Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,167 npm 223,990 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,990 reports · Feed

  • npm
    log-format-thread 1.0.1, 1.0.0
    MAL-2026-6848 ghsa-malware, amazon-inspector
  • npm
    hjs-biginteger 5.0.5
    MAL-2026-6838 ghsa-malware
  • npm
    chai-guard 1.2.3, 1.0.0
    MAL-2026-6827 ghsa-malware, reversing-labs
  • npm
    metrica-chain 2.4.5
    MAL-2026-6851 ghsa-malware, reversing-labs
  • npm
    lint-builders 1.0.0
    MAL-2026-6842 ghsa-malware
  • npm
    lint-nuler 1.0.4
    MAL-2026-6845 ghsa-malware, reversing-labs
  • npm
    lint-nule 1.0.4
    MAL-2026-6844 ghsa-malware
  • npm
    eth-tick 7.4.18, 7.4.17
    MAL-2026-6837 ghsa-malware, reversing-labs
  • npm
    eslint-vite 1.0.2, 1.0.1, 1.0.0
    MAL-2026-6836 ghsa-malware
  • npm
    es-lint-entry 1.0.0
    MAL-2026-6835 ghsa-malware
  • npm
    jsonupper 1.0.0, 5.1.0
    MAL-2026-6841 ghsa-malware, reversing-labs
  • npm
    hjs-lint-builders 1.0.4
    MAL-2026-6839 ghsa-malware
  • npm
    grid-settings-align 14.1.2, 14.1.1
    MAL-2026-6824 ghsa-malware
  • npm
    graphpilot 0.1.4, 0.1.3, 0.1.2, 0.1.1, 0.1.0
    MAL-2026-6823 ghsa-malware
  • npm
    fastnodemailer 8.0.4, 8.0.3, 8.0.2
    MAL-2026-6822 ghsa-malware, reversing-labs
  • npm
    express-guardrail 1.4.1, 1.3.5
    MAL-2026-6821 ghsa-malware, reversing-labs
  • npm
    env-axios 1.3.6
    MAL-2026-6818 ghsa-malware, reversing-labs
  • npm
    elevate-log 2.0.5
    MAL-2026-6815 ghsa-malware
  • npm
    express-dotenv 1.3.5
    MAL-2026-6820 ghsa-malware
  • npm
    es-lint-builders 1.0.5, 1.0.4, 1.0.3, 1.0.0
    MAL-2026-6819 ghsa-malware
  • npm
    custom-log-viewer 1.0.0
    MAL-2026-6813 ghsa-malware
  • npm
    emojiprint-prettier 1.0.9
    MAL-2026-6817 ghsa-malware
  • npm
    bootstrap-utils 4.5.0
    MAL-2026-6807 ghsa-malware, amazon-inspector
  • npm
    emojiprint-logger 5.6.2, 1.1.0
    MAL-2026-6816 ghsa-malware
  • npm
    devkit-scripts 1.0.3, 1.0.0
    MAL-2026-6814 ghsa-malware
  • npm
    chain-await-test 1.3.5
    MAL-2026-6808 ghsa-malware
  • npm
    cookie-ease 1.1.5, 1.1.3, 1.1.2, 1.1.1, 1.0.9, 1.0.8, 1.0.7, 1.0.6, 1.0.5, 1.0.0
    MAL-2026-6812 ghsa-malware, reversing-labs
  • npm
    chalks-logger 1.1.3, 1.1.2, 1.1.1, 1.1.0, 1.0.9
    MAL-2026-6811 ghsa-malware
  • npm
    chalk-logger-prettier 1.0.8, 1.0.7, 1.0.5, 1.0.3, 1.0.2, 1.0.1, 1.0.4
    MAL-2026-6809 ghsa-malware, reversing-labs
  • npm
    chalk-prettier 1.0.9, 1.0.8
    MAL-2026-6810 ghsa-malware, reversing-labs
  • npm
    bn-eslint.js 8.0.5
    MAL-2026-6805 ghsa-malware
  • npm
    bigint.os 5.0.8, 5.0.7, 5.0.6, 5.0.5
    MAL-2026-6804 ghsa-malware
  • npm
    bn-math 1.0.1, 1.0.0
    MAL-2026-6806 ghsa-malware
  • npm
    big256-ts 5.0.4, 5.0.3
    MAL-2026-6803 ghsa-malware, reversing-labs
  • npm
    big-numerator 5.0.6, 5.0.3
    MAL-2026-6802 ghsa-malware
  • npm
    big-numer 5.0.5
    MAL-2026-6800 ghsa-malware
  • npm
    big-numerate 5.0.3
    MAL-2026-6801 ghsa-malware
  • npm
    argonflux 2.0.1
    MAL-2026-6798 ghsa-malware, reversing-labs
  • npm
    awesome-cli-logger 1.2.0, 1.0.0
    MAL-2026-6799 ghsa-malware, reversing-labs
  • npm
    rollup-plugin-polyfill-handler 1.0.0, 1.0.1
    MAL-2026-6826 ghsa-malware, amazon-inspector