Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,406 npm 223,265 PyPI 11,995 RubyGems 4,318 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,406 reports · Feed

  • npm
    node-fetch-core all versions
    MAL-2026-11339 ghsa-malware
  • npm
    @nordea-web/ui all versions
    MAL-2026-11218 ghsa-malware
  • npm
    @nordea-web/core all versions
    MAL-2026-11217 ghsa-malware
  • npm
    ncc-web all versions
    MAL-2026-11338 ghsa-malware
  • npm
    ncc-hyperapp all versions
    MAL-2026-11337 ghsa-malware
  • npm
    ncc-fonts all versions
    MAL-2026-11336 ghsa-malware
  • npm
    hjw-nasa-lib all versions
    MAL-2026-11316 ghsa-malware
  • npm
    dwa-tridion-webapp all versions
    MAL-2026-11284 ghsa-malware
  • npm
    tsetnpmackage all versions
    MAL-2026-11403 ghsa-malware
  • npm
    testsetset all versions
    MAL-2026-11397 ghsa-malware
  • npm
    @meteora-sdk/core all versions
    MAL-2026-11215 ghsa-malware
  • npm
    kajl all versions
    MAL-2026-11325 ghsa-malware
  • npm
    cmd-auth all versions
    MAL-2026-11264 ghsa-malware
  • npm
    react.jd all versions
    MAL-2026-11369 ghsa-malware
  • npm
    react.ja all versions
    MAL-2026-11368 ghsa-malware
  • npm
    installreact all versions
    MAL-2026-11322 ghsa-malware
  • npm
    reakt.js all versions
    MAL-2026-11370 ghsa-malware
  • npm
    react.j all versions
    MAL-2026-11367 ghsa-malware
  • npm
    reac.js all versions
    MAL-2026-11364 ghsa-malware
  • npm
    express.jd all versions
    MAL-2026-11308 ghsa-malware
  • npm
    express.ja all versions
    MAL-2026-11307 ghsa-malware
  • npm
    expres.js all versions
    MAL-2026-11302 ghsa-malware
  • npm
    ekspress all versions
    MAL-2026-11288 ghsa-malware
  • npm
    chalk-helper all versions
    MAL-2026-11258 ghsa-malware
  • npm
    chalk-buttons all versions
    MAL-2026-11257 ghsa-malware
  • npm
    chalk-button all versions
    MAL-2026-11256 ghsa-malware
  • npm
    chalk-butons all versions
    MAL-2026-11255 ghsa-malware
  • npm
    uniswapintefrace all versions
    MAL-2026-11407 ghsa-malware
  • npm
    ttest3333 all versions
    MAL-2026-11405 ghsa-malware
  • npm
    ttest333 all versions
    MAL-2026-11404 ghsa-malware
  • npm
    testtwix all versions
    MAL-2026-11398 ghsa-malware
  • npm
    raydiums all versions
    MAL-2026-11363 ghsa-malware
  • npm
    clotest all versions
    MAL-2026-11263 ghsa-malware
  • npm
    clo321-server all versions
    MAL-2026-11262 ghsa-malware
  • npm
    clo321 all versions
    MAL-2026-11261 ghsa-malware
  • npm
    clo2 all versions
    MAL-2026-11260 ghsa-malware
  • npm
    clo-adspect all versions
    MAL-2026-11259 ghsa-malware
  • npm
    apijsclo all versions
    MAL-2026-11239 ghsa-malware
  • npm
    1apijs all versions
    MAL-2026-11206 ghsa-malware
  • PyPI
    ml-data-shared 12.0.1, 16.0.1
    MAL-2026-11199 kam193 1 IOC