Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,168 npm 223,991 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,991 reports · Feed

  • npm
    therdweb 0.0.8
    MAL-2026-6342 amazon-inspector, ghsa-malware
  • npm
    thidweb 0.0.8
    MAL-2026-6343 amazon-inspector, ghsa-malware
  • npm
    thurdweb 0.0.8
    MAL-2026-6345 amazon-inspector, ghsa-malware
  • npm
    rainbownkit 0.0.8
    MAL-2026-6340 amazon-inspector, ghsa-malware
  • npm
    thirdwebjs 0.0.8
    MAL-2026-6344 amazon-inspector, ghsa-malware
  • npm
    rainbokit 0.0.8
    MAL-2026-6339 amazon-inspector, ghsa-malware
  • npm
    hunsterx-package 7.0.1
    MAL-2026-6337 amazon-inspector, ghsa-malware
  • npm
    @zynkit/probe 0.0.1
    MAL-2026-6314 amazon-inspector, ghsa-malware
  • npm
    @frostnode/probe 0.0.1
    MAL-2026-6304 amazon-inspector, ghsa-malware
  • npm
    @gleamkit/probe 0.0.1
    MAL-2026-6306 amazon-inspector, ghsa-malware
  • npm
    ts-grok 0.0.8
    MAL-2026-6321 amazon-inspector, ghsa-malware
  • npm
    ts-escrow 0.1.0, 0.0.9
    MAL-2026-6320 amazon-inspector, ghsa-malware
  • npm
    ts-bn-lint-helper 3.1.19
    MAL-2026-6318 amazon-inspector, reversing-labs
  • npm
    ts-bn-lint 5.8.0, 3.1.19
    MAL-2026-6317 amazon-inspector
  • npm
    ts-escro 0.0.6, 0.0.8, 0.0.7, 0.0.9
    MAL-2026-6319 amazon-inspector, ghsa-malware
  • npm
    @muaththir/api 2.0.0
    MAL-2026-6328 ghsa-malware, amazon-inspector
  • npm
    ts-biginteger-lib 5.0.5
    MAL-2026-6316 amazon-inspector, ghsa-malware
  • npm
    cursorai-agent 1.0.0
    MAL-2026-6332 ghsa-malware, amazon-inspector
  • npm
    @ravespaceio/rave-engine all versions
    MAL-2026-6330 ghsa-malware
  • npm
    @ravespaceio/browser-input all versions
    MAL-2026-6329 ghsa-malware
  • npm
    web3-crypto-address-utils 0.1.0
    MAL-2026-6324 amazon-inspector
  • npm
    web3-eth-util 6.2.8
    MAL-2026-6325 amazon-inspector, ghsa-malware
  • npm
    web3-eth-utils 6.2.8
    MAL-2026-6326 amazon-inspector, ghsa-malware
  • npm
    calculate-helper all versions
    MAL-2026-6331 ghsa-malware
  • npm
    sync-external 1.6.2, 1.6.0, 1.6.1
    MAL-2026-6336 ghsa-malware, amazon-inspector
  • npm
    server-parket 3.9.1, 4.0.1, 0.1.0, 3.8.1, 3.9.2
    MAL-2026-6335 ghsa-malware, amazon-inspector
  • npm
    mjs-eslint-service 7.0.5
    MAL-2026-6333 ghsa-malware, amazon-inspector
  • npm
    ts-sudo 1.0.0
    MAL-2026-6323 amazon-inspector, ghsa-malware
  • npm
    parket-flow 3.0.1
    MAL-2026-6334 ghsa-malware, amazon-inspector
  • npm
    ts-predict-helper 3.7.1, 3.7.0
    MAL-2026-6322 amazon-inspector, ghsa-malware
  • npm
    ts-arithmetic-helper 3.7.2
    MAL-2026-6315 amazon-inspector, ghsa-malware
  • npm
    chalk-ultra 12.0.3, 12.0.15, 12.0.14
    MAL-2026-6300 amazon-inspector, ghsa-malware
  • npm
    analysis-chart 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16, 2.0.17, 2…
    MAL-2026-6299 amazon-inspector, reversing-labs, ghsa-malware
  • npm
    hashd-edu 1.0.5, 1.0.0, 1.0.4, 1.0.1, 1.0.2
    MAL-2026-6302 amazon-inspector, ghsa-malware
  • npm
    date-format-helper2 1.0.3, 1.0.7, 1.0.6, 1.0.2, 1.0.4, 1.0.5, 1.0.0
    MAL-2026-6301 amazon-inspector, ghsa-malware
  • npm
    react-simple-utils-kit 1.3.2, 1.2.2, 1.0.2, 1.4.2, 1.3.3, 1.3.1, 1.0.5, 1.0.1, 1.3.0, 1.4.0, 1.1.0, 1.…
    MAL-2026-6303 amazon-inspector, ghsa-malware
  • npm
    @outmarket/utils 9.9.9, 9.9.10, 9.9.11
    MAL-2026-6292 amazon-inspector, reversing-labs
  • npm
    @outmarket/ui 9.9.9
    MAL-2026-6291 amazon-inspector
  • npm
    airbnb-airlock 99.0.0
    MAL-2026-6293 amazon-inspector, reversing-labs
  • npm
    ttal2ttml 99.0.1, 99.0.3, 99.0.2, 1.0.4
    MAL-2026-6298 amazon-inspector, ghsa-malware