Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,408 npm 223,266 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

223,266 reports · Feed

  • npm
    ksp-client-registry 100.100.100, 100.100.101
    MAL-2026-17771 amazon-inspector
  • npm
    another-very-long-name 2.0.0, 1.0.1, 2.0.1, 1.1.0
    MAL-2026-17767 amazon-inspector
  • npm
    some-very-long-package-name 2.0.0, 1.0.0, 3.0.0, 2.0.1, 99.0.1
    MAL-2026-17778 amazon-inspector
  • npm
    nested-lib 1.0.0, 1.0.1, 1.1.0
    MAL-2026-17773 amazon-inspector
  • npm
    pay-methods-kmf 100.100.102, 100.100.100, 100.100.101
    MAL-2026-17776 amazon-inspector
  • npm
    cloudflare_module 3.0.0, 1.0.1, 1.0.0, 99.0.1
    MAL-2026-17768 amazon-inspector
  • npm
    @coopeuch/button 1.999.999
    MAL-2026-17759 amazon-inspector, ghsa-malware
  • npm
    deposit-limit-fe 100.100.106, 100.100.101, 100.100.102
    MAL-2026-17769 amazon-inspector
  • npm
    nitro-cjs-requirer 1.0.0, 0.0.1, 1.1.0, 2.0.0, 99.0.1, 3.0.0
    MAL-2026-17775 amazon-inspector
  • npm
    @coopeuch/config 1.999.999
    MAL-2026-17762 amazon-inspector, ghsa-malware
  • npm
    nitro-bundled-dep 99.0.1, 2.0.1, 1.1.0, 0.0.1, 1.0.0
    MAL-2026-17774 amazon-inspector
  • npm
    orderly-plugin-liquidity-heatmap 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.6, 0.0.0-stage
    MAL-2026-17848 ghsa-malware, amazon-inspector
  • npm
    react-dropzone-v4 99.0.0
    MAL-2026-17758 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    @library-wide/library-shell 99.9.1
    MAL-2026-17754 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    passwordcracker 1.1.1, 1.0.0
    MAL-2026-17864 amazon-inspector, ghsa-malware 5 IOCs
  • npm
    passwordcrackv2 1.1.1, 1.1.0
    MAL-2026-17865 amazon-inspector, ghsa-malware 5 IOCs
  • npm
    @fer2809fl/baileys 7.0.7, 7.0.6, 7.0.5, 7.0.4, 7.0.2, 7.0.1, 7.0.0, 7.0.0-rc13, 1.4.9, 1.4.7, 1.4.…
    MAL-2026-17750 ghsa-malware
  • npm
    cloud-baileys 1.1.42, 1.1.41, 1.1.40, 1.1.39, 1.1.38, 1.1.37, 1.1.36, 1.1.35, 1.1.34, 1.1.33,…
    MAL-2026-17751 ghsa-malware
  • npm
    arsya-baileys 9.2.0, 9.2.2, 9.2.4, 9.2.1, 9.2.3
    MAL-2026-17387 ghsa-malware
  • npm
    @myorder-frontend-commons/analytics 99.0.0, 10.0.0, 3.0.0, 1.0.0, 1.2.0, 0.0.1, 2.0.0, 0.1.0, 5.0.0, 0.2.0, 1.1.0, …
    MAL-2026-17749 ossf-package-analysis, amazon-inspector, ghsa-malware 3 IOCs
  • npm
    kmf-i18n 100.100.102, 100.100.101, 100.100.100
    MAL-2026-17747 ossf-package-analysis, amazon-inspector
  • npm
    test-account-portal-fe 100.100.102, 100.100.100, 100.100.101
    MAL-2026-17748 ossf-package-analysis, amazon-inspector
  • npm
    kmf-bootstrap 100.100.102, 100.100.103, 100.100.106, 100.100.101, 100.100.100
    MAL-2026-17746 ossf-package-analysis, amazon-inspector
  • npm
    bungoma 1.1.0, 1.0.1, 1.0.0
    MAL-2026-17389 amazon-inspector, ghsa-malware
  • npm
    @bellaxchuu/teambails 1.1.9, 1.1.8, 1.1.6, 1.1.4, 1.2.4
    MAL-2026-17348 amazon-inspector
  • npm
    @tunstock/remact-dom 19.2.0
    MAL-2026-17745 amazon-inspector
  • npm
    kmf-vendor-pack 99.0.0, 100.100.101, 100.100.100, 100.100.106
    MAL-2026-17744 ossf-package-analysis, amazon-inspector 2 IOCs
  • npm
    tailwind-animatecss-form all versions
    MAL-2026-17743 ghsa-malware
  • npm
    hanncap all versions
    MAL-2026-17740 ghsa-malware
  • npm
    asepxyz-baileys all versions
    MAL-2026-17733 ghsa-malware
  • npm
    razamodsxasepxyz all versions
    MAL-2026-17742 ghsa-malware
  • npm
    pahinuy all versions
    MAL-2026-17741 ghsa-malware
  • npm
    asepxyzz all versions
    MAL-2026-17739 ghsa-malware
  • npm
    asepxyzxrazamodsnew-baileys all versions
    MAL-2026-17738 ghsa-malware
  • npm
    asepxyznew all versions
    MAL-2026-17737 ghsa-malware
  • npm
    asepxyz12 all versions
    MAL-2026-17736 ghsa-malware
  • npm
    asepxyz-signal all versions
    MAL-2026-17735 ghsa-malware
  • npm
    asepxyz-eslint-config all versions
    MAL-2026-17734 ghsa-malware
  • npm
    asepxyz all versions
    MAL-2026-17732 ghsa-malware
  • npm
    @aseppxyzz12/baileys all versions
    MAL-2026-17731 ghsa-malware