Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,167 npm 223,990 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,990 reports · Feed

  • npm
    react-next-dom 17.2.7, 1.1.7, 17.2.8
    MAL-2026-6825 ghsa-malware, reversing-labs, amazon-inspector
  • npm
    mongoose-lean-hooks 0.5.3, 0.5.2, 0.5.4, 0.5.5, 0.5.7, 0.5.6
    MAL-2026-6797 ghsa-malware, amazon-inspector
  • npm
    internallib_v234 1.0.3, 1.0.5, 1.0.6, 1.0.7, 1.0.4
    MAL-2026-6796 amazon-inspector
  • npm
    neon-terminal 0.3.0, 0.7.0, 0.9.0, 0.4.0, 0.6.0, 0.5.0, 0.2.0
    MAL-2026-6793 amazon-inspector
  • npm
    zod-pino434 1.0.127, 1.0.128
    MAL-2026-6794 amazon-inspector, ghsa-malware
  • npm
    zod-pino444 1.0.128, 1.0.129, 1.0.131, 1.0.130
    MAL-2026-6795 amazon-inspector, ghsa-malware
  • npm
    zredis-typed 1.0.127
    MAL-2026-6944 ghsa-malware, amazon-inspector
  • npm
    pinokio-redis 1.0.127
    MAL-2026-6938 ghsa-malware, amazon-inspector
  • npm
    tme-xca-react 3.0.0
    MAL-2026-10237 ghsa-malware, amazon-inspector
  • npm
    tme-xca 3.0.0
    MAL-2026-10236 amazon-inspector, ghsa-malware
  • npm
    tme-error 2.8.42
    MAL-2026-10235 amazon-inspector, ghsa-malware
  • npm
    sams-sr-sdk-h5 7.0.0
    MAL-2026-10233 amazon-inspector, ghsa-malware
  • npm
    enbd-react-logger 4.0.0
    MAL-2026-10231 amazon-inspector, ghsa-malware
  • npm
    enbd-react-lib 8.0.0
    MAL-2026-10230 amazon-inspector, ghsa-malware
  • npm
    enbd-react-error-boundry 6.0.0
    MAL-2026-10229 amazon-inspector, ghsa-malware
  • npm
    box-react-uix 18.6.91
    MAL-2026-10227 amazon-inspector, ghsa-malware
  • npm
    @logdna-web/styles 0.8.40
    MAL-2026-10226 amazon-inspector, ghsa-malware
  • npm
    @logdna-web/shared 13.19.37
    MAL-2026-10225 amazon-inspector, ghsa-malware
  • npm
    @idms-corp/auth-ui 0.0.0, 1.0.0
    MAL-2026-10224 amazon-inspector, ghsa-malware
  • npm
    @flex-ng/header-component 0.1.0
    MAL-2026-10223 amazon-inspector, ghsa-malware
  • npm
    @flex-ng/filter-pipe 1.1.0
    MAL-2026-10222 amazon-inspector, ghsa-malware
  • npm
    @flex-ng/error-component 2.1.0
    MAL-2026-10221 amazon-inspector, ghsa-malware
  • npm
    gen-ai-opt-in 99.0.2, 99.0.1, 99.0.0
    MAL-2026-6761 ossf-package-analysis, ghsa-malware, amazon-inspector
  • npm
    wsh4-nmp 1.0.0
    MAL-2026-6792 ossf-package-analysis, ghsa-malware, amazon-inspector
  • npm
    @adobesign/as-dev-tools 99.9.10, 99.9.9
    MAL-2026-6760 ossf-package-analysis, amazon-inspector
  • npm
    logger-daemon-regex 1.0.124
    MAL-2026-7017 amazon-inspector
  • npm
    fmt-date-lite 1.0.0
    MAL-2026-10115 amazon-inspector 1 IOC
  • npm
    vps-maintenance 0.1.0, 0.1.1
    MAL-2026-6756 amazon-inspector, ghsa-malware
  • npm
    vps-maintenance-paperclip-adapter 0.1.2, 0.1.6, 0.1.3, 0.1.5, 0.1.1, 0.1.4, 0.1.0
    MAL-2026-6757 amazon-inspector, ghsa-malware, ossf-package-analysis
  • npm
    paperclip2 1.0.0
    MAL-2026-6755 amazon-inspector, ghsa-malware
  • npm
    datefmt-helper 1.0.0, 1.0.1
    MAL-2026-6788 amazon-inspector, ghsa-malware 1 IOC
  • npm
    debugcli 4.3.9, 4.3.5, 4.3.8, 4.3.7, 4.4.1, 4.3.6
    MAL-2026-6790 ossf-package-analysis, ghsa-malware, amazon-inspector
  • npm
    web-api-node all versions
    MAL-2026-6747 ghsa-malware
  • npm
    typescript-util-core 7.1.6, 7.1.5, 7.1.3, 3.5.0
    MAL-2026-6746 ghsa-malware
  • npm
    ts-node-utils 8.0.6, 8.0.4, 8.0.1
    MAL-2026-6745 ghsa-malware
  • npm
    api-ts-utils all versions
    MAL-2026-6744 ghsa-malware
  • npm
    api-node-utils 2.2.4
    MAL-2026-6743 ghsa-malware
  • npm
    alder_morrgan all versions
    MAL-2026-6742 ghsa-malware
  • npm
    @node-cloud/create 1.0.2, 1.0.0, 1.0.1, 1.0.3, 1.0.5, 1.0.4, 1.0.6
    MAL-2026-6741 ghsa-malware, amazon-inspector
  • npm
    @lodash-en/lodash-en 1.4.11, 1.5.0
    MAL-2026-6739 ghsa-malware, reversing-labs