Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 241,168 npm 223,991 PyPI 12,027 RubyGems 4,320 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,991 reports · Feed

  • npm
    @mastra/clickhouse 1.10.1
    MAL-2026-5942 ghsa-malware, amazon-inspector
  • npm
    @mastra/inngest 1.5.2
    MAL-2026-5951 ghsa-malware, amazon-inspector
  • npm
    @mastra/braintrust 1.1.4
    MAL-2026-5941 ghsa-malware, amazon-inspector
  • npm
    @mastra/rag 2.2.2
    MAL-2026-5961 ghsa-malware, amazon-inspector
  • npm
    @mastra/mongodb 1.9.3
    MAL-2026-5957 ghsa-malware, amazon-inspector
  • npm
    @mastra/fastify 1.3.31
    MAL-2026-5949 ghsa-malware, amazon-inspector
  • npm
    @mastra/mcp-docs-server 1.1.47
    MAL-2026-5956 ghsa-malware, amazon-inspector
  • npm
    @mastra/langsmith 1.2.4
    MAL-2026-5953 ghsa-malware, amazon-inspector
  • npm
    @mastra/sentry 1.1.4
    MAL-2026-5964 ghsa-malware, amazon-inspector
  • npm
    @mastra/s3 0.5.3
    MAL-2026-5962 ghsa-malware, amazon-inspector
  • npm
    @mastra/fastembed 1.1.3
    MAL-2026-5948 ghsa-malware, amazon-inspector
  • npm
    @mastra/auth 1.0.3
    MAL-2026-5940 ghsa-malware, amazon-inspector
  • npm
    @mastra/hono 1.4.26
    MAL-2026-5950 ghsa-malware, amazon-inspector
  • npm
    @mastra/datadog 1.2.5
    MAL-2026-5943 ghsa-malware, amazon-inspector
  • npm
    @mastra/editor 0.11.3
    MAL-2026-5946 ghsa-malware, amazon-inspector
  • npm
    @mastra/otel-bridge 1.2.3
    MAL-2026-5958 ghsa-malware, amazon-inspector
  • npm
    @mastra/dynamodb 1.0.9
    MAL-2026-5945 ghsa-malware, amazon-inspector
  • npm
    @mastra/duckdb 1.4.3
    MAL-2026-5944 ghsa-malware, amazon-inspector
  • npm
    @mastra/schema-compat 1.2.12
    MAL-2026-5963 ghsa-malware, amazon-inspector
  • npm
    @mastra/evals 1.3.1
    MAL-2026-5947 ghsa-malware, amazon-inspector
  • npm
    @mastra/langfuse 1.3.6
    MAL-2026-5952 ghsa-malware, amazon-inspector
  • npm
    @mastra/ai-sdk 1.4.6
    MAL-2026-5939 ghsa-malware, amazon-inspector
  • npm
    @mastra/pg 1.13.1
    MAL-2026-5959 ghsa-malware, amazon-inspector
  • npm
    @mastra/mcp 1.10.1
    MAL-2026-5955 ghsa-malware, amazon-inspector
  • npm
    @mastra/libsql 1.13.1
    MAL-2026-5954 ghsa-malware, amazon-inspector
  • npm
    mastra 1.13.1
    MAL-2026-5965 ghsa-malware, amazon-inspector
  • npm
    abuden21 1.7.7, 2.0.0, 1.1.7
    MAL-2026-5937 amazon-inspector, ghsa-malware
  • npm
    speed4 1.1.7, 2.0.0
    MAL-2026-5938 amazon-inspector, ghsa-malware
  • npm
    backoffice-charges-module 1.999.0, 2.999.1, 2.999.0
    MAL-2026-5929 amazon-inspector, ghsa-malware
  • npm
    bubblestr 1.1.4
    MAL-2026-5930 amazon-inspector, ghsa-malware
  • npm
    tw-theme-kit 1.1.0, 1.0.1
    MAL-2026-5935 amazon-inspector, ghsa-malware
  • npm
    vite-config-field 1.1.2, 1.1.3, 1.1.0, 1.1.1, 1.1.4, 1.1.5
    MAL-2026-5936 amazon-inspector, ghsa-malware
  • npm
    react-vite-assert 1.4.1
    MAL-2026-5933 amazon-inspector
  • npm
    ssr-auth-sync 1.6.16
    MAL-2026-5934 amazon-inspector, ghsa-malware
  • npm
    package-uploader 1.3.25
    MAL-2026-5932 amazon-inspector, ghsa-malware
  • npm
    mci-sdk 1.2.8, 1.2.10, 1.2.9, 1.2.11, 1.2.12, 1.2.13
    MAL-2026-5931 amazon-inspector, ghsa-malware
  • npm
    chai-test-mocks 1.2.0
    MAL-2026-5928 amazon-inspector
  • npm
    aillmgen 4.0.2
    MAL-2026-5927 amazon-inspector, ghsa-malware
  • npm
    @kalipto/local 1.0.0, 1.0.2, 1.0.3, 1.0.1
    MAL-2026-5922 amazon-inspector, ghsa-malware
  • npm
    test-copppss 1.999.0
    MAL-2026-5926 amazon-inspector