Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,168 npm 223,991 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,991 reports · Feed

  • npm
    ts-opus 0.0.8
    MAL-2026-6468 amazon-inspector, ghsa-malware
  • npm
    @vpms/design-system 0.1.3, 1.0.0, 1.1.2, 1.0.1
    MAL-2026-6467 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    chai-as-built 6.0.3
    MAL-2026-6465 amazon-inspector
  • npm
    gx-npm-feature-flags 99.99.99
    MAL-2026-6466 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    @colibri-event-types/megamarket-ru-web 5.2.8
    MAL-2026-6464 amazon-inspector
  • npm
    abu-common-components 99.99.1
    MAL-2026-6463 amazon-inspector
  • npm
    dttsdee 1.0.0
    MAL-2026-6462 ossf-package-analysis, amazon-inspector
  • npm
    easy-string-kit232 1.0.8
    MAL-2026-6461 ossf-package-analysis, amazon-inspector
  • npm
    dddooo 1.0.2, 1.0.1, 1.0.0
    MAL-2026-6460 ossf-package-analysis, amazon-inspector
  • npm
    easy-string-kit 1.0.1, 1.0.4, 1.0.5, 1.0.8, 1.0.6, 1.0.7, 1.0.3, 1.0.2
    MAL-2026-6459 ossf-package-analysis, amazon-inspector
  • npm
    wp-codebox-workspace 9999.99.99
    MAL-2026-6458 amazon-inspector
  • npm
    simple-node-calc-c 1.0.0
    MAL-2026-6454 amazon-inspector
  • npm
    simple-node-calc-b 1.0.0
    MAL-2026-6453 amazon-inspector
  • npm
    simple-node-calc-a 1.0.0
    MAL-2026-6451 amazon-inspector
  • npm
    simple-node-calc-aa 1.0.0
    MAL-2026-6452 amazon-inspector
  • npm
    simple-node-calc-ccc 1.0.0
    MAL-2026-6455 amazon-inspector
  • npm
    subsearch 1.0.2, 1.0.3
    MAL-2026-6457 amazon-inspector, ghsa-malware
  • npm
    stitch-design 0.1.1, 0.1.0
    MAL-2026-6456 amazon-inspector
  • npm
    based-32 1.0.1, 1.0.0
    MAL-2026-6447 amazon-inspector
  • npm
    howdybase32 1.0.0
    MAL-2026-6449 amazon-inspector
  • npm
    nizzybase32 1.0.0
    MAL-2026-6450 amazon-inspector
  • npm
    base58-core 1.0.1, 1.0.0, 1.0.2, 1.0.3, 1.0.5, 1.0.4, 1.0.7, 1.0.8, 1.0.6, 1.0.10, 1.0.11, …
    MAL-2026-6445 amazon-inspector, ghsa-malware
  • npm
    bs58-86 6.0.1, 6.0.2
    MAL-2026-6448 amazon-inspector, ghsa-malware
  • npm
    base62-86x 5.0.5, 5.0.4
    MAL-2026-6446 amazon-inspector, ghsa-malware
  • npm
    agentsync-tool 1.0.1
    MAL-2026-6444 amazon-inspector
  • npm
    agentsync-pkg 2.0.0, 3.0.0, 1.0.3
    MAL-2026-6443 amazon-inspector, ghsa-malware
  • npm
    logfmt-core 3.5.2, 3.1.0, 3.3.0, 3.2.0
    MAL-2026-6437 amazon-inspector, ghsa-malware
  • npm
    polymarket-stake-math 3.5.1, 3.5.0, 3.2.0, 3.3.0, 3.1.0, 3.4.0
    MAL-2026-6438 amazon-inspector, ghsa-malware
  • npm
    polymarket-stake-maths 3.5.2, 3.1.0, 3.3.0, 3.2.0
    MAL-2026-6439 amazon-inspector, ghsa-malware
  • npm
    easy-time-format 1.0.0
    MAL-2026-6442 ghsa-malware, amazon-inspector
  • npm
    tokenization-util 1.1.0, 0.2.0, 0.1.0
    MAL-2026-6440 amazon-inspector, ghsa-malware
  • npm
    unifydata 3.6.6
    MAL-2026-6441 amazon-inspector
  • npm
    anthropic-claude-latest 4.7.3, 4.7.2, 4.7.1
    MAL-2026-6415 amazon-inspector, ghsa-malware
  • npm
    block-slot 1.0.9
    MAL-2026-6416 ghsa-malware, amazon-inspector
  • npm
    poc-publish-test-su-doughnym 0.0.1
    MAL-2026-6413 ghsa-malware, amazon-inspector
  • npm
    nabisco 0.0.1-poc
    MAL-2026-6412 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    @su-doughnym/react-dlb 99.99.99
    MAL-2026-6410 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    @su-doughnym/metrics-js 99.99.99
    MAL-2026-6409 ghsa-malware, reversing-labs
  • npm
    @su-doughnym/loginui 99.99.99
    MAL-2026-6408 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    two-factor-prompt-lib 0.0.1-poc
    MAL-2026-6414 ghsa-malware, amazon-inspector, reversing-labs