Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,168 npm 223,991 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,991 reports · Feed

  • npm
    vercel-api-client all versions
    MAL-2026-6389 ghsa-malware
  • npm
    evmdotjs all versions
    MAL-2026-6386 ghsa-malware
  • npm
    eth_accounts all versions
    MAL-2026-6385 ghsa-malware
  • npm
    simplisafe-gatsby 1.0.1, 1.0.2
    MAL-2026-6379 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    macos-ci-utils 1.0.1, 1.0.0
    MAL-2026-6378 amazon-inspector, reversing-labs
  • npm
    linux-ci-utils 1.0.0
    MAL-2026-6377 amazon-inspector
  • npm
    system-core-utils 1.0.0
    MAL-2026-6380 amazon-inspector
  • npm
    bn-lint 3.0.8, 3.0.6
    MAL-2026-6376 amazon-inspector
  • npm
    evil-pkg 1.0.0, 1.0.1, 1.0.5, 1.0.4, 1.0.2, 1.0.3
    MAL-2026-6374 amazon-inspector, ghsa-malware
  • npm
    gpt-chat-cli 1.0.1, 1.0.2
    MAL-2026-6375 amazon-inspector
  • npm
    hardhat-test-log 1.1.0, 1.1.2, 1.1.3, 1.1.1
    MAL-2026-6369 amazon-inspector
  • npm
    dbt-language-server 1.0.1, 1.0.2
    MAL-2026-6367 amazon-inspector, ghsa-malware
  • npm
    hyperpure 1.0.0
    MAL-2026-6370 amazon-inspector, reversing-labs
  • npm
    decimal-format-utils 1.0.0, 1.0.1
    MAL-2026-6368 amazon-inspector, ghsa-malware
  • npm
    rollup-runtime-polyfill-core 0.13.7, 0.13.9, 0.14.0, 0.13.8, 0.13.4, 0.13.2, 0.13.3, 0.13.6, 0.13.1, 0.13.5
    MAL-2026-6372 amazon-inspector, ghsa-malware
  • npm
    assertcore 3.1.7
    MAL-2026-6365 amazon-inspector, ghsa-malware
  • npm
    backpack-ios 1.0.0
    MAL-2026-6366 amazon-inspector
  • npm
    llm-traces-app 1.0.1, 1.0.2
    MAL-2026-6371 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    twilio-voice-js-reference-components 1.0.1, 1.0.2
    MAL-2026-6373 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    openllmapi 4.0.2
    MAL-2026-6364 amazon-inspector
  • npm
    monty-data 1.2.0, 1.0.0, 1.1.0
    MAL-2026-6362 amazon-inspector
  • npm
    npmkekw 2.0.0, 2.0.3, 2.0.5, 2.0.1
    MAL-2026-6363 amazon-inspector
  • npm
    tailwind-textform-fill all versions
    MAL-2026-6360 ghsa-malware
  • npm
    html-to-gutenberg 4.2.11, 4.2.14, 4.2.16, 4.2.15, 4.2.13, 4.2.12, 4.2.17, 4.2.18, 4.2.19, 4.2.20,…
    MAL-2026-6359 ghsa-malware, amazon-inspector
  • npm
    fetch-page-assets 1.2.9, 1.2.14, 1.2.13, 1.2.12, 1.2.11, 1.2.10, 1.2.15, 1.2.16
    MAL-2026-6358 ghsa-malware, amazon-inspector
  • npm
    vscode-test-web 1.0.0
    MAL-2026-6361 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    delta-time-32bb 1.0.0
    MAL-2026-6351 amazon-inspector
  • npm
    npm-bug-bounty-test1-rhyselsmore 1.0.5
    MAL-2026-6354 amazon-inspector
  • npm
    ppt-creator 1.0.0
    MAL-2026-6355 amazon-inspector
  • npm
    bug-monorepo 3.1.94
    MAL-2026-6349 amazon-inspector
  • npm
    theme-color-picker 2.0.28, 2.0.31, 2.0.30
    MAL-2026-6357 amazon-inspector, ghsa-malware
  • npm
    chai-as-operated 6.0.3
    MAL-2026-6350 amazon-inspector
  • npm
    markdownlint-cli2-fix 99.0.6, 99.0.7
    MAL-2026-6353 amazon-inspector, ghsa-malware
  • npm
    buffer-wrap-67d7 1.0.0
    MAL-2026-6348 amazon-inspector
  • npm
    hex-conv-ae7a 1.0.0
    MAL-2026-6352 amazon-inspector
  • npm
    safe-json-38bd 1.0.0
    MAL-2026-6356 amazon-inspector
  • npm
    wagmi_util 3.6.19
    MAL-2026-6347 amazon-inspector
  • npm
    log-taker 0.1.0, 0.0.7, 0.0.8, 0.0.9
    MAL-2026-6338 amazon-inspector, ghsa-malware
  • npm
    react-check-error 2.1.7, 2.1.6
    MAL-2026-6341 amazon-inspector, ghsa-malware
  • npm
    triage-bot 1.0.1, 1.0.2
    MAL-2026-6346 amazon-inspector