Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,465 npm 223,299 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,299 reports · Feed

  • npm
    moidevy 1.0.0
    MAL-2026-14348 amazon-inspector
  • npm
    express-session-handler 2.3.3
    MAL-2026-14345 amazon-inspector
  • npm
    @js-lib-team/env-parser 1.0.0
    MAL-2026-14344 amazon-inspector
  • npm
    chai-as-soul 2.3.5, 2.3.6
    MAL-2026-14343 amazon-inspector
  • npm
    coin-fees 20.1.1
    MAL-2026-14342 amazon-inspector
  • npm
    exam-kit 1.0.2, 1.0.3, 1.0.1, 1.0.0
    MAL-2026-14331 ghsa-malware, amazon-inspector
  • npm
    @pablo_clueless/sniffr 0.1.1, 0.1.0
    MAL-2026-14330 ghsa-malware, amazon-inspector
  • npm
    @pablo_clueless/printr 0.1.4, 0.1.7, 0.1.8, 0.1.2, 0.1.6, 0.1.5
    MAL-2026-14329 ghsa-malware, amazon-inspector
  • npm
    goldstar-api-server all versions
    MAL-2026-14328 ghsa-malware
  • npm
    ethereum-validator all versions
    MAL-2026-14327 ghsa-malware
  • npm
    create-react-app-ux 1.0.0
    MAL-2026-14326 ghsa-malware, amazon-inspector
  • npm
    create-react-app-ui 1.0.0
    MAL-2026-14325 ghsa-malware, amazon-inspector
  • npm
    create-react-app-text 1.0.0
    MAL-2026-14324 ghsa-malware, amazon-inspector
  • npm
    cig-data-patcher all versions
    MAL-2026-14323 ghsa-malware
  • npm
    debug-fnt all versions
    MAL-2026-14322 ghsa-malware
  • npm
    test-flow-entire7 1.0.0
    MAL-2026-14321 ghsa-malware, amazon-inspector
  • npm
    test-flow-entire6 1.0.0
    MAL-2026-14320 ghsa-malware, amazon-inspector
  • npm
    test-flow-1 1.0.0, 1.0.2
    MAL-2026-14319 ghsa-malware, amazon-inspector
  • npm
    frenchworldcupwin 2.0.5, 1.0.0, 1.0.1, 2.0.0
    MAL-2026-14318 ghsa-malware, amazon-inspector
  • npm
    fetch-webjs-script 1.0.0
    MAL-2026-14317 ghsa-malware, amazon-inspector
  • npm
    @httttt/mcp-demo 1.0.0, 1.1.0
    MAL-2026-14315 amazon-inspector, ghsa-malware
  • npm
    expect-dotenv 7.2.1
    MAL-2026-14316 amazon-inspector, ghsa-malware
  • npm
    express-route-engine 3.6.3
    MAL-2026-14307 amazon-inspector
  • npm
    mc-provider 1.0.10
    MAL-2026-14305 amazon-inspector, ghsa-malware
  • npm
    base99-85x 5.0.2
    MAL-2026-14304 amazon-inspector
  • npm
    x6842179305 1.0.0, 1.0.1
    MAL-2026-14303 amazon-inspector
  • npm
    ai-texts-utils 1.0.3, 1.0.0, 1.0.1, 1.0.2
    MAL-2026-14302 amazon-inspector, ghsa-malware
  • npm
    node-runtime-utils 1.0.0
    MAL-2026-14313 ghsa-malware, amazon-inspector
  • npm
    webpack-cdn-fetcher all versions
    MAL-2026-14314 ghsa-malware
  • npm
    griffin-transliterator all versions
    MAL-2026-14312 ghsa-malware
  • npm
    eslint-config-consumerweb all versions
    MAL-2026-14311 ghsa-malware
  • npm
    bunnyhijack-test-0x00 1.0.0, 1.0.1
    MAL-2026-14310 ghsa-malware, amazon-inspector
  • npm
    @idanefraim/my-ui-kit all versions
    MAL-2026-14309 ghsa-malware
  • npm
    evm-validation 1.0.3, 1.0.2, 1.0.4
    MAL-2026-14301 amazon-inspector, ghsa-malware
  • npm
    eth-react-provider 1.0.0
    MAL-2026-14300 amazon-inspector, ghsa-malware
  • npm
    emoji-prints-fancy 5.6.4
    MAL-2026-14298 amazon-inspector, ghsa-malware
  • npm
    gear-composer 1.0.126
    MAL-2026-14299 amazon-inspector
  • npm
    gfff5 1.0.0
    MAL-2026-14296 amazon-inspector
  • npm
    homekit-mcp 1.0.0
    MAL-2026-14297 amazon-inspector
  • npm
    anhn-cli 1.1.4
    MAL-2026-14290 amazon-inspector, ghsa-malware