Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,458 npm 223,292 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,292 reports · Feed

  • npm
    crypto-validates 0.0.2
    MAL-2026-16085 ghsa-malware 2 IOCs
  • npm
    server-authorized-cleanup 1.1.0
    MAL-2026-16079 amazon-inspector
  • npm
    cache-cleanup-module 2.6.0, 2.5.0
    MAL-2026-16078 amazon-inspector
  • npm
    chai-as-sleek 7.1.2
    MAL-2026-16077 amazon-inspector
  • npm
    external_deps_enjoyer 1.0.0
    MAL-2026-16076 amazon-inspector
  • npm
    easypanel-agent 1.0.0
    MAL-2026-16072 amazon-inspector
  • npm
    cat-sis2go-utils 99.1.0, 99.0.0
    MAL-2026-16071 amazon-inspector 2 IOCs
  • npm
    easypanel-deploy 1.0.0
    MAL-2026-16074 amazon-inspector
  • npm
    easypanel-api-client 1.0.0
    MAL-2026-16073 amazon-inspector
  • npm
    easypanel-hosting 1.0.0
    MAL-2026-16075 amazon-inspector
  • npm
    @fyxzpediaa/baileys 8.1.2, 9.1.0
    MAL-2026-16070 amazon-inspector, ghsa-malware
  • npm
    reactlogo-load 1.0.0
    MAL-2026-16069 amazon-inspector, ghsa-malware
  • npm
    @versacode/baileys 1.4.5-beta.2, 1.4.5-beta.0, 1.4.5-beta.1
    MAL-2026-16068 ghsa-malware, amazon-inspector
  • npm
    @vallensofficial/baileys 10.0.0-beta.1, 9.4.6, 9.4.7
    MAL-2026-16067 ghsa-malware, amazon-inspector
  • npm
    @haimiya/baileys 9.4.6, 9.4.5
    MAL-2026-16066 ghsa-malware, amazon-inspector
  • npm
    @yongot/canary-mcp-isolation 1.0.1, 1.0.0, 1.0.2
    MAL-2026-16061 amazon-inspector
  • npm
    express-session-timer 1.0.0, 1.0.1, 1.0.13, 1.0.14, 1.0.16, 1.0.11, 1.0.15
    MAL-2026-16065 amazon-inspector
  • npm
    bx-ui-view 1.0.0
    MAL-2026-16064 amazon-inspector
  • npm
    @yongot/canary-mcp-test 3.0.0, 2.0.0, 4.0.0, 1.0.0
    MAL-2026-16062 amazon-inspector
  • npm
    alloy-graphql 1.0.1
    MAL-2026-16063 amazon-inspector
  • npm
    selfcerts 1.0.0
    MAL-2026-16060 amazon-inspector
  • npm
    rojo-rbx 1.4.3
    MAL-2026-16059 amazon-inspector
  • npm
    file-type-detector 1.1.0, 1.1.1
    MAL-2026-16053 amazon-inspector, ghsa-malware
  • npm
    gloggo 1.1.3, 1.1.4, 1.1.2
    MAL-2026-16054 amazon-inspector, ghsa-malware
  • npm
    sonmors 2.11.2
    MAL-2026-16055 amazon-inspector
  • npm
    vinzz-wcli 1.0.1
    MAL-2026-16058 amazon-inspector
  • npm
    toru-ultimate 1.0.0
    MAL-2026-16057 amazon-inspector
  • npm
    tailwind-aspect-styles 0.4.2
    MAL-2026-16056 amazon-inspector
  • npm
    open-item-validator 1.0.3, 1.0.5, 1.0.2, 1.0.0, 1.0.4, 1.0.1
    MAL-2026-16052 amazon-inspector, ghsa-malware
  • npm
    @aspect-adv-ui/consent-manager 2.4.0, 2.4.1
    MAL-2026-16050 amazon-inspector
  • npm
    @umschool/analytics 999.0.1, 999.0.0, 999.0.2, 999.0.4, 999.0.3
    MAL-2026-16051 amazon-inspector
  • npm
    tailwindcss-aspectratio-styles 0.3.5, 0.3.4
    MAL-2026-16049 amazon-inspector
  • npm
    punypump 1.2.4, 1.2.5, 1.2.2
    MAL-2026-16048 amazon-inspector
  • npm
    @usemosaik/template-react-js 1.0.1
    MAL-2026-16047 ghsa-malware, amazon-inspector
  • npm
    i18nexus-tools 3.2.0
    MAL-2026-16046 ghsa-malware, amazon-inspector
  • npm
    i18nexus all versions
    MAL-2026-16045 ghsa-malware
  • npm
    @web2apk/baileys 4.5.5, 7.0.0, 9.0.9, 2.0.0, 9.9.9, 3.5.5, 3.5.0, 3.0.0, 5.5.5, 7.0.5, 2.5.0, 7.…
    MAL-2026-16043 ghsa-malware, amazon-inspector
  • npm
    krdpass-auth-react-native 10.0.0, 1.6.0
    MAL-2026-16042 ghsa-malware, amazon-inspector
  • npm
    plogme 1.0.0, 1.0.1, 1.0.2, 1.0.3
    MAL-2026-16199 amazon-inspector 2 IOCs
  • npm
    @cp-shared-14/frontend-ui 6.3.4
    MAL-2026-16015 ossf-package-analysis