Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,167 npm 223,990 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,990 reports · Feed

  • npm
    tailstyle-core 0.0.1
    MAL-2026-6885 ghsa-malware, amazon-inspector
  • npm
    syncora 0.2.0
    MAL-2026-6884 ghsa-malware, amazon-inspector
  • npm
    tailwind-scroller 1.0.2
    MAL-2026-6887 ghsa-malware, reversing-labs
  • npm
    styled-text-logger 1.3.1
    MAL-2026-6883 ghsa-malware
  • npm
    secure-box 1.0.2, 1.0.1
    MAL-2026-6875 ghsa-malware, amazon-inspector
  • npm
    st-bigintr 5.0.6, 5.0.5
    MAL-2026-6881 ghsa-malware
  • npm
    sjs-builders 1.0.4
    MAL-2026-6877 ghsa-malware
  • npm
    sjs-builder 1.0.5, 1.0.4
    MAL-2026-6876 ghsa-malware
  • npm
    safe-validate 1.0.4, 1.0.3, 1.0.2, 1.0.1
    MAL-2026-6874 ghsa-malware, amazon-inspector
  • npm
    router-kit 2.1.0, 2.0.1, 2.0.0, 1.3.4, 1.3.3, 1.3.2, 1.3.1, 1.3.0, 1.2.6, 1.2.5, 1.2.4, 1.…
    MAL-2026-6873 ghsa-malware
  • npm
    react-svg-render 1.0.2
    MAL-2026-6870 ghsa-malware
  • npm
    react-native-template-my-starter 1.0.0
    MAL-2026-6869 ghsa-malware
  • npm
    pretty-pino-logger 2.0.2, 2.0.1, 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0
    MAL-2026-6867 ghsa-malware, reversing-labs
  • npm
    pretty-pino-loggers 1.0.1
    MAL-2026-6868 ghsa-malware, reversing-labs
  • npm
    prettier-logger 0.1.6, 0.1.5, 0.1.4
    MAL-2026-6866 ghsa-malware, reversing-labs
  • npm
    polymarket-onchain-plugin 2.1.5, 2.1.4, 2.1.3
    MAL-2026-6864 ghsa-malware, reversing-labs
  • npm
    pino-utils 1.4.0, 1.3.6
    MAL-2026-6863 ghsa-malware
  • npm
    polymarket-onchain-sdk 1.0.4, 1.0.3, 1.0.2
    MAL-2026-6865 ghsa-malware, reversing-labs
  • npm
    pino-pretty-logs 2.0.0, 1.1.0, 1.0.7, 1.0.8
    MAL-2026-6862 ghsa-malware, reversing-labs
  • npm
    picocolor-logger 1.0.2, 1.0.1, 1.0.0
    MAL-2026-6861 ghsa-malware
  • npm
    peptideenv 16.6.6, 16.6.5, 16.6.4, 16.6.3, 16.6.2, 16.6.1
    MAL-2026-6860 ghsa-malware
  • npm
    lint-builds 1.0.5, 1.0.0
    MAL-2026-6843 ghsa-malware
  • npm
    older_morgan 1.0.2, 1.0.1
    MAL-2026-6859 ghsa-malware
  • npm
    npm-eslint-helper 1.0.1
    MAL-2026-6858 ghsa-malware, reversing-labs
  • npm
    npm-doc-dev 1.1.1, 1.1.0, 1.0.9, 1.0.8, 1.0.7, 1.0.6, 1.0.4, 1.0.5
    MAL-2026-6857 ghsa-malware, reversing-labs
  • npm
    node-env-detector 1.0.1, 1.0.0
    MAL-2026-6856 ghsa-malware
  • npm
    df-vision 1.1.79, 1.1.78, 1.1.77, 1.1.76, 1.1.75, 1.1.74, 1.1.73, 1.1.72, 1.1.71
    MAL-2026-6834 ghsa-malware, amazon-inspector
  • npm
    debug-glitzs 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0
    MAL-2026-6833 ghsa-malware
  • npm
    next-bignumber.js 1.0.0
    MAL-2026-6855 ghsa-malware, amazon-inspector
  • npm
    color-logger-console 3.1.9, 3.1.8
    MAL-2026-6831 ghsa-malware
  • npm
    linter-entry 1.0.0
    MAL-2026-6847 ghsa-malware
  • npm
    lint-null 1.0.4
    MAL-2026-6846 ghsa-malware
  • npm
    modulyn 1.0.1
    MAL-2026-6854 ghsa-malware
  • npm
    chalki-pretty 1.0.0
    MAL-2026-6829 ghsa-malware
  • npm
    metrica-node 2.4.5
    MAL-2026-6852 ghsa-malware, reversing-labs
  • npm
    js-unimode 1.1.10, 1.1.9, 1.1.8, 1.1.7, 1.1.6, 1.1.5, 1.1.4, 1.1.3, 1.1.2, 1.1.1
    MAL-2026-6840 ghsa-malware
  • npm
    chalk-pro-logger 1.1.2, 1.1.1
    MAL-2026-6828 ghsa-malware
  • npm
    mjs-biginteger 5.0.6, 5.0.5
    MAL-2026-6853 ghsa-malware
  • npm
    logger-beauty 2.1.1, 1.1.0, 1.0.3, 1.0.2, 1.0.1
    MAL-2026-6850 ghsa-malware, reversing-labs
  • npm
    log-upgrade 7.1.0
    MAL-2026-6849 ghsa-malware, reversing-labs