Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,382 npm 223,243 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,382 reports · Feed

  • npm
    mnhdjoweuq 1.0.0
    MAL-2026-13822 ghsa-malware, amazon-inspector
  • npm
    khanbmnxls 1.0.0
    MAL-2026-13820 ghsa-malware, amazon-inspector
  • npm
    hxckdoeaqjlc8 1.0.0
    MAL-2026-13816 ghsa-malware, amazon-inspector
  • npm
    hlksdcixycvf 1.0.0
    MAL-2026-13814 ghsa-malware, amazon-inspector
  • npm
    hcfguyfrmblp 1.0.0
    MAL-2026-13811 ghsa-malware, amazon-inspector
  • npm
    fghvbmniwu 1.0.1, 1.0.0
    MAL-2026-13808 ghsa-malware, amazon-inspector
  • npm
    cvvkshuelwiu 1.0.0
    MAL-2026-13800 ghsa-malware, amazon-inspector
  • npm
    cvmbxcjiasdg 1.0.0, 1.0.1
    MAL-2026-13799 ghsa-malware, amazon-inspector
  • npm
    cvjwyinkpas all versions
    MAL-2026-13798 ghsa-malware
  • npm
    cvbniydplwe3 1.0.0
    MAL-2026-13797 ghsa-malware, amazon-inspector
  • npm
    cvbmxiowkwqla6 1.0.0
    MAL-2026-13796 ghsa-malware, amazon-inspector
  • npm
    clxofwfjskaz7 1.0.0
    MAL-2026-13794 ghsa-malware, amazon-inspector
  • npm
    bgzxcuite2 1.0.0
    MAL-2026-13785 ghsa-malware, amazon-inspector
  • npm
    bgncvhferucfds 1.0.0, 1.0.1
    MAL-2026-13784 ghsa-malware, amazon-inspector
  • npm
    yangming8 1.0.0
    MAL-2026-13846 ghsa-malware, amazon-inspector
  • npm
    yangming708 1.0.0
    MAL-2026-13845 ghsa-malware, amazon-inspector
  • npm
    thundertiger 1.0.0
    MAL-2026-13834 ghsa-malware, amazon-inspector
  • npm
    nhdxzthponv5 1.0.0
    MAL-2026-13829 ghsa-malware, amazon-inspector
  • npm
    ms_aidc_com_tw 1.0.0
    MAL-2026-13828 ghsa-malware, amazon-inspector
  • npm
    mnchfnvbue1 1.0.0
    MAL-2026-13821 ghsa-malware, amazon-inspector
  • npm
    jhkxcixudnvm1 1.0.1, 1.0.0
    MAL-2026-13817 ghsa-malware, amazon-inspector
  • npm
    hfkcdyuwbdx1 1.0.0
    MAL-2026-13812 ghsa-malware, amazon-inspector
  • npm
    gdwkh6vcbu 1.0.0
    MAL-2026-13810 ghsa-malware, amazon-inspector
  • npm
    fhj8cv9dkwm4 1.0.0
    MAL-2026-13809 ghsa-malware, amazon-inspector
  • npm
    fdhcvriwecv3 1.0.0
    MAL-2026-13807 ghsa-malware, amazon-inspector
  • npm
    dhjksficgwu2 1.0.0
    MAL-2026-13802 ghsa-malware, amazon-inspector
  • npm
    cxcbdjxcmncvfg2 1.0.0
    MAL-2026-13801 ghsa-malware, amazon-inspector
  • npm
    csbcldfvivwfgd4 1.0.0
    MAL-2026-13795 ghsa-malware, amazon-inspector
  • npm
    cjdfswifuem3 1.0.0
    MAL-2026-13793 ghsa-malware, amazon-inspector
  • npm
    chmjdsidwlf5 1.0.0
    MAL-2026-13792 ghsa-malware, amazon-inspector
  • npm
    bvdfhdfvnk3 1.0.0
    MAL-2026-13790 ghsa-malware, amazon-inspector
  • npm
    bcnfjndwbkf2 1.0.0
    MAL-2026-13783 ghsa-malware, amazon-inspector
  • npm
    jkbnwsdf8 1.0.1, 1.0.0, 1.0.2
    MAL-2026-13818 ghsa-malware, amazon-inspector
  • npm
    hngfykuvgh4 1.0.0
    MAL-2026-13815 ghsa-malware, amazon-inspector
  • npm
    hgdvfuflnb 1.0.0
    MAL-2026-13813 ghsa-malware, amazon-inspector
  • npm
    china_airlines 1.0.0
    MAL-2026-13791 ghsa-malware, amazon-inspector
  • npm
    bmgki3g6fh3 1.0.0
    MAL-2026-13789 ghsa-malware, amazon-inspector
  • npm
    bikliwrapper 1.0.0, 1.0.2, 1.0.1
    MAL-2026-13788 ghsa-malware, amazon-inspector
  • npm
    biklirouter 0.5.47, 0.5.46
    MAL-2026-13787 ghsa-malware, amazon-inspector
  • npm
    biklimaster 1.1.4, 1.0.0, 1.1.3
    MAL-2026-13786 ghsa-malware, amazon-inspector