Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,378 npm 223,239 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

223,239 reports · Feed

npm
@levvicode/eslint-config all versions
MAL-2026-18471 ghsa-malware

Nov 2, 2026
npm
levvleys 2.1.0, 2.0.26, 2.0.25, 2.0.24, 2.0.23, 2.0.22, 2.0.21, 2.0.20, 2.0.19, 2.0.18, …
MAL-2026-17397 ghsa-malware

Nov 2, 2026
npm
@levvicode/baileys 0.0.3, 0.0.2
MAL-2026-17366 ghsa-malware

Nov 2, 2026
npm
tailwind-animatrix all versions
MAL-2026-18481 ghsa-malware

Nov 2, 2026
npm
tailwind-animate-final all versions
MAL-2026-18479 ghsa-malware

Nov 2, 2026
npm
tailwind-animate-engine all versions
MAL-2026-18478 ghsa-malware

Nov 2, 2026
npm
unjailed all versions
MAL-2026-18482 ghsa-malware

Nov 2, 2026
npm
tailwind-animate-test all versions
MAL-2026-18480 ghsa-malware

Nov 2, 2026
npm
@mrlegendbot/libsignal-node all versions
MAL-2026-18474 ghsa-malware

Nov 2, 2026
npm
@bigdevin55/calculator-install-demo all versions
MAL-2026-18465 ghsa-malware

Nov 2, 2026
npm
@bigdevin55/calculator-install-hook all versions
MAL-2026-18466 ghsa-malware

Nov 2, 2026
npm
@vanzky/baileys 0.0.0-stage, 1.0.0, 1.0.1, 1.0.2, 1.0.4
MAL-2026-19055

Nov 2, 2026
npm
tailwindcss-animate-bridge all versions
MAL-2026-18470 ghsa-malware

Nov 2, 2026
npm
@utilitycraft/tailwindcss-motion-atelier all versions
MAL-2026-18468 ghsa-malware

Nov 2, 2026
npm
@ubedsockets/baileys 1.0.0, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.…
MAL-2026-18600

Nov 2, 2026
npm
atlassian-wallboard-plugin1 all versions
MAL-2026-18464 ghsa-malware

Nov 2, 2026
npm
persona-ai-sdk 1.0.0
MAL-2026-18463 ghsa-malware

Nov 2, 2026
npm
xenacious_kangaroo_blush-47 4.3.3
MAL-2026-18623

Nov 2, 2026
npm
valid_antlion_amber-50 4.1.3
MAL-2026-18622

Nov 2, 2026
npm
unfortunate_crawdad_emerald-79 3.3.1
MAL-2026-18621

Nov 2, 2026
npm
temporary_smelt_lavender-81 3.3.1
MAL-2026-18620

Nov 2, 2026
npm
specific_sheep_violet-22 2.4.1
MAL-2026-18619

Nov 2, 2026
npm
southern_duck_tan-16 2.4.3
MAL-2026-18618

Nov 2, 2026
npm
sound_deer_apricot-15 2.1.4
MAL-2026-18617

Nov 2, 2026
npm
smooth_angelfish_emerald-54 2.2.2
MAL-2026-18616

Nov 2, 2026
npm
pure_opossum_amaranth-54 2.3.2
MAL-2026-18615

Nov 2, 2026
npm
motionless_mandrill_blush-51 2.2.3
MAL-2026-18614

Nov 2, 2026
npm
itchy_gecko_magenta-98 2.3.4
MAL-2026-18613

Nov 2, 2026
npm
intimate_ostrich_amethyst-45 3.1.4
MAL-2026-18612

Nov 2, 2026
npm
inadequate_earwig_magenta-66 3.4.3
MAL-2026-18611

Nov 2, 2026
npm
hushed_zebra_green-81 2.4.2
MAL-2026-18610

Nov 2, 2026
npm
hollow_wildebeest_silver-94 1.1.2
MAL-2026-18609

Nov 2, 2026
npm
gugodapis 1.0.0
MAL-2026-18608

Nov 2, 2026
npm
et_phone_home 0.0.5
MAL-2026-18607

Nov 2, 2026
npm
colossal_wallaby_pink-87 1.2.1
MAL-2026-18606

Nov 2, 2026
npm
babyyodaa 1.1.0
MAL-2026-18605

Nov 2, 2026
npm
@signals-notebook/annotation-editor 2.2.60-630109c
MAL-2026-18604

Nov 2, 2026
npm
@goparrot-dashboard-api/users 0.0.1
MAL-2026-18516

Nov 2, 2026
npm
@goparrot-dashboard-api/store 0.0.1
MAL-2026-18515

Nov 2, 2026
npm
@goparrot-dashboard-api/shared 0.0.1
MAL-2026-18514

Nov 2, 2026