Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,401 npm 223,260 PyPI 11,995 RubyGems 4,318 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,401 reports · Feed

  • npm
    @ornikar/monorepo-config 14.3.2, 14.3.3, 14.3.4, 14.3.5, 14.3.6, 14.3.7, 14.3.8, 14.3.9, 14.3.10, 14.3.1…
    MAL-2026-11764 ghsa-malware, amazon-inspector
  • npm
    @ornikar/repo-config-react-legacy-css 15.1.2, 15.1.3, 15.1.4, 15.1.5, 15.1.6, 15.1.7, 15.1.8, 15.1.9, 15.1.10, 15.1.1…
    MAL-2026-11773 ghsa-malware, amazon-inspector
  • npm
    @ornikar/jest-config-react 18.0.2, 18.0.3, 18.0.4, 18.0.5, 18.0.6, 18.0.7, 18.0.8, 18.0.9, 18.0.10, 18.0.11
    MAL-2026-11759 ghsa-malware, amazon-inspector
  • npm
    @ornikar/jest-config-react-native 17.0.2, 17.0.3, 17.0.4, 17.0.5, 17.0.6, 17.0.7, 17.0.8, 17.0.9, 17.0.10, 17.0.1…
    MAL-2026-11760 ghsa-malware, amazon-inspector
  • npm
    @ornikar/kitt2 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11
    MAL-2026-11762 ghsa-malware, amazon-inspector
  • npm
    @ornikar/rollup-plugin-postcss 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.…
    MAL-2026-11775 ghsa-malware, amazon-inspector
  • npm
    @ornikar/typed-css-modules-loader 0.8.2, 0.8.3, 0.8.4, 0.8.5, 0.8.6, 0.8.7, 0.8.8, 0.8.9, 0.8.10, 0.8.11, 0.8.12
    MAL-2026-11779 ghsa-malware, amazon-inspector
  • npm
    @ornikar/lerna-config 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5, 11.0.6, 11.0.7, 11.0.8, 11.0.9, 11.0.10…
    MAL-2026-11763 ghsa-malware, amazon-inspector
  • npm
    @ornikar/slate-react-fork 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11
    MAL-2026-11776 ghsa-malware, amazon-inspector
  • npm
    @ornikar/react-modern-calendar-datepicker 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.2.9, 3.2.10, 3.2.11
    MAL-2026-11768 ghsa-malware, amazon-inspector
  • npm
    @ornikar/eslint-config-node 12.2.1, 12.2.2, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10
    MAL-2026-11749 ghsa-malware, amazon-inspector
  • npm
    @ornikar/apollo-link-timeout 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.4.8, 1.4.9, 1.4.10, 1.4.11
    MAL-2026-11739 ghsa-malware, amazon-inspector
  • npm
    @ornikar/react-native-svg-transformer 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13
    MAL-2026-11769 ghsa-malware, amazon-inspector
  • npm
    @ornikar/webpack-config 12.0.2, 12.0.3, 12.0.4, 12.0.5, 12.0.6, 12.0.7, 12.0.8, 12.0.9, 12.0.10, 12.0.1…
    MAL-2026-11780 ghsa-malware, amazon-inspector
  • npm
    @ornikar/eslint-config-formatjs 24.0.1, 24.0.2, 24.0.3, 24.0.4, 24.0.5, 24.0.6, 24.0.7, 24.0.8, 24.0.9, 24.0.10
    MAL-2026-11748 ghsa-malware, amazon-inspector
  • npm
    @ornikar/babel-preset-kitt-universal 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.0.11, 8.0.12
    MAL-2026-11741 ghsa-malware, amazon-inspector
  • npm
    pob-test-typescript-package-in-monorepo 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.2.6, 4.2.7, 4.2.8, 4.2.9, 4.2.10, 4.2.11, …
    MAL-2026-11981 ghsa-malware, amazon-inspector
  • npm
    @ornikar/postcss-config 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.1.8, 9.1.9, 9.1.10, 9.1.11, 9.1.12
    MAL-2026-11765 ghsa-malware, amazon-inspector
  • npm
    @ornikar/eslint-config-babel 24.0.1, 24.0.2, 24.0.3, 24.0.4, 24.0.5, 24.0.6, 24.0.7, 24.0.8, 24.0.9, 24.0.10…
    MAL-2026-11746 ghsa-malware, amazon-inspector
  • npm
    @ornikar/eslint-config-react 24.0.1, 24.0.2, 24.0.3, 24.0.4, 24.0.5, 24.0.6, 24.0.7, 24.0.8, 24.0.9, 24.0.10…
    MAL-2026-11750 ghsa-malware, amazon-inspector
  • npm
    @ornikar/browserslist-config 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.0.11
    MAL-2026-11743 ghsa-malware, amazon-inspector
  • npm
    @ornikar/storybook-config 12.1.2, 12.1.3, 12.1.4, 12.1.5, 12.1.6, 12.1.7, 12.1.8, 12.1.9, 12.1.10
    MAL-2026-11777 ghsa-malware, amazon-inspector
  • npm
    @ornikar/intl-config 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9, 10.0.10
    MAL-2026-11757 ghsa-malware, amazon-inspector
  • npm
    @ornikar/commitlint-config 8.3.2, 8.3.3, 8.3.4, 8.3.5, 8.3.6, 8.3.7, 8.3.8, 8.3.9, 8.3.10, 8.3.11, 8.3.12
    MAL-2026-11744 ghsa-malware, amazon-inspector
  • npm
    @ornikar/eslint-config-typescript-nestjs 24.0.1, 24.0.2, 24.0.3, 24.0.4, 24.0.5, 24.0.6, 24.0.7, 24.0.8, 24.0.9, 24.0.10…
    MAL-2026-11752 ghsa-malware, amazon-inspector
  • npm
    @ornikar/eslint-config-typescript 24.0.1, 24.0.2, 24.0.3, 24.0.4, 24.0.5, 24.0.6, 24.0.7, 24.0.8, 24.0.9, 24.0.10
    MAL-2026-11751 ghsa-malware, amazon-inspector
  • npm
    @ornikar/eslint-config 24.0.1, 24.0.2, 24.0.3, 24.0.4, 24.0.5, 24.0.6, 24.0.7, 24.0.8, 24.0.9, 24.0.10…
    MAL-2026-11745 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/culture 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11848 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/account-settings 1.3.6, 1.3.7, 1.3.8
    MAL-2026-11665 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/views 3.1.5, 3.1.6, 3.1.7
    MAL-2026-11737 ghsa-malware, amazon-inspector
  • npm
    @onereach/step-components 0.1.37, 0.1.38, 0.1.39
    MAL-2026-11652 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-validated-timestring-input 0.3.5, 0.3.6, 0.3.7
    MAL-2026-11649 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/table 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11929 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/deployer 1.7.5, 1.7.6, 1.7.7
    MAL-2026-11687 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/standalone-root 1.11.3, 1.11.4, 1.11.5, 1.11.6, 1.11.7, 1.11.8, 1.11.9
    MAL-2026-11920 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil2-mcp 0.0.9, 0.0.10, 0.0.11, 0.0.12, 0.0.13, 0.0.14, 0.0.15
    MAL-2026-11829 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/docs-uikit 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11854 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/card-templates 2.2.5, 2.2.6, 2.2.7
    MAL-2026-11679 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil-css-utilities 14.5.4, 14.5.5, 14.5.6, 14.5.7, 14.5.8, 14.5.9, 14.5.10
    MAL-2026-11815 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-text-message 0.4.5, 0.4.6, 0.4.7
    MAL-2026-11647 ghsa-malware, amazon-inspector