Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,378 npm 223,239 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

223,239 reports · Feed

npm
qxjf8r all versions
MAL-2026-18559 ghsa-malware

Nov 3, 2026
npm
ll3zea all versions
MAL-2026-18552 ghsa-malware

Nov 3, 2026
npm
kojs0k all versions
MAL-2026-18549 ghsa-malware

Nov 3, 2026
npm
jd7ijw all versions
MAL-2026-18547 ghsa-malware

Nov 3, 2026
npm
j4pe0w all versions
MAL-2026-18545 ghsa-malware

Nov 3, 2026
npm
ib3rwn all versions
MAL-2026-18544 ghsa-malware

Nov 3, 2026
npm
gvmabc all versions
MAL-2026-18543 ghsa-malware

Nov 3, 2026
npm
g3ypjg all versions
MAL-2026-18540 ghsa-malware

Nov 3, 2026
npm
bznio5 all versions
MAL-2026-18538 ghsa-malware

Nov 3, 2026
npm
7un7kh all versions
MAL-2026-18535 ghsa-malware

Nov 3, 2026
npm
5df897 all versions
MAL-2026-18534 ghsa-malware

Nov 3, 2026
npm
3zqth8 all versions
MAL-2026-18533 ghsa-malware

Nov 3, 2026
npm
2tyegs all versions
MAL-2026-18532 ghsa-malware

Nov 3, 2026
npm
yhk9j0 all versions
MAL-2026-18579 ghsa-malware

Nov 3, 2026
npm
working-today--empire-takeover-h-a-c-k-gen-erat-or-akcp8z all versions
MAL-2026-18575 ghsa-malware

Nov 3, 2026
npm
winjb6 all versions
MAL-2026-18573 ghsa-malware

Nov 3, 2026
npm
updated-today-gen-photo-lab-pro-h-a-c-k-gen-erat-or-ofgpju all versions
MAL-2026-18571 ghsa-malware

Nov 3, 2026
npm
updated-today-gen-dr-parking-4-h-a-c-k-gen-erat-or-hmdcsa all versions
MAL-2026-18570 ghsa-malware

Nov 3, 2026
npm
updated-gen-erator-rainbow-six-mobile-h-a-c-k-gen-erat-or-1179lh all versions
MAL-2026-18569 ghsa-malware

Nov 3, 2026
npm
updated-gen-erator-producer-h-a-c-k-gen-erat-or-g8pi55 all versions
MAL-2026-18568 ghsa-malware

Nov 3, 2026
npm
u0bh1f all versions
MAL-2026-18566 ghsa-malware

Nov 3, 2026
npm
real-gen-erator-one-shade-h-a-c-k-gen-erat-or-8ks294 all versions
MAL-2026-18560 ghsa-malware

Nov 3, 2026
npm
new-code-unlim-ited-my-time-at-portia-h-a-c-k-gen-erat-or-i477p4 all versions
MAL-2026-18558 ghsa-malware

Nov 3, 2026
npm
new-code-unlim-ited-jurassic-world-m-od-f-r-e-e-wuo1ky all versions
MAL-2026-18557 ghsa-malware

Nov 3, 2026
npm
more-resour-ces-gen-tailed-demon-slayer-h-a-c-k-gen-erat-or-yas2jz all versions
MAL-2026-18556 ghsa-malware

Nov 3, 2026
npm
more-resour-ces-gen-stickman-legends-f-r-e-e-h-a-c-k-gen-erat-or-bv4n15 all versions
MAL-2026-18555 ghsa-malware

Nov 3, 2026
npm
more-resour-ces-gen-disney-mirrorverse-h-a-c-k-gen-erat-or-gulnxl all versions
MAL-2026-18554 ghsa-malware

Nov 3, 2026
npm
more-resour-ces-gen-daylio-h-a-c-k-gen-erat-or-qvi0r6 all versions
MAL-2026-18553 ghsa-malware

Nov 3, 2026
npm
latest-update-my-talking-angela-h-a-c-k-gen-erat-or-q8z42f all versions
MAL-2026-18551 ghsa-malware

Nov 3, 2026
npm
l52upm all versions
MAL-2026-18550 ghsa-malware

Nov 3, 2026
npm
k7nhgj all versions
MAL-2026-18548 ghsa-malware

Nov 3, 2026
npm
j5ugvu all versions
MAL-2026-18546 ghsa-malware

Nov 3, 2026
npm
gene-rator-new-rope-hero-h-a-c-k-gen-erat-or-azkrvc all versions
MAL-2026-18542 ghsa-malware

Nov 3, 2026
npm
gene-rator-new-hearthstone-h-a-c-k-gen-erat-or-9wy4b5 all versions
MAL-2026-18541 ghsa-malware

Nov 3, 2026
npm
code-resour-ces-new-app-cloner-premium-9upyk2 all versions
MAL-2026-18539 ghsa-malware

Nov 3, 2026
npm
9ct8bi all versions
MAL-2026-18536 ghsa-malware

Nov 3, 2026
npm
1b67v5 all versions
MAL-2026-18531 ghsa-malware

Nov 3, 2026
npm
updated-gen-erator-carx-drift-racing-h-a-c-k-gen-erat-or-tkfm7v all versions
MAL-2026-18567 ghsa-malware

Nov 3, 2026
npm
@shein-risk/si_verify all versions
MAL-2026-18537 ghsa-malware

Nov 3, 2026
npm
@vanzxy/nusa all versions
MAL-2026-18530 ghsa-malware

Nov 3, 2026