Supply chain
Malicious packages
Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.
Source: OpenSSF Malicious Packages via OSV.dev
240,383 reports · Feed
- npm
- npm
- npm
- npm
- npm
- npm
-
npm
twork-data-services-proxy-prime-api-v1-account-overdraft-info 20.7.4MAL-2026-12299 amazon-inspector, ghsa-malware
-
npm
twork-data-services-sme-operations-authorizations 20.8.9MAL-2026-12302 amazon-inspector, ghsa-malware
-
npm
twork-data-services-aggregator-company-sme-main-timeline-loader-with-customers 20.3.8MAL-2026-12287 amazon-inspector, ghsa-malware
- npm
-
npm
twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config 20.6.1MAL-2026-12294 amazon-inspector
- npm
- npm
- npm
- npm
-
npm
twork-data-services-eacq-company-service-v2-api-v1-identifiers-crm 20.6.7MAL-2026-12291 amazon-inspector, ghsa-malware
- npm
-
npm
twork-data-services-proxy-b2b-crm-api-v1-partners-companies-info 20.5.1MAL-2026-12297 amazon-inspector, ghsa-malware
- npm
-
npm
twork-data-services-customer-api-v2-customer-vip-status 20.9.7MAL-2026-12290 amazon-inspector, ghsa-malware
- npm
- npm
-
npm
statist-browser-typed-client-mb.product.analytics 20.1.2MAL-2026-12211 amazon-inspector, ghsa-malware
-
npm
statist-browser-typed-client-mb.product.payments 20.1.9MAL-2026-12212 amazon-inspector, ghsa-malware
- npm
-
npm
a.poltoradnev-package-c 6.1.9, 33.9.5, 6.1.10, 0.0.2, 6.1.11, 6.1.12, 12.8.5, 0.0.1MAL-2026-12127 amazon-inspector, ghsa-malware
- npm
- npm
- npm
- npm
- npm
- npm
- npm
- npm
-
npm
statist-browser-typed-client-investing.product.loginandauthorization 20.7.3MAL-2026-12210 amazon-inspector, ghsa-malware
- npm
- npm
-
npm
twork-data-services-procedure-engine-api-v1-procedure-info 20.6.9MAL-2026-12295 amazon-inspector, ghsa-malware
- npm
- npm