Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,406 npm 223,265 PyPI 11,995 RubyGems 4,318 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,406 reports · Feed

  • npm
    lodash-ex all versions
    MAL-2026-11327 ghsa-malware
  • npm
    imut-set all versions
    MAL-2026-11320 ghsa-malware
  • npm
    ag-grid-boost all versions
    MAL-2026-11235 ghsa-malware
  • npm
    wastu all versions
    MAL-2026-11409 ghsa-malware
  • npm
    test-wastu all versions
    MAL-2026-11396 ghsa-malware
  • npm
    scol all versions
    MAL-2026-11377 ghsa-malware
  • npm
    blbird all versions
    MAL-2026-11248 ghsa-malware
  • npm
    zcas all versions
    MAL-2026-11412 ghsa-malware
  • npm
    spectral-wraith all versions
    MAL-2026-11385 ghsa-malware
  • npm
    spectral-corsair 999.999.999, 999.999.1000
    MAL-2026-11384 ghsa-malware, reversing-labs
  • npm
    ecto-logger all versions
    MAL-2026-11287 ghsa-malware
  • npm
    curse-dependent 1.0.0, 9.9.9, 9.9.11, 9.9.12, 9.9.13, 9.9.15, 9.9.16, 9.9.17, 9.9.18, 9.9.19, 9…
    MAL-2026-11272 ghsa-malware, reversing-labs
  • npm
    @spectraltest/loglevel all versions
    MAL-2026-11232 ghsa-malware
  • npm
    puppetewebr all versions
    MAL-2026-11361 ghsa-malware
  • npm
    etwl all versions
    MAL-2026-11301 ghsa-malware
  • npm
    pretierr all versions
    MAL-2026-11348 ghsa-malware
  • npm
    malxios all versions
    MAL-2026-11330 ghsa-malware
  • npm
    maalxios all versions
    MAL-2026-11329 ghsa-malware
  • npm
    @sourav_chanduka/oidc-client all versions
    MAL-2026-11231 ghsa-malware
  • npm
    @sourav_chanduka/core-no-ngrok all versions
    MAL-2026-11230 ghsa-malware
  • npm
    @sourav_chanduka/core all versions
    MAL-2026-11229 ghsa-malware
  • npm
    @web3utils/common all versions
    MAL-2026-11234 ghsa-malware
  • npm
    @web3-util/common all versions
    MAL-2026-11233 ghsa-malware
  • npm
    @solana-utils/common all versions
    MAL-2026-11228 ghsa-malware
  • npm
    discord-rsc all versions
    MAL-2026-11279 ghsa-malware
  • npm
    discord-csr all versions
    MAL-2026-11277 ghsa-malware
  • npm
    tailwindcsssss all versions
    MAL-2026-11394 ghsa-malware
  • npm
    tailwindcssss 0.2.0, 1.0.1, 1.0.2, 1.0.3, 1.1.0, 1.1.1, 1.2.0, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.…
    MAL-2026-11393 ghsa-malware, reversing-labs
  • npm
    @relforce-dev/console-log all versions
    MAL-2026-11225 ghsa-malware
  • npm
    @pumpdot-fun/pump-swap-sdk all versions
    MAL-2026-11224 ghsa-malware
  • npm
    @pumpdot-fun/pump-sdk all versions
    MAL-2026-11223 ghsa-malware
  • npm
    @node-console-log/log all versions
    MAL-2026-11216 ghsa-malware
  • npm
    fwf all versions
    MAL-2026-11314 ghsa-malware
  • npm
    @santieich/homebridge-midea-lan all versions
    MAL-2026-11226 ghsa-malware
  • npm
    famshot 1.0.0, 1.0.1
    MAL-2026-11309 ghsa-malware, amazon-inspector
  • npm
    aruda all versions
    MAL-2026-11240 ghsa-malware
  • npm
    @patternfly-4/react-tokens 9.9.9
    MAL-2026-11222 ghsa-malware, reversing-labs
  • npm
    @patternfly-4/react-table 9.9.9
    MAL-2026-11221 ghsa-malware, reversing-labs
  • npm
    @patternfly-4/react-core 9.9.9
    MAL-2026-11220 ghsa-malware, reversing-labs
  • npm
    @patternfly-4/quickstarts 9.9.9
    MAL-2026-11219 ghsa-malware, reversing-labs