Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,168 npm 223,991 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,991 reports · Feed

  • npm
    kdrive-utils 99.9.9
    MAL-2026-6295 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    cue-mcp 9999.99.99
    MAL-2026-6294 amazon-inspector
  • npm
    tree-sitter-forth 9999.99.99
    MAL-2026-6297 amazon-inspector
  • npm
    myebaynode 99.0.0
    MAL-2026-6296 amazon-inspector, reversing-labs
  • npm
    poly-utils 1.0.0
    MAL-2026-6287 ghsa-malware, amazon-inspector
  • npm
    new-solt-1 0.0.9
    MAL-2026-6286 ghsa-malware, amazon-inspector
  • npm
    new-solt 0.0.7, 0.0.8, 0.0.9
    MAL-2026-6285 ghsa-malware, amazon-inspector
  • npm
    new-helper 5.8.1
    MAL-2026-6284 ghsa-malware, amazon-inspector
  • npm
    new-ecro-helper 5.8.0
    MAL-2026-6283 ghsa-malware, amazon-inspector
  • npm
    ts-numbering 1.0.0
    MAL-2026-6288 ghsa-malware, amazon-inspector
  • npm
    local-ip-helper 0.1.0
    MAL-2026-6282 ghsa-malware, amazon-inspector
  • npm
    libsignal-node-travatiger 1.0.0, 1.0.1
    MAL-2026-6281 ghsa-malware, amazon-inspector
  • npm
    ts-wross 0.0.8, 0.0.7
    MAL-2026-6278 ghsa-malware, amazon-inspector
  • npm
    node-core-libs 1.0.0, 1.1.0
    MAL-2026-6276 ghsa-malware, amazon-inspector
  • npm
    search-from-search 999.99.99
    MAL-2026-6277 ghsa-malware, amazon-inspector
  • npm
    @ts-apis/ts-utils 1.0.0, 1.0.7, 1.0.9, 1.0.8, 1.0.5, 1.0.4, 1.0.6, 1.0.3, 1.1.0, 1.0.2, 1.0.1
    MAL-2026-6275 amazon-inspector, ghsa-malware
  • npm
    web3-token-helper 1.1.1, 1.2.1, 1.2.0, 1.0.1, 1.1.2, 1.1.3, 1.0.0, 2.0.1
    MAL-2026-6274 amazon-inspector, ghsa-malware
  • npm
    zod-pino 1.0.122, 1.0.123, 1.0.124, 1.0.126, 1.0.127, 1.0.125
    MAL-2026-6273 amazon-inspector, ghsa-malware
  • npm
    @variational/common-ui 1.1.0, 1.2.3, 1.0.1, 1.0.9, 1.0.6, 1.0.4, 1.0.3, 1.2.1, 1.0.2, 1.0.8, 1.2.2, 1.…
    MAL-2026-6272 amazon-inspector
  • npm
    node-fetch-utils 1.2.1, 1.2.5, 1.2.6, 1.2.3, 1.2.2, 1.2.4, 1.2.7, 1.3.0, 1.2.8
    MAL-2026-6271 amazon-inspector, ghsa-malware
  • npm
    vitest-cli 1.0.3, 1.0.7, 1.0.0, 1.0.9, 1.0.4
    MAL-2026-6267 amazon-inspector, ghsa-malware
  • npm
    zomato-mcp 1.0.0
    MAL-2026-6270 amazon-inspector
  • npm
    zomato-espresso 1.0.0
    MAL-2026-6269 amazon-inspector
  • npm
    zomato-core 1.0.0
    MAL-2026-6268 amazon-inspector
  • npm
    sn-internal-testjgsakjdkjadkjah 2.1.6, 2.1.4, 2.1.5, 2.1.3, 2.1.2
    MAL-2026-6265 amazon-inspector
  • npm
    test-package-sajsdkashdj 2.1.6, 2.1.7
    MAL-2026-6266 amazon-inspector
  • npm
    search-from-feed 999.0.0
    MAL-2026-6264 amazon-inspector
  • npm
    gd-auth-client 999.0.0
    MAL-2026-6263 amazon-inspector
  • npm
    @zynkit/jwtbytes 0.5.1, 0.5.4, 0.5.2, 0.4.3, 0.5.3
    MAL-2026-6313 amazon-inspector, ghsa-malware
  • npm
    @tinyfox/shapecheck 0.8.5, 0.8.6, 0.8.7, 0.8.8, 0.7.4
    MAL-2026-6312 amazon-inspector, ghsa-malware
  • npm
    @thymelab/logfx 2.15.3, 2.15.6, 2.15.5, 2.15.4
    MAL-2026-6311 amazon-inspector, ghsa-malware
  • npm
    @petitcode/eb-retry 1.3.4, 1.3.5, 1.3.6, 1.3.3
    MAL-2026-6310 amazon-inspector, ghsa-malware
  • npm
    @nullzero/urlcat 1.4.1, 1.4.0, 1.4.2, 1.4.3, 1.4.4, 1.4.5
    MAL-2026-6309 amazon-inspector
  • npm
    @lazyutil/dater 0.9.2, 0.8.1, 0.9.4, 0.9.5, 0.9.3
    MAL-2026-6308 amazon-inspector, ghsa-malware
  • npm
    @glitchpad/throttler 2.2.4, 2.2.3, 2.2.2, 2.2.1, 2.1.1
    MAL-2026-6307 amazon-inspector, ghsa-malware
  • npm
    @frostnode/waitfor 0.9.0, 0.10.4, 0.10.3, 0.10.5, 0.10.6
    MAL-2026-6305 amazon-inspector, ghsa-malware
  • npm
    forge-jsx4 1.0.122
    MAL-2026-6279 amazon-inspector
  • npm
    respects-switch 999.0.0
    MAL-2026-6259 amazon-inspector, ghsa-malware
  • npm
    onboarding-respects-modal 999.99.99
    MAL-2026-6258 amazon-inspector, ghsa-malware
  • npm
    crud-respect 999.99.99
    MAL-2026-6257 amazon-inspector, ghsa-malware