Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,431 npm 223,271 PyPI 12,011 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,431 reports · Feed

  • npm
    node-fsmetrics-data 1.0.1, 1.0.0, 1.0.2, 1.1.0
    MAL-2026-10479 amazon-inspector, ghsa-malware
  • npm
    route-processor 3.1.5
    MAL-2026-10483 amazon-inspector, ghsa-malware
  • npm
    node-fsmetrics-native 1.0.0
    MAL-2026-10480 amazon-inspector, ghsa-malware
  • npm
    @sectest429/hello-npm-world 1.0.3, 1.0.2, 1.0.1, 1.0.0
    MAL-2026-10478 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    @torbeck/priority-queue 6.3.9, 6.3.7, 6.3.6, 6.3.10, 6.3.8, 6.3.5
    MAL-2026-10472 amazon-inspector, ghsa-malware
  • npm
    claude-team-tracker 1.2.1, 1.2.0, 1.2.2
    MAL-2026-10473 amazon-inspector
  • npm
    @dervix/socket.io 4.8.5, 4.8.6, 4.8.8, 4.8.4, 4.8.9, 4.8.3, 4.8.7
    MAL-2026-10475 ghsa-malware, amazon-inspector
  • npm
    @dervix/engine.io 6.6.5, 6.6.7, 6.6.2, 6.6.9, 6.6.3, 6.6.6
    MAL-2026-10474 ghsa-malware, amazon-inspector
  • npm
    @gleamkit/socket.io 4.8.7, 4.8.8, 4.8.6
    MAL-2026-10477 ghsa-malware, amazon-inspector
  • npm
    @gleamkit/engine.io 6.6.3, 6.6.5, 6.6.4
    MAL-2026-10476 ghsa-malware, amazon-inspector
  • npm
    loading-sessions 6.13.2
    MAL-2026-10471 amazon-inspector, reversing-labs
  • npm
    @uw010010/vite-tree 3.4.3, 3.6.1, 3.4.2, 3.4.1, 8.1.0
    MAL-2026-10470 amazon-inspector, ghsa-malware
  • npm
    @sheltr_/agent 1.0.2, 1.0.4
    MAL-2026-10469 amazon-inspector
  • npm
    @origindev/ethaccount 1.0.0, 1.0.1
    MAL-2026-10455 amazon-inspector
  • npm
    @spzhongwin/skill-logger-plugin 1.0.5, 1.0.10, 1.0.7, 1.0.14
    MAL-2026-10456 amazon-inspector
  • npm
    nodemon-sync 3.1.13
    MAL-2026-10468 ghsa-malware, amazon-inspector
  • npm
    hehehee 1.0.9, 2.0.21, 2.0.22, 2.0.19
    MAL-2026-10462 amazon-inspector
  • npm
    cktool-core 1.0.0, 1.0.2, 1.0.1, 1.0.4, 1.0.3
    MAL-2026-10457 amazon-inspector, ghsa-malware
  • npm
    polymarket-math-stake-kelly 3.7.2
    MAL-2026-10466 amazon-inspector
  • npm
    gptlite 4.0.8
    MAL-2026-10461 amazon-inspector
  • npm
    polymarket-stake-kelly-math 3.8.2
    MAL-2026-10467 amazon-inspector, ghsa-malware
  • npm
    compliancepolicyserv 9.9.11
    MAL-2026-10458 amazon-inspector
  • npm
    connectedmerchantsserv 9.9.11
    MAL-2026-10459 amazon-inspector
  • npm
    datavaultx 1.7.1
    MAL-2026-10460 amazon-inspector
  • npm
    node-path-addon 1.0.8, 1.0.7
    MAL-2026-10463 amazon-inspector, ghsa-malware
  • npm
    node-procmetrics-data 1.0.1
    MAL-2026-10464 amazon-inspector
  • npm
    node-sysmon-native 1.0.0, 1.0.1, 1.0.2
    MAL-2026-10465 amazon-inspector
  • npm
    nodemon-async 3.1.13
    MAL-2026-10454 ghsa-malware, amazon-inspector
  • npm
    router-processor 1.5.2
    MAL-2026-10453 amazon-inspector
  • npm
    font-hub 1.5.2
    MAL-2026-10450 amazon-inspector
  • npm
    @sqlite-group/schema-generator 1.0.2
    MAL-2026-10448 amazon-inspector, ghsa-malware
  • npm
    gifuct 2.1.2
    MAL-2026-10451 amazon-inspector, ghsa-malware
  • npm
    auth-gen-next 1.7.13
    MAL-2026-10449 amazon-inspector
  • npm
    markdown-editable-table 2.4.3, 2.4.4, 2.4.2
    MAL-2026-10452 amazon-inspector, ghsa-malware
  • npm
    @oliviamcdaniel12/safer-buffer 2.2.1, 2.2.0
    MAL-2026-10442 amazon-inspector, ghsa-malware
  • npm
    react-markable-table 2.4.10
    MAL-2026-10446 amazon-inspector, ghsa-malware
  • npm
    remarkable-table 2.4.11
    MAL-2026-10447 amazon-inspector, ghsa-malware
  • npm
    markable-table 3.1.2, 3.1.4, 3.1.3, 3.1.8, 3.1.6, 3.1.7, 3.1.5, 3.1.1, 3.1.0
    MAL-2026-10444 amazon-inspector, ghsa-malware
  • npm
    home-sections-web-ui 99.9.9
    MAL-2026-10443 amazon-inspector, ghsa-malware
  • npm
    node-procmetrics 1.0.7, 1.0.1, 1.0.5, 1.0.9, 1.0.4, 1.0.8, 1.0.6, 1.0.3, 1.0.2, 1.0.0
    MAL-2026-10445 amazon-inspector