Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,431 npm 223,271 PyPI 12,011 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,271 reports · Feed

  • npm
    tostpro 100.6.0, 100.2.0, 100.7.0, 99.101.0, 112.5.9, 99.100.0, 99.99.99
    MAL-2026-17564 amazon-inspector, ghsa-malware
  • npm
    @inpeek/odata 99.99.102, 99.99.100, 99.99.99, 99.99.101
    MAL-2026-17542 amazon-inspector, ghsa-malware
  • npm
    @inpeek/odata-angular 99.99.102, 99.99.101, 99.99.100, 99.99.99
    MAL-2026-17543 amazon-inspector, ghsa-malware
  • npm
    @angjlar/core 22.2.1
    MAL-2026-17534 amazon-inspector
  • npm
    hardhat-spack 3.0.2
    MAL-2026-17560 amazon-inspector
  • npm
    @angulaar/core 22.2.1
    MAL-2026-17537 amazon-inspector
  • npm
    @anguar/core 22.2.1
    MAL-2026-17535 amazon-inspector
  • npm
    @abgular/core 22.2.1
    MAL-2026-17532 amazon-inspector
  • npm
    @angulr/core 22.2.1
    MAL-2026-17538 amazon-inspector
  • npm
    @anuglar/core 22.2.1
    MAL-2026-17541 amazon-inspector
  • npm
    @anngular/core 22.2.1
    MAL-2026-17540 amazon-inspector
  • npm
    @angupar/core 22.2.1
    MAL-2026-17539 amazon-inspector
  • npm
    internallib_v923 1.0.3
    MAL-2026-17562 amazon-inspector
  • npm
    @qngular/core 22.2.1
    MAL-2026-17544 amazon-inspector
  • npm
    @angulaar/cli 22.2.1
    MAL-2026-17536 amazon-inspector
  • npm
    @anfular/core 22.2.1
    MAL-2026-17533 amazon-inspector
  • npm
    api-nebula 1.0.0
    MAL-2026-17531 amazon-inspector, ghsa-malware
  • npm
    dotenv-async 1.0.0
    MAL-2026-17504 amazon-inspector, ghsa-malware
  • npm
    dotenv-promises 1.0.0
    MAL-2026-17505 amazon-inspector
  • npm
    a11y-tabindex-manager 1.0.0
    MAL-2026-17501 amazon-inspector
  • npm
    dom-focus-sentinel 1.0.0
    MAL-2026-17503 amazon-inspector
  • npm
    hardhat-roof 2.21.0
    MAL-2026-17509 amazon-inspector
  • npm
    hardhat-plus 2.21.0
    MAL-2026-17508 amazon-inspector
  • npm
    hardhat-ftp 2.0.1
    MAL-2026-17506 amazon-inspector
  • npm
    hardhat-jsx 2.0.1
    MAL-2026-17507 amazon-inspector
  • npm
    internallib_v275 1.0.3
    MAL-2026-17510 amazon-inspector, ghsa-malware
  • npm
    lite-matte 1.0.0
    MAL-2026-17512 amazon-inspector
  • npm
    lite-matterr 1.0.0
    MAL-2026-17513 amazon-inspector
  • npm
    lite-mater 1.0.0
    MAL-2026-17511 amazon-inspector
  • npm
    oleh-modal 1.0.0
    MAL-2026-17516 amazon-inspector
  • npm
    minimal-a11y-contrast-check 1.0.0
    MAL-2026-17514 amazon-inspector
  • npm
    monitoring-agent 1.0.1
    MAL-2026-17515 amazon-inspector, ghsa-malware
  • npm
    postcss-gap-fallback-util 1.0.0
    MAL-2026-17518 amazon-inspector
  • npm
    popover-anchor-polyfill 1.0.0
    MAL-2026-17517 amazon-inspector
  • npm
    tiny-viewport-unit-calc 1.0.0
    MAL-2026-17528 amazon-inspector
  • npm
    promises-dotenv3 1.0.0
    MAL-2026-17519 amazon-inspector
  • npm
    rgx33-css-grid-utils 1.0.0
    MAL-2026-17520 amazon-inspector
  • npm
    studiocode_tools 1.0.1
    MAL-2026-17523 amazon-inspector
  • npm
    studiocode_eligibility 1.0.1
    MAL-2026-17522 amazon-inspector
  • npm
    rgx33-flex-layout-core 1.0.0
    MAL-2026-17521 amazon-inspector