Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,401 npm 223,260 PyPI 11,995 RubyGems 4,318 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,401 reports · Feed

  • npm
    @or-sdk/store 2.1.5, 2.1.6, 2.1.7
    MAL-2026-11730 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/pgsql 1.5.1, 1.5.2, 1.5.3
    MAL-2026-11720 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/data-hub 0.26.5, 0.26.6, 0.26.7
    MAL-2026-11685 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/bots 1.7.1, 1.7.2, 1.7.3
    MAL-2026-11678 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/tags 1.1.5, 1.1.6, 1.1.7
    MAL-2026-11732 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/files 3.11.6, 3.11.7, 3.11.8
    MAL-2026-11692 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/api-tokens 1.4.2, 1.4.3, 1.4.4
    MAL-2026-11669 ghsa-malware, amazon-inspector
  • npm
    @onereach/expression-components 9.1.1, 9.1.2, 9.1.3
    MAL-2026-11598 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-code 0.6.4, 0.6.5, 0.6.6
    MAL-2026-11632 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/idw 9.0.4, 9.0.5, 9.0.6
    MAL-2026-11699 ghsa-malware, amazon-inspector
  • npm
    @onereach/ui-components-common 27.0.2, 27.0.3, 27.0.4
    MAL-2026-11661 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/billing-internal 27.2.1, 27.2.2, 27.2.3
    MAL-2026-11676 ghsa-malware, amazon-inspector
  • npm
    @onereach/font-icons 27.0.2, 27.0.3, 27.0.4
    MAL-2026-11599 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/invitations 1.4.8, 1.4.9, 1.4.10
    MAL-2026-11702 ghsa-malware, amazon-inspector
  • npm
    @onereach/step-conversation 1.0.41, 1.0.42, 1.0.43
    MAL-2026-11653 ghsa-malware, amazon-inspector
  • npm
    @onereach/bandwidth-steps-voice-bxml 0.1.1, 0.1.2, 0.1.3
    MAL-2026-11588 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/auth 0.38.1, 0.38.2, 0.38.3
    MAL-2026-11672 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/idw-public 1.6.6, 1.6.7, 1.6.8
    MAL-2026-11700 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/adapters 0.3.6, 0.3.7, 0.3.8
    MAL-2026-11667 ghsa-malware, amazon-inspector
  • npm
    @onereach/messengers-infobip-sdk 0.1.1, 0.1.2, 0.1.3
    MAL-2026-11607 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/flows 2.7.8, 2.7.9, 2.7.10
    MAL-2026-11695 ghsa-malware, amazon-inspector
  • npm
    @onereach/authorizer-helper 0.0.11, 0.0.12, 0.0.13
    MAL-2026-11587 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/hitl 0.41.1, 0.41.2, 0.41.3
    MAL-2026-11697 ghsa-malware, amazon-inspector
  • npm
    @onereach/step-voice 7.0.32, 7.0.33, 7.0.34
    MAL-2026-11655 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/lookup 1.25.1, 1.25.2, 1.25.3
    MAL-2026-11711 ghsa-malware, amazon-inspector
  • npm
    @onereach/billing-dto 27.2.1, 27.2.2, 27.2.3
    MAL-2026-11589 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/transcripts 1.2.5, 1.2.6, 1.2.7
    MAL-2026-11734 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-select 0.1.3, 0.1.4, 0.1.5
    MAL-2026-11644 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/agents 4.21.3, 4.21.4, 4.21.5
    MAL-2026-11668 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/web-search 0.6.1, 0.6.2, 0.6.3
    MAL-2026-11738 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/identifiers 0.27.6, 0.27.7, 0.27.8
    MAL-2026-11698 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/apps 1.2.6, 1.2.7, 1.2.8
    MAL-2026-11671 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/flow-templates 2.1.5, 2.1.6, 2.1.7
    MAL-2026-11694 ghsa-malware, amazon-inspector
  • npm
    @onereach/types-contacts-api 9.0.8, 9.0.9, 9.0.10
    MAL-2026-11659 ghsa-malware, amazon-inspector
  • npm
    @onereach/ts-memoize 1.0.2, 1.0.3, 1.0.4
    MAL-2026-11658 ghsa-malware, amazon-inspector
  • npm
    @onereach/orest-vue-demi-vue3 0.0.4, 0.0.5, 0.0.6
    MAL-2026-11618 ghsa-malware, amazon-inspector
  • npm
    @onereach/or-content-builder-renderer 0.0.2, 0.0.3, 0.0.4
    MAL-2026-11610 ghsa-malware, amazon-inspector
  • npm
    @arv-bedrock/auth-admin 1.0.2, 1.0.3
    MAL-2026-11554 ghsa-malware, amazon-inspector
  • npm
    @picsart/ai-sdk 3.32.2
    MAL-2026-11781 ghsa-malware, amazon-inspector
  • npm
    @onereach/lambda-invocation 1.2.1, 1.2.2, 1.2.3
    MAL-2026-11606 ghsa-malware, amazon-inspector