Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,401 npm 223,260 PyPI 11,995 RubyGems 4,318 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,401 reports · Feed

  • npm
    @servicetitan/assist-ui 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7
    MAL-2026-11830 ghsa-malware, amazon-inspector
  • npm
    @onereach/orest-cli 2.4.1, 2.4.2, 2.4.3
    MAL-2026-11614 ghsa-malware, amazon-inspector
  • npm
    @thiennq/docs-viewer 1.6.2, 1.6.3, 1.6.4
    MAL-2026-11952 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/install 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11879 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/eslint-plugin 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11861 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/hammer-icon 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7
    MAL-2026-11873 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil-icons 14.5.4, 14.5.5, 14.5.6, 14.5.7, 14.5.8, 14.5.9, 14.5.10
    MAL-2026-11818 ghsa-malware, amazon-inspector
  • npm
    @hubsync/web-sdk-react 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.3.15, 6.3.16, 6.…
    MAL-2026-11564 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil-themes 14.5.4, 14.5.5, 14.5.6, 14.5.7, 14.5.8, 14.5.9, 14.5.10
    MAL-2026-11820 ghsa-malware, amazon-inspector
  • npm
    @qlik/sprout-react 6.45.3
    MAL-2026-11808 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/marketing-widgets 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7
    MAL-2026-11897 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/web-components 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11949 ghsa-malware, amazon-inspector
  • npm
    @picsart/gen-ai 2.55.11
    MAL-2026-11782 ghsa-malware, amazon-inspector
  • npm
    @ornikar/graphql-config 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9, 1.1.10, 1.1.11
    MAL-2026-11756 ghsa-malware, amazon-inspector
  • npm
    @ornikar/eslint-plugin-neverthrow 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7, 1.3.8, 1.3.9, 1.3.10, 1.3.11, …
    MAL-2026-11754 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/chat 0.3.1, 0.3.2, 0.3.3
    MAL-2026-11682 ghsa-malware, amazon-inspector
  • npm
    @onereach/get-version-data 3.1.2, 3.1.3, 3.1.4
    MAL-2026-11600 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/library-categories 0.2.6, 0.2.7, 0.2.8
    MAL-2026-11707 ghsa-malware, amazon-inspector
  • npm
    @onereach/cb-schema-translator 1.3.1, 1.3.2, 1.3.3
    MAL-2026-11591 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/graph 1.10.5, 1.10.6, 1.10.7
    MAL-2026-11696 ghsa-malware, amazon-inspector
  • npm
    @onereach/styles 27.0.2, 27.0.3, 27.0.4
    MAL-2026-11656 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/log-service 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11889 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/library-types-v2 9.0.1, 9.0.2, 9.0.3
    MAL-2026-11710 ghsa-malware, amazon-inspector
  • npm
    @onereach/idw-contracts 0.1.2, 0.1.3, 0.1.4
    MAL-2026-11602 ghsa-malware, amazon-inspector
  • npm
    rwc-client 0.29.10, 0.29.11, 0.29.12, 0.29.13, 0.29.14, 0.29.15, 0.29.16, 0.29.17, 0.29.18…
    MAL-2026-11985 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/hammer-token 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7
    MAL-2026-11875 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/toolbelt-shared-registry 1.14.1, 1.14.2, 1.14.3, 1.14.4, 1.14.5, 1.14.6, 1.14.7
    MAL-2026-11945 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-checkbox 0.6.5, 0.6.6, 0.6.7
    MAL-2026-11630 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-a-button 0.0.3, 0.0.4, 0.0.5
    MAL-2026-11628 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/tanstack-query-mobx 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7
    MAL-2026-11930 ghsa-malware, amazon-inspector
  • npm
    @onereach/idw-init-account-resources 1.0.1, 1.0.2, 1.0.3
    MAL-2026-11603 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/hammer-react 1.42.2, 1.42.3, 1.42.4, 1.42.5, 1.42.6, 1.42.7, 1.42.8
    MAL-2026-11874 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/base 0.44.4, 0.44.5, 0.44.6
    MAL-2026-11674 ghsa-malware, amazon-inspector
  • npm
    @onereach/or-sdk-agent-cli 0.0.6, 0.0.7, 0.0.8
    MAL-2026-11613 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/authorizer 0.26.7, 0.26.8, 0.26.9
    MAL-2026-11673 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-datepicker 0.4.5, 0.4.6, 0.4.7
    MAL-2026-11635 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil-fonts 14.5.4, 14.5.5, 14.5.6, 14.5.7, 14.5.8, 14.5.9, 14.5.10
    MAL-2026-11816 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/queue-manager 1.4.6, 1.4.7, 1.4.8
    MAL-2026-11723 ghsa-malware, amazon-inspector
  • npm
    @onereach/channel-transformer 0.0.66, 0.0.67, 0.0.68
    MAL-2026-11592 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/permissions-lambda 2.5.1, 2.5.2, 2.5.3
    MAL-2026-11719 ghsa-malware, amazon-inspector