Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,401 npm 223,260 PyPI 11,995 RubyGems 4,318 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,401 reports · Feed

  • npm
    @servicetitan/forge 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7
    MAL-2026-11869 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/titan-chat-ui-common 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7
    MAL-2026-11937 ghsa-malware, amazon-inspector
  • npm
    @nebula.js/nucleus 0.5.1
    MAL-2026-11570 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/onboarding-ui 18.5.1, 18.5.2, 18.5.3, 18.5.4, 18.5.5, 18.5.6, 18.5.7
    MAL-2026-11910 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/contentful-proxy 1.1.12, 1.1.13, 1.1.14, 1.1.15, 1.1.16, 1.1.17, 1.1.18
    MAL-2026-11842 ghsa-malware, amazon-inspector
  • npm
    @keyv/memcache 6.0.0
    MAL-2026-12016 ghsa-malware, amazon-inspector
  • npm
    @keyv/mongo 6.0.0
    MAL-2026-12017 ghsa-malware, amazon-inspector
  • npm
    @keyv/etcd 6.0.0
    MAL-2026-12015 ghsa-malware
  • npm
    @keyv/sqlite 6.0.0
    MAL-2026-12023 ghsa-malware, amazon-inspector
  • npm
    @keyv/valkey 6.0.0
    MAL-2026-12025 ghsa-malware, amazon-inspector
  • npm
    @keyv/redis 6.0.0
    MAL-2026-12020 ghsa-malware, amazon-inspector
  • npm
    @keyv/mysql 6.0.0
    MAL-2026-12018 ghsa-malware, amazon-inspector
  • npm
    @keyv/postgres 6.0.0
    MAL-2026-12019 ghsa-malware, amazon-inspector
  • npm
    @keyv/serialize-msgpackr 6.0.0
    MAL-2026-12021 ghsa-malware, amazon-inspector
  • npm
    @keyv/encrypt-node 6.0.0
    MAL-2026-12013 ghsa-malware, amazon-inspector
  • npm
    @keyv/dynamo 6.0.0
    MAL-2026-12012 ghsa-malware
  • npm
    @keyv/compress-gzip 6.0.0
    MAL-2026-12010 ghsa-malware, amazon-inspector
  • npm
    @keyv/encrypt-web 6.0.0
    MAL-2026-12014 ghsa-malware, amazon-inspector
  • npm
    @keyv/compress-lz4 6.0.0
    MAL-2026-12011 ghsa-malware, amazon-inspector
  • npm
    @keyv/compress-brotli 6.0.0
    MAL-2026-12009 ghsa-malware, amazon-inspector
  • npm
    @keyv/test-suite 6.0.0
    MAL-2026-12024 ghsa-malware, amazon-inspector
  • npm
    @keyv/serialize-superjson 6.0.0
    MAL-2026-12022 ghsa-malware, amazon-inspector
  • npm
    @keyv/cloudflare-kv 6.0.0
    MAL-2026-12008 ghsa-malware, amazon-inspector
  • npm
    @keyv/bigmap 6.0.0
    MAL-2026-12007 ghsa-malware, amazon-inspector
  • npm
    @servicetitan/suppress-warnings 38.1.1, 38.1.2, 38.1.3, 38.1.4, 38.1.5, 38.1.6, 38.1.7, 38.1.0, 38.0.0, 37.0.2,…
    MAL-2026-11928 ghsa-malware, amazon-inspector
  • npm
    file-entry-cache 11.1.6
    MAL-2026-11970 ghsa-malware, amazon-inspector
  • npm
    @cacheable/net 2.1.1
    MAL-2026-11559 ghsa-malware, amazon-inspector
  • npm
    @cacheable/utils 2.5.1
    MAL-2026-11561 ghsa-malware, amazon-inspector
  • npm
    @cacheable/memory 2.2.1
    MAL-2026-11558 ghsa-malware, amazon-inspector
  • npm
    @cacheable/node-cache 3.1.2
    MAL-2026-11560 ghsa-malware, amazon-inspector
  • npm
    ecto 5.0.1
    MAL-2026-11966 ghsa-malware, amazon-inspector
  • npm
    cacheable 2.5.1
    MAL-2026-11963 ghsa-malware, amazon-inspector
  • npm
    keyv 6.0.0
    MAL-2026-11524 amazon-inspector, ghsa-malware
  • npm
    cache-manager 7.2.10
    MAL-2026-11523 amazon-inspector, ghsa-malware
  • npm
    flat-cache 6.1.24
    MAL-2026-11971 ghsa-malware
  • npm
    cacheable-request 13.0.20
    MAL-2026-11964 ghsa-malware, amazon-inspector
  • PyPI
    psbt-helpers 1.0.0
    MAL-2026-11521 kam193 2 IOCs
  • PyPI
    launchdarkly-ai-server-sdk 1.0.1, 1.9.9
    MAL-2026-11519 kam193, amazon-inspector
  • PyPI
    psbt-utils 1.0.0
    MAL-2026-11520 kam193, amazon-inspector 2 IOCs
  • npm
    exnesss 0.0.1
    MAL-2026-11518 ossf-package-analysis, amazon-inspector, ghsa-malware