Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,407 npm 223,265 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

223,265 reports · Feed

npm
overarch-windows-x64-yr 2.0.0, 1.4.0, 1.5.0
MAL-2026-18248 ghsa-malware, amazon-inspector

Oct 24, 2026
npm
@liauto/win32-x64 0.1.2-b2
MAL-2026-18247 ghsa-malware, amazon-inspector

Oct 24, 2026
npm
@sxm-web/client-sdk-core 0.0.1, 1.0.0, 1.0.1, 2.0.0, 1.1.0, 3.0.0, 13.3.7, 0.0.0-stage, 0.1.0
MAL-2026-18319 amazon-inspector, ghsa-malware 2 IOCs

Oct 23, 2026
npm
@k18k/entrypoint-sdk-darwin-arm64 0.2.0, 0.2.1
MAL-2026-18243 ghsa-malware, amazon-inspector

Oct 23, 2026
npm
orqiva-runtime-win32-x64 0.1.0
MAL-2026-18246 ghsa-malware, amazon-inspector

Oct 23, 2026
npm
@k18k/entrypoint-sdk-linux-x64 0.2.0, 0.2.1
MAL-2026-18245 ghsa-malware, amazon-inspector

Oct 23, 2026
npm
@k18k/entrypoint-sdk-darwin-x64 0.2.0, 0.2.1
MAL-2026-18244 ghsa-malware, amazon-inspector

Oct 23, 2026
npm
@greenlake/session 99.0.1, 3.0.0, 1.0.0, 2.0.0, 0.1.0, 0.0.0-stage
MAL-2026-18283 amazon-inspector, ghsa-malware 2 IOCs

Oct 23, 2026
npm
@greenlake/mfe-login-url 2.0.0, 1.0.0, 3.0.0, 0.1.0, 0.0.0-stage
MAL-2026-18318 amazon-inspector, ghsa-malware 2 IOCs

Oct 23, 2026
npm
@greenlake/context-pane 3.0.0, 1.0.0, 0.0.0-stage, 0.1.0
MAL-2026-18317 amazon-inspector, ghsa-malware 2 IOCs

Oct 23, 2026
npm
@greenlake/common-context 99.0.1, 3.0.0, 0.1.0, 0.0.0-stage
MAL-2026-18282 amazon-inspector, ghsa-malware 2 IOCs

Oct 23, 2026
npm
@greenlake/auth 3.0.0, 0.0.0-stage, 0.1.0
MAL-2026-18316 amazon-inspector, ghsa-malware 2 IOCs

Oct 23, 2026
npm
skillward 0.1.1, 0.1.2
MAL-2026-18220 ghsa-malware, amazon-inspector

Oct 23, 2026
npm
@grabcad/user-license 1.1.0, 1.0.0, 2.0.1, 2.0.0, 3.0.0, 0.0.1, 1.0.1
MAL-2026-18217 ghsa-malware, amazon-inspector

Oct 23, 2026
npm
@grabcad/preferences-client 0.0.1, 3.0.0, 2.0.0, 1.1.0, 1.0.0
MAL-2026-18216 ghsa-malware, amazon-inspector

Oct 23, 2026
npm
@grabcad/grabcad-shop-shared 1.0.1, 2.0.1, 2.0.0, 3.0.0, 1.0.0, 99.0.1, 1.1.0
MAL-2026-18215 ghsa-malware, amazon-inspector

Oct 23, 2026
npm
@grabcad/company-server-shared 1.0.0, 1.1.0, 2.0.1, 99.0.1, 3.0.0, 2.0.0, 0.0.1, 1.0.1
MAL-2026-18214 ghsa-malware, amazon-inspector

Oct 23, 2026
npm
@cecm-web-sdk/core 99.0.1, 3.0.0, 1.1.0, 1.0.1
MAL-2026-18213 ghsa-malware, amazon-inspector

Oct 23, 2026
npm
@blueskydataplatform/shared-ui 99.0.3, 99.0.2, 0.0.1, 1.0.1, 1.0.0, 2.0.0, 2.0.1, 0.1.0
MAL-2026-18212 ghsa-malware, amazon-inspector

Oct 23, 2026
npm
@ecg-internal/js-react-i18n 2.0.0, 1.1.0, 1.0.1, 1.0.0, 99.0.1
MAL-2026-18209 amazon-inspector, ghsa-malware

Oct 23, 2026
npm
@ecg-internal/aurora-js-formatters 99.0.1, 2.0.0, 1.0.0, 2.0.1, 3.0.0
MAL-2026-18207 amazon-inspector, ghsa-malware

Oct 23, 2026
npm
@ecg-internal/media-util-js-lib 0.0.1, 99.0.1, 2.0.0, 3.0.0, 1.0.1, 1.1.0, 2.0.1
MAL-2026-18210 amazon-inspector, ghsa-malware

Oct 23, 2026
npm
@ecg-internal/favourites-ui 99.0.1, 1.1.0, 0.0.1, 3.0.0, 2.0.1, 1.0.0, 2.0.0
MAL-2026-18208 amazon-inspector, ghsa-malware

Oct 23, 2026
npm
@ecg-internal/adobe-dmp-js 99.0.1, 2.0.0, 1.0.1, 2.0.1, 0.0.1
MAL-2026-18206 amazon-inspector, ghsa-malware

Oct 23, 2026
npm
@ecg-internal/reviews-dialog-ui 99.0.1, 1.0.1, 3.0.0, 0.0.1, 2.0.1, 1.0.0, 2.0.0
MAL-2026-18211 amazon-inspector, ghsa-malware

Oct 23, 2026
npm
@tekmidian/pai 1.0.9, 1.0.8, 1.0.10
MAL-2026-18205 ghsa-malware, amazon-inspector

Oct 23, 2026
npm
react-native-bright-sdk 9000.0.0
MAL-2026-18290 amazon-inspector 2 IOCs

Oct 22, 2026
npm
@seggy116/next-diff 0.3.0
MAL-2026-18200 ghsa-malware, amazon-inspector

Oct 22, 2026
npm
@pkgship/frps-linux-amd64 0.71.1
MAL-2026-18199 ghsa-malware, amazon-inspector

Oct 22, 2026
npm
@pkgship/frpc-linux-amd64 0.71.1
MAL-2026-18198 ghsa-malware, amazon-inspector

Oct 22, 2026
npm
sdk-utils-testmetest 1.0.0
MAL-2026-18202 ghsa-malware, amazon-inspector

Oct 22, 2026
npm
kvarzo8f3atestmetest all versions
MAL-2026-18201 ghsa-malware

Oct 22, 2026
npm
@lumen-labs-dev/whisper-node 0.5.1
MAL-2026-18194 ghsa-malware, amazon-inspector

Oct 22, 2026
npm
darknode-cli 2.46.2, 2.46.1, 2.46.0
MAL-2026-18195 ghsa-malware, amazon-inspector

Oct 22, 2026
npm
x402-prompt-injection-scan 0.1.4
MAL-2026-18197 ghsa-malware, amazon-inspector

Oct 22, 2026
npm
imgdecode 1.0.1, 1.0.0, 1.0.2, 1.0.3
MAL-2026-18196 ghsa-malware, amazon-inspector

Oct 22, 2026
npm
@liauto/darwin-x64 0.1.1-b3
MAL-2026-18190 ghsa-malware, amazon-inspector

Oct 22, 2026
npm
@pkgship/frpc-darwin-amd64 0.71.1
MAL-2026-18191 ghsa-malware, amazon-inspector

Oct 22, 2026
npm
opencode-skills-collection 4.1.10, 4.0.57, 4.1.11, 4.1.16, 4.1.13, 4.1.6, 4.1.3, 4.1.4, 4.1.1, 4.1.8, 4.1.…
MAL-2026-18193 ghsa-malware, amazon-inspector

Oct 22, 2026
npm
agentic-awesome-skills 19.0.0, 19.9.0, 19.6.0, 18.12.0, 18.9.0, 18.11.0, 19.4.0, 19.10.1, 18.14.0, 18.…
MAL-2026-18192 ghsa-malware, amazon-inspector

Oct 22, 2026