Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,432 npm 223,271 PyPI 12,012 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,271 reports · Feed

  • npm
    tailwindcss-forms-ui 0.5.2
    MAL-2026-16295 amazon-inspector
  • npm
    @shared-runtime/modules 9.9.10
    MAL-2026-16291 amazon-inspector
  • npm
    internallib_v949 1.0.3
    MAL-2026-16294 amazon-inspector, ghsa-malware
  • npm
    openmct-heatmap all versions
    MAL-2026-16287 ghsa-malware
  • npm
    test890-auth 1.0.0
    MAL-2026-16289 ghsa-malware, amazon-inspector
  • npm
    test89-auth 1.0.1
    MAL-2026-16288 ghsa-malware, amazon-inspector
  • npm
    test8999-auth 1.0.1
    MAL-2026-16286 ossf-package-analysis, ghsa-malware, amazon-inspector
  • npm
    test899-auth 1.0.1
    MAL-2026-16285 ossf-package-analysis, ghsa-malware, amazon-inspector
  • npm
    @shared-web/assets 9.9.10
    MAL-2026-16283 amazon-inspector
  • npm
    sinful 1.0.0
    MAL-2026-16284 ghsa-malware, amazon-inspector
  • npm
    tailwindcss-form 0.5.1
    MAL-2026-16282 amazon-inspector, ghsa-malware
  • npm
    @sanzoffc/baileys 3.0.4
    MAL-2026-16281 amazon-inspector, ghsa-malware
  • npm
    xzvbailsx 1.0.0
    MAL-2026-16279 amazon-inspector
  • npm
    xzvbailey 1.0.0
    MAL-2026-16278 amazon-inspector
  • npm
    xa424234657567 1.0.0
    MAL-2026-16277 amazon-inspector
  • npm
    zero-baileys 2.7.0, 3.2.0, 3.3.0, 3.3.5, 3.5.0, 2.5.5, 2.6.0, 3.6.0, 3.4.6
    MAL-2026-16280 amazon-inspector, ghsa-malware
  • npm
    @lekzo/baileys 0.0.1, 0.0.7
    MAL-2026-16276 amazon-inspector, ghsa-malware
  • npm
    blue-string-formatter-utils 1.0.0
    MAL-2026-16273 amazon-inspector
  • npm
    @tink/tink-link-core 9.9.10
    MAL-2026-16270 amazon-inspector
  • npm
    test89078-auth 99.99.99
    MAL-2026-16271 amazon-inspector
  • npm
    kartykgithub-multiversion-a 1.0.1, 1.0.0
    MAL-2026-16272 ghsa-malware
  • npm
    @kartyk-github-org/takedown-b all versions
    MAL-2026-16266 ghsa-malware
  • npm
    @kartyk-github-org/takedown-a all versions
    MAL-2026-16265 ghsa-malware
  • npm
    tailwindcss-form-ui 0.5.1, 0.5.8
    MAL-2026-16262 amazon-inspector, ghsa-malware
  • npm
    tailwindcss-form-utils 0.5.1, 0.5.9
    MAL-2026-16263 amazon-inspector, ghsa-malware
  • npm
    @railone/image-utils 1.1.10
    MAL-2026-16261 amazon-inspector
  • npm
    confx1789550882 1.0.0
    MAL-2026-16260 amazon-inspector
  • npm
    randompkge all versions
    MAL-2026-16259 ghsa-malware
  • npm
    randompkgd all versions
    MAL-2026-16258 ghsa-malware
  • npm
    randompkgc all versions
    MAL-2026-16257 ghsa-malware
  • npm
    randompkgb 1.0.1
    MAL-2026-16256 ghsa-malware, amazon-inspector
  • npm
    randompkga 1.0.9, 1.0.11, 1.0.4, 1.0.22, 1.0.15, 1.0.13, 1.0.16, 1.0.7, 1.0.14, 1.0.5, 1.0…
    MAL-2026-16255 ghsa-malware, amazon-inspector
  • npm
    pulse-pwn-9f3a2 1.0.0
    MAL-2026-16254 amazon-inspector, ghsa-malware
  • npm
    ragacateslikodi 1.0.6, 1.0.4, 1.0.3, 1.0.5, 1.0.1, 1.0.0, 1.0.2
    MAL-2026-16252 amazon-inspector, ghsa-malware
  • npm
    tailwindcss-contact-form 0.5.1, 0.5.5
    MAL-2026-16251 amazon-inspector, ghsa-malware
  • npm
    kartykgithub-takedown-b 1.0.0
    MAL-2026-16249 ghsa-malware
  • npm
    kartykgithub-takedown-a 1.0.2, 1.0.1, 1.0.3, 1.0.0
    MAL-2026-16248 ghsa-malware
  • npm
    laycot 1.3.10
    MAL-2026-16253 amazon-inspector 4 IOCs
  • npm
    pkg-rollback-dreed-viced-sonic-ponds all versions
    MAL-2026-16247 ghsa-malware
  • npm
    kartyk-github-token-pkg 1.0.4, 1.0.3
    MAL-2026-16246 ghsa-malware