0.2
    MAL-2026-6930 ghsa-malware, amazon-inspector
  • npm
    tx-guard-snap 1.0.0
    MAL-2026-6943 ghsa-malware, amazon-inspector
  • npm
    chai-sdk 1.4.7, 1.4.8
    MAL-2026-6931 ghsa-malware, amazon-inspector
  • npm
    notifier-utils 1.3.8, 1.3.7, 1.3.9, 1.4.0
    MAL-2026-6923 ghsa-malware, amazon-inspector
  • npm
    jsf-utils 1.3.1, 0.3.1
    MAL-2026-6921 ghsa-malware, amazon-inspector
  • npm
    chai-chain-dom 1.3.9, 1.3.7, 1.3.8
    MAL-2026-6919 ghsa-malware, amazon-inspector
  • npm
    typescript-base58 1.0.0
    MAL-2026-6925 ghsa-malware, amazon-inspector
  • npm
    crypto-base58 1.0.0, 1.0.4, 1.0.1, 1.0.3, 1.0.2
    MAL-2026-6920 ghsa-malware, amazon-inspector
  • npm
    solana-address-codec 1.0.1, 1.0.0, 1.0.5, 1.0.3, 1.0.4, 1.0.2
    MAL-2026-6924 ghsa-malware, amazon-inspector
  • npm
    base58-cli 1.0.1, 1.0.4, 1.0.5, 1.0.2, 1.0.0, 1.0.3
    MAL-2026-6918 ghsa-malware, amazon-inspector
  • npm
    @sqlite-list/schema-generator all versions
    MAL-2026-6916 ghsa-malware
  • npm
    @sqlite-list/sql-creator all versions
    MAL-2026-6917 ghsa-malware
  • npm
    @sqlite-list/createsql all versions
    MAL-2026-6915 ghsa-malware
  • npm
    @sqlite-access/nodesql 1.0.2
    MAL-2026-6914 ghsa-malware, amazon-inspector
  • npm
    mcp-server-pg 1.2.1, 1.1.0, 1.2.2, 1.1.1, 0.7.0, 0.1.0, 0.2.1, 0.2.0, 0.6.0, 0.8.0, 0.3.1, 0.…
    MAL-2026-6922 ghsa-malware, amazon-inspector
  • npm
    @engagehub/test-claim all versions
    MAL-2026-6912 ghsa-malware
  • npm
    brunomenozzi-test-pkg all versions
    MAL-2026-6913 ghsa-malware
  • npm
    zreactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7447 reversing-labs
  • npm
    zircuit-vault 99.0.0
    MAL-2026-7446 reversing-labs
  • npm
    zircuit-reporter 99.0.0
    MAL-2026-7445 reversing-labs
  • npm
    zircuit-oracle 99.0.0
    MAL-2026-7444 reversing-labs
  • npm
    zircuit-keeper 99.0.0
    MAL-2026-7443 reversing-labs
  • npm
    yreactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7442 reversing-labs
  • npm
    wreactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7441 reversing-labs
  • npm
    winston-middleware 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.3.1, 1.0.0, 1.…
    MAL-2026-7440 reversing-labs
  • npm
    win-env-setup 3.0.5, 3.0.6
    MAL-2026-7439 reversing-labs
  • npm
    whaleco-assets-json 99.9.9, 100.0.5
    MAL-2026-7438 reversing-labs
  • npm
    web3-runtime-engine 1.0.3
    MAL-2026-7437 reversing-labs
  • npm
    wazirx-localtestnpm 9.9.9
    MAL-2026-7436 reversing-labs
  • npm
    wazir-xlocaletstnpm 9.9.2, 9.9.9
    MAL-2026-7435 reversing-labs
  • npm
    wallarm-design-system 1.1.0
    MAL-2026-7434 reversing-labs
  • npm
    vubiquity-website 3.9.10
    MAL-2026-7433 reversing-labs