Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,465 npm 223,299 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,299 reports · Feed

  • npm
    @wizloft/harness-plugin-repository-files 0.1.1-alpha.3
    MAL-2026-14288 amazon-inspector, ghsa-malware
  • npm
    @wizloft/harness-kernel 0.1.1-alpha.3
    MAL-2026-14287 amazon-inspector, ghsa-malware
  • npm
    @wizloft/harness-validation 0.1.1-alpha.3
    MAL-2026-14289 amazon-inspector, ghsa-malware
  • npm
    @wizloft/harness 0.1.1-alpha.3
    MAL-2026-14285 amazon-inspector, ghsa-malware
  • npm
    @wizloft/harness-context 0.1.1-alpha.3
    MAL-2026-14286 amazon-inspector, ghsa-malware
  • npm
    log-res 1.0.3
    MAL-2026-14292 amazon-inspector
  • npm
    mc-registry 1.0.8, 1.0.9, 1.0.10
    MAL-2026-14294 amazon-inspector, ghsa-malware
  • npm
    libas-signal 1.0.0
    MAL-2026-14291 amazon-inspector
  • npm
    matrixflow-js 3.2.1
    MAL-2026-14293 amazon-inspector
  • npm
    mcp-dev-toolkit 1.5.0
    MAL-2026-14295 amazon-inspector
  • npm
    layer2-sdk 1.0.0, 1.0.1
    MAL-2026-14278 amazon-inspector
  • npm
    neverthrow-core 1.1.2
    MAL-2026-14283 amazon-inspector
  • npm
    localize-translate 1.0.0
    MAL-2026-14279 amazon-inspector
  • npm
    mutex-plus 3.0.2
    MAL-2026-14282 amazon-inspector
  • npm
    mutex-lite 1.4.2
    MAL-2026-14281 amazon-inspector
  • npm
    mutex-core 2.1.2
    MAL-2026-14280 amazon-inspector
  • npm
    nibra1 1.0.0
    MAL-2026-14284 amazon-inspector
  • npm
    node_cryptography 1.0.0
    MAL-2026-14276 amazon-inspector
  • npm
    minequest 0.1.1
    MAL-2026-14275 amazon-inspector
  • npm
    o0o9 1.8.0, 2.0.1, 1.0.3, 1.3.0, 1.0.7, 1.2.1, 2.0.0, 1.0.0, 2.0.2, 1.0.8, 1.8.1, 1.…
    MAL-2026-14277 amazon-inspector, ghsa-malware
  • npm
    nodealpha 1.0.7
    MAL-2026-14270 amazon-inspector
  • npm
    nodeberlin 1.0.7
    MAL-2026-14271 amazon-inspector
  • npm
    price-scripping-js 1.1.2
    MAL-2026-14272 amazon-inspector, ghsa-malware
  • npm
    rand-txs-sdk 1.0.3
    MAL-2026-14273 amazon-inspector
  • npm
    karma-proxy 1.0.0
    MAL-2026-14267 amazon-inspector
  • npm
    easydsbots 1.0.0
    MAL-2026-14265 amazon-inspector
  • npm
    no-for-of-loops 1.0.1
    MAL-2026-14268 amazon-inspector, ghsa-malware
  • npm
    novel-suduko 1.0.1
    MAL-2026-14269 amazon-inspector
  • npm
    de-morgan 2.1.3
    MAL-2026-14264 amazon-inspector, ghsa-malware
  • npm
    electron-sessions 0.1.5
    MAL-2026-14266 amazon-inspector
  • npm
    arb-kit 1.0.1
    MAL-2026-14263 amazon-inspector
  • npm
    postcss-initialize-provider 3.0.4
    MAL-2026-14261 amazon-inspector
  • npm
    pump-fun-skills 20.1.1
    MAL-2026-14262 amazon-inspector
  • npm
    modsync 5.0.2
    MAL-2026-14257 amazon-inspector
  • npm
    api-rs-tuils 2.1.6
    MAL-2026-14256 amazon-inspector
  • npm
    ranux-dev 5.0.0
    MAL-2026-14259 amazon-inspector
  • npm
    ranux-cloud 1.0.0
    MAL-2026-14258 amazon-inspector
  • npm
    ranux-pro 2.0.0
    MAL-2026-14260 amazon-inspector
  • npm
    react-dom-helpers 3.3.3
    MAL-2026-14253 amazon-inspector
  • npm
    saaa9 1.0.0
    MAL-2026-14254 amazon-inspector