Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,465 npm 223,299 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,299 reports · Feed

  • npm
    svelte-dim-ui 1.0.0
    MAL-2026-14441 ghsa-malware, amazon-inspector
  • npm
    hydration-dim-ui 1.0.0
    MAL-2026-14430 amazon-inspector, ghsa-malware
  • npm
    @pimy-b2cweb/common 99.99.99
    MAL-2026-15684 reversing-labs
  • npm
    @pimy-b2cweb/apiclient-common 99.99.99
    MAL-2026-15683 reversing-labs
  • npm
    @ice-trade-components/common 99.99.99
    MAL-2026-15682 reversing-labs
  • npm
    @grab-food/order-sdk-web 49.9.9
    MAL-2026-15681 reversing-labs, amazon-inspector
  • npm
    @cawraytestorg/packagetest2 9.9.9
    MAL-2026-15680 reversing-labs
  • npm
    @bpa-internal/bpa-utils 99.99.98, 99.99.99
    MAL-2026-15679 reversing-labs
  • npm
    @bpa-internal/bpa-types 99.99.98, 99.99.99
    MAL-2026-15678 reversing-labs
  • npm
    @bpa-internal/bpa-common 99.99.98, 99.99.99
    MAL-2026-15677 reversing-labs
  • npm
    @bpa-internal/bpa-auth 99.99.98, 99.99.99
    MAL-2026-15676 reversing-labs
  • npm
    @b2b-frontend/store 1.0.0
    MAL-2026-15675 reversing-labs
  • npm
    dotish 1.0.0
    MAL-2026-14418 ghsa-malware, amazon-inspector
  • npm
    dims-svelte-ui all versions
    MAL-2026-14417 ghsa-malware
  • npm
    dims-hydration-ui 1.0.0
    MAL-2026-14416 ghsa-malware, amazon-inspector
  • npm
    tkyoussef-hb all versions
    MAL-2026-14419 ghsa-malware
  • npm
    @elc-online/up-analytics 99.99.99
    MAL-2026-14443 ossf-package-analysis
  • npm
    react-dynamic-parser all versions
    MAL-2026-14415 ghsa-malware
  • npm
    mcp-real-chrome 1.1.0, 1.2.0, 1.2.1, 1.1.1
    MAL-2026-14414 ghsa-malware, amazon-inspector
  • npm
    livemcp 1.3.0, 1.2.1
    MAL-2026-14413 ghsa-malware, amazon-inspector
  • npm
    @deepaksilaych/sess all versions
    MAL-2026-14412 ghsa-malware
  • npm
    @medisend/webview-bridge 0.0.1-security-research, 0.0.2-security-research
    MAL-2026-14424 amazon-inspector, ossf-package-analysis, ghsa-malware
  • npm
    dpg-media-7ehemel 999.9.15
    MAL-2026-14411 ossf-package-analysis, amazon-inspector
  • npm
    @temptation.js/utils 999.9.16, 999.9.15
    MAL-2026-14410 ossf-package-analysis, amazon-inspector
  • npm
    dext-crate-video 1.0.0
    MAL-2026-14408 ghsa-malware, amazon-inspector
  • npm
    dext-crate-image 1.0.0
    MAL-2026-14407 ghsa-malware, amazon-inspector
  • npm
    dext-crate-check 1.0.0
    MAL-2026-14406 ghsa-malware, amazon-inspector
  • npm
    create-json-client 1.0.0
    MAL-2026-14405 ghsa-malware, amazon-inspector
  • npm
    polis-diraja all versions
    MAL-2026-14409 ghsa-malware
  • npm
    @blurrydespair/libsignal-node 2.2.9, 2.2.7
    MAL-2026-14404 ghsa-malware, amazon-inspector
  • npm
    react-emits 1.0.0, 1.0.1, 1.0.2, 1.0.4, 1.0.5
    MAL-2026-14403 ghsa-malware, reversing-labs
  • npm
    agentgui 1.0.1127
    MAL-2026-14402 ghsa-malware
  • npm
    message-compiler 9.2.0
    MAL-2026-14392 amazon-inspector
  • npm
    sm-oauth 99.0.0
    MAL-2026-14398 amazon-inspector, ghsa-malware
  • npm
    amundi-compare 999.9.12
    MAL-2026-14390 amazon-inspector
  • npm
    fund-calculator 999.9.12
    MAL-2026-14391 amazon-inspector
  • npm
    @opap/player-kyc-widget 3.999.999
    MAL-2026-14387 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    sm-apikey-model 99.0.0, 99.0.1
    MAL-2026-14394 amazon-inspector, ossf-package-analysis, ghsa-malware
  • npm
    sm-checkout 99.0.0, 99.0.1
    MAL-2026-14397 amazon-inspector, ossf-package-analysis, ghsa-malware
  • npm
    sm-payment 99.0.1, 99.0.0
    MAL-2026-14399 amazon-inspector, ossf-package-analysis, ghsa-malware