Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,377 npm 223,238 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

223,238 reports · Feed

npm
nodecheck-health all versions
MAL-2026-19070 ghsa-malware

Nov 10, 2026
npm
moltbook-api-helper all versions
MAL-2026-19068 ghsa-malware

Nov 10, 2026
npm
leveldb-edit all versions
MAL-2026-19057 ghsa-malware

Nov 10, 2026
npm
@openyard/vetcode 0.3.1, 0.3.0
MAL-2026-19056 ghsa-malware

Nov 10, 2026
npm
@bestcoolman/dev-mcp all versions
MAL-2026-19052 ghsa-malware

Nov 9, 2026
npm
charape all versions
MAL-2026-19053 ghsa-malware

Nov 9, 2026
npm
react-bootstrap-table2-toolkit-bg all versions
MAL-2026-18799 ghsa-malware

Nov 9, 2026
npm
react-bootstrap-table-next-bg 9.9.9
MAL-2026-18798 ghsa-malware, amazon-inspector

Nov 9, 2026
npm
file-saver-bg 9.9.9
MAL-2026-18797 ghsa-malware, amazon-inspector

Nov 9, 2026
npm
archetype-index-sdk 1.0.0, 0.0.0-stage
MAL-2026-18796 ghsa-malware

Nov 9, 2026
npm
template-projection-map 99.1.3, 22.1.1
MAL-2026-18802 ghsa-malware, amazon-inspector

Nov 9, 2026
npm
template-cards 16.1.1
MAL-2026-18800 ghsa-malware, amazon-inspector

Nov 9, 2026
npm
template-pictogram 9.1.1
MAL-2026-18801 ghsa-malware, amazon-inspector

Nov 9, 2026
npm
@aaron205whitmore/postcss-animate-utils all versions
MAL-2026-18795 ghsa-malware

Nov 9, 2026
npm
dsh-ungate 0.2.3, 0.2.4
MAL-2026-18794 ghsa-malware

Nov 9, 2026
npm
focashi 1.1.0
MAL-2026-17392 ghsa-malware

Nov 9, 2026
npm
@liauto/linux-x64 all versions
MAL-2026-18793 ghsa-malware

Nov 9, 2026
npm
@liauto/darwin-arm64 all versions
MAL-2026-18791 ghsa-malware

Nov 9, 2026
npm
@liauto/linux-arm64 all versions
MAL-2026-18792 ghsa-malware

Nov 9, 2026
npm
@liauto/cli all versions
MAL-2026-18790 ghsa-malware

Nov 9, 2026
npm
@dikaaofficial/libsignal-node all versions
MAL-2026-18789 ghsa-malware

Nov 9, 2026
npm
@dikaaofficial/eslint-config all versions
MAL-2026-18788 ghsa-malware

Nov 9, 2026
npm
yonzofficial 2.1.3, 2.1.2, 2.1.1, 2.1.0
MAL-2026-17414 ghsa-malware

Nov 9, 2026
npm
@chatbridgeworld/baileys 0.0.0-stage, 1.0.0
MAL-2026-18787 ghsa-malware

Nov 9, 2026
npm
zhg.sql all versions
MAL-2026-18786 ghsa-malware

Nov 9, 2026
npm
gpa-core all versions
MAL-2026-18784 ghsa-malware

Nov 9, 2026
npm
@velliajs/telegram all versions
MAL-2026-18783 ghsa-malware

Nov 9, 2026
npm
winks.tunnelsql all versions
MAL-2026-18785 ghsa-malware

Nov 9, 2026
npm
@gqb333/based all versions
MAL-2026-18782 ghsa-malware

Nov 9, 2026
npm
@gqb333/baileys all versions
MAL-2026-18781 ghsa-malware

Nov 9, 2026
npm
@massnerder/x402-scraper-mcp 1.0.0
MAL-2026-18780 ossf-package-analysis

Nov 9, 2026
npm
@hello.nrfcloud.com/proto-map 18.0.0, 18.1.0
MAL-2026-18779 ghsa-malware

Nov 9, 2026
npm
u-chan-secrets 5.2.1, 5.2.2
MAL-2026-18777 ghsa-malware

Nov 9, 2026
npm
kafbail 2.0.14, 2.0.13, 2.0.12
MAL-2026-18774 ghsa-malware

Nov 9, 2026
npm
seolibs-package all versions
MAL-2026-18775 ghsa-malware

Nov 9, 2026
npm
@ethersphere/bee-js 13.3.0
MAL-2026-18773 ghsa-malware, amazon-inspector

Nov 9, 2026
npm
@htooayelwinict/travis234 3.3.2
MAL-2026-18757 ghsa-malware

Nov 8, 2026
npm
dsh-notify-focus 0.7.0, 0.5.0, 0.7.1
MAL-2026-18748 ghsa-malware

Nov 7, 2026
npm
@cherrydotfun/miniapp-sdk 0.1.22, 0.1.23
MAL-2026-18737 ghsa-malware

Nov 6, 2026
npm
tailwind-animationfound all versions
MAL-2026-18740 ghsa-malware

Nov 6, 2026