Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,168 npm 223,991 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,991 reports · Feed

  • npm
    authmatrix 1.0.30, 1.1.7
    MAL-2026-6656 ghsa-malware, amazon-inspector
  • npm
    auth-state-service 1.6.16
    MAL-2026-6655 ghsa-malware, amazon-inspector
  • npm
    vkzmn 1.0.6, 1.0.4, 1.0.3, 1.0.1, 1.0.0, 1.0.5, 1.0.2, 1.0.8, 1.0.7
    MAL-2026-6594 ghsa-malware, amazon-inspector
  • npm
    maplibre-gl-vue3 1.0.0, 5.24.2, 5.24.1, 5.24.3
    MAL-2026-6592 amazon-inspector
  • npm
    endpointmap 2.1.0, 3.0.0
    MAL-2026-6588 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    envfile-sync 1.0.0
    MAL-2026-6589 amazon-inspector
  • npm
    envfile-sync-cli 2.0.0, 3.0.0, 1.0.2
    MAL-2026-6590 amazon-inspector, ghsa-malware
  • npm
    clob-client-math 1.0.0, 1.0.1
    MAL-2026-6587 amazon-inspector
  • npm
    ledgerflow-deploy-utils 1.0.1, 1.0.4, 1.0.3, 1.0.5
    MAL-2026-6591 amazon-inspector
  • npm
    loadutils 1.0.4, 1.0.5, 1.0.6
    MAL-2026-6580 amazon-inspector, ghsa-malware
  • npm
    layerd-unit-codec-parser 1.0.0, 2.0.0
    MAL-2026-6578 amazon-inspector, ghsa-malware
  • npm
    pino-debugging 1.1.3, 1.1.4, 1.1.5
    MAL-2026-6583 amazon-inspector, ghsa-malware
  • npm
    openai-agents-helpers 1.3.2, 1.3.3, 1.2.0, 1.1.0, 0.8.0, 0.9.0, 1.3.1, 1.2.1, 0.1.0, 1.0.1, 0.7.0, 0.…
    MAL-2026-6582 amazon-inspector, ghsa-malware
  • npm
    poly-kelly 3.5.3, 3.3.0, 3.1.0, 3.2.0, 3.5.2
    MAL-2026-6584 amazon-inspector, ghsa-malware
  • npm
    checkmarx-claude-cache 1.0.0, 1.0.1
    MAL-2026-6576 amazon-inspector
  • npm
    ollama-helpers 1.2.1, 1.2.2, 0.3.0, 1.0.1, 0.5.0, 0.2.0, 1.1.0, 0.9.0, 0.1.1, 0.6.0, 0.7.1, 1.…
    MAL-2026-6581 amazon-inspector, ghsa-malware
  • npm
    int_sezzle_sfra 25.2.1
    MAL-2026-6577 amazon-inspector
  • npm
    stake-math 3.5.2, 3.5.3, 3.5.4, 3.3.0, 3.2.0, 3.1.0, 3.5.5
    MAL-2026-6585 amazon-inspector, ghsa-malware
  • npm
    lessload 1.0.1
    MAL-2026-6579 amazon-inspector, ghsa-malware
  • npm
    yastatic-s3 0.1.0, 0.1.99, 0.1.10
    MAL-2026-6586 amazon-inspector, ghsa-malware
  • npm
    @ibrahim1337/baksen 2.0.1, 2.0.3, 1.5.0, 2.0.0, 2.0.4, 2.0.7, 2.0.8, 2.0.6, 2.0.5, 2.0.9, 2.1.2, 2.…
    MAL-2026-6575 amazon-inspector, ghsa-malware
  • npm
    @thone33/analytics-injector 1.0.1, 1.0.0
    MAL-2026-6563 amazon-inspector, ghsa-malware
  • npm
    @thone33/core-utils 1.0.4, 1.0.0, 1.0.3, 1.0.1, 1.0.5, 1.0.2
    MAL-2026-6564 amazon-inspector, ghsa-malware
  • npm
    longzy-basic-ui 2.0.3
    MAL-2026-6569 amazon-inspector
  • npm
    pkg-fallback 1.1.0
    MAL-2026-6570 amazon-inspector
  • npm
    express-mocha-test 0.0.1
    MAL-2026-6568 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    @epic-common/observability-node 0.0.1, 10.10.1, 10.10.2, 0.0.1-security
    MAL-2026-6562 amazon-inspector
  • npm
    yandex-geobase 2.9.0, 2.1.2, 3.9.0, 2.1.0, 2.2.0, 2.1.1
    MAL-2026-6574 amazon-inspector, ghsa-malware
  • npm
    react-wp-viewer 0.2.15, 0.2.4, 0.2.99
    MAL-2026-6571 amazon-inspector, ghsa-malware
  • npm
    date-uuid 1.0.1, 1.0.0, 1.0.3, 1.0.2, 1.0.4
    MAL-2026-6566 amazon-inspector
  • npm
    eslint-commit-parser 1.0.0
    MAL-2026-6567 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    @uisp/utils 99.0.2, 99.0.1, 99.0.0
    MAL-2026-6565 amazon-inspector, ghsa-malware
  • npm
    rebrandly-domains-digger 9999.0.0
    MAL-2026-6572 amazon-inspector, ghsa-malware
  • npm
    rebrandly-domains-search-client 9999.0.0
    MAL-2026-6573 amazon-inspector, ghsa-malware
  • npm
    ulid-xyz 3.2.3, 3.2.4, 3.1.0, 2.12.1, 3.2.2, 3.2.1, 2.12.2, 2.12.3, 3.2.0
    MAL-2026-6672 amazon-inspector, ghsa-malware
  • npm
    @sailing-package/core all versions
    MAL-2026-6598
  • npm
    @longzy/react-native-polyfill all versions
    MAL-2026-6597
  • npm
    @digitalcnzz/embedded-sdk all versions
    MAL-2026-6596
  • npm
    @digitalcnzz/commonmodule all versions
    MAL-2026-6595
  • npm
    lc-chatbot 0.9.0-rc.0
    MAL-2026-6559 ossf-package-analysis, amazon-inspector