Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,408 npm 223,266 PyPI 11,995 RubyGems 4,319 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,408 reports · Feed

  • npm
    lychee-norm-cache 22.0.0
    MAL-2026-11029 ghsa-malware, amazon-inspector
  • npm
    create-kumo-project 22.0.0
    MAL-2026-11024 ghsa-malware, amazon-inspector
  • npm
    helix-deploy 110.0.1, 110.0.0
    MAL-2026-11028 ghsa-malware, amazon-inspector
  • npm
    da-sc-sdk 1.2.4, 1.2.3
    MAL-2026-11025 ghsa-malware, amazon-inspector
  • npm
    aio-commerce-lib-app all versions
    MAL-2026-11022 ghsa-malware
  • npm
    ethers-packge all versions
    MAL-2026-11026 ghsa-malware
  • npm
    bs58-88 6.0.1
    MAL-2026-11023 ghsa-malware, amazon-inspector
  • npm
    @bcryptln/bcryptjs all versions
    MAL-2026-11021 ghsa-malware
  • npm
    hardhat-gas-tracker 1.0.1, 1.0.0
    MAL-2026-11020 ossf-package-analysis, amazon-inspector
  • npm
    application-util 2.1.6
    MAL-2026-11000 amazon-inspector
  • npm
    web3-terminal 2.1.6
    MAL-2026-11007 amazon-inspector
  • npm
    habinger 2.1.6
    MAL-2026-11002 amazon-inspector
  • npm
    encryptstringadmincore 1.0.1, 1.1.0
    MAL-2026-11013 ghsa-malware, amazon-inspector
  • npm
    encryptstringadmin 1.2.1, 1.4.2, 1.3.0
    MAL-2026-11012 ghsa-malware, amazon-inspector
  • npm
    encrypt-string-ttak 1.0.1, 1.0.0, 1.0.2
    MAL-2026-11011 ghsa-malware, amazon-inspector
  • npm
    n8n-nodes-net-utils 1.0.2, 1.0.0, 1.0.1
    MAL-2026-11003 amazon-inspector
  • npm
    n8n-nodes-pwn 1.0.6, 1.0.5, 1.0.8, 1.0.7, 1.0.0, 1.0.2, 1.0.1, 1.0.4
    MAL-2026-11004 amazon-inspector
  • npm
    n8n-nodes-quick-utils 1.0.2, 1.0.0, 1.0.1
    MAL-2026-11005 amazon-inspector
  • npm
    n8n-nodes-utils-helper 1.0.0, 1.0.2, 1.0.1
    MAL-2026-11006 amazon-inspector
  • npm
    n8n-nodes-http-probe 1.0.2, 1.0.0, 1.0.1
    MAL-2026-10997 amazon-inspector
  • npm
    n8n-nodes-port-scanner 1.0.2, 1.0.1, 1.0.0
    MAL-2026-10998 amazon-inspector
  • npm
    habingeer 2.1.6
    MAL-2026-10995 amazon-inspector
  • npm
    app-data-ist 2.1.6
    MAL-2026-10994 amazon-inspector, ghsa-malware
  • npm
    init-js-examples 1.0.0
    MAL-2026-10996 amazon-inspector
  • npm
    n8n-nodes-task-runner 1.0.16, 1.0.1, 1.0.7, 1.0.9, 1.0.4, 1.0.2, 1.0.3, 1.0.6, 1.0.8, 1.0.0, 1.0.5, 1…
    MAL-2026-10999 amazon-inspector
  • PyPI
    torch-musa 0.0.0, 1.0.0
    MAL-2026-10993 kam193
  • npm
    kijai 0.0.2
    MAL-2026-11014 ghsa-malware, amazon-inspector
  • npm
    veskr 1.0.0
    MAL-2026-11019 ghsa-malware, amazon-inspector
  • npm
    veldora 1.0.1
    MAL-2026-11018 ghsa-malware, amazon-inspector
  • npm
    vantora 1.0.1, 1.0.0
    MAL-2026-11016 ghsa-malware, amazon-inspector
  • npm
    calvora 1.0.1, 1.0.0
    MAL-2026-11010 ghsa-malware, amazon-inspector
  • npm
    calmora 1.0.1
    MAL-2026-11009 ghsa-malware, amazon-inspector
  • npm
    caldryn 1.0.0
    MAL-2026-11008 ghsa-malware, amazon-inspector
  • npm
    vectormark 1.0.1, 1.0.0
    MAL-2026-11017 ghsa-malware, amazon-inspector
  • npm
    react-tabulix-query 0.1.2, 0.1.0, 0.1.3
    MAL-2026-11015 ghsa-malware, amazon-inspector
  • npm
    react-tabulix-extended 0.1.7
    MAL-2026-11040 ossf-package-analysis, amazon-inspector
  • PyPI
    dev-helper-bg 0.1.3, 0.1.4, 0.1.6, 0.1.7
    MAL-2026-10992 kam193, amazon-inspector 2 IOCs
  • PyPI
    make-helper 0.1.0, 0.1.1
    MAL-2026-10991 kam193, amazon-inspector 2 IOCs
  • npm
    svelte-streaks 1.0.2, 1.0.0, 1.0.1
    MAL-2026-10983 ghsa-malware, amazon-inspector
  • npm
    streak-daycount 1.0.0
    MAL-2026-10982 ghsa-malware, amazon-inspector