Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,407 npm 223,265 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,407 reports · Feed

  • npm
    pretty-log-cli 2.9.0, 2.6.0, 2.0.0, 2.8.0, 2.1.0, 2.2.0, 2.3.0, 2.4.0, 2.5.0, 2.7.0
    MAL-2026-11349 ghsa-malware, amazon-inspector
  • npm
    logform-core 3.2.0, 3.1.0, 3.3.0
    MAL-2026-11328 ghsa-malware, amazon-inspector
  • npm
    @wbnr/design 99.3.0, 99.0.0, 99.1.0, 99.0.1
    MAL-2026-11196 ossf-package-analysis, amazon-inspector
  • npm
    react-fast-refresh-helper 1.2.6, 1.2.4, 1.2.5
    MAL-2026-11366 ghsa-malware, amazon-inspector
  • PyPI
    phabricator-client 99.0.0, 99.0.1, 99.0.2, 99.0.3, 99.0.4
    MAL-2026-11195 kam193, amazon-inspector
  • npm
    litespeed-cache 1.1.2, 1.1.1, 1.0.0
    MAL-2026-11193 ghsa-malware, amazon-inspector
  • npm
    n8n-nodes-trust-me-im-totally-safe all versions
    MAL-2026-11194 ghsa-malware
  • npm
    @ai-plus/de-agent-sdk all versions
    MAL-2026-11175 ghsa-malware
  • npm
    @ai-plus/de-agent all versions
    MAL-2026-11174 ghsa-malware
  • npm
    @ai-agent-node/nodesql all versions
    MAL-2026-11173 ghsa-malware
  • npm
    @ai-agent-node/createnode 1.0.1, 1.0.0
    MAL-2026-11172 ghsa-malware, amazon-inspector
  • npm
    @ai-agent-node/agent-node all versions
    MAL-2026-11171 ghsa-malware
  • npm
    @zannstore/baileys 2.4.4, 2.4.3, 2.4.2, 2.4.1, 2.4.0, 2.3.9, 2.3.7, 2.3.6, 2.3.5, 2.3.4, 2.3.3, 2.…
    MAL-2026-11179 ghsa-malware, amazon-inspector
  • npm
    @peptide-unit/peptide-modify 1.0.6, 1.0.7
    MAL-2026-11178 ghsa-malware, amazon-inspector
  • npm
    @peptide-unit/js-unimode 1.1.13, 1.1.12
    MAL-2026-11177 ghsa-malware, amazon-inspector
  • npm
    uniapi-bridge all versions
    MAL-2026-11190 ghsa-malware
  • npm
    test-skill-zip all versions
    MAL-2026-11189 ghsa-malware
  • npm
    lzd-unified-station-sdk all versions
    MAL-2026-11187 ghsa-malware
  • npm
    lwp-web-client all versions
    MAL-2026-11186 ghsa-malware
  • npm
    flight-compare-analyzer all versions
    MAL-2026-11185 ghsa-malware
  • npm
    def-open-client all versions
    MAL-2026-11183 ghsa-malware
  • npm
    colder-cli all versions
    MAL-2026-11182 ghsa-malware
  • npm
    open-worker-cli all versions
    MAL-2026-11188 ghsa-malware
  • npm
    feedback-ai-sdk all versions
    MAL-2026-11184 ghsa-malware
  • npm
    aone-cloud-cli all versions
    MAL-2026-11180 ghsa-malware
  • npm
    zer0code 0.2.0
    MAL-2026-11191 ghsa-malware, amazon-inspector
  • npm
    @finxsecdemo/utils 1.0.2, 1.0.3
    MAL-2026-11170 ossf-package-analysis, amazon-inspector
  • npm
    test2221 2.2.4, 2.2.3, 2.2.6
    MAL-2026-11192 ossf-package-analysis, amazon-inspector
  • npm
    chain-manager 1.0.8, 1.0.10, 1.0.9
    MAL-2026-11181 ghsa-malware, amazon-inspector
  • npm
    @bowozzz/baileys 6.6.7, 8.8.8, 6.6.6, 7.0.0, 7.0.2, 9.9.9, 1.0.0, 7.0.3, 7.7.7, 7.0.1
    MAL-2026-11176 ghsa-malware, amazon-inspector
  • npm
    @mypwn/hawkeye 99.0.0
    MAL-2026-11157 ossf-package-analysis
  • npm
    @types-beta/sdk 0.1.0, 0.1.1, 0.1.2, 0.1.3
    MAL-2026-11499 amazon-inspector
  • npm
    @joyfill/layouts 0.1.2-2773.beta.0
    MAL-2026-11161 ghsa-malware, amazon-inspector
  • npm
    @joyfill/components 4.0.0-rc24-2773-beta.4
    MAL-2026-11160 ghsa-malware, amazon-inspector
  • npm
    postcss-motion-utils 3.2.7
    MAL-2026-11168 ghsa-malware, amazon-inspector
  • npm
    local-config-parser all versions
    MAL-2026-11167 ghsa-malware
  • npm
    lib-mtop all versions
    MAL-2026-11166 ghsa-malware
  • npm
    aone-sandbox all versions
    MAL-2026-11164 ghsa-malware
  • npm
    aone-kit-cli all versions
    MAL-2026-11163 ghsa-malware
  • npm
    aone-kit all versions
    MAL-2026-11162 ghsa-malware