Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,460 npm 223,294 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,294 reports · Feed

  • npm
    @liuliang520500/taobao-topclient all versions
    MAL-2026-15962 ghsa-malware
  • npm
    @pilllesss/yorn all versions
    MAL-2026-15963 ghsa-malware
  • npm
    dcftunnel 0.4.5
    MAL-2026-15975 ghsa-malware, amazon-inspector
  • npm
    1cattunnel 0.2.0, 0.3.4, 0.5.1, 0.3.0, 0.3.1, 0.1.2-b.1, 0.3.2, 0.1.2-b.3, 0.1.2-b.2
    MAL-2026-15943 ghsa-malware, amazon-inspector
  • npm
    multicore-kit 1.1.5
    MAL-2026-15995 ghsa-malware, amazon-inspector
  • npm
    date-fns-formatter 1.3.8, 1.3.10, 1.4.9, 1.3.9
    MAL-2026-15974 ghsa-malware, amazon-inspector
  • npm
    array-frames 2.3.5, 2.3.6, 2.3.2, 2.3.4, 2.3.3
    MAL-2026-15969 ghsa-malware, amazon-inspector
  • npm
    node-helper 1.5.4, 1.6.4
    MAL-2026-15997 ghsa-malware, amazon-inspector
  • npm
    jwt-logger 2.4.9, 2.1.9, 2.5.0
    MAL-2026-15991 ghsa-malware, amazon-inspector
  • npm
    array-scala 1.2.5, 1.2.4
    MAL-2026-15970 ghsa-malware, amazon-inspector
  • npm
    @domyjs/throttle all versions
    MAL-2026-15956 ghsa-malware
  • npm
    @domyjs/router all versions
    MAL-2026-15955 ghsa-malware
  • npm
    @domyjs/reactive all versions
    MAL-2026-15954 ghsa-malware
  • npm
    @domyjs/mask all versions
    MAL-2026-15953 ghsa-malware
  • npm
    @domyjs/intersect all versions
    MAL-2026-15952 ghsa-malware
  • npm
    @domyjs/i18n all versions
    MAL-2026-15951 ghsa-malware
  • npm
    tempjs-template all versions
    MAL-2026-16002 ghsa-malware
  • npm
    puppeteer-obscura 1.0.0
    MAL-2026-16001 ghsa-malware, amazon-inspector
  • npm
    pipipe all versions
    MAL-2026-16000 ghsa-malware
  • npm
    parallaxy-img all versions
    MAL-2026-15999 ghsa-malware
  • npm
    onetime-rnd all versions
    MAL-2026-15998 ghsa-malware
  • npm
    muswish all versions
    MAL-2026-15996 ghsa-malware
  • npm
    memov all versions
    MAL-2026-15994 ghsa-malware
  • npm
    linkpreview-simple all versions
    MAL-2026-15993 ghsa-malware
  • npm
    lazy-attr all versions
    MAL-2026-15992 ghsa-malware
  • npm
    json-into-html all versions
    MAL-2026-15990 ghsa-malware
  • npm
    jimg 1.0.2
    MAL-2026-15989 ghsa-malware, amazon-inspector
  • npm
    inner-svg-ts all versions
    MAL-2026-15988 ghsa-malware
  • npm
    infinity-grid all versions
    MAL-2026-15987 ghsa-malware
  • npm
    iframe-to-video all versions
    MAL-2026-15986 ghsa-malware
  • npm
    google-img-scrap 1.2.0
    MAL-2026-15985 ghsa-malware, amazon-inspector
  • npm
    fast-html-dom-parser all versions
    MAL-2026-15983 ghsa-malware
  • npm
    enqueu all versions
    MAL-2026-15979 ghsa-malware
  • npm
    drive-album all versions
    MAL-2026-15978 ghsa-malware
  • npm
    discord-tqr all versions
    MAL-2026-15977 ghsa-malware
  • npm
    discord-phub all versions
    MAL-2026-15976 ghsa-malware
  • npm
    chrome-speech-recognition all versions
    MAL-2026-15973 ghsa-malware
  • npm
    card3d all versions
    MAL-2026-15972 ghsa-malware
  • npm
    btn-particles all versions
    MAL-2026-15971 ghsa-malware
  • npm
    anime-vostfr all versions
    MAL-2026-15968 ghsa-malware