Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

  • npm
    autoai all versions
    MAL-2026-14104 ghsa-malware
  • npm
    @junofficial/baileys all versions
    MAL-2026-14101 ghsa-malware
  • npm
    a.poltoradnev-package-a 0.0.1
    MAL-2026-14103 ghsa-malware, amazon-inspector
  • npm
    @siwatfa/yorn 0.0.43, 1.0.40, 1.0.3, 1.0.26, 1.0.81, 1.0.67, 1.0.48, 0.0.31, 1.0.74, 0.0.1, 1…
    MAL-2026-14102 ghsa-malware, amazon-inspector
  • npm
    runtime-health 1.0.2, 1.0.4, 1.0.1
    MAL-2026-14116 ossf-package-analysis
  • npm
    @ai-vertical/ai-agent 1.0.1, 1.0.0
    MAL-2026-14070 ghsa-malware, amazon-inspector
  • PyPI
    kb-ai 0.1.0, 0.1.1
    MAL-2026-14069 kam193, amazon-inspector
  • npm
    depcruise-wrap-stream-in-html 99.9.1
    MAL-2026-14068 amazon-inspector, ghsa-malware
  • npm
    upload-to-gcp 3.2.1
    MAL-2026-14067 amazon-inspector
  • npm
    akamaijs-sensorv1 3.0.0
    MAL-2026-14066 amazon-inspector, reversing-labs
  • npm
    akamai-sensor 1.0.0
    MAL-2026-14065 amazon-inspector, reversing-labs
  • npm
    @finaxis/common-js 0.3.4, 0.3.6, 0.3.10, 0.3.8, 0.3.5
    MAL-2026-14064 amazon-inspector
  • npm
    adxaa 1.0.0
    MAL-2026-14058 amazon-inspector
  • npm
    @openrepl/shared 0.0.5, 0.0.4
    MAL-2026-14057 amazon-inspector
  • npm
    fastly-vcl-language-client 1.0.0
    MAL-2026-14060 amazon-inspector
  • npm
    twilio-hackerone-poc-afe6937c 1.0.0, 1.0.3, 1.0.2, 1.0.4, 1.0.1
    MAL-2026-14063 amazon-inspector
  • npm
    hunterone-build-probe-9210 1.0.5, 1.0.3, 1.0.6, 1.0.1, 1.0.0, 1.0.2, 1.0.7, 1.0.4
    MAL-2026-14061 amazon-inspector
  • npm
    tw-pkgprobe-7731 1.0.5, 1.1.1, 1.0.3, 1.0.0, 1.1.0, 1.0.1, 1.0.7, 1.0.4, 1.0.6
    MAL-2026-14062 amazon-inspector
  • npm
    autbank-core 99.0.0, 99.0.2
    MAL-2026-14059 amazon-inspector
  • npm
    gunzip-js 99.9.1
    MAL-2026-14056 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    depcruise-fmt 99.9.1
    MAL-2026-14054 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    depcruise-baseline 99.9.1
    MAL-2026-14053 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    harmony-app-toolkit 22.0.0, 21.0.0
    MAL-2026-14055 ossf-package-analysis, amazon-inspector
  • npm
    require-i18next 20.0.0, 21.0.0
    MAL-2026-14052 ossf-package-analysis, amazon-inspector
  • npm
    svelte-goal-vim 1.0.0
    MAL-2026-14096 ghsa-malware, amazon-inspector
  • npm
    kit-hydration-vim 1.0.0
    MAL-2026-14086 ghsa-malware, amazon-inspector
  • npm
    @velliajs/discord 1.0.5, 1.0.4, 1.0.3, 1.0.6, 1.0.7
    MAL-2026-14051 amazon-inspector, ghsa-malware
  • npm
    sui-gql-lite 0.2.0, 0.1.0
    MAL-2026-14095 ghsa-malware, amazon-inspector
  • npm
    bcs-mini 1.0.1, 1.0.0
    MAL-2026-14076 ghsa-malware, amazon-inspector
  • npm
    @peptideventure/peptide-unit all versions
    MAL-2026-14072 ghsa-malware
  • npm
    @peptideventure/peptide-score-modifier 1.0.5, 1.0.4
    MAL-2026-14071 ghsa-malware, amazon-inspector
  • npm
    @polymarkets/clob-client-v2 1.0.6
    MAL-2026-14050 amazon-inspector, ghsa-malware
  • npm
    @mexc/shared-utils 1.0.0
    MAL-2026-14049 amazon-inspector
  • npm
    @lodash-js/lodash-js 0.1.0, 0.2.0, 0.3.0
    MAL-2026-14048 amazon-inspector
  • npm
    @guangnao/agent-proxy 1.2.1, 1.4.2, 1.4.0
    MAL-2026-14047 amazon-inspector
  • npm
    @ghost_debugger/nanocache 0.1.1
    MAL-2026-14046 amazon-inspector
  • npm
    @ferudionz/webautomation 1.0.0
    MAL-2026-14045 amazon-inspector
  • npm
    @ferudionz/web_logger_js 1.0.0
    MAL-2026-14044 amazon-inspector
  • npm
    @divineubg/divine 1.0.5
    MAL-2026-14043 amazon-inspector
  • npm
    @devmikets/hyperliquid-sdk 1.9.6
    MAL-2026-14042 amazon-inspector, ghsa-malware