Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,465 npm 223,299 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,299 reports · Feed

  • npm
    sm-session 99.0.1, 99.0.0
    MAL-2026-14400 amazon-inspector, ossf-package-analysis, ghsa-malware
  • npm
    sm-admin 99.0.0, 99.0.1
    MAL-2026-14393 amazon-inspector, ossf-package-analysis, ghsa-malware
  • npm
    sm-cart 99.0.0, 99.0.1
    MAL-2026-14396 amazon-inspector, ossf-package-analysis, ghsa-malware
  • npm
    sm-billing-form 99.0.0, 99.0.1
    MAL-2026-14395 amazon-inspector, ossf-package-analysis, ghsa-malware
  • npm
    svelte-dim-kit 1.0.0
    MAL-2026-14386 ghsa-malware, amazon-inspector
  • npm
    hydration-dim-kit 1.0.0
    MAL-2026-14385 ghsa-malware, amazon-inspector
  • npm
    @sdgdfgdfhhhfd/multiviewr 1.0.0, 2.0.0, 2.0.1
    MAL-2026-14383 ghsa-malware, amazon-inspector
  • npm
    @sdgdfgdfhhhfd/chainvista 1.0.0, 2.0.2, 2.0.0, 2.0.1
    MAL-2026-14382 ghsa-malware, amazon-inspector
  • npm
    fund-list-filter 999.9.12
    MAL-2026-14380 ossf-package-analysis, amazon-inspector
  • npm
    fund-portfolio 999.9.12
    MAL-2026-14381 ossf-package-analysis, amazon-inspector
  • npm
    10-shardsight-web 1.0.1, 1.0.0
    MAL-2026-14362 amazon-inspector
  • npm
    2-loadsight-web 1.0.0, 1.0.1
    MAL-2026-14363 amazon-inspector
  • npm
    3-buildsight-web 1.0.1, 1.0.0
    MAL-2026-14364 amazon-inspector
  • npm
    8-fetchsight-web 1.0.1, 1.0.0
    MAL-2026-14366 amazon-inspector
  • npm
    6-viewsight-web 1.0.1, 1.0.0
    MAL-2026-14365 amazon-inspector
  • npm
    @usaa-grp-personal-profile/personal-profile-common 999.0.0
    MAL-2026-14370 amazon-inspector, ghsa-malware
  • npm
    @syncraft-labs/react 0.4.1
    MAL-2026-14368 amazon-inspector, ghsa-malware
  • npm
    create-coin 20.1.1
    MAL-2026-14372 amazon-inspector
  • npm
    @syncraft-labs/vue 0.4.1
    MAL-2026-14369 amazon-inspector, ghsa-malware
  • npm
    @syncraft-labs/core 0.4.1
    MAL-2026-14367 amazon-inspector, ghsa-malware
  • npm
    chai-as-testkit 2.3.5
    MAL-2026-14371 amazon-inspector, ghsa-malware
  • npm
    rust-testing-utils 2.3.0
    MAL-2026-14374 amazon-inspector
  • npm
    solidity-testing-utils 1.2.0
    MAL-2026-14375 amazon-inspector
  • npm
    hatdhat-testkit 3.2.14
    MAL-2026-14373 amazon-inspector
  • npm
    stillm4ddpocs-rtest-bravo 999.9.10, 999.9.9
    MAL-2026-14378 amazon-inspector
  • npm
    stillm4ddpocs-demo-sprocket 999.9.12
    MAL-2026-14376 amazon-inspector
  • npm
    stillm4ddpocs-rtest-alpha 999.9.10, 999.9.9
    MAL-2026-14377 amazon-inspector
  • npm
    @postman-cse/okta-aio-darwin-arm64 0.11.6
    MAL-2026-14580
  • npm
    stillm4ddpocs-demo-gadget 999.9.10, 999.9.20, 999.9.12
    MAL-2026-14361 ossf-package-analysis, amazon-inspector
  • npm
    stillm4ddpocs-demo-widget 999.9.9
    MAL-2026-14360 ossf-package-analysis
  • npm
    internallib_v902 1.2.1
    MAL-2026-14359 ghsa-malware, amazon-inspector
  • npm
    @postman-cse/okta-aio-linux-arm64 0.11.4, 0.11.5, 0.11.6, 0.11.3, 0.11.2, 0.11.1, 0.11.0, 0.10.9, 0.10.8, 0.10.7,…
    MAL-2026-14357 ghsa-malware, amazon-inspector
  • npm
    lumen-pages-community 9.9.9
    MAL-2026-14356 amazon-inspector
  • npm
    fuel-react 91.0.0
    MAL-2026-14355 amazon-inspector
  • npm
    kelly-sizing 0.1.0, 0.1.1
    MAL-2026-14354 ghsa-malware, amazon-inspector
  • npm
    @gfe/lx-watcher 1.5.3, 1.5.4
    MAL-2026-14353 amazon-inspector, ghsa-malware
  • npm
    totp-utils 1.4.8, 1.4.7, 1.4.6, 1.4.2, 1.4.5, 1.4.4, 1.4.3, 1.4.9
    MAL-2026-14379 amazon-inspector, ghsa-malware, ossf-package-analysis
  • npm
    tailwind-animate-css-plugin 2.0.1, 1.0.0, 4.0.3
    MAL-2026-14352 ghsa-malware, amazon-inspector
  • npm
    @next-fonts/font 1.0.1, 1.0.0
    MAL-2026-14346 amazon-inspector
  • npm
    mcq-session 1.0.4, 1.0.3
    MAL-2026-14347 amazon-inspector