Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,465 npm 223,299 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,299 reports · Feed

npm
secure-test-browser-o5kevayg all versions
MAL-2026-15402 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-nu4lhvyb all versions
MAL-2026-15397 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-khflxpz7 all versions
MAL-2026-15376 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-izxyw11l all versions
MAL-2026-15366 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-ggbh6tng all versions
MAL-2026-15351 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-f0dzh835 all versions
MAL-2026-15340 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-cxtwmz33 all versions
MAL-2026-15325 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-c9b32eoo all versions
MAL-2026-15321 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-c5iac3qm all versions
MAL-2026-15320 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-c2df2vbx all versions
MAL-2026-15319 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-7sktckna all versions
MAL-2026-15300 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-7s217blm all versions
MAL-2026-15299 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-7lp0evnc all versions
MAL-2026-15298 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-5pst58e3 all versions
MAL-2026-15290 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-3bpg8lyh all versions
MAL-2026-15279 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-2amz9mh0 all versions
MAL-2026-15271 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-232piklt all versions
MAL-2026-15268 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-1uomcu7q all versions
MAL-2026-15265 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-1pe78gsn all versions
MAL-2026-15264 ghsa-malware

Aug 28, 2026
npm
classlink-xx8vtk2p all versions
MAL-2026-15177 ghsa-malware

Aug 28, 2026
npm
classlink-mwnbufxp all versions
MAL-2026-15116 ghsa-malware

Aug 28, 2026
npm
classlink-hl9uycka all versions
MAL-2026-15085 ghsa-malware

Aug 28, 2026
npm
classlink-3k14cslj all versions
MAL-2026-15019 ghsa-malware

Aug 28, 2026
npm
classlink-0xcszcdo all versions
MAL-2026-15007 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-z6d4ruii all versions
MAL-2026-15465 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-r270knja all versions
MAL-2026-15416 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-ezbajpcd all versions
MAL-2026-15339 ghsa-malware

Aug 28, 2026
npm
secure-test-browser-1yjarnvk all versions
MAL-2026-15266 ghsa-malware

Aug 28, 2026
npm
cacao1 9.9.9
MAL-2026-14591 ossf-package-analysis, amazon-inspector

Aug 28, 2026
npm
@fleetbo/svro 0.0.42, 0.0.40, 0.0.39, 0.0.38, 0.0.37, 0.0.35, 0.0.34, 0.0.33, 0.0.32, 0.0.31,…
MAL-2026-14586 ghsa-malware, amazon-inspector

Aug 28, 2026
npm
@znan/wabot 0.2.2-beta.3, 0.2.2-beta.2, 0.2.2-beta.1, 0.2.2-beta.0, 0.2.1, 0.2.0-beta.8, 0.…
MAL-2026-14585 ghsa-malware

Aug 28, 2026
npm
pushgitquickx 1.0.17, 1.0.16, 1.0.15, 1.0.14, 1.0.13, 1.0.12, 1.0.11, 1.0.10, 1.0.9, 1.0.8, 1…
MAL-2026-14578 ghsa-malware, amazon-inspector

Aug 27, 2026
npm
@hd-team/app-impkg-test all versions
MAL-2026-14576 ghsa-malware

Aug 27, 2026
npm
@hd-team/app-impkg-prod all versions
MAL-2026-14575 ghsa-malware

Aug 27, 2026
npm
@hd-team/app-dnpkg-three all versions
MAL-2026-14574 ghsa-malware

Aug 27, 2026
npm
@hd-team/app-dnpkg-prod all versions
MAL-2026-14571 ghsa-malware

Aug 27, 2026
npm
@hd-team/app-dnpkg-beta 1.0.20260808153500
MAL-2026-14569 ghsa-malware, amazon-inspector

Aug 27, 2026
npm
@hd-team/app-dnpkg-test all versions
MAL-2026-14573 ghsa-malware

Aug 27, 2026
npm
@hd-team/app-dnpkg-ten all versions
MAL-2026-14572 ghsa-malware

Aug 27, 2026
npm
@hd-team/app-dnpkg-eight all versions
MAL-2026-14570 ghsa-malware

Aug 27, 2026