Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,160 npm 223,989 PyPI 12,021 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,989 reports · Feed

  • npm
    vscode-component-explorer 99.9.9, 99.9.15
    MAL-2026-7432 reversing-labs
  • npm
    vreactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7431 reversing-labs
  • npm
    ureactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7430 reversing-labs
  • npm
    treactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7429 reversing-labs
  • npm
    timelycare 1.0.0
    MAL-2026-7428 reversing-labs
  • npm
    swiper-css-normalize 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13…
    MAL-2026-7427 reversing-labs
  • npm
    suit-base 45.0.0
    MAL-2026-7426 reversing-labs
  • npm
    style-to-objact 99.9.0
    MAL-2026-7425 reversing-labs
  • npm
    strapi-plugin-pocvk 0.0.1
    MAL-2026-7424 reversing-labs
  • npm
    stellar-stablecoin-scripts 99.1.0
    MAL-2026-7423 reversing-labs
  • npm
    smtp-test-server-node 99.2.1, 99.2.2
    MAL-2026-7422 reversing-labs
  • npm
    sitefinitywebapp 99.0.0
    MAL-2026-7421 reversing-labs
  • npm
    sim-apis-chatbot 1.1.0
    MAL-2026-7420 reversing-labs
  • npm
    shiphero-dashboard 1.1.0
    MAL-2026-7419 reversing-labs
  • npm
    serverless-twi-testing 1.0.7
    MAL-2026-7418 reversing-labs
  • npm
    rzeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7417 reversing-labs
  • npm
    ryeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7416 reversing-labs
  • npm
    rxeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7415 reversing-labs
  • npm
    rweactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7414 reversing-labs
  • npm
    rveactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7413 reversing-labs
  • npm
    rueactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7412 reversing-labs
  • npm
    rteactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7411 reversing-labs
  • npm
    rseactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7410 reversing-labs
  • npm
    rreactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7409 reversing-labs
  • npm
    rqeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7408 reversing-labs
  • npm
    rpeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7407 reversing-labs
  • npm
    roeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7406 reversing-labs
  • npm
    roblox-lua-promise 99.9.0
    MAL-2026-7405 reversing-labs
  • npm
    rngularjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7404 reversing-labs
  • npm
    rneactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7403 reversing-labs
  • npm
    rn-bitu-user 99.0.0
    MAL-2026-7402 reversing-labs
  • npm
    rn-bitu 99.0.0
    MAL-2026-7401 reversing-labs
  • npm
    rmeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7400 reversing-labs
  • npm
    rleactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7399 reversing-labs
  • npm
    rkeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7398 reversing-labs
  • npm
    rjeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7397 reversing-labs
  • npm
    rieactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7396 reversing-labs
  • npm
    rheactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7395 reversing-labs
  • npm
    rgeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7394 reversing-labs
  • npm
    rfeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7393 reversing-labs