Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,465 npm 223,299 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,299 reports · Feed

  • npm
    svelte-streak-panel 1.0.0
    MAL-2026-14501 ghsa-malware, amazon-inspector
  • npm
    svelte-streak-tracker 1.0.0
    MAL-2026-14502 ghsa-malware, amazon-inspector
  • npm
    svelte-insights-streak 1.0.0
    MAL-2026-14497 ghsa-malware, amazon-inspector
  • npm
    svelte-insight-streaks all versions
    MAL-2026-14496 ghsa-malware
  • npm
    svelte-daily-streaks 1.0.0
    MAL-2026-14493 ghsa-malware, amazon-inspector
  • npm
    spotify-url-infos 3.4.2
    MAL-2026-14492 amazon-inspector
  • npm
    chai-as-otc 1.0.5
    MAL-2026-14491 amazon-inspector
  • npm
    mkb-manager 1.0.11, 1.0.13, 1.0.12, 1.0.15, 1.0.14, 1.0.10
    MAL-2026-14490 ghsa-malware, amazon-inspector
  • npm
    hydration-cls-ui 1.0.0
    MAL-2026-14489 amazon-inspector, ghsa-malware
  • npm
    modules-newline 0.0.6
    MAL-2026-14483 amazon-inspector, ghsa-malware
  • npm
    react-remove-properties 6.14.1
    MAL-2026-14484 amazon-inspector, ghsa-malware
  • npm
    spf-analytics 1.0.0
    MAL-2026-14486 amazon-inspector, ghsa-malware
  • npm
    secretkey-2fa 1.0.0, 1.0.1
    MAL-2026-14485 amazon-inspector
  • npm
    spotify-url-resolovela 3.4.2
    MAL-2026-14487 amazon-inspector
  • npm
    vite-plugin-images-analysis 1.0.0
    MAL-2026-14482 amazon-inspector
  • npm
    vite-plugin-image-tracker 1.0.0, 1.1.0
    MAL-2026-14481 amazon-inspector
  • npm
    vite-plugin-bug-tracker 1.0.0, 1.1.0
    MAL-2026-14479 amazon-inspector
  • npm
    vite-plugin-image-analysis 1.1.0, 1.0.0, 1.1.2
    MAL-2026-14480 amazon-inspector
  • npm
    mham-js 1.0.4
    MAL-2026-14478 amazon-inspector
  • npm
    js-soul 1.0.4
    MAL-2026-14477 amazon-inspector
  • npm
    ecobee-home 0.0.2, 0.0.1
    MAL-2026-14475 amazon-inspector, ghsa-malware
  • npm
    ecobee2 0.0.2, 0.0.1
    MAL-2026-14476 amazon-inspector, ghsa-malware
  • npm
    ecobee-api 0.0.2, 0.0.1
    MAL-2026-14474 amazon-inspector, ghsa-malware
  • npm
    css-import-order 1.1.0
    MAL-2026-14473 amazon-inspector, ghsa-malware
  • npm
    cscasereadserv-paypal 3.4.3
    MAL-2026-14472 amazon-inspector
  • npm
    cat-embed-i18n-res 1.0.0
    MAL-2026-14471 amazon-inspector
  • npm
    whatsgoodlookingbabycreed 1.0.0
    MAL-2026-14470 ghsa-malware, amazon-inspector
  • npm
    tungtungisgoated 1.0.0
    MAL-2026-14469 ghsa-malware, amazon-inspector
  • npm
    tungtunggod 1.0.0
    MAL-2026-14468 ghsa-malware, amazon-inspector
  • npm
    superdupertest111 1.0.0
    MAL-2026-14467 ghsa-malware, amazon-inspector
  • npm
    sonsonsahur 1.0.0
    MAL-2026-14466 ghsa-malware, amazon-inspector
  • npm
    schoolwork 1.0.0
    MAL-2026-14465 ghsa-malware, amazon-inspector
  • npm
    schoollesson 1.0.0
    MAL-2026-14464 ghsa-malware, amazon-inspector
  • npm
    schoolhomework 1.0.0
    MAL-2026-14463 ghsa-malware, amazon-inspector
  • npm
    pleasedoyourhomework 1.0.0
    MAL-2026-14462 ghsa-malware, amazon-inspector
  • npm
    iwantaburger 1.0.0
    MAL-2026-14461 ghsa-malware, amazon-inspector
  • npm
    ilovedesmos 1.0.0
    MAL-2026-14460 ghsa-malware, amazon-inspector
  • npm
    iamhungryrn 1.0.0
    MAL-2026-14459 ghsa-malware, amazon-inspector
  • npm
    desmoswork 1.0.0
    MAL-2026-14458 ghsa-malware, amazon-inspector
  • npm
    desmosschoolwork 1.0.0
    MAL-2026-14457 ghsa-malware, amazon-inspector