Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,458 npm 223,292 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,292 reports · Feed

  • npm
    strapi-plugin-vinsoc-1109 3.6.8
    MAL-2026-16126 ossf-package-analysis, amazon-inspector
  • npm
    pinochiomathm 2.3.4, 2.3.3, 2.3.2, 2.3.5
    MAL-2026-16123 amazon-inspector
  • npm
    tailwindcss-contact-forms 0.5.8, 0.5.6, 0.5.5, 0.5.4, 0.5.9, 0.6.0, 0.5.7, 0.6.1, 0.6.2
    MAL-2026-16124 amazon-inspector
  • npm
    etoro-cashout 999.0.0, 99.0.0, 99.0.2
    MAL-2026-16117 amazon-inspector
  • npm
    etoro-builders 999.0.0
    MAL-2026-16116 amazon-inspector
  • npm
    etoro-aggregator 999.0.0, 99.0.2, 99.0.0
    MAL-2026-16111 amazon-inspector
  • npm
    etoro-analytics 999.0.0, 99.0.0, 99.0.2
    MAL-2026-16112 amazon-inspector
  • npm
    etoro-api 999.0.0
    MAL-2026-16113 amazon-inspector
  • npm
    etoro-client 999.0.0
    MAL-2026-16119 amazon-inspector
  • npm
    etoro-core 999.0.0
    MAL-2026-16120 amazon-inspector
  • npm
    etoro-charts 999.0.0, 99.0.0
    MAL-2026-16118 amazon-inspector
  • npm
    etoro-auth 999.0.0, 99.0.0
    MAL-2026-16114 amazon-inspector, ossf-package-analysis
  • npm
    etoro-billing 999.0.0
    MAL-2026-16115 amazon-inspector
  • npm
    @nexustechpro/baileys 2.2.7, 2.2.5, 2.2.4
    MAL-2026-16104 amazon-inspector, ghsa-malware
  • npm
    @neroxkira/vangal-baileys 1.0.0, 1.0.1
    MAL-2026-16103 amazon-inspector
  • npm
    @sahril2nd/baileys 1.0.21
    MAL-2026-16105 amazon-inspector
  • npm
    @auction-fe/ui-kit 9.9.3, 9.9.1
    MAL-2026-16109 ghsa-malware, amazon-inspector
  • npm
    @auction-fe/reporting-system all versions
    MAL-2026-16108 ghsa-malware
  • npm
    @auction-fe/portal all versions
    MAL-2026-16107 ghsa-malware
  • npm
    @auction-fe/base all versions
    MAL-2026-16106 ghsa-malware
  • npm
    @convertics/script 0.3.0, 0.2.0, 0.4.0, 0.1.0, 1.0.0, 0.2.1
    MAL-2026-16110 ghsa-malware, amazon-inspector
  • npm
    mfatest2 1.0.0
    MAL-2026-16102 amazon-inspector
  • npm
    mfaby 1.0.0
    MAL-2026-16101 amazon-inspector
  • npm
    discord-mfa-solver 1.0.2, 1.0.1, 1.0.0, 1.0.3
    MAL-2026-16100 amazon-inspector, ghsa-malware
  • npm
    matrixkit-js 1.0.0
    MAL-2026-16095 amazon-inspector
  • npm
    gmgn-trading-kit 1.7.0, 1.7.1, 1.7.2
    MAL-2026-16094 amazon-inspector
  • npm
    twilio-hackerone-poc-b8f21a 1.0.1, 1.0.0
    MAL-2026-16097 amazon-inspector
  • npm
    soltinel-pro 0.2.1, 0.2.2, 0.2.0
    MAL-2026-16096 amazon-inspector
  • npm
    sams-text-style all versions
    MAL-2026-16091 ghsa-malware
  • npm
    sams-run-style all versions
    MAL-2026-16090 ghsa-malware
  • npm
    graphql-js-client-transform 6.14.0
    MAL-2026-16086 ghsa-malware, reversing-labs
  • npm
    @staticj/cropperxmjs 1.6.0
    MAL-2026-16081 amazon-inspector
  • npm
    @umschool/platform 999.0.2, 999.0.1, 999.0.0
    MAL-2026-16082 amazon-inspector
  • npm
    vinnleys 1.0.0, 1.0.1
    MAL-2026-16092 ghsa-malware, amazon-inspector
  • npm
    xbailsync 1.0.4, 1.0.6, 1.0.5, 1.0.1, 1.0.3, 1.0.0, 2.0.0, 1.0.2, 1.0.7
    MAL-2026-16093 ghsa-malware, amazon-inspector
  • npm
    amprem-activator 1.0.0, 1.0.2, 1.0.1
    MAL-2026-16084 ghsa-malware, amazon-inspector
  • npm
    @vnxsync/libsignal-node all versions
    MAL-2026-16083 ghsa-malware
  • npm
    raydium-clmm-sdk 0.0.1, 0.0.2
    MAL-2026-16089 ghsa-malware 2 IOCs
  • npm
    pumpswap-sdk-v1 0.0.1
    MAL-2026-16088 ghsa-malware 2 IOCs
  • npm
    polygon-toolkits-validator 1.1.4
    MAL-2026-16087 ghsa-malware, amazon-inspector 2 IOCs