Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,401 npm 223,260 PyPI 11,995 RubyGems 4,318 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,401 reports · Feed

  • npm
    @or-sdk/files-sync-node 0.1.8, 0.1.9, 0.1.10
    MAL-2026-11693 ghsa-malware, amazon-inspector
  • npm
    @onereach/content-builder-template-compiler 0.0.3, 0.0.4, 0.0.5
    MAL-2026-11597 ghsa-malware, amazon-inspector
  • npm
    @onereach/ckeditor5-build-classic 30.0.1, 30.0.2, 30.0.3
    MAL-2026-11594 amazon-inspector, ghsa-malware
  • npm
    @or-sdk/source-api 1.1.1, 1.1.2, 1.1.3
    MAL-2026-11728 ghsa-malware, amazon-inspector
  • npm
    @ornikar/prismic-components 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.0.10, 0.0.11, 0.0.12
    MAL-2026-11767 ghsa-malware, amazon-inspector
  • npm
    pob-test-package-in-monorepo 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.2.11, …
    MAL-2026-11980 ghsa-malware, amazon-inspector
  • npm
    @onereach/step-run-snowflake-query 0.1.1, 0.1.2, 0.1.3
    MAL-2026-11654 ghsa-malware, amazon-inspector
  • npm
    @ornikar/eslint-config-babel-use 13.2.1, 13.2.2, 13.2.3, 13.2.4, 13.2.5, 13.2.6, 13.2.7, 13.2.8, 13.2.9, 13.2.10…
    MAL-2026-11747 ghsa-malware, amazon-inspector
  • npm
    @onereach/pnpm-audit-junit 1.0.3, 1.0.4, 1.0.5
    MAL-2026-11621 ghsa-malware, amazon-inspector
  • npm
    @onereach/orest-input-cli 1.18.1, 1.18.2, 1.18.3
    MAL-2026-11615 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/mcp-tools 0.5.2, 0.5.3, 0.5.4
    MAL-2026-11713 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/permissions-cli 1.4.1, 1.4.2, 1.4.3
    MAL-2026-11718 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/notifications 1.7.5, 1.7.6, 1.7.7
    MAL-2026-11714 ghsa-malware, amazon-inspector
  • npm
    @onereach/time-interpreter 1.0.30, 1.0.31, 1.0.32
    MAL-2026-11657 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-checkbox-group 0.3.5, 0.3.6, 0.3.7
    MAL-2026-11631 ghsa-malware, amazon-inspector
  • npm
    @onereach/slack-helpers 1.0.3, 1.0.4, 1.0.5
    MAL-2026-11650 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/library-source 0.4.5, 0.4.6, 0.4.7
    MAL-2026-11708 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/qna 3.4.2, 3.4.3, 3.4.4
    MAL-2026-11722 ghsa-malware, amazon-inspector
  • npm
    @arv-bedrock/auth 1.1.7, 1.1.8
    MAL-2026-11553 ghsa-malware, amazon-inspector
  • npm
    conv-context-next 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10
    MAL-2026-11965 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/providers 0.3.6, 0.3.7, 0.3.8
    MAL-2026-11721 ghsa-malware, amazon-inspector
  • npm
    @arv-bedrock/auth-sso-backend 1.7.1, 1.7.2
    MAL-2026-11556 ghsa-malware, amazon-inspector
  • npm
    @onereach/or-file-uploader-next 0.0.8, 0.0.9, 0.0.10
    MAL-2026-11611 ghsa-malware, amazon-inspector
  • npm
    @arv-bedrock/logger 1.7.1, 1.7.2
    MAL-2026-11557 ghsa-malware, amazon-inspector
  • npm
    native-frontend-orb 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9, 1.1.10, 1.1.11, 1.1.12, 1.1.13, 1.1.1…
    MAL-2026-11976 ghsa-malware, amazon-inspector
  • npm
    @arv-bedrock/auth-sso 1.6.1, 1.6.2
    MAL-2026-11555 ghsa-malware, amazon-inspector
  • npm
    @ornikar/babel-preset-react 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14
    MAL-2026-11742 ghsa-malware, amazon-inspector
  • npm
    @ornikar/stylelint-config 14.0.3, 14.0.4, 14.0.5, 14.0.6, 14.0.7, 14.0.8, 14.0.9, 14.0.10, 14.0.11, 14.0.…
    MAL-2026-11778 ghsa-malware, amazon-inspector
  • npm
    @ornikar/rollup-config 11.1.2, 11.1.3, 11.1.4, 11.1.5, 11.1.6, 11.1.7, 11.1.8, 11.1.9, 11.1.10, 11.1.1…
    MAL-2026-11774 ghsa-malware, amazon-inspector
  • npm
    @ornikar/prettier-config 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.0.11
    MAL-2026-11766 ghsa-malware, amazon-inspector
  • npm
    @ornikar/jest-config-react-native-web 12.0.3, 12.0.4, 12.0.5, 12.0.6, 12.0.7, 12.0.8, 12.0.9, 12.0.10, 12.0.11, 12.0.…
    MAL-2026-11761 ghsa-malware, amazon-inspector
  • npm
    @ornikar/repo-config 15.3.3, 15.3.4, 15.3.5, 15.3.6, 15.3.7, 15.3.8, 15.3.9, 15.3.10, 15.3.11, 15.3.…
    MAL-2026-11771 ghsa-malware, amazon-inspector
  • npm
    @ornikar/jest-config 13.0.3, 13.0.4, 13.0.5, 13.0.6, 13.0.7, 13.0.8, 13.0.9, 13.0.10, 13.0.11, 13.0.…
    MAL-2026-11758 ghsa-malware, amazon-inspector
  • npm
    @ornikar/eslint-plugin-ornikar 24.0.1, 24.0.2, 24.0.3, 24.0.4, 24.0.5, 24.0.6, 24.0.7, 24.0.8, 24.0.9, 24.0.10…
    MAL-2026-11755 ghsa-malware, amazon-inspector
  • npm
    @ornikar/babel-preset-base 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13…
    MAL-2026-11740 ghsa-malware, amazon-inspector
  • npm
    @ornikar/renovate-config 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.0.11, 9.0.12,…
    MAL-2026-11770 ghsa-malware, amazon-inspector
  • npm
    @ornikar/eslint-config-typescript-react 24.0.1, 24.0.2, 24.0.3, 24.0.4, 24.0.5, 24.0.6, 24.0.7, 24.0.8, 24.0.9, 24.0.10…
    MAL-2026-11753 ghsa-malware, amazon-inspector
  • npm
    frontend-orb 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 4.4.8, 4.4.9, 4.4.10, 4.4.11, …
    MAL-2026-11973 ghsa-malware, amazon-inspector
  • npm
    @ornikar/repo-config-react 13.0.8, 13.0.9, 13.0.10, 13.0.11, 13.0.12, 13.0.13, 13.0.14, 13.0.15, 13.0.16, …
    MAL-2026-11772 ghsa-malware, amazon-inspector
  • npm
    babel-plugin-linaria-css-to-undefined 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.3.7, 0.3.8, 0.3.9, 0.3.10, 0.3.11, …
    MAL-2026-11962 ghsa-malware, amazon-inspector