Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,383 npm 223,244 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,383 reports · Feed

npm
@umacloud/cli-darwin-arm64 1.0.74
MAL-2026-11953 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/embed-svelte 1.1.4
MAL-2026-11791 amazon-inspector

Aug 4, 2026
npm
@qlik/dts-bundler 2.0.3
MAL-2026-11788 amazon-inspector

Aug 4, 2026
npm
@deliveroo/reevent 1.0.1
MAL-2026-11563

Aug 4, 2026
npm
@deliveroo/determinator 0.2.1
MAL-2026-11562

Aug 4, 2026
npm
@adminide-stack/clock-tik-browser 12.0.24
MAL-2026-11551 amazon-inspector

Aug 4, 2026
npm
@jsimplify/errno 2.0.7, 2.0.6, 2.0.8, 2.0.5, 2.0.1, 2.0.0
MAL-2026-12006 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
cors-version 1.0.2, 1.0.3, 1.0.5, 1.0.4, 1.0.1, 1.0.0
MAL-2026-12026 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
tailwind-anime 1.1.0, 1.1.1, 1.0.0, 0.0.1
MAL-2026-12027 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
server-hemera-mongo 0.0.12, 0.0.16
MAL-2026-11986 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@adminide-stack/yantra-mobile 12.0.33
MAL-2026-11552 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
workbench-browser-server 0.0.2
MAL-2026-11992 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@workbench-stack/core 3.9.8
MAL-2026-11961 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/nebula-table-utils 2.6.9
MAL-2026-11798 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-line-chart 2.7.1
MAL-2026-11575 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-layout-container 4.4.1
MAL-2026-11574 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/sprout-icons 0.12.3
MAL-2026-11807 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
http-metrics-middleware 2.2.2
MAL-2026-11975 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/sprout-design-docs 1.0.2
MAL-2026-11805 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/prettier-config 1.0.3
MAL-2026-11801 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/browserslist-config 3.0.2
MAL-2026-11784 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/api 2.14.2
MAL-2026-11783 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
qlik-modifiers 0.10.1
MAL-2026-11983 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/eslint-config-react 0.1.1
MAL-2026-11795 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
qlik-object-conversion 0.17.2
MAL-2026-11984 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/eslint-config-base 0.1.1
MAL-2026-11794 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-listbox 0.19.3
MAL-2026-11576 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
qlik-chart-modules 1.1.1
MAL-2026-11982 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/embed-runtime 1.6.4
MAL-2026-11790 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/carbon-core 2.1.1
MAL-2026-11785 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/carboncopy 1.1.6
MAL-2026-11786 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
example-js-project 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11
MAL-2026-11969 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/sprout-gesture 0.0.13
MAL-2026-11806 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/stardust 7.1.2
MAL-2026-11584 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/cli-serve 7.1.2
MAL-2026-11568 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
picasso-plugin-q 2.11.6
MAL-2026-11978 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/tsconfig 1.0.3
MAL-2026-11810 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/react-native-simple-grid 1.5.5
MAL-2026-11802 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/sdk 0.28.1
MAL-2026-11804 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-slider 0.20.1
MAL-2026-11581 ghsa-malware, amazon-inspector

Aug 4, 2026