Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,167 npm 223,990 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,990 reports · Feed

  • npm
    @2011-08-19/n 99.9.9, 99.9.10
    MAL-2026-7033 reversing-labs
  • npm
    @pimy-b2cweb/apiclient-b2cweb-r2 99.99.99
    MAL-2026-10655 ossf-package-analysis
  • npm
    @pimy-b2cweb/frontend-lib 99.99.99
    MAL-2026-10656 ossf-package-analysis
  • npm
    @higherlogic/ocfe 99.9.1
    MAL-2026-6911 ossf-package-analysis, ghsa-malware
  • npm
    paperclip-adapter-helpers 1.0.9, 1.0.6, 1.0.5, 1.0.12, 1.0.4, 1.0.7, 1.0.1, 1.0.8, 1.0.2, 1.0.11, 1.0.10,…
    MAL-2026-6981 amazon-inspector, ghsa-malware, ossf-package-analysis
  • npm
    express-firegate all versions
    MAL-2026-6909 ghsa-malware
  • npm
    express-deflect 1.6.10, 1.6.12
    MAL-2026-6908 ghsa-malware, amazon-inspector
  • npm
    chai-spycore 1.1.0, 1.5.3
    MAL-2026-6907 ghsa-malware, amazon-inspector
  • npm
    zluri-ad-connector 9.9.9
    MAL-2026-6910 ossf-package-analysis, amazon-inspector
  • npm
    express-mongo-limit 2.0.2, 2.0.6, 2.0.1, 2.0.4, 2.0.5, 2.0.3, 1.0.0, 1.0.3, 1.0.1, 1.0.2, 1.0.4
    MAL-2026-7012 amazon-inspector, ghsa-malware 4 IOCs
  • npm
    vps-adapter-core 1.0.2, 1.0.1, 1.0.0
    MAL-2026-6949 ghsa-malware, amazon-inspector, ossf-package-analysis 2 IOCs
  • npm
    paperclip-host-utils 1.0.4, 1.0.0, 1.0.2, 1.0.5, 1.0.7, 1.0.6, 1.0.3
    MAL-2026-6947 ghsa-malware, amazon-inspector 2 IOCs
  • npm
    xnder-sdk-js 0.1.0
    MAL-2026-6906 ghsa-malware, amazon-inspector
  • npm
    winston-prism 1.0.1
    MAL-2026-6905 ghsa-malware, reversing-labs
  • npm
    winston-js-express 1.1.2, 1.1.1, 1.0.7, 1.0.6, 1.0.5, 1.0.4, 1.0.3, 1.0.0
    MAL-2026-6904 ghsa-malware
  • npm
    wime-zle 1.1.4
    MAL-2026-6902 ghsa-malware, reversing-labs
  • npm
    vite-plugin-svg-paths 1.1.9, 1.1.8, 1.1.7, 1.1.6, 1.1.5
    MAL-2026-6901 ghsa-malware
  • npm
    tailwindcss-animatecss-latest 2.1.1, 2.1.0
    MAL-2026-6888 ghsa-malware
  • npm
    windrule-utils 0.0.1
    MAL-2026-6903 ghsa-malware, amazon-inspector
  • npm
    tailwindcss-fonttypo-inter 2.3.2
    MAL-2026-6890 ghsa-malware
  • npm
    twcompose-utils 0.7.7, 0.7.6
    MAL-2026-6899 ghsa-malware, amazon-inspector
  • npm
    txs-data 1.0.1
    MAL-2026-6900 ghsa-malware, amazon-inspector
  • npm
    renderctx 1.1.1
    MAL-2026-6871 ghsa-malware
  • npm
    ts-lint-builders 1.0.5
    MAL-2026-6897 ghsa-malware
  • npm
    ts-eslinter 1.0.0
    MAL-2026-6896 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    rma-utils 1.0.1
    MAL-2026-6872 ghsa-malware
  • npm
    ts-relayer-pub 1.0.0
    MAL-2026-6898 ghsa-malware
  • npm
    competion 1.8.4, 1.8.3, 1.8.2, 1.8.1
    MAL-2026-6832 ghsa-malware, reversing-labs
  • npm
    ts-bigtn 1.3.2, 1.3.1
    MAL-2026-6895 ghsa-malware, reversing-labs
  • npm
    tracing-str 2.0.3, 1.0.5, 1.0.4, 1.0.3, 1.0.2, 1.0.0
    MAL-2026-6894 ghsa-malware, reversing-labs
  • npm
    test-prettier 1.0.9
    MAL-2026-6893 ghsa-malware
  • npm
    color-cli-log 2.1.0, 2.0.0
    MAL-2026-6830 ghsa-malware, reversing-labs
  • npm
    tailwindcss-svg-helper 1.18.0, 1.17.9
    MAL-2026-6892 ghsa-malware
  • npm
    tailwindcss-fonttype-inter 2.3.2, 2.3.1
    MAL-2026-6889 ghsa-malware
  • npm
    tailwindcss-framer-motion 1.1.3
    MAL-2026-6891 ghsa-malware
  • npm
    stacknova 1.0.0
    MAL-2026-6882 ghsa-malware, reversing-labs
  • npm
    st-biginteger 5.0.5
    MAL-2026-6880 ghsa-malware
  • npm
    sol-sdk 2.3.18
    MAL-2026-6879 ghsa-malware, reversing-labs
  • npm
    sleek-pretty 1.0.0
    MAL-2026-6878 ghsa-malware, reversing-labs
  • npm
    tailwind-fonttype-inter 2.3.2
    MAL-2026-6886 ghsa-malware