Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,387 npm 223,246 PyPI 11,995 RubyGems 4,318 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,387 reports · Feed

npm
@servicetitan/carto-charts-rn 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8
MAL-2026-11834 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/standalone-feature-flags 2.3.2, 2.3.3, 2.3.4, 2.3.5, 2.3.6, 2.3.7, 2.3.8
MAL-2026-11919 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/anvil2-codemods 0.11.2, 0.11.3, 0.11.4, 0.11.5, 0.11.6, 0.11.7, 0.11.8
MAL-2026-11823 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/grid 0.0.63, 0.0.64, 0.0.65, 0.0.66, 0.0.67, 0.0.68, 0.0.69
MAL-2026-11872 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
editable-contracts 0.0.12, 0.0.13, 0.0.14, 0.0.15, 0.0.16, 0.0.17, 0.0.18, 0.0.19, 0.0.20, 0.0.21,…
MAL-2026-11967 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/unit-tests 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8
MAL-2026-11947 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/titan-chatbot-api 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7
MAL-2026-11939 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/titan-chat-ui 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9
MAL-2026-11935 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/anvil2-illustrations 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8
MAL-2026-11828 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/mpa-components 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5, 2.5.6, 2.5.7
MAL-2026-11907 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/cp-ui 1.115.1, 1.115.2, 1.115.3, 1.115.4, 1.115.5, 1.115.6, 1.115.7
MAL-2026-11847 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/intl 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7
MAL-2026-11880 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/carto-react-kit 0.8.4, 0.8.5, 0.8.6, 0.8.7, 0.8.8, 0.8.9, 0.8.10
MAL-2026-11835 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@onereach/salesforce-miaw-client 0.0.3, 0.0.4, 0.0.5
MAL-2026-11627 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/carto-rn-kit 0.0.10, 0.0.11, 0.0.12, 0.0.13, 0.0.14, 0.0.15, 0.0.16
MAL-2026-11836 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/titan-chatbot-ui 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9
MAL-2026-11941 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/marketing-email-components 20.2.3, 20.2.4, 20.2.5, 20.2.6, 20.2.7, 20.2.8, 20.2.9
MAL-2026-11891 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/skeleton 9.2.4, 9.2.5, 9.2.6, 9.2.7, 9.2.8, 9.2.9, 9.2.10
MAL-2026-11917 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/microfront-utils 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7
MAL-2026-11904 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/dte-pdf-editor 1.76.1, 1.76.2, 1.76.3, 1.76.4, 1.76.5, 1.76.6, 1.76.7
MAL-2026-11856 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/titan-chatbot-ui-anvil2 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7
MAL-2026-11942 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/anvil-icon 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7
MAL-2026-11817 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/titan-chatbot-ui-cypress 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7
MAL-2026-11943 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/titan-chatbot-client 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9
MAL-2026-11940 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/titan-chat-ui-anvil2 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7
MAL-2026-11936 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/temporal-lite 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.7
MAL-2026-11931 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/microfront-tests 0.0.11, 0.0.12, 0.0.13, 0.0.14, 0.0.15, 0.0.16, 0.0.17
MAL-2026-11903 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/time-zones 3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.8.5, 3.8.6, 3.8.7
MAL-2026-11934 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/modularpayments-webfields 1.0.53, 1.0.54, 1.0.55, 1.0.56, 1.0.57, 1.0.58, 1.0.59
MAL-2026-11905 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/cp-react-hooks 1.115.1, 1.115.2, 1.115.3, 1.115.4, 1.115.5, 1.115.6, 1.115.7
MAL-2026-11846 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/admin-layout 2.4.3, 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9
MAL-2026-11812 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/marketing-direct-mail-components 20.1.1, 20.1.2, 20.1.3, 20.1.4, 20.1.5, 20.1.6, 20.1.7
MAL-2026-11890 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/marketing-ui 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.3.5, 9.3.6, 9.3.7
MAL-2026-11896 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/eslint-plugin-processors-stub 12.8.15, 12.8.16, 12.8.17, 12.8.18, 12.8.19, 12.8.20, 12.8.21
MAL-2026-11865 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/cp-mfe 1.115.1, 1.115.2, 1.115.3, 1.115.4, 1.115.5, 1.115.6, 1.115.7
MAL-2026-11844 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/startup 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
MAL-2026-11923 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/lazy-module 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
MAL-2026-11885 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/cp-mfe-dev 1.115.1, 1.115.2, 1.115.3, 1.115.4, 1.115.5, 1.115.6, 1.115.7
MAL-2026-11845 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/admin-sql-table 1.0.14, 1.0.15, 1.0.16, 1.0.17, 1.0.18, 1.0.19, 1.0.20
MAL-2026-11813 ghsa-malware, amazon-inspector

Aug 4, 2026
npm
@servicetitan/anvil2-ext-common 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.7.7
MAL-2026-11826 ghsa-malware, amazon-inspector

Aug 4, 2026