Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,383 npm 223,244 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,383 reports · Feed

  • npm
    widget-forge 9999.0.0
    MAL-2026-12815 amazon-inspector
  • npm
    messenger-style 1.0.1
    MAL-2026-12796 amazon-inspector, reversing-labs
  • npm
    npm-groat 1.1.2, 1.1.1
    MAL-2026-12798 amazon-inspector
  • npm
    glia-functions-tools 0.2.1, 1.2.1
    MAL-2026-12790 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    application_base 9999.0.0
    MAL-2026-12511 amazon-inspector
  • npm
    editor_application 9999.0.0
    MAL-2026-12788 amazon-inspector
  • npm
    tick-forge 11.5.2
    MAL-2026-13385 ghsa-malware, amazon-inspector
  • npm
    poly-provider-api 4.6.1
    MAL-2026-13381 ghsa-malware, amazon-inspector
  • npm
    knowledge-grader 1.0.1, 1.0.2
    MAL-2026-12795 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    the-search 1.0.1, 1.0.0
    MAL-2026-12810 amazon-inspector
  • npm
    dynstrg-howto 1.0.1, 1.1.1
    MAL-2026-12787 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    umber-root 1.1.0, 1.1.2
    MAL-2026-12814 amazon-inspector
  • npm
    ts-toolkit-plus 1.3.2
    MAL-2026-12812 amazon-inspector, ghsa-malware
  • npm
    sc-payment-utils 9999.0.0
    MAL-2026-12801 amazon-inspector
  • npm
    anthropic-setup 1.0.1, 1.0.0
    MAL-2026-12510 amazon-inspector, ghsa-malware
  • npm
    dust-helpers 9999.0.0
    MAL-2026-12786 amazon-inspector
  • npm
    crypto-checkout-api 1.0.0
    MAL-2026-12666 amazon-inspector, ghsa-malware
  • npm
    technical-challenge 1.0.1, 1.1.1
    MAL-2026-12809 amazon-inspector, ghsa-malware
  • npm
    @latlongid/location 1.0.1
    MAL-2026-12506 amazon-inspector
  • npm
    break-after 9999.0.0
    MAL-2026-12518 amazon-inspector
  • npm
    karapace-docs 1.0.1, 1.1.1
    MAL-2026-12794 amazon-inspector, ghsa-malware
  • npm
    shiftmarkets-sdk 2.1.0
    MAL-2026-12803 amazon-inspector
  • npm
    async-mutex-v3 3.1.0
    MAL-2026-12514 amazon-inspector, reversing-labs
  • npm
    poly-bbc-service 3.7.2
    MAL-2026-12799 amazon-inspector, reversing-labs
  • npm
    wolverinechat 1.0.1, 1.1.1
    MAL-2026-12816 amazon-inspector, ghsa-malware
  • npm
    @sapappgyver/appgyver-descriptors 9.9.11, 9.9.0
    MAL-2026-12507 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    streak-grid-core 1.0.0
    MAL-2026-12807 amazon-inspector, ghsa-malware
  • npm
    twilio-functions 99.99.99, 99.99.100
    MAL-2026-12813 amazon-inspector, reversing-labs
  • npm
    sc-font-icons 9999.0.0, 99.9.1
    MAL-2026-12800 amazon-inspector, ossf-package-analysis
  • npm
    store-locator-widget 9999.0.0
    MAL-2026-12804 amazon-inspector
  • npm
    @shiftmarkets/shift-exchange-root 3.9.9, 2.9.9, 1.9.9
    MAL-2026-12509 amazon-inspector
  • npm
    async-mutex-lock 5.3.1
    MAL-2026-12513 amazon-inspector, ghsa-malware
  • npm
    @shiftmarkets/no-brainer-sdk 1.0.18
    MAL-2026-12508 amazon-inspector
  • npm
    dbk-ui-forms 99.0.1, 99.0.0
    MAL-2026-12669 amazon-inspector, reversing-labs
  • npm
    appsignal 9999.0.0
    MAL-2026-12512 amazon-inspector
  • npm
    @cy4dev/cydemo-bg-color 5.0.0, 7.0.0, 6.0.0, 4.0.0
    MAL-2026-12504 amazon-inspector
  • npm
    streak-core-bucket 1.0.0
    MAL-2026-12806 amazon-inspector, ghsa-malware
  • npm
    trailserver 1.0.5
    MAL-2026-12484 amazon-inspector
  • npm
    voicemail 1.0.1, 1.0.2
    MAL-2026-12496 amazon-inspector, reversing-labs
  • npm
    luluking 0.0.1
    MAL-2026-12397 amazon-inspector