Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,432 npm 223,271 PyPI 12,012 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,271 reports · Feed

  • npm
    cisco-github-simple 1.0.1
    MAL-2026-16381 amazon-inspector
  • npm
    test-react-app-out 1.0.0
    MAL-2026-16375 ghsa-malware, amazon-inspector
  • npm
    test-react-app-in 1.0.0
    MAL-2026-16374 ghsa-malware, amazon-inspector
  • npm
    test-react-app-way 1.0.0
    MAL-2026-16376 ghsa-malware, amazon-inspector
  • npm
    @zig-design-system/react 99.0.0
    MAL-2026-16372 ghsa-malware, reversing-labs
  • npm
    wos-library 999.999.999, 99.0.0
    MAL-2026-16373 ghsa-malware, amazon-inspector, reversing-labs
  • npm
    @vite-tab/tabui 7.15.16
    MAL-2026-16371 ghsa-malware, amazon-inspector
  • npm
    @uol-afiliados/affiliated-config-lib 102.0.0
    MAL-2026-16370 amazon-inspector, ghsa-malware
  • npm
    math-universe 1.0.2, 1.0.0, 1.0.1
    MAL-2026-16367 ghsa-malware, amazon-inspector
  • npm
    mathsbase 1.0.2, 1.0.1, 1.0.0
    MAL-2026-16369 ghsa-malware, amazon-inspector
  • npm
    bytepack-probe-a7x3 1.0.0, 1.0.1
    MAL-2026-16364 amazon-inspector
  • npm
    mathmain 1.0.0
    MAL-2026-16368 ghsa-malware, amazon-inspector
  • npm
    blue-string-formatter-utilss 1.2.0
    MAL-2026-16363 amazon-inspector
  • npm
    my-ctf-helper-script-9921 1.0.0
    MAL-2026-16365 amazon-inspector, ghsa-malware
  • npm
    @asdfaskdjfksadhfkasf/nadaver2 102.0.0
    MAL-2026-16357 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    @uh-platform/nadaver 102.0.0
    MAL-2026-16360 amazon-inspector, ghsa-malware
  • npm
    @uh-platform/domain-widget 100.0.0
    MAL-2026-16359 amazon-inspector, ghsa-malware
  • npm
    @uh-platform/webcard 99.0.0
    MAL-2026-16362 amazon-inspector, ghsa-malware
  • npm
    @uh-platform/cloud 101.0.0
    MAL-2026-16358 amazon-inspector, ghsa-malware
  • npm
    @uh-platform/nadaver2 102.0.0
    MAL-2026-16361 amazon-inspector, ghsa-malware
  • npm
    gemini-computer-use 0.1.2, 0.4.3, 0.4.5
    MAL-2026-16355 amazon-inspector, ossf-package-analysis
  • npm
    @woodpecker-web-shared/components 2.20.5, 4.20.5, 1.20.4
    MAL-2026-16354 amazon-inspector, ghsa-malware
  • npm
    @baanx/blockchain-config 9.9.11, 9.9.9
    MAL-2026-16352 amazon-inspector, ghsa-malware
  • npm
    @baanx/abis 9.9.11, 9.9.9
    MAL-2026-16351 amazon-inspector, ghsa-malware
  • npm
    @insiderintelligence/componentlibrary 9.9.10
    MAL-2026-16353 amazon-inspector, ghsa-malware
  • npm
    bnppf-flag-icons 99.99.99
    MAL-2026-16350 amazon-inspector, ghsa-malware
  • npm
    hardhat-base 2.2.2, 2.2.0
    MAL-2026-16348 amazon-inspector
  • npm
    hardhat-devkit 2.3.6, 2.0.1
    MAL-2026-16349 amazon-inspector
  • npm
    pf23727 1.0.0
    MAL-2026-16338 amazon-inspector, ghsa-malware
  • npm
    pflag14570 1.0.0
    MAL-2026-16341 amazon-inspector, ghsa-malware
  • npm
    pflag29424 1.0.0
    MAL-2026-16342 amazon-inspector, ghsa-malware
  • npm
    pf25133 1.0.0
    MAL-2026-16339 amazon-inspector, ghsa-malware
  • npm
    keroeltopgg 99.99.99
    MAL-2026-16334 amazon-inspector
  • npm
    keroeltopkkk 99.99.99
    MAL-2026-16336 amazon-inspector
  • npm
    keroeltopkk 99.99.99
    MAL-2026-16335 amazon-inspector
  • npm
    my-cdn-script 1.0.0
    MAL-2026-16337 amazon-inspector
  • npm
    pf25262 1.0.0
    MAL-2026-16340 amazon-inspector, ghsa-malware
  • npm
    homestack-cheer 1.1.9, 1.1.8, 1.1.7, 1.1.6, 1.1.5, 1.1.3, 1.1.2, 1.1.1, 1.1.0, 1.0.2, 1.0.1, 1.…
    MAL-2026-16333 amazon-inspector, ghsa-malware
  • npm
    @asenfotech/unplugin-element-plus 2.9.5, 2.9.3
    MAL-2026-16318 amazon-inspector
  • npm
    feed-widget-helper 1.0.0, 1.0.8, 1.0.6
    MAL-2026-16332 amazon-inspector, ghsa-malware