Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,465 npm 223,299 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,299 reports · Feed

  • npm
    @worrisome/reutil 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.5
    MAL-2026-15604 amazon-inspector, ghsa-malware
  • npm
    zenntechinc-cli 1.6.6, 1.6.4
    MAL-2026-14539 amazon-inspector, ghsa-malware
  • npm
    spotify-url-resolvers 3.4.2
    MAL-2026-14538 amazon-inspector, ghsa-malware
  • npm
    chai-plus 6.2.5, 6.2.3, 6.2.4, 6.3.0, 7.0.0
    MAL-2026-14533 amazon-inspector, ghsa-malware
  • npm
    commonjs-code-token 1.0.1, 1.0.0
    MAL-2026-14534 amazon-inspector
  • npm
    analytics-v2 4.0.0
    MAL-2026-14531 amazon-inspector
  • npm
    mt-ts-serverless-starter 1.0.1
    MAL-2026-14536 amazon-inspector
  • npm
    hydration-vli-ui 1.0.0
    MAL-2026-14535 amazon-inspector, ghsa-malware
  • npm
    chai-as-org 1.0.5
    MAL-2026-14532 amazon-inspector
  • npm
    octopus-action 1.0.1, 1.1.1
    MAL-2026-14537 amazon-inspector, ghsa-malware
  • npm
    @lordmega/baileys all versions
    MAL-2026-14540 ghsa-malware
  • npm
    infomedia all versions
    MAL-2026-14530 ghsa-malware
  • npm
    baileys-mbuilder 4.7.0-lts, 4.5.0-cjs, 4.5.0-lts, 4.5.3-cjs, 4.5.0, 4.5.0-beta, 4.5.0-custom, 4.…
    MAL-2026-14529 ghsa-malware, amazon-inspector
  • npm
    baileys-inmemory-store 1.0.2-beta-3, 1.0.2-beta-4, 1.0.2-beta-6, 1.0.2-beta-5
    MAL-2026-14528 ghsa-malware, amazon-inspector
  • npm
    @fongsidev/scraper all versions
    MAL-2026-14527 ghsa-malware
  • npm
    omniauth-recharge-rails-example 1.0.0
    MAL-2026-14526 ossf-package-analysis, amazon-inspector
  • npm
    array-shuffler-utils-99 all versions
    MAL-2026-14519 ghsa-malware
  • npm
    fivem-tool-helper-v2 all versions
    MAL-2026-14521 ghsa-malware
  • npm
    fivem-tool-helper all versions
    MAL-2026-14520 ghsa-malware
  • npm
    svelte-ui-cls 1.0.0
    MAL-2026-14518 ghsa-malware, amazon-inspector
  • npm
    hydration-ui-cls 1.0.0
    MAL-2026-14517 ghsa-malware, amazon-inspector
  • npm
    bamru 1.0.0
    MAL-2026-15674 amazon-inspector 2 IOCs
  • npm
    wm-eslint-fe all versions
    MAL-2026-14514 ghsa-malware
  • npm
    wm-lib-env-provider all versions
    MAL-2026-14515 ghsa-malware
  • npm
    hexdrift 10.0.1
    MAL-2026-14508 ghsa-malware, amazon-inspector
  • npm
    foldmap 2.0.3
    MAL-2026-14507 ghsa-malware, amazon-inspector
  • npm
    snapbuf 1.4.2
    MAL-2026-14510 ghsa-malware, amazon-inspector
  • npm
    dim-svelte-ui 1.0.0
    MAL-2026-14506 ghsa-malware, amazon-inspector
  • npm
    svelte-cls-ui 1.0.0
    MAL-2026-14511 ghsa-malware, amazon-inspector
  • npm
    typedoc-xyz 0.28.19
    MAL-2026-14513 ghsa-malware, amazon-inspector
  • npm
    r4wk-book 2.2.2
    MAL-2026-14509 ghsa-malware, amazon-inspector
  • npm
    tailwind-scrollbar-hider 5.0.2, 5.0.1, 0.0.1
    MAL-2026-14512 ghsa-malware, amazon-inspector
  • npm
    voice-crate-check 1.0.0
    MAL-2026-14505 ghsa-malware, amazon-inspector
  • npm
    video-crate-check 1.0.0
    MAL-2026-14504 ghsa-malware, amazon-inspector
  • npm
    text-crate-check 1.0.0
    MAL-2026-14503 ghsa-malware, amazon-inspector
  • npm
    svelte-streak-map 1.0.0
    MAL-2026-14500 ghsa-malware, amazon-inspector
  • npm
    svelte-map-metric 1.0.0
    MAL-2026-14499 ghsa-malware, amazon-inspector
  • npm
    svelte-hydration-streak 1.0.0
    MAL-2026-14495 ghsa-malware, amazon-inspector
  • npm
    svelte-intake-streaks 1.0.0
    MAL-2026-14498 ghsa-malware, amazon-inspector
  • npm
    svelte-goal-streaks 1.0.0
    MAL-2026-14494 ghsa-malware, amazon-inspector