Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,387 npm 223,246 PyPI 11,995 RubyGems 4,318 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,387 reports · Feed

  • npm
    @onereach/ssml-editor 2.0.12, 2.0.13, 2.0.14
    MAL-2026-11651 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-list 0.7.4, 0.7.5, 0.7.6
    MAL-2026-11640 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-copyable-text 0.4.11, 0.4.12, 0.4.13
    MAL-2026-11634 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/api-tokens-lambda 1.4.2, 1.4.3, 1.4.4
    MAL-2026-11670 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/permissions 2.8.1, 2.8.2, 2.8.3
    MAL-2026-11717 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/library 0.5.6, 0.5.7, 0.5.8
    MAL-2026-11706 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/view-templates 2.2.5, 2.2.6, 2.2.7
    MAL-2026-11736 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/password 1.3.6, 1.3.7, 1.3.8
    MAL-2026-11715 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-radio-group 0.3.5, 0.3.6, 0.3.7
    MAL-2026-11642 ghsa-malware, amazon-inspector
  • npm
    @onereach/billing-shared 27.2.1, 27.2.2, 27.2.3
    MAL-2026-11590 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/sku-builder 2.5.1, 2.5.2, 2.5.3
    MAL-2026-11726 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/payments 3.2.5, 3.2.6, 3.2.7
    MAL-2026-11716 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/content-request 0.2.6, 0.2.7, 0.2.8
    MAL-2026-11684 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-textinput 0.5.5, 0.5.6, 0.5.7
    MAL-2026-11648 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/event-manager 1.1.5, 1.1.6, 1.1.7
    MAL-2026-11691 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/deployments 2.1.5, 2.1.6, 2.1.7
    MAL-2026-11688 ghsa-malware, amazon-inspector
  • npm
    @onereach/channel-transformers 0.0.5, 0.0.6, 0.0.7
    MAL-2026-11593 ghsa-malware, amazon-inspector
  • npm
    @onereach/condition-builder 1.0.8, 1.0.9, 1.0.10
    MAL-2026-11595 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/key-value-storage 0.28.6, 0.28.7, 0.28.8
    MAL-2026-11703 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/step-templates 2.2.5, 2.2.6, 2.2.7
    MAL-2026-11729 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/discovery 1.12.1, 1.12.2, 1.12.3
    MAL-2026-11689 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/tickets 1.9.5, 1.9.6, 1.9.7
    MAL-2026-11733 ghsa-malware, amazon-inspector
  • npm
    @onereach/regex-helper 0.5.16, 0.5.17, 0.5.18
    MAL-2026-11623 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-root 0.9.4, 0.9.5, 0.9.6
    MAL-2026-11643 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-step-chooser 0.4.4, 0.4.5, 0.4.6
    MAL-2026-11645 ghsa-malware, amazon-inspector
  • npm
    @onereach/ui-components-vue2 27.0.2, 27.0.3, 27.0.4
    MAL-2026-11662 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/store 2.1.5, 2.1.6, 2.1.7
    MAL-2026-11730 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/pgsql 1.5.1, 1.5.2, 1.5.3
    MAL-2026-11720 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/data-hub 0.26.5, 0.26.6, 0.26.7
    MAL-2026-11685 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/bots 1.7.1, 1.7.2, 1.7.3
    MAL-2026-11678 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/tags 1.1.5, 1.1.6, 1.1.7
    MAL-2026-11732 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/files 3.11.6, 3.11.7, 3.11.8
    MAL-2026-11692 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/api-tokens 1.4.2, 1.4.3, 1.4.4
    MAL-2026-11669 ghsa-malware, amazon-inspector
  • npm
    @onereach/expression-components 9.1.1, 9.1.2, 9.1.3
    MAL-2026-11598 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-code 0.6.4, 0.6.5, 0.6.6
    MAL-2026-11632 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/idw 9.0.4, 9.0.5, 9.0.6
    MAL-2026-11699 ghsa-malware, amazon-inspector
  • npm
    @onereach/ui-components-common 27.0.2, 27.0.3, 27.0.4
    MAL-2026-11661 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/billing-internal 27.2.1, 27.2.2, 27.2.3
    MAL-2026-11676 ghsa-malware, amazon-inspector
  • npm
    @onereach/font-icons 27.0.2, 27.0.3, 27.0.4
    MAL-2026-11599 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/invitations 1.4.8, 1.4.9, 1.4.10
    MAL-2026-11702 ghsa-malware, amazon-inspector