Skip to content
OpenAdvisories

Supply chain

Malicious packages · npm

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,465 npm 223,299 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

223,299 reports · Feed

  • npm
    autbank-core 99.0.0, 99.0.2
    MAL-2026-14059 amazon-inspector
  • npm
    gunzip-js 99.9.1
    MAL-2026-14056 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    depcruise-fmt 99.9.1
    MAL-2026-14054 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    depcruise-baseline 99.9.1
    MAL-2026-14053 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    harmony-app-toolkit 22.0.0, 21.0.0
    MAL-2026-14055 ossf-package-analysis, amazon-inspector
  • npm
    require-i18next 20.0.0, 21.0.0
    MAL-2026-14052 ossf-package-analysis, amazon-inspector
  • npm
    svelte-goal-vim 1.0.0
    MAL-2026-14096 ghsa-malware, amazon-inspector
  • npm
    kit-hydration-vim 1.0.0
    MAL-2026-14086 ghsa-malware, amazon-inspector
  • npm
    @velliajs/discord 1.0.5, 1.0.4, 1.0.3, 1.0.6, 1.0.7
    MAL-2026-14051 amazon-inspector, ghsa-malware
  • npm
    sui-gql-lite 0.2.0, 0.1.0
    MAL-2026-14095 ghsa-malware, amazon-inspector
  • npm
    bcs-mini 1.0.1, 1.0.0
    MAL-2026-14076 ghsa-malware, amazon-inspector
  • npm
    @peptideventure/peptide-unit all versions
    MAL-2026-14072 ghsa-malware
  • npm
    @peptideventure/peptide-score-modifier 1.0.5, 1.0.4
    MAL-2026-14071 ghsa-malware, amazon-inspector
  • npm
    @polymarkets/clob-client-v2 1.0.6
    MAL-2026-14050 amazon-inspector, ghsa-malware
  • npm
    @mexc/shared-utils 1.0.0
    MAL-2026-14049 amazon-inspector
  • npm
    @lodash-js/lodash-js 0.1.0, 0.2.0, 0.3.0
    MAL-2026-14048 amazon-inspector
  • npm
    @guangnao/agent-proxy 1.2.1, 1.4.2, 1.4.0
    MAL-2026-14047 amazon-inspector
  • npm
    @ghost_debugger/nanocache 0.1.1
    MAL-2026-14046 amazon-inspector
  • npm
    @ferudionz/webautomation 1.0.0
    MAL-2026-14045 amazon-inspector
  • npm
    @ferudionz/web_logger_js 1.0.0
    MAL-2026-14044 amazon-inspector
  • npm
    @divineubg/divine 1.0.5
    MAL-2026-14043 amazon-inspector
  • npm
    @devmikets/hyperliquid-sdk 1.9.6
    MAL-2026-14042 amazon-inspector, ghsa-malware
  • npm
    @demopack/www 0.0.12
    MAL-2026-14041 amazon-inspector
  • npm
    @cdnshell/loader 0.0.13, 0.0.19, 0.0.18, 0.0.16, 0.0.14, 0.0.15, 0.0.20
    MAL-2026-14039 amazon-inspector
  • npm
    @workoscalifant/sudoku-term 1.1.4, 1.1.5, 1.1.3, 1.1.1, 1.1.7, 1.1.2, 1.1.8
    MAL-2026-14040 amazon-inspector
  • npm
    axios-fast 1.0.0, 1.0.1
    MAL-2026-14029 amazon-inspector
  • npm
    alelo-auth 99.0.0, 99.0.2
    MAL-2026-14021 amazon-inspector, reversing-labs
  • npm
    alelo-api 99.0.0, 99.0.2
    MAL-2026-14020 amazon-inspector, reversing-labs
  • npm
    alelo-sdk 99.0.0, 99.0.2
    MAL-2026-14026 amazon-inspector, reversing-labs
  • npm
    datefmt-core-utils 1.0.0
    MAL-2026-14031 amazon-inspector
  • npm
    datefmt-simple-utils 1.0.0
    MAL-2026-14032 amazon-inspector
  • npm
    alelo-utils 99.0.0, 99.0.2
    MAL-2026-14028 amazon-inspector, reversing-labs
  • npm
    tailwind-plugin-kit 1.3.2
    MAL-2026-14037 amazon-inspector
  • npm
    alelo-payment 99.0.2, 99.0.0
    MAL-2026-14025 amazon-inspector, reversing-labs
  • npm
    alelo-common 99.0.0, 99.0.2
    MAL-2026-14023 amazon-inspector, reversing-labs
  • npm
    meualelo 99.0.0, 99.0.2
    MAL-2026-14033 amazon-inspector, reversing-labs
  • npm
    tailwind-toolkit 1.3.2
    MAL-2026-14038 amazon-inspector
  • npm
    bootstrap-custom-ui 5.7.2
    MAL-2026-14030 amazon-inspector
  • npm
    alelo-core 99.0.2, 99.0.0, 99.0.1
    MAL-2026-14024 amazon-inspector, reversing-labs
  • npm
    alelo-services 99.0.2, 99.0.0
    MAL-2026-14027 amazon-inspector, reversing-labs