Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,401 npm 223,260 PyPI 11,995 RubyGems 4,318 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,401 reports · Feed

  • npm
    @onereach/si-collapsible-group 0.6.4, 0.6.5, 0.6.6
    MAL-2026-11633 ghsa-malware, amazon-inspector
  • npm
    @onereach/idw-ui-components 0.1.2, 0.1.3, 0.1.4
    MAL-2026-11605 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/contacts 4.7.5, 4.7.6, 4.7.7
    MAL-2026-11683 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/ccp 10.15.4, 10.15.5, 10.15.6
    MAL-2026-11681 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/design-system 14.5.4, 14.5.5, 14.5.6, 14.5.7, 14.5.8, 14.5.9, 14.5.10
    MAL-2026-11852 ghsa-malware, amazon-inspector
  • npm
    @onereach/rwc-client 6.4.7, 6.4.8, 6.4.9
    MAL-2026-11626 ghsa-malware, amazon-inspector
  • npm
    @onereach/regular-expressions 0.5.23, 0.5.24, 0.5.25
    MAL-2026-11624 ghsa-malware, amazon-inspector
  • npm
    @onereach/phonenumber-interpreter 0.0.18, 0.0.19, 0.0.20
    MAL-2026-11620 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/data-hub-svc 2.3.5, 2.3.6, 2.3.7
    MAL-2026-11686 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/sdk-api 0.29.2, 0.29.3, 0.29.4
    MAL-2026-11724 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/knowledge-models 0.25.5, 0.25.6, 0.25.7
    MAL-2026-11705 ghsa-malware, amazon-inspector
  • npm
    @or-sdk/settings 0.25.6, 0.25.7, 0.25.8
    MAL-2026-11725 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/va-mfe-loader 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7
    MAL-2026-11948 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/standalone-tm-api 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7
    MAL-2026-11921 ghsa-malware, amazon-inspector
  • npm
    @onereach/content-builder 0.0.18, 0.0.19, 0.0.20
    MAL-2026-11596 ghsa-malware, amazon-inspector
  • npm
    @qlik/eslint-config-vue 0.1.1
    MAL-2026-11797 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/line-item-editor 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.6, 1.5.7
    MAL-2026-11887 ghsa-malware, amazon-inspector
  • npm
    @onereach/webform 0.3.13, 0.3.14, 0.3.15
    MAL-2026-11664 ghsa-malware, amazon-inspector
  • npm
    @onereach/si-merge-tag-input 0.4.5, 0.4.6, 0.4.7
    MAL-2026-11641 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/micro-frontend 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.0.10
    MAL-2026-11900 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/responsive 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7
    MAL-2026-11914 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/moneyout-api-client 1.29.1, 1.29.2, 1.29.3, 1.29.4, 1.29.5, 1.29.6, 1.29.7
    MAL-2026-11906 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/form 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11870 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/marketing-integration-widgets 1.0.40, 1.0.41, 1.0.42, 1.0.43, 1.0.44, 1.0.45, 1.0.46
    MAL-2026-11894 ghsa-malware, amazon-inspector
  • npm
    @onereach/orest-jest-presets 0.0.3, 0.0.4, 0.0.5
    MAL-2026-11616 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/data-query 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11849 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/tokens 12.9.1, 12.9.2, 12.9.3, 12.9.4, 12.9.5, 12.9.6, 12.9.7
    MAL-2026-11944 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil-react 0.11.3, 0.11.4, 0.11.5, 0.11.6, 0.11.7, 0.11.8, 0.11.9
    MAL-2026-11819 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/testing-library 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7
    MAL-2026-11932 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/stylelint-config 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11927 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/form-state 41.3.1, 41.3.2, 41.3.3, 41.3.4, 41.3.5, 41.3.6, 41.3.7
    MAL-2026-11871 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/datadog-rum 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11850 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/launchdarkly-service 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11884 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/eslint-config 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11860 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/error-boundary 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11859 ghsa-malware, amazon-inspector
  • npm
    sn-listbox 0.3.3
    MAL-2026-11987 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil2 3.9.1, 3.9.2, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7
    MAL-2026-11822 ghsa-malware, amazon-inspector
  • npm
    @nebula.js/cli-build 7.1.2
    MAL-2026-11566 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/anvil2-ext-atlas 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8
    MAL-2026-11824 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/folder-lint 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7
    MAL-2026-11868 ghsa-malware, amazon-inspector