Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,378 npm 223,239 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,378 reports · Feed

  • npm
    spf-analytics 1.0.0
    MAL-2026-14486 amazon-inspector, ghsa-malware
  • npm
    secretkey-2fa 1.0.0, 1.0.1
    MAL-2026-14485 amazon-inspector
  • npm
    spotify-url-resolovela 3.4.2
    MAL-2026-14487 amazon-inspector
  • npm
    vite-plugin-images-analysis 1.0.0
    MAL-2026-14482 amazon-inspector
  • npm
    vite-plugin-image-tracker 1.0.0, 1.1.0
    MAL-2026-14481 amazon-inspector
  • npm
    vite-plugin-bug-tracker 1.0.0, 1.1.0
    MAL-2026-14479 amazon-inspector
  • npm
    vite-plugin-image-analysis 1.1.0, 1.0.0, 1.1.2
    MAL-2026-14480 amazon-inspector
  • npm
    mham-js 1.0.4
    MAL-2026-14478 amazon-inspector
  • npm
    js-soul 1.0.4
    MAL-2026-14477 amazon-inspector
  • npm
    ecobee-home 0.0.2, 0.0.1
    MAL-2026-14475 amazon-inspector, ghsa-malware
  • npm
    ecobee2 0.0.2, 0.0.1
    MAL-2026-14476 amazon-inspector, ghsa-malware
  • npm
    ecobee-api 0.0.2, 0.0.1
    MAL-2026-14474 amazon-inspector, ghsa-malware
  • npm
    css-import-order 1.1.0
    MAL-2026-14473 amazon-inspector, ghsa-malware
  • npm
    cscasereadserv-paypal 3.4.3
    MAL-2026-14472 amazon-inspector
  • npm
    cat-embed-i18n-res 1.0.0
    MAL-2026-14471 amazon-inspector
  • npm
    whatsgoodlookingbabycreed 1.0.0
    MAL-2026-14470 ghsa-malware, amazon-inspector
  • npm
    tungtungisgoated 1.0.0
    MAL-2026-14469 ghsa-malware, amazon-inspector
  • npm
    tungtunggod 1.0.0
    MAL-2026-14468 ghsa-malware, amazon-inspector
  • npm
    superdupertest111 1.0.0
    MAL-2026-14467 ghsa-malware, amazon-inspector
  • npm
    sonsonsahur 1.0.0
    MAL-2026-14466 ghsa-malware, amazon-inspector
  • npm
    schoolwork 1.0.0
    MAL-2026-14465 ghsa-malware, amazon-inspector
  • npm
    schoollesson 1.0.0
    MAL-2026-14464 ghsa-malware, amazon-inspector
  • npm
    schoolhomework 1.0.0
    MAL-2026-14463 ghsa-malware, amazon-inspector
  • npm
    pleasedoyourhomework 1.0.0
    MAL-2026-14462 ghsa-malware, amazon-inspector
  • npm
    iwantaburger 1.0.0
    MAL-2026-14461 ghsa-malware, amazon-inspector
  • npm
    ilovedesmos 1.0.0
    MAL-2026-14460 ghsa-malware, amazon-inspector
  • npm
    iamhungryrn 1.0.0
    MAL-2026-14459 ghsa-malware, amazon-inspector
  • npm
    desmoswork 1.0.0
    MAL-2026-14458 ghsa-malware, amazon-inspector
  • npm
    desmosschoolwork 1.0.0
    MAL-2026-14457 ghsa-malware, amazon-inspector
  • npm
    desmosmathwork 1.0.0
    MAL-2026-14456 ghsa-malware, amazon-inspector
  • npm
    desmosistuff 1.0.0
    MAL-2026-14455 ghsa-malware, amazon-inspector
  • npm
    desmosisfire 1.0.0
    MAL-2026-14454 ghsa-malware, amazon-inspector
  • npm
    desmoshomework 1.0.0
    MAL-2026-14453 ghsa-malware, amazon-inspector
  • npm
    desmosclasswork 1.0.0
    MAL-2026-14452 ghsa-malware, amazon-inspector
  • npm
    classwork all versions
    MAL-2026-14451 ghsa-malware
  • npm
    classroomwork 1.0.0
    MAL-2026-14450 ghsa-malware, amazon-inspector
  • npm
    classroomlesson 1.0.0
    MAL-2026-14449 ghsa-malware, amazon-inspector
  • npm
    classroomhomework 1.0.0
    MAL-2026-14448 ghsa-malware, amazon-inspector
  • npm
    classlesson 1.0.0
    MAL-2026-14447 ghsa-malware, amazon-inspector
  • npm
    classhomework 1.0.0
    MAL-2026-14446 ghsa-malware, amazon-inspector