Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,387 npm 223,246 PyPI 11,995 RubyGems 4,318 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,387 reports · Feed

npm
@qlik/tsconfig 1.0.3
MAL-2026-11810 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/react-native-simple-grid 1.5.5
MAL-2026-11802 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/sdk 0.28.1
MAL-2026-11804 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-slider 0.20.1
MAL-2026-11581 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/eslint-config-svelte 0.1.1
MAL-2026-11796 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/eslint-config 2.0.20
MAL-2026-11793 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/sprout-react-table 0.16.7
MAL-2026-11809 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-shape 1.5.1
MAL-2026-11580 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-org-chart 1.7.1
MAL-2026-11579 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/oxlint-config 0.7.2
MAL-2026-11800 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/theme 0.6.1
MAL-2026-11586 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-tabbed-container 2.4.1
MAL-2026-11582 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/cli-sense 7.1.2
MAL-2026-11567 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/runtime-module-loader 1.5.1
MAL-2026-11803 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
picasso.js 2.11.6
MAL-2026-11979 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/snapshooter 0.6.1
MAL-2026-11583 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-distributionplot 1.0.7
MAL-2026-11573 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
picasso-plugin-hammer 2.11.6
MAL-2026-11977 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-action-button 2.3.1
MAL-2026-11571 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/embed-react 2.5.3
MAL-2026-11789 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/cli 7.1.2
MAL-2026-11565 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/regular-expressions-test 0.0.4, 0.0.5, 0.0.6
MAL-2026-11625 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/oxfmt-config 0.1.6
MAL-2026-11799 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/test-utils 0.6.1
MAL-2026-11585 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/embed-web-components 1.7.3
MAL-2026-11792 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@qlik/design-tokens 1.3.13
MAL-2026-11787 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/locale 0.6.2
MAL-2026-11569 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-map 0.12.7
MAL-2026-11577 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-nav-menu 0.14.2
MAL-2026-11578 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@nebula.js/sn-animator 2.13.1
MAL-2026-11572 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
hamus.js 0.4.1
MAL-2026-11974 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/postcss-scoped-selector 1.2.1, 1.2.2, 1.2.3
MAL-2026-11622 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/feature-spotlight 3.9.1, 3.9.2, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7
MAL-2026-11867 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
tslint-folder-schema 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0…
MAL-2026-11988 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/startup-mfe-compat 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7
MAL-2026-11925 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/microfront 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8
MAL-2026-11901 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/examples 1.2.5, 1.2.6, 1.2.7, 1.2.8, 1.2.9, 1.2.10, 1.2.11
MAL-2026-11866 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
folder-lint 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0…
MAL-2026-11972 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/standalone-core-feature-gates 1.11.4, 1.11.5, 1.11.6, 1.11.7, 1.11.8, 1.11.9, 1.11.10
MAL-2026-11918 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/microfront-auth 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.0.10, 0.0.11
MAL-2026-11902 ghsa-malware, amazon-inspector

Aug 4, 2026