Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

  • npm
    lodsh-cli 1.0.0
    MAL-2026-14184 amazon-inspector
  • npm
    comand 1.0.0
    MAL-2026-14169 amazon-inspector
  • npm
    lodahs-cli 1.0.0
    MAL-2026-14180 amazon-inspector
  • npm
    chalk-lib 1.0.0
    MAL-2026-14167 amazon-inspector
  • npm
    chalk-util 1.0.0
    MAL-2026-14168 amazon-inspector
  • npm
    lodash-lib 1.0.0
    MAL-2026-14182 amazon-inspector
  • npm
    chalk-core 1.0.0
    MAL-2026-14165 amazon-inspector
  • npm
    sui-move-gql 1.0.2
    MAL-2026-14188 amazon-inspector
  • npm
    chalk-es 1.0.0
    MAL-2026-14166 amazon-inspector
  • npm
    commandor-core 1.0.0
    MAL-2026-14173 amazon-inspector
  • npm
    @evial/runtime-health 1.0.1
    MAL-2026-14159 amazon-inspector
  • npm
    commandor-cli 1.0.0
    MAL-2026-14172 amazon-inspector
  • npm
    comander-lib 1.0.0
    MAL-2026-14171 amazon-inspector
  • npm
    dev-env-check 1.0.3
    MAL-2026-14176 amazon-inspector
  • npm
    axois-http 1.0.0
    MAL-2026-14163 amazon-inspector
  • npm
    loadashjs 1.0.0
    MAL-2026-14179 amazon-inspector
  • npm
    ladash-cli 1.0.0
    MAL-2026-14178 amazon-inspector
  • npm
    commandorjs 1.0.0
    MAL-2026-14174 amazon-inspector
  • npm
    bqq1 1.0.0
    MAL-2026-14164 amazon-inspector
  • npm
    pump-segments-sdk 20.1.1
    MAL-2026-14186 amazon-inspector
  • npm
    comander-cli 1.0.0
    MAL-2026-14170 amazon-inspector
  • npm
    axious-core 1.0.0
    MAL-2026-14162 amazon-inspector
  • npm
    lodahsjs 1.0.0
    MAL-2026-14181 amazon-inspector
  • npm
    mutex-thread 1.3.0
    MAL-2026-14185 amazon-inspector
  • npm
    @library-dev-team/data-sanitizer 1.3.0
    MAL-2026-14160 amazon-inspector
  • npm
    fast-glob-fast 11.0.0, 9.0.0, 4.0.1, 10.0.0, 0.2.0, 8.0.0
    MAL-2026-14177 amazon-inspector
  • npm
    testingsmthb1g 1.0.0
    MAL-2026-14142 amazon-inspector
  • npm
    test-npm-snurkeburk-hackerone 1.999.0
    MAL-2026-14141 amazon-inspector
  • npm
    typscript-core 1.0.0
    MAL-2026-14157 amazon-inspector
  • npm
    typscript-cli 1.0.0
    MAL-2026-14156 amazon-inspector
  • npm
    typesript-cli 1.0.0
    MAL-2026-14154 amazon-inspector
  • npm
    typesript-core 1.0.0
    MAL-2026-14155 amazon-inspector
  • npm
    typescrit-cli 1.0.0
    MAL-2026-14153 amazon-inspector
  • npm
    typescriptt-core 1.0.0
    MAL-2026-14152 amazon-inspector
  • npm
    typescirpt-core 1.0.0
    MAL-2026-14149 amazon-inspector
  • npm
    typescrip-cli 1.0.0
    MAL-2026-14150 amazon-inspector
  • npm
    typescirpt-cli 1.0.0
    MAL-2026-14148 amazon-inspector
  • npm
    typescriptt-cli 1.0.0
    MAL-2026-14151 amazon-inspector
  • npm
    tyepescript-core 1.0.0
    MAL-2026-14144 amazon-inspector
  • npm
    typecript-cli 1.0.0
    MAL-2026-14145 amazon-inspector