Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,465 npm 223,299 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,299 reports · Feed

  • npm
    svelte-ui-dlx 1.0.0
    MAL-2026-14579 ghsa-malware, amazon-inspector
  • npm
    hydration-ui-dlx 1.0.0
    MAL-2026-14577 ghsa-malware, amazon-inspector
  • npm
    tailwindcss-3d-animate 1.1.0, 1.2.1, 1.2.2, 1.2.0, 0.0.1-security
    MAL-2026-14567 ghsa-malware, amazon-inspector
  • npm
    tailwindcss-form-styles 0.5.15
    MAL-2026-14568 ghsa-malware, amazon-inspector
  • npm
    stackpaths 3.1.2, 3.1.1, 3.1.0, 3.1.3
    MAL-2026-14565 ghsa-malware, amazon-inspector
  • npm
    inspectstack 3.1.1, 3.1.2, 3.1.0, 3.1.3
    MAL-2026-14560 ghsa-malware, amazon-inspector
  • npm
    deepjoin 4.3.3, 4.3.1, 4.3.2
    MAL-2026-14558 ghsa-malware, amazon-inspector
  • npm
    charclass 1.0.4, 1.0.2, 1.0.6, 1.0.3
    MAL-2026-14557 ghsa-malware, amazon-inspector
  • npm
    veloq 1.1.0, 1.0.2, 1.2.2, 1.0.1, 1.2.3, 1.1.3, 1.2.1
    MAL-2026-14566 ghsa-malware, amazon-inspector
  • npm
    sigcheck 1.0.3, 1.0.1, 1.1.0
    MAL-2026-14564 ghsa-malware, amazon-inspector
  • npm
    morglog 1.1.0, 1.2.1
    MAL-2026-14562 ghsa-malware, amazon-inspector
  • npm
    module-relpath 1.0.1, 1.0.2, 1.0.3
    MAL-2026-14561 ghsa-malware, amazon-inspector
  • npm
    rn-push-provisioning 99.0.1, 99.0.0
    MAL-2026-14563 ghsa-malware, amazon-inspector
  • npm
    imo-allowlist-xss-poc 1.0.0
    MAL-2026-14559 ghsa-malware, amazon-inspector
  • npm
    @cortana-md/engine 1.4.1
    MAL-2026-14553 ghsa-malware, amazon-inspector
  • npm
    bnotify-web-sdk 1.3.3, 1.2.8, 1.2.0, 1.2.9, 1.2.10, 1.2.11, 1.2.2, 1.2.3, 1.1.9, 1.2.4, 1.3.1, …
    MAL-2026-14551 ghsa-malware, amazon-inspector
  • npm
    dumb-binding-gyp-package 0.1.0
    MAL-2026-14546 ghsa-malware, amazon-inspector
  • npm
    tset_racie 1.0.3, 1.0.1, 1.0.2, 1.0.0
    MAL-2026-14550 ghsa-malware, amazon-inspector
  • npm
    the_tax_free_cashier_is_at_9f 1995.3.20, 2026.6.3-0.hades.no.isshouni, 1995.3.2-0.miasma, 2026.6.2-5.hades.no…
    MAL-2026-14549 ghsa-malware, amazon-inspector
  • npm
    shai_hulululud 1.0.48596
    MAL-2026-14548 ghsa-malware, amazon-inspector
  • npm
    grandfather_of_the_desert 0.1.0
    MAL-2026-14547 ghsa-malware, amazon-inspector
  • npm
    self-sign 5.6.2, 5.6.5, 5.6.8, 5.6.6, 5.6.9, 5.6.4, 5.6.3, 5.6.1, 5.6.7
    MAL-2026-14544 ghsa-malware, amazon-inspector
  • npm
    self-certificates 1.1.2, 1.2.5, 1.2.3, 1.1.9, 1.0.9, 1.1.1, 1.0.2, 1.2.2, 1.1.7, 1.0.5, 1.0.8, 1.…
    MAL-2026-14543 ghsa-malware, amazon-inspector
  • npm
    svelte-vli-ui 1.0.0
    MAL-2026-14541 ghsa-malware, amazon-inspector
  • npm
    vxhjkseuiaqkb 1.0.0
    MAL-2026-15620 amazon-inspector, ghsa-malware
  • npm
    testdgdbcsd 1.0.0, 1.0.1
    MAL-2026-15619 amazon-inspector, ghsa-malware
  • npm
    tesgfvbncsdbcv 1.0.0
    MAL-2026-15618 amazon-inspector, ghsa-malware
  • npm
    skxcmwuncbg2 1.0.0, 1.0.1
    MAL-2026-15617 amazon-inspector, ghsa-malware
  • npm
    ndmxchdjxn2 1.0.0
    MAL-2026-15616 amazon-inspector, ghsa-malware
  • npm
    ndmushdkeqe 1.0.0
    MAL-2026-15615 amazon-inspector, ghsa-malware
  • npm
    ndmfguyhoxc3 1.0.0
    MAL-2026-15614 amazon-inspector, ghsa-malware
  • npm
    mobiwaefhxc3 1.0.0
    MAL-2026-15613 amazon-inspector, ghsa-malware
  • npm
    mndsxcusiwlk1 1.0.0
    MAL-2026-15612 amazon-inspector, ghsa-malware
  • npm
    mn4xcouzvhus 1.0.0
    MAL-2026-15611 amazon-inspector, ghsa-malware
  • npm
    mn3sadkoiewu 1.0.0
    MAL-2026-15610 amazon-inspector, ghsa-malware
  • npm
    mn2adskhweox 1.0.0
    MAL-2026-15609 amazon-inspector, ghsa-malware
  • npm
    mjsdqwocvn 1.0.0
    MAL-2026-15608 amazon-inspector, ghsa-malware
  • npm
    mbxcnsuwgs1 1.0.0
    MAL-2026-15607 amazon-inspector, ghsa-malware
  • npm
    m3fdfocdoewn 1.0.0
    MAL-2026-15606 amazon-inspector, ghsa-malware
  • npm
    m2fcsfyjkuxb 1.0.0
    MAL-2026-15605 amazon-inspector, ghsa-malware