Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,431 npm 223,271 PyPI 12,011 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,271 reports · Feed

npm
ui.dist.min.js all versions
MAL-2026-17460 ghsa-malware

Oct 2, 2026
npm
ui-base-colors all versions
MAL-2026-17459 ghsa-malware

Oct 2, 2026
npm
translate-base-font 1.4.2
MAL-2026-17458 ghsa-malware, amazon-inspector

Oct 2, 2026
npm
@smwebserver/static 99.9.1
MAL-2026-17456 ossf-package-analysis, amazon-inspector, ghsa-malware

Oct 2, 2026
npm
kartykgithub-ph-f 1.0.0
MAL-2026-17426 ghsa-malware

Oct 2, 2026
npm
kartykgithub-ph-e 1.0.0
MAL-2026-17425 ghsa-malware

Oct 2, 2026
npm
kartykgithub-ph-b 1.0.0, 0.0.1-security.0, 0.0.1-security
MAL-2026-17424 ghsa-malware

Oct 2, 2026
npm
wailib 1.0.0
MAL-2026-17451

Oct 1, 2026
npm
mikuhostt-baileys 1.0.0, 1.0.1, 1.0.2
MAL-2026-17447

Oct 1, 2026
npm
danz-bails 1.0.0, 1.1.0
MAL-2026-17444

Oct 1, 2026
npm
illusion-datalab 1.1.5, 1.1.4, 1.1.3, 1.1.2, 1.1.1
MAL-2026-17423 ghsa-malware

Oct 1, 2026
npm
@kelvdra/baileys 1.0.6-rc.1, 1.0.6, 1.0.5-rc.3, 1.0.6-rc.4, 1.0.6-rc.5, 1.0.6-rc.2, 1.0.6-rc.6, …
MAL-2026-17362 amazon-inspector

Oct 1, 2026
npm
@bottino/baileys 1.0.14, 1.0.13, 1.0.12, 1.0.11, 1.0.10, 1.0.9, 1.0.8, 1.0.7, 1.0.6, 1.0.5, 1.0.…
MAL-2026-17351 amazon-inspector, ghsa-malware

Oct 1, 2026
npm
online-header 99.0.0
MAL-2026-17420 ossf-package-analysis, amazon-inspector

Oct 1, 2026
npm
@bluewin/utils 1.0.0
MAL-2026-17437 amazon-inspector 2 IOCs

Oct 1, 2026
npm
com.epi.e2e_test 1.2.2
MAL-2026-17415 amazon-inspector

Sep 30, 2026
npm
xzvbails 0.0.1
MAL-2026-17411

Sep 30, 2026
npm
xvinleys 1.0.0
MAL-2026-17409

Sep 30, 2026
npm
syncxbails 1.0.1, 1.0.0
MAL-2026-17407

Sep 30, 2026
npm
spencer-baileys 1.0.4
MAL-2026-17406

Sep 30, 2026
npm
noxxleys 1.1.6, 1.1.5, 1.1.4, 1.1.2, 1.1.1, 1.1.0, 1.0.0
MAL-2026-17403

Sep 30, 2026
npm
noverojs 1.0.4, 1.0.1
MAL-2026-17401

Sep 30, 2026
npm
lilys-baileys 1.3.3, 1.3.2
MAL-2026-17398

Sep 30, 2026
npm
kasabaileys 1.0.2, 1.0.1, 1.0.0, 0.3.15
MAL-2026-17394

Sep 30, 2026
npm
ishumdz-bail 1.0.16, 1.0.15, 1.0.14, 1.0.13, 1.0.11, 1.0.10, 1.0.9, 1.0.8, 1.0.7, 1.0.6, 1.0…
MAL-2026-17393

Sep 30, 2026
npm
eliteprotech-baileys 1.1.2, 1.1.1, 1.1.0
MAL-2026-17391

Sep 30, 2026
npm
anuaja 1.1.1, 1.1.0, 1.0.0
MAL-2026-17386

Sep 30, 2026
npm
@nyzzpedia/baileys-new 1.0.0
MAL-2026-17370

Sep 30, 2026
npm
@noxleyss/baileys 1.1.10
MAL-2026-17369

Sep 30, 2026
npm
@lendkzn/xntaabail 7.0.0
MAL-2026-17364

Sep 30, 2026
npm
@japofc/baileys 2.4.3, 2.4.2, 2.4.1, 2.4.0, 2.3.0, 2.2.0, 2.1.0
MAL-2026-17359

Sep 30, 2026
npm
@hanzofc/baileys 7.0.1, 7.0.0
MAL-2026-17354

Sep 30, 2026
npm
reactjs-risk 99.17.1, 99.17.2, 99.9.9, 99.17.4, 99.12.0, 99.17.0
MAL-2026-17339 ossf-package-analysis, amazon-inspector

Sep 30, 2026
npm
niksinnkatalapp 100.0.0
MAL-2026-17435 amazon-inspector 2 IOCs

Sep 30, 2026
npm
live-detection-dashboard 100.0.0
MAL-2026-17434 amazon-inspector 2 IOCs

Sep 30, 2026
npm
figma-to-apl 100.0.0
MAL-2026-17433 amazon-inspector 2 IOCs

Sep 30, 2026
npm
brioche-apl-dev-env 100.0.0
MAL-2026-17432 amazon-inspector 2 IOCs

Sep 30, 2026
npm
apl-rive-renderer 100.0.0
MAL-2026-17431 amazon-inspector 2 IOCs

Sep 30, 2026
npm
alexa-cybertron-team-code-review-agent 100.0.0
MAL-2026-17430 amazon-inspector 2 IOCs

Sep 30, 2026
npm
ai-workshop-radio-lambda 100.0.0
MAL-2026-17429 amazon-inspector 2 IOCs

Sep 30, 2026