Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,431 npm 223,271 PyPI 12,011 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,271 reports · Feed

  • npm
    ai-workshop-radio-app 100.0.0
    MAL-2026-17428 amazon-inspector 2 IOCs
  • npm
    ai-workshop-maa15-radio 100.0.0
    MAL-2026-17427 amazon-inspector 2 IOCs
  • npm
    okra-cloud-cdk 100.0.0
    MAL-2026-17436 amazon-inspector 2 IOCs
  • npm
    @cat-gen/material 1.0.1, 1.0.0, 1.0.2
    MAL-2026-17334 ghsa-malware, amazon-inspector
  • npm
    @cat-gen/materia 1.0.0
    MAL-2026-17333 ghsa-malware, amazon-inspector
  • npm
    @firelordzuka/pulse-poc all versions
    MAL-2026-17335 ghsa-malware
  • npm
    link-status-page 0.0.47, 0.0.38, 0.0.42, 0.0.2, 0.0.50, 0.0.56, 0.0.54, 0.0.45, 0.0.40, 0.0.52, …
    MAL-2026-17338 ghsa-malware, amazon-inspector
  • npm
    link-age-great all versions
    MAL-2026-17337 ghsa-malware
  • npm
    @redman89405/my-module 1.0.0, 1.1.0
    MAL-2026-17336 ghsa-malware, amazon-inspector
  • npm
    runhelper 1.0.0
    MAL-2026-17332 amazon-inspector
  • npm
    iban-validator-js all versions
    MAL-2026-17331 ghsa-malware
  • npm
    focaleys 1.1.0
    MAL-2026-17329 amazon-inspector
  • npm
    fca-raihan 37.2.5, 37.2.6
    MAL-2026-17328 amazon-inspector
  • npm
    exiouss 5.0.1
    MAL-2026-17327 amazon-inspector
  • npm
    imgbundle 1.0.0, 1.0.1, 1.0.2
    MAL-2026-17330 amazon-inspector, ghsa-malware
  • npm
    contoso-login-sim-loader 1.0.1
    MAL-2026-17322 amazon-inspector
  • npm
    cdn-img-fetch 1.0.0, 1.0.1, 1.0.3
    MAL-2026-17320 amazon-inspector, ghsa-malware
  • npm
    cortana-md-engine 1.4.6
    MAL-2026-17323 amazon-inspector
  • npm
    chaienv 1.0.2
    MAL-2026-17321 amazon-inspector
  • npm
    booking-eligibility 1.0.0
    MAL-2026-17316 amazon-inspector
  • npm
    developmentstelemetry 1.0.2, 1.0.1
    MAL-2026-17318 amazon-inspector
  • npm
    booking-tasks 1.0.2
    MAL-2026-17317 amazon-inspector
  • npm
    pixsvg 0.2.0
    MAL-2026-17313 amazon-inspector
  • npm
    json-bigint-rs 0.1.1
    MAL-2026-17312 amazon-inspector
  • npm
    test-supply-npm-lib-4 3.3.3, 3.3.4, 3.3.6, 3.3.5
    MAL-2026-17314 amazon-inspector
  • npm
    itsmeeaizat-bailey 1.0.4, 1.0.3, 1.0.5
    MAL-2026-17311 amazon-inspector, ghsa-malware
  • npm
    esm-dotenv 1.0.1
    MAL-2026-17305 amazon-inspector
  • npm
    stestenv 1.0.1
    MAL-2026-17309 amazon-inspector
  • npm
    tailwind-forms-kit 0.5.1, 0.5.3, 0.5.5
    MAL-2026-17310 amazon-inspector, ghsa-malware
  • npm
    fabric-mod-utils 1.0.0
    MAL-2026-17307 amazon-inspector
  • npm
    mfahelper 1.0.0
    MAL-2026-17308 amazon-inspector, ghsa-malware
  • npm
    solidity-lock 2.21.0
    MAL-2026-17302 amazon-inspector
  • npm
    web-vitals-polyfill-core-v1 1.0.0
    MAL-2026-17303 amazon-inspector, ghsa-malware
  • npm
    fs-commons 1.0.1
    MAL-2026-17301 amazon-inspector
  • npm
    common-fs 1.0.0
    MAL-2026-17300 amazon-inspector
  • npm
    test-agency-assignment-01 1.0.5
    MAL-2026-17296 amazon-inspector
  • npm
    test-agency-assignment-02 1.0.5
    MAL-2026-17297 amazon-inspector
  • npm
    test-agency-assign 1.0.4
    MAL-2026-17295 amazon-inspector
  • npm
    testosu8887 1.0.1
    MAL-2026-17299 amazon-inspector
  • npm
    testosu888 1.0.0
    MAL-2026-17298 amazon-inspector