Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,168 npm 223,991 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,991 reports · Feed

  • npm
    @mastra/client-js 1.24.1
    MAL-2026-6007 ghsa-malware, amazon-inspector
  • npm
    create-mastra 1.13.1
    MAL-2026-6050 ghsa-malware, amazon-inspector
  • npm
    @mastra/deployer 1.42.1
    MAL-2026-6015 ghsa-malware, amazon-inspector
  • npm
    @mastra/core 1.42.1
    MAL-2026-6011 ghsa-malware, amazon-inspector
  • npm
    metrics-probe-64b2 1.0.0
    MAL-2026-5981 amazon-inspector, ghsa-malware
  • npm
    metrics-probe-77d4 1.0.0
    MAL-2026-5982 amazon-inspector, ghsa-malware
  • npm
    metrics-probe-dc85 1.0.0
    MAL-2026-5983 amazon-inspector, ghsa-malware
  • npm
    pkg-telemetry-r4f9 1.0.0
    MAL-2026-5990 amazon-inspector, ghsa-malware
  • npm
    runtime-metrics-w7k2 1.0.0
    MAL-2026-5992 amazon-inspector, ghsa-malware
  • npm
    npm-sandbox-ping-r9t2 1.0.0
    MAL-2026-5986 amazon-inspector, ghsa-malware
  • npm
    gpu-accelerator 1.4.4, 1.4.6, 1.4.2, 1.4.7, 1.4.5, 1.4.3
    MAL-2026-5980 amazon-inspector, ghsa-malware
  • npm
    canary-ci-test 1.0.0
    MAL-2026-5972 amazon-inspector, ghsa-malware
  • npm
    nepublisher 0.4.0
    MAL-2026-5984 amazon-inspector
  • npm
    ts-webplug 3.0.5, 3.0.6, 3.0.8, 3.0.7
    MAL-2026-5994 amazon-inspector, ghsa-malware
  • npm
    params-valid-js 1.0.0, 1.0.3, 1.0.1
    MAL-2026-5988 amazon-inspector, reversing-labs
  • npm
    node-path-utils 1.23.2
    MAL-2026-5985 amazon-inspector, ghsa-malware
  • npm
    req-parmas-valid 1.0.2
    MAL-2026-5991 amazon-inspector, reversing-labs
  • npm
    sheratan_test_p 1.0.0
    MAL-2026-5993 amazon-inspector
  • npm
    pathfix 3.0.10, 3.0.11, 3.0.12
    MAL-2026-5989 amazon-inspector, ghsa-malware
  • npm
    ogd-analytics 1.0.0
    MAL-2026-5987 amazon-inspector
  • npm
    classbreeze-utils 0.7.8, 0.7.10, 0.7.9, 0.7.7
    MAL-2026-5973 amazon-inspector, ghsa-malware
  • npm
    easy-day-js 1.11.22
    MAL-2026-5979 amazon-inspector
  • npm
    @public-for-cdao/hooks 99.99.99
    MAL-2026-5971 ossf-package-analysis
  • npm
    cryptodao-contracts 99.99.99
    MAL-2026-5975 amazon-inspector
  • npm
    cryptodao-core 99.99.99
    MAL-2026-5976 amazon-inspector
  • npm
    cryptodao-bot 99.99.99
    MAL-2026-5974 amazon-inspector, ossf-package-analysis
  • npm
    cryptodao-utils 99.99.99
    MAL-2026-5978 amazon-inspector, ossf-package-analysis
  • npm
    cryptodao-signer 99.99.99
    MAL-2026-5977 amazon-inspector, ossf-package-analysis
  • npm
    @public-for-cdao/abi 99.99.99
    MAL-2026-10599 amazon-inspector, reversing-labs
  • npm
    @public-for-cdao/api 99.99.99
    MAL-2026-10600 amazon-inspector, reversing-labs
  • npm
    @public-for-cdao/token 99.99.99
    MAL-2026-10603 amazon-inspector, reversing-labs
  • npm
    @public-for-cdao/common 99.99.99
    MAL-2026-10601 amazon-inspector, reversing-labs
  • npm
    @public-for-cdao/config 99.99.99
    MAL-2026-10602 amazon-inspector, reversing-labs
  • npm
    @public-for-cdao/types 99.99.99
    MAL-2026-10604 amazon-inspector, reversing-labs
  • npm
    cryptodao-deploy 99.99.99
    MAL-2026-5968 ossf-package-analysis, amazon-inspector
  • npm
    cryptodao-config 99.99.99
    MAL-2026-5967 ossf-package-analysis, amazon-inspector
  • npm
    cryptodao-types 99.99.99
    MAL-2026-5970 ossf-package-analysis, amazon-inspector
  • npm
    cryptodao-backend 99.99.99
    MAL-2026-5966 ossf-package-analysis, amazon-inspector
  • npm
    cryptodao-sdk 99.99.99
    MAL-2026-5969 ossf-package-analysis, amazon-inspector
  • npm
    @mastra/posthog 1.0.29
    MAL-2026-5960 ghsa-malware