Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,167 npm 223,990 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,990 reports · Feed

  • npm
    chai-as-consisted 2.2.9
    MAL-2026-7233 reversing-labs
  • npm
    chai-as-commited 2.38.8, 2.38.9
    MAL-2026-7232 reversing-labs
  • npm
    chai-as-belonged 4.3.8
    MAL-2026-7231 reversing-labs
  • npm
    chai-as-absorbed 3.4.1
    MAL-2026-7230 reversing-labs
  • npm
    breactjs 1.1.1, 1.1.4, 8.7.6
    MAL-2026-7229 reversing-labs
  • npm
    box-ui-elements-usm 99.3.1
    MAL-2026-7228 reversing-labs
  • npm
    bode-which 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7227 reversing-labs
  • npm
    bmg-user-interaction-tracker 999.9.9
    MAL-2026-7226 reversing-labs
  • npm
    bitu-wallet 99.0.0
    MAL-2026-7225 reversing-labs
  • npm
    bitu-user 99.0.0
    MAL-2026-7224 reversing-labs
  • npm
    bitu-trade 99.0.0
    MAL-2026-7223 reversing-labs
  • npm
    bitu-sdk 99.0.0
    MAL-2026-7222 reversing-labs
  • npm
    bitu-protocol 99.0.0
    MAL-2026-7221 reversing-labs
  • npm
    bitu-core 99.0.0
    MAL-2026-7220 reversing-labs
  • npm
    bitu-app 99.0.0
    MAL-2026-7219 reversing-labs
  • npm
    bitopro-trade-guard 1.1.0
    MAL-2026-7218 reversing-labs
  • npm
    backoff-table 99.9.1
    MAL-2026-7217 reversing-labs
  • npm
    babelcode_js 99.12.9
    MAL-2026-7216 reversing-labs
  • npm
    axgularjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7215 reversing-labs
  • npm
    autoprethixer 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7214 reversing-labs
  • npm
    autoprafixar 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7213 reversing-labs
  • npm
    atgularjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7212 reversing-labs
  • npm
    ashcare-ui-ember 99.99.99
    MAL-2026-7211 reversing-labs
  • npm
    ash-session-tracker 99.99.99
    MAL-2026-7210 reversing-labs
  • npm
    areactjs 1.1.1, 1.1.4, 8.7.6
    MAL-2026-7209 reversing-labs
  • npm
    apple-mycelium-internal-research 99.9.11
    MAL-2026-7208 reversing-labs
  • npm
    appauthhelper-enduser 99.0.0
    MAL-2026-7207 reversing-labs
  • npm
    apache-arrow-17 9.9.9
    MAL-2026-7206 reversing-labs
  • npm
    anjularjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7205 reversing-labs
  • npm
    angzlarjs 1.1.4, 8.7.6
    MAL-2026-7204 reversing-labs
  • npm
    angylarjs 1.1.4, 8.7.6
    MAL-2026-7203 reversing-labs
  • npm
    angxlarjs 1.1.4, 8.7.6
    MAL-2026-7202 reversing-labs
  • npm
    angwlarjs 1.1.4, 8.7.6
    MAL-2026-7201 reversing-labs
  • npm
    angvlarjs 1.1.4, 8.7.6
    MAL-2026-7200 reversing-labs
  • npm
    anguzarjs 1.1.4, 8.7.6
    MAL-2026-7199 reversing-labs
  • npm
    anguyarjs 1.1.4, 8.7.6
    MAL-2026-7198 reversing-labs
  • npm
    anguxarjs 1.1.4, 8.7.6
    MAL-2026-7197 reversing-labs
  • npm
    anguwarjs 1.1.4, 8.7.6
    MAL-2026-7196 reversing-labs
  • npm
    anguvarjs 1.1.4, 8.7.6
    MAL-2026-7195 reversing-labs
  • npm
    anguuarjs 1.1.4
    MAL-2026-7194 reversing-labs