Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

  • npm
    @demopack/www 0.0.12
    MAL-2026-14041 amazon-inspector
  • npm
    @cdnshell/loader 0.0.13, 0.0.19, 0.0.18, 0.0.16, 0.0.14, 0.0.15, 0.0.20
    MAL-2026-14039 amazon-inspector
  • npm
    @workoscalifant/sudoku-term 1.1.4, 1.1.5, 1.1.3, 1.1.1, 1.1.7, 1.1.2, 1.1.8
    MAL-2026-14040 amazon-inspector
  • npm
    axios-fast 1.0.0, 1.0.1
    MAL-2026-14029 amazon-inspector
  • npm
    alelo-auth 99.0.0, 99.0.2
    MAL-2026-14021 amazon-inspector, reversing-labs
  • npm
    alelo-api 99.0.0, 99.0.2
    MAL-2026-14020 amazon-inspector, reversing-labs
  • npm
    alelo-sdk 99.0.0, 99.0.2
    MAL-2026-14026 amazon-inspector, reversing-labs
  • npm
    datefmt-core-utils 1.0.0
    MAL-2026-14031 amazon-inspector
  • npm
    datefmt-simple-utils 1.0.0
    MAL-2026-14032 amazon-inspector
  • npm
    alelo-utils 99.0.0, 99.0.2
    MAL-2026-14028 amazon-inspector, reversing-labs
  • npm
    tailwind-plugin-kit 1.3.2
    MAL-2026-14037 amazon-inspector
  • npm
    alelo-payment 99.0.2, 99.0.0
    MAL-2026-14025 amazon-inspector, reversing-labs
  • npm
    alelo-common 99.0.0, 99.0.2
    MAL-2026-14023 amazon-inspector, reversing-labs
  • npm
    meualelo 99.0.0, 99.0.2
    MAL-2026-14033 amazon-inspector, reversing-labs
  • npm
    tailwind-toolkit 1.3.2
    MAL-2026-14038 amazon-inspector
  • npm
    bootstrap-custom-ui 5.7.2
    MAL-2026-14030 amazon-inspector
  • npm
    alelo-core 99.0.2, 99.0.0, 99.0.1
    MAL-2026-14024 amazon-inspector, reversing-labs
  • npm
    alelo-services 99.0.2, 99.0.0
    MAL-2026-14027 amazon-inspector, reversing-labs
  • npm
    notafollower1226 1.0.3, 1.0.5, 1.0.2, 1.0.1, 1.0.0, 1.0.4
    MAL-2026-14036 amazon-inspector
  • npm
    alelo-client 99.0.0, 99.0.2
    MAL-2026-14022 amazon-inspector, reversing-labs
  • npm
    notafollower122 1.0.6, 1.0.1, 1.0.4, 1.0.7, 1.0.5, 1.0.2, 1.0.0, 1.0.3
    MAL-2026-14035 amazon-inspector
  • npm
    notafollower1 1.0.1, 1.0.13, 1.0.3, 1.0.8, 1.0.7, 1.0.5, 1.0.11, 1.0.12, 1.0.9, 1.0.4, 1.0.6,…
    MAL-2026-14034 amazon-inspector
  • npm
    heft-storybook-v6-react-tutorial-storykit 1000.0.16, 1000.0.13
    MAL-2026-14083 ghsa-malware, reversing-labs
  • npm
    ak-mal-test-poc 1.0.3
    MAL-2026-14075 ghsa-malware
  • npm
    game_overlay 8.5.8
    MAL-2026-14081 ghsa-malware, reversing-labs
  • npm
    pocbitbarrontest 1.0.0
    MAL-2026-14091 ghsa-malware
  • npm
    zip-bundle 7.3.1
    MAL-2026-14099 ghsa-malware, reversing-labs
  • npm
    dinotech-auth-utils 99.9.9, 10.1.1, 10.1.0, 10.0.8, 10.0.6, 10.0.5, 10.0.0
    MAL-2026-14077 ghsa-malware, reversing-labs
  • npm
    @veertly/web-app 100.0.2, 100.0.0, 99.9.9
    MAL-2026-14073 ghsa-malware, reversing-labs
  • npm
    @vyzensockets/baileys 0.3.2, 0.3.1, 0.2.5-B, 0.2.5, 0.2.4, 0.2.3, 0.2.2, 0.2.1, 0.2.0, 0.1.0
    MAL-2026-14074 ghsa-malware
  • npm
    hrp9872 1.0.0
    MAL-2026-14085 ghsa-malware
  • npm
    hrp9871 1.0.0
    MAL-2026-14084 ghsa-malware
  • npm
    npm_pkg_1094 1.0.7
    MAL-2026-14090 ghsa-malware
  • npm
    npm_pkg_1093 1.0.7, 1.0.6, 1.0.5, 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0
    MAL-2026-14089 ghsa-malware
  • npm
    rimo-env-validator 1.0.1, 1.0.0
    MAL-2026-14092 ghsa-malware, reversing-labs
  • npm
    utils-bundle 8.1.6
    MAL-2026-14098 ghsa-malware, reversing-labs
  • npm
    elf-stats-cranberry-wishlist-933 1.0.2, 1.0.1, 2.0.0
    MAL-2026-14079 ghsa-malware, reversing-labs
  • npm
    elf-stats-caroling-stocking-510 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0
    MAL-2026-14078 ghsa-malware, reversing-labs
  • npm
    thepackagethatworks_ 1.0.2, 1.0.1, 1.0.0
    MAL-2026-14097 ghsa-malware
  • npm
    google-logging-utils-internal 1.1.4, 9.9.9, 1.1.3
    MAL-2026-14082 ghsa-malware, reversing-labs