Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

  • npm
    eslint-config-consumerweb all versions
    MAL-2026-14311 ghsa-malware
  • npm
    bunnyhijack-test-0x00 1.0.0, 1.0.1
    MAL-2026-14310 ghsa-malware, amazon-inspector
  • npm
    @idanefraim/my-ui-kit all versions
    MAL-2026-14309 ghsa-malware
  • npm
    evm-validation 1.0.3, 1.0.2, 1.0.4
    MAL-2026-14301 amazon-inspector, ghsa-malware
  • npm
    eth-react-provider 1.0.0
    MAL-2026-14300 amazon-inspector, ghsa-malware
  • npm
    emoji-prints-fancy 5.6.4
    MAL-2026-14298 amazon-inspector, ghsa-malware
  • npm
    gear-composer 1.0.126
    MAL-2026-14299 amazon-inspector
  • npm
    gfff5 1.0.0
    MAL-2026-14296 amazon-inspector
  • npm
    homekit-mcp 1.0.0
    MAL-2026-14297 amazon-inspector
  • npm
    anhn-cli 1.1.4
    MAL-2026-14290 amazon-inspector, ghsa-malware
  • npm
    @wizloft/harness-plugin-repository-files 0.1.1-alpha.3
    MAL-2026-14288 amazon-inspector, ghsa-malware
  • npm
    @wizloft/harness-kernel 0.1.1-alpha.3
    MAL-2026-14287 amazon-inspector, ghsa-malware
  • npm
    @wizloft/harness-validation 0.1.1-alpha.3
    MAL-2026-14289 amazon-inspector, ghsa-malware
  • npm
    @wizloft/harness 0.1.1-alpha.3
    MAL-2026-14285 amazon-inspector, ghsa-malware
  • npm
    @wizloft/harness-context 0.1.1-alpha.3
    MAL-2026-14286 amazon-inspector, ghsa-malware
  • npm
    log-res 1.0.3
    MAL-2026-14292 amazon-inspector
  • npm
    mc-registry 1.0.8, 1.0.9, 1.0.10
    MAL-2026-14294 amazon-inspector, ghsa-malware
  • npm
    libas-signal 1.0.0
    MAL-2026-14291 amazon-inspector
  • npm
    matrixflow-js 3.2.1
    MAL-2026-14293 amazon-inspector
  • npm
    mcp-dev-toolkit 1.5.0
    MAL-2026-14295 amazon-inspector
  • npm
    layer2-sdk 1.0.0, 1.0.1
    MAL-2026-14278 amazon-inspector
  • npm
    neverthrow-core 1.1.2
    MAL-2026-14283 amazon-inspector
  • npm
    localize-translate 1.0.0
    MAL-2026-14279 amazon-inspector
  • npm
    mutex-plus 3.0.2
    MAL-2026-14282 amazon-inspector
  • npm
    mutex-lite 1.4.2
    MAL-2026-14281 amazon-inspector
  • npm
    mutex-core 2.1.2
    MAL-2026-14280 amazon-inspector
  • npm
    nibra1 1.0.0
    MAL-2026-14284 amazon-inspector
  • npm
    node_cryptography 1.0.0
    MAL-2026-14276 amazon-inspector
  • npm
    minequest 0.1.1
    MAL-2026-14275 amazon-inspector
  • npm
    o0o9 1.8.0, 2.0.1, 1.0.3, 1.3.0, 1.0.7, 1.2.1, 2.0.0, 1.0.0, 2.0.2, 1.0.8, 1.8.1, 1.…
    MAL-2026-14277 amazon-inspector, ghsa-malware
  • npm
    nodealpha 1.0.7
    MAL-2026-14270 amazon-inspector
  • npm
    nodeberlin 1.0.7
    MAL-2026-14271 amazon-inspector
  • npm
    price-scripping-js 1.1.2
    MAL-2026-14272 amazon-inspector, ghsa-malware
  • npm
    rand-txs-sdk 1.0.3
    MAL-2026-14273 amazon-inspector
  • PyPI
    reqcrypt-dev 0.1.0
    MAL-2026-14274 kam193, amazon-inspector
  • npm
    karma-proxy 1.0.0
    MAL-2026-14267 amazon-inspector
  • npm
    easydsbots 1.0.0
    MAL-2026-14265 amazon-inspector
  • npm
    no-for-of-loops 1.0.1
    MAL-2026-14268 amazon-inspector, ghsa-malware
  • npm
    novel-suduko 1.0.1
    MAL-2026-14269 amazon-inspector
  • npm
    de-morgan 2.1.3
    MAL-2026-14264 amazon-inspector, ghsa-malware