Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,387 npm 223,246 PyPI 11,995 RubyGems 4,318 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,387 reports · Feed

  • npm
    @servicetitan/link-item 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11888 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/notifications 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11909 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/ko-bridge 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11883 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/mfe-quick-actions 0.5.49, 0.5.50, 0.5.51, 0.5.52, 0.5.53, 0.5.54, 0.5.55
    MAL-2026-11899 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/carto-charts-react 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8
    MAL-2026-11833 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/ajax-handlers 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11814 ghsa-malware, amazon-inspector
  • npm
    eslint-plugin-folder-schema 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0…
    MAL-2026-11968 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/titan-chat-ui-cypress 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9
    MAL-2026-11938 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/thoughtspot-theme 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7
    MAL-2026-11933 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/schema-comparison 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9
    MAL-2026-11916 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/carto-charts-core 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8
    MAL-2026-11832 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/tables 0.28.5, 0.28.6, 0.28.7
    MAL-2026-11731 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/users 3.8.1, 3.8.2, 3.8.3
    MAL-2026-11735 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/eslint-plugin-decorators-declare 12.8.15, 12.8.16, 12.8.17, 12.8.18, 12.8.19, 12.8.20, 12.8.21
    MAL-2026-11862 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil2-ext-charts 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.2.9, 0.2.10
    MAL-2026-11825 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/widget-platform 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7
    MAL-2026-11950 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/assist-utils 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8
    MAL-2026-11831 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/acquisition-functions 5.22.1, 5.22.2, 5.22.3, 5.22.4, 5.22.5, 5.22.6, 5.22.7
    MAL-2026-11811 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/help-center 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14
    MAL-2026-11877 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/contentful 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9
    MAL-2026-11841 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil2-ext-mwv 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.0.10, 0.0.11
    MAL-2026-11827 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/widget-platform-monolith 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7
    MAL-2026-11951 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/eh-module-communication 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7
    MAL-2026-11858 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/quick-actions 1.15.2, 1.15.3, 1.15.4, 1.15.5, 1.15.6, 1.15.7, 1.15.8
    MAL-2026-11911 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/marketing-route 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7
    MAL-2026-11895 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/kendo-theme 0.0.27, 0.0.28, 0.0.29, 0.0.30, 0.0.31, 0.0.32, 0.0.33
    MAL-2026-11882 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/html-sketchapp 4.2.8, 4.2.9, 4.2.10, 4.2.11, 4.2.12, 4.2.13, 4.2.14
    MAL-2026-11878 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil-token 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7
    MAL-2026-11821 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/startup-jest 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7
    MAL-2026-11924 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/eslint-plugin-mobx-6 12.8.15, 12.8.16, 12.8.17, 12.8.18, 12.8.19, 12.8.20
    MAL-2026-11864 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/carto-tokens 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.3.7
    MAL-2026-11837 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/startup-utils 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11926 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/react-hooks 7.7.1, 7.7.2, 7.7.3, 7.7.4, 7.7.5, 7.7.6, 7.7.7
    MAL-2026-11912 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/marketing-form 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8
    MAL-2026-11892 ghsa-malware, amazon-inspector
  • npm
    verdaccio-tarball-local-storage 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7, 38.1.8, 38.1.9, 38.1.10…
    MAL-2026-11991 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/marketing-global-route 1.14.1, 1.14.2, 1.14.3, 1.14.4, 1.14.5, 1.14.6, 1.14.7
    MAL-2026-11893 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/document-title 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.5, 2.4.6, 2.4.7
    MAL-2026-11855 ghsa-malware, amazon-inspector
  • npm
    verdaccio-okta-oauth 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7, 38.1.8, 38.1.9, 38.1.10…
    MAL-2026-11990 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/measure-sheet-data 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7
    MAL-2026-11898 ghsa-malware, amazon-inspector
  • npm
    @onereach/ui-components 27.0.2, 27.0.3, 27.0.4
    MAL-2026-11660 ghsa-malware, amazon-inspector