Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,431 npm 223,271 PyPI 12,011 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,431 reports · Feed

  • npm
    flick-test-app 1.0.1
    MAL-2026-10522 ghsa-malware, amazon-inspector
  • npm
    @flcik/flick.js 3.1.2, 3.0.1, 3.1.3, 3.1.4, 3.0.3, 3.0.0, 3.0.4, 3.1.1, 3.0.2
    MAL-2026-10521 ghsa-malware, amazon-inspector
  • npm
    fastify-bundler 1.4.13, 1.4.16, 1.4.15, 1.4.14
    MAL-2026-10520 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    @tqm-mfe/main 5.4.7, 5.5.0
    MAL-2026-10517 amazon-inspector, ghsa-malware
  • npm
    chai-as-sets 3.1.3
    MAL-2026-10519 amazon-inspector
  • npm
    chai-as-auth 2.3.5
    MAL-2026-10518 amazon-inspector
  • npm
    polymarket-bot-logger 1.0.1, 1.0.0
    MAL-2026-10516 amazon-inspector, ghsa-malware
  • npm
    nodemon-client 3.1.13
    MAL-2026-10513 ghsa-malware, amazon-inspector
  • npm
    nodemon-eslint 3.1.13
    MAL-2026-10514 ghsa-malware, amazon-inspector
  • npm
    nodemon-web 3.1.13
    MAL-2026-10515 ghsa-malware, amazon-inspector
  • npm
    type-astr 3.2.3
    MAL-2026-10510 amazon-inspector, ghsa-malware
  • npm
    type-swap 3.1.3
    MAL-2026-10511 amazon-inspector, ghsa-malware
  • npm
    type-unique 3.1.3
    MAL-2026-10512 amazon-inspector, ghsa-malware
  • npm
    nodemon-delog 3.1.13
    MAL-2026-10507 amazon-inspector, ghsa-malware
  • npm
    nodemon-elint 3.1.13
    MAL-2026-10508 amazon-inspector
  • npm
    chai-as-verified 7.1.5
    MAL-2026-10504 amazon-inspector
  • npm
    node-fsagent 1.1.3, 1.2.2, 1.0.4, 1.1.2, 1.1.1, 1.2.0, 1.0.0, 1.0.8, 1.2.1
    MAL-2026-10506 amazon-inspector, ghsa-malware
  • npm
    test_adminet 99.9.9
    MAL-2026-10509 amazon-inspector
  • npm
    express-ini 12.1.10
    MAL-2026-10505 amazon-inspector, ghsa-malware
  • npm
    filewisee 0.1.0, 0.1.1
    MAL-2026-10501 amazon-inspector, ghsa-malware
  • npm
    bubblestring 1.1.4
    MAL-2026-10496 amazon-inspector
  • npm
    ddok-modal 1.0.0
    MAL-2026-10497 amazon-inspector, ghsa-malware
  • npm
    n8n-nodes-rce-poc 1.0.0
    MAL-2026-10503 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    gamified-trading-system 3.6.2, 3.1.0
    MAL-2026-10502 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    eslint-angular-react 110.0.1, 110.0.0, 110.0.2
    MAL-2026-10498 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    express-bunker 6.1.0
    MAL-2026-10500 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    @quukk/opencode-clawmessenger 1.1.10
    MAL-2026-10495 amazon-inspector
  • npm
    @quickcall/krew 0.1.7
    MAL-2026-10494 amazon-inspector
  • npm
    eth-lib-utils 5.2.3, 5.2.5, 5.2.4
    MAL-2026-10499 amazon-inspector, ghsa-malware
  • npm
    insomnia-plugin-poc-m4gester-run 1.0.0
    MAL-2026-10493 amazon-inspector
  • npm
    assertcoreutils 2.3.2, 2.3.3
    MAL-2026-10491 amazon-inspector, ghsa-malware
  • npm
    font-huge 2.5.3
    MAL-2026-10492 amazon-inspector, ghsa-malware
  • npm
    @sqlite-panel/createsql 1.0.0
    MAL-2026-10490 amazon-inspector, ghsa-malware
  • npm
    permcarmserver 1.0.0
    MAL-2026-10488 amazon-inspector, ghsa-malware
  • npm
    permcserver 1.0.1, 1.0.0, 1.0.3, 1.0.4, 1.0.2
    MAL-2026-10489 amazon-inspector, ghsa-malware
  • npm
    @omniwatch-wick/cli 0.1.2, 0.1.3, 0.1.1, 0.1.0, 0.1.4
    MAL-2026-10486 amazon-inspector, ghsa-malware
  • npm
    @outsmartly/metaobjects 0.3.3-rc.1
    MAL-2026-10487 amazon-inspector
  • npm
    polymarket-stake-kelly-math-check 3.5.2
    MAL-2026-10485 ghsa-malware, amazon-inspector
  • npm
    react-icons-svgo 1.0.0, 1.5.4, 1.5.3
    MAL-2026-10482 amazon-inspector, ghsa-malware
  • PyPI
    browser-use-headless 0.1.4
    MAL-2026-10484 amazon-inspector, kam193 3 IOCs