Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,465 npm 223,299 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,299 reports · Feed

  • npm
    desmosmathwork 1.0.0
    MAL-2026-14456 ghsa-malware, amazon-inspector
  • npm
    desmosistuff 1.0.0
    MAL-2026-14455 ghsa-malware, amazon-inspector
  • npm
    desmosisfire 1.0.0
    MAL-2026-14454 ghsa-malware, amazon-inspector
  • npm
    desmoshomework 1.0.0
    MAL-2026-14453 ghsa-malware, amazon-inspector
  • npm
    desmosclasswork 1.0.0
    MAL-2026-14452 ghsa-malware, amazon-inspector
  • npm
    classwork all versions
    MAL-2026-14451 ghsa-malware
  • npm
    classroomwork 1.0.0
    MAL-2026-14450 ghsa-malware, amazon-inspector
  • npm
    classroomlesson 1.0.0
    MAL-2026-14449 ghsa-malware, amazon-inspector
  • npm
    classroomhomework 1.0.0
    MAL-2026-14448 ghsa-malware, amazon-inspector
  • npm
    classlesson 1.0.0
    MAL-2026-14447 ghsa-malware, amazon-inspector
  • npm
    classhomework 1.0.0
    MAL-2026-14446 ghsa-malware, amazon-inspector
  • npm
    digitalexp-style-module-l9 99.0.0
    MAL-2026-14445 amazon-inspector, ghsa-malware
  • npm
    unifi-credential-server 99.0.0
    MAL-2026-15692 reversing-labs, amazon-inspector
  • npm
    react-hook-doms 5.3.1
    MAL-2026-15691 reversing-labs, amazon-inspector
  • npm
    mongosooe 1.0.1
    MAL-2026-15690 reversing-labs
  • npm
    lil-swisgom-hlepers 49.9.9
    MAL-2026-15689 reversing-labs, amazon-inspector
  • npm
    leaflet-opencage-geocoding 1.0.0
    MAL-2026-15688 reversing-labs
  • npm
    @medisend/shared 0.0.1-security-research
    MAL-2026-14423 amazon-inspector, ghsa-malware
  • npm
    chai-as-mno 1.0.5
    MAL-2026-14427 amazon-inspector
  • npm
    @medisend/auth 0.0.1-security-research
    MAL-2026-14421 amazon-inspector, ghsa-malware
  • npm
    @medisend/core 0.0.1-security-research
    MAL-2026-14422 amazon-inspector, ghsa-malware
  • npm
    kelly-stake-sizing 0.1.1
    MAL-2026-14432 amazon-inspector, ghsa-malware
  • npm
    openai-pr-reviewer 1.0.0, 1.0.1
    MAL-2026-14434 amazon-inspector, ghsa-malware
  • npm
    consumerweb-serverutils 3.4.3
    MAL-2026-14428 amazon-inspector
  • npm
    babel-polyfill-plugin-corejs2 1.0.1
    MAL-2026-14426 amazon-inspector, ghsa-malware
  • npm
    poly-price-node 1.1.2
    MAL-2026-14436 amazon-inspector
  • npm
    auth-otp 1.0.0, 1.0.2, 1.0.1, 1.0.4, 1.0.5, 1.0.3
    MAL-2026-14425 amazon-inspector
  • npm
    remove-bg-serverless-azure 1.0.1, 1.1.1
    MAL-2026-14438 amazon-inspector, ghsa-malware
  • npm
    dim-hydration-ui 1.0.0
    MAL-2026-14429 amazon-inspector, ghsa-malware
  • npm
    secret-key-totp 1.5.1
    MAL-2026-14439 amazon-inspector
  • npm
    paypal-business-sdk 9.4.3
    MAL-2026-14435 amazon-inspector
  • npm
    manticore-log 9.4.3
    MAL-2026-14433 amazon-inspector
  • npm
    ppb-manticore 9.4.3
    MAL-2026-14437 amazon-inspector
  • npm
    @gsas/gsas-sdk 999.9.15, 99.99.99, 0.0.0-stage
    MAL-2026-14420 amazon-inspector, ghsa-malware
  • npm
    web-advertising 999.9.15, 999.9.16
    MAL-2026-14440 amazon-inspector
  • npm
    @yuva2210/okx-poc-rce-impact 2.0.0
    MAL-2026-15687 reversing-labs, amazon-inspector
  • npm
    @yuva2210/htx-poc-skills-rce 1.0.0, 1.0.1
    MAL-2026-15686 reversing-labs
  • npm
    @x-team/strapi 3.6.11, 3.7.0, 3.7.1
    MAL-2026-15685 reversing-labs
  • npm
    svelte-ui-dim 1.0.0
    MAL-2026-14442 ghsa-malware, amazon-inspector
  • npm
    hydration-ui-dim 1.0.0
    MAL-2026-14431 amazon-inspector, ghsa-malware