Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,465 npm 223,299 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,299 reports · Feed

  • npm
    @reducers/projects all versions
    MAL-2026-14127 ghsa-malware
  • npm
    @guildai-services/guildai all versions
    MAL-2026-14125 ghsa-malware
  • npm
    @milleree/date-display all versions
    MAL-2026-14126 ghsa-malware
  • npm
    motionspring all versions
    MAL-2026-14128 ghsa-malware
  • npm
    alphazone all versions
    MAL-2026-14124 ghsa-malware
  • npm
    @oyo_tech/oyochat_user 100.0.0, 99.99.99
    MAL-2026-14123 ossf-package-analysis, amazon-inspector
  • npm
    bcc-design-icons 9999.0.0
    MAL-2026-14119 amazon-inspector, reversing-labs
  • npm
    bcc-design 9999.0.0
    MAL-2026-14117 amazon-inspector, reversing-labs
  • npm
    core-tailwindcss-utility 3.7.1
    MAL-2026-14118 amazon-inspector
  • npm
    blastradar 1.0.0
    MAL-2026-14120 ghsa-malware, amazon-inspector
  • npm
    ulebkit 1.0.1, 1.0.0
    MAL-2026-14122 ghsa-malware, amazon-inspector
  • npm
    sui-move-graphql 0.2.0, 0.2.1, 0.1.0
    MAL-2026-14121 ghsa-malware, amazon-inspector
  • npm
    sui-move-rpc 0.2.0, 0.1.0
    MAL-2026-14113 ghsa-malware, amazon-inspector
  • npm
    sui-gql-core 0.2.0, 0.1.0
    MAL-2026-14112 ghsa-malware, amazon-inspector
  • npm
    leb128x 1.0.1, 1.0.0
    MAL-2026-14109 ghsa-malware, amazon-inspector
  • npm
    bcs-core 1.0.0
    MAL-2026-14105 ghsa-malware, amazon-inspector
  • npm
    reseller-app 9.9.11
    MAL-2026-14110 ghsa-malware, reversing-labs
  • npm
    club-sauce 9.9.11
    MAL-2026-14107 ghsa-malware, reversing-labs
  • npm
    sugarball-cli 1.0.0
    MAL-2026-14111 ghsa-malware, amazon-inspector
  • npm
    cloud-agen-bot 1.0.0
    MAL-2026-14106 ghsa-malware, amazon-inspector
  • npm
    userbotjs-jun all versions
    MAL-2026-14115 ghsa-malware
  • npm
    userbotjs all versions
    MAL-2026-14114 ghsa-malware
  • npm
    junofficial-userbot all versions
    MAL-2026-14108 ghsa-malware
  • npm
    autoai all versions
    MAL-2026-14104 ghsa-malware
  • npm
    @junofficial/baileys all versions
    MAL-2026-14101 ghsa-malware
  • npm
    a.poltoradnev-package-a 0.0.1
    MAL-2026-14103 ghsa-malware, amazon-inspector
  • npm
    @siwatfa/yorn 0.0.43, 1.0.40, 1.0.3, 1.0.26, 1.0.81, 1.0.67, 1.0.48, 0.0.31, 1.0.74, 0.0.1, 1…
    MAL-2026-14102 ghsa-malware, amazon-inspector
  • npm
    runtime-health 1.0.2, 1.0.4, 1.0.1
    MAL-2026-14116 ossf-package-analysis
  • npm
    @ai-vertical/ai-agent 1.0.1, 1.0.0
    MAL-2026-14070 ghsa-malware, amazon-inspector
  • npm
    depcruise-wrap-stream-in-html 99.9.1
    MAL-2026-14068 amazon-inspector, ghsa-malware
  • npm
    upload-to-gcp 3.2.1
    MAL-2026-14067 amazon-inspector
  • npm
    akamaijs-sensorv1 3.0.0
    MAL-2026-14066 amazon-inspector, reversing-labs
  • npm
    akamai-sensor 1.0.0
    MAL-2026-14065 amazon-inspector, reversing-labs
  • npm
    @finaxis/common-js 0.3.4, 0.3.6, 0.3.10, 0.3.8, 0.3.5
    MAL-2026-14064 amazon-inspector
  • npm
    adxaa 1.0.0
    MAL-2026-14058 amazon-inspector
  • npm
    @openrepl/shared 0.0.5, 0.0.4
    MAL-2026-14057 amazon-inspector
  • npm
    fastly-vcl-language-client 1.0.0
    MAL-2026-14060 amazon-inspector
  • npm
    twilio-hackerone-poc-afe6937c 1.0.0, 1.0.3, 1.0.2, 1.0.4, 1.0.1
    MAL-2026-14063 amazon-inspector
  • npm
    hunterone-build-probe-9210 1.0.5, 1.0.3, 1.0.6, 1.0.1, 1.0.0, 1.0.2, 1.0.7, 1.0.4
    MAL-2026-14061 amazon-inspector
  • npm
    tw-pkgprobe-7731 1.0.5, 1.1.1, 1.0.3, 1.0.0, 1.1.0, 1.0.1, 1.0.7, 1.0.4, 1.0.6
    MAL-2026-14062 amazon-inspector