Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,168 npm 223,991 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,991 reports · Feed

  • npm
    test-pkg-pnpm 1.0.1, 1.0.4, 1.0.2, 1.0.0, 1.0.3
    MAL-2026-6716 amazon-inspector, ghsa-malware
  • npm
    test-pkg-x0 1.0.4, 1.0.3, 1.0.0, 1.0.2, 1.0.1
    MAL-2026-6717 amazon-inspector, ghsa-malware
  • npm
    polymarket-toolkit 1.4.9
    MAL-2026-6713 amazon-inspector, ghsa-malware
  • npm
    polymarket-trading-developer-tool 0.1.1, 0.1.2
    MAL-2026-6714 amazon-inspector, ghsa-malware
  • npm
    polymarket-risk-manager 3.5.2, 3.2.0, 3.3.0, 3.1.0
    MAL-2026-6712 amazon-inspector, ghsa-malware
  • npm
    ts-clob-math-v2 2.0.1
    MAL-2026-6719 amazon-inspector
  • npm
    ts-elinter 3.3.9
    MAL-2026-6720 amazon-inspector
  • npm
    ts-eslint-helper 4.0.5, 4.0.4, 4.0.3, 4.0.2, 4.0.1
    MAL-2026-6721 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    vega-lite-next 19.2.1
    MAL-2026-6709 amazon-inspector, reversing-labs
  • npm
    vitest-agent 1.0.6, 1.0.5, 1.0.0
    MAL-2026-6710 amazon-inspector, ghsa-malware
  • npm
    hardhat-plugin-solidity 1.0.0, 2.3.1, 1.1.0, 2.0.0
    MAL-2026-6706 amazon-inspector
  • npm
    hardhat-compile-ethers 0.4.7, 0.4.10, 0.4.12, 0.4.11, 0.4.8, 0.4.6, 0.4.5, 0.4.4, 0.4.2, 0.4.0, 0.4.3,…
    MAL-2026-6705 amazon-inspector, ghsa-malware
  • npm
    zyncmap 0.0.1, 0.0.0
    MAL-2026-6708 amazon-inspector
  • npm
    svgson-lite 1.0.1, 1.0.0, 1.0.5, 1.0.6, 1.0.7, 1.0.2, 1.0.4, 1.0.8, 1.0.3
    MAL-2026-6707 amazon-inspector, ghsa-malware
  • npm
    base65-85x 5.0.1
    MAL-2026-6704 amazon-inspector, ghsa-malware
  • npm
    @andes-tools/colors 999.0.0
    MAL-2026-6703 ossf-package-analysis
  • npm
    npm-show-date-proof-strings 1.0.3, 1.0.4
    MAL-2026-6791 ossf-package-analysis, amazon-inspector
  • npm
    date-fns-lite 1.0.5, 1.0.9, 1.0.11, 1.0.0, 1.0.1, 1.0.6, 1.0.10, 1.0.8, 1.0.2, 1.0.7, 1.0.3, …
    MAL-2026-6722 amazon-inspector, ossf-package-analysis, reversing-labs
  • npm
    node-pino 2.3.2
    MAL-2026-6762 ghsa-malware
  • npm
    ecto-corsair-flag-7kq3mz 1.0.2, 1.0.0, 1.0.1
    MAL-2026-6699 amazon-inspector
  • npm
    module-index-cache 1.0.1, 1.0.0, 1.0.2
    MAL-2026-6700 amazon-inspector
  • npm
    ripshakti 80.0.0
    MAL-2026-6701 amazon-inspector
  • npm
    @sudoughnym/enviro-demo 99.99.99, 0.3.3
    MAL-2026-6697 amazon-inspector, ghsa-malware
  • npm
    @businessapp-microsites/apis 9999.0.0, 9999.0.1, 9999.0.2
    MAL-2026-6696 amazon-inspector, ghsa-malware
  • npm
    cursed-modules 999.0.0, 999.0.3, 999.0.1, 999.0.2, 2.0.0, 999.0.6, 1.0.5, 999.0.8, 1.0.6, 1.0.…
    MAL-2026-6698 amazon-inspector, ossf-package-analysis
  • npm
    procwire 2.0.0, 1.3.0
    MAL-2026-6687 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    quoting all versions
    MAL-2026-6685 ghsa-malware
  • npm
    brock-react-alerts all versions
    MAL-2026-6681 ghsa-malware
  • npm
    brock-loader all versions
    MAL-2026-6680 ghsa-malware
  • npm
    setup-cicd 0.0.1
    MAL-2026-6686 ghsa-malware, amazon-inspector
  • npm
    postcss-property-rollup 0.0.1
    MAL-2026-6684 ghsa-malware, amazon-inspector
  • npm
    nbmolviz-js 0.0.1
    MAL-2026-6683 ghsa-malware, amazon-inspector
  • npm
    confluent-kafka-javascript 0.0.1
    MAL-2026-6682 ghsa-malware, amazon-inspector
  • npm
    agent-starter-pack 0.0.1
    MAL-2026-6679 ghsa-malware, amazon-inspector
  • npm
    ts-linting-builder 2.1.2
    MAL-2026-6678 ghsa-malware, amazon-inspector
  • npm
    ts-lint-builders-v2.1 2.1.0
    MAL-2026-6677 ghsa-malware, amazon-inspector
  • npm
    rs-biginteger 6.1.5, 6.1.3
    MAL-2026-6675 ghsa-malware, amazon-inspector
  • npm
    terminal-prettier 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0, 1.…
    MAL-2026-6676 ghsa-malware, reversing-labs
  • npm
    vue-demi-fix 10.0.4, 10.0.3, 10.0.5, 10.0.2, 10.0.6, 10.0.1, 10.0.0
    MAL-2026-6702 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    ripshakti1 81.0.0
    MAL-2026-6674 ossf-package-analysis, amazon-inspector