Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,387 npm 223,246 PyPI 11,995 RubyGems 4,318 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,387 reports · Feed

  • npm
    @onereach/orest-vue-demi-vue2 0.0.4, 0.0.5, 0.0.6
    MAL-2026-11617 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/docs-anvil-uikit-contrib 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11853 ghsa-malware, amazon-inspector
  • npm
    @onereach/or-browser 0.0.48, 0.0.49, 0.0.50
    MAL-2026-11608 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/json-render-react 0.4.6, 0.4.7, 0.4.8, 0.4.9, 0.4.10, 0.4.11, 0.4.12
    MAL-2026-11881 ghsa-malware, amazon-inspector
  • npm
    @onereach/idw-sdk 0.1.2, 0.1.3, 0.1.4
    MAL-2026-11604 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/eslint-plugin-folder-schema 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11863 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/ld-type-generator 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7
    MAL-2026-11886 ghsa-malware, amazon-inspector
  • npm
    @onereach/idw-apps 0.1.3, 0.1.4, 0.1.5
    MAL-2026-11601 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/uikit-docs 22.11.1, 22.11.2, 22.11.3, 22.11.4, 22.11.5, 22.11.6, 22.11.7
    MAL-2026-11946 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/standalone-ui 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.9, 2.2.10
    MAL-2026-11922 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/hash-browser-router 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11876 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/markdowner 0.5.1, 0.5.2, 0.5.3
    MAL-2026-11712 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/component-usage 28.5.1, 28.5.2, 28.5.3, 28.5.4, 28.5.5, 28.5.6, 28.5.7
    MAL-2026-11838 ghsa-malware, amazon-inspector
  • npm
    @onereach/orest-vue3 0.0.4, 0.0.5, 0.0.6
    MAL-2026-11619 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/react-ioc 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11913 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/navigation 14.1.1, 14.1.2, 14.1.3, 14.1.4, 14.1.5, 14.1.6, 14.1.7
    MAL-2026-11908 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/dte-unlayer 0.150.1, 0.150.2, 0.150.3, 0.150.4, 0.150.5, 0.150.6, 0.150.7
    MAL-2026-11857 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/datetime-utils 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11851 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/accounts 2.3.5, 2.3.6, 2.3.7
    MAL-2026-11666 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/restrict-imports 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11915 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/cp-api 1.115.1, 1.115.2, 1.115.3, 1.115.4, 1.115.5, 1.115.6, 1.115.7
    MAL-2026-11843 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/confirm 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11839 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/bot-templates 2.2.5, 2.2.6, 2.2.7
    MAL-2026-11677 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/confirm-navigation 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11840 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-dropdown-simple 0.4.5, 0.4.6, 0.4.7
    MAL-2026-11638 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/idw-skill 1.4.1, 1.4.2, 1.4.3
    MAL-2026-11701 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/billing 27.2.1, 27.2.2, 27.2.3
    MAL-2026-11675 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/cards 1.2.5, 1.2.6, 1.2.7
    MAL-2026-11680 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/library-types-v1 9.0.1, 9.0.2, 9.0.3
    MAL-2026-11709 ghsa-malware, amazon-inspector
  • npm
    @onereach/or-pro 1.13.1, 1.13.2, 1.13.3
    MAL-2026-11612 ghsa-malware, amazon-inspector
  • npm
    @onereach/v-event-calendar 0.1.22, 0.1.23, 0.1.24
    MAL-2026-11663 ghsa-malware, amazon-inspector
  • npm
    @onereach/or-browser-next 0.0.11, 0.0.12, 0.0.13
    MAL-2026-11609 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-divider 0.4.11, 0.4.12, 0.4.13
    MAL-2026-11636 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/keys 1.2.6, 1.2.7, 1.2.8
    MAL-2026-11704 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-alert 0.4.11, 0.4.12, 0.4.13
    MAL-2026-11629 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-dropdown-advanced 0.4.5, 0.4.6, 0.4.7
    MAL-2026-11637 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-switch 0.4.5, 0.4.6, 0.4.7
    MAL-2026-11646 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-header 0.4.11, 0.4.12, 0.4.13, 0.4.14
    MAL-2026-11639 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/source 2.1.5, 2.1.6, 2.1.7
    MAL-2026-11727 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/druid 1.4.7, 1.4.8, 1.4.9
    MAL-2026-11690 ghsa-malware, amazon-inspector