Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,432 npm 223,271 PyPI 12,012 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,432 reports · Feed

  • npm
    tslint-conf 7.2.1
    MAL-2026-7022 amazon-inspector, ghsa-malware
  • npm
    @vite-js/ui 7.15.16, 7.15.10
    MAL-2026-7021 amazon-inspector, ghsa-malware
  • npm
    n8n-nodes-barcode-generator 1.0.3
    MAL-2026-7018 amazon-inspector
  • npm
    react-v17 20.0.1
    MAL-2026-7020 amazon-inspector
  • npm
    npm-rce-poc 1.0.13
    MAL-2026-7019 amazon-inspector, ghsa-malware
  • npm
    none123s 0.1.7, 1.1.6, 1.1.7, 0.1.9, 1.1.4, 1.1.2, 0.1.1, 0.1.0, 0.1.3, 1.1.1, 0.1.4, 0.…
    MAL-2026-7024 ossf-package-analysis, ghsa-malware, amazon-inspector
  • npm
    @vraksha/gh-helper 1.0.0
    MAL-2026-7016 amazon-inspector
  • npm
    crypto-promiser 1.0.1, 1.0.2
    MAL-2026-7010 amazon-inspector, ghsa-malware
  • npm
    vps-new-manager 0.1.4, 0.1.3
    MAL-2026-7014 amazon-inspector, ghsa-malware
  • npm
    events-alias 15.0.1
    MAL-2026-7011 amazon-inspector
  • npm
    chai-as-const 1.4.5, 1.4.6, 1.4.7
    MAL-2026-7008 amazon-inspector, ghsa-malware
  • npm
    configration 2.3.5
    MAL-2026-7009 amazon-inspector, reversing-labs
  • npm
    next-locomotive-init 1.0.4, 1.0.3, 1.0.0, 1.0.2, 1.0.1
    MAL-2026-7013 amazon-inspector, ghsa-malware
  • npm
    @vite-tab/tab 5.7.0, 3.15.10
    MAL-2026-6988 amazon-inspector, ghsa-malware
  • PyPI
    turbom 1.0.0, 1.0.1
    MAL-2026-7015 kam193
  • npm
    luludawang-kit 0.0.1
    MAL-2026-6999 amazon-inspector, ghsa-malware
  • npm
    ec-checker 0.0.1
    MAL-2026-6996 amazon-inspector
  • npm
    chai-redirection 0.0.1, 0.0.4, 0.0.3
    MAL-2026-6995 amazon-inspector, ghsa-malware
  • npm
    chai-presentation 0.0.1, 0.0.2, 0.0.4, 0.0.3
    MAL-2026-6994 amazon-inspector
  • npm
    airkey-mfa-react 36.1.1, 20.0.1, 35.1.1, 29.1.1
    MAL-2026-6991 ossf-package-analysis, amazon-inspector, ghsa-malware
  • npm
    pipo-sdk 9999.0.0
    MAL-2026-7000 amazon-inspector
  • npm
    goofy-sdk 9999.0.0
    MAL-2026-6997 amazon-inspector
  • npm
    @luminarycloudinternal/lcvis-st 9999.0.1, 9999.0.2, 9999.0.3
    MAL-2026-6987 amazon-inspector, ghsa-malware
  • npm
    bytefaas-sdk 9999.0.0
    MAL-2026-6993 amazon-inspector
  • npm
    searchresults 999.0.0
    MAL-2026-7003 amazon-inspector, ghsa-malware
  • npm
    thunder-rony 99.9.9
    MAL-2026-7004 amazon-inspector
  • npm
    ronyfortest 99.9.9
    MAL-2026-7002 amazon-inspector
  • npm
    rony-test 99.9.9
    MAL-2026-7001 amazon-inspector
  • npm
    higherlogic-ocfe 99.9.1
    MAL-2026-6998 amazon-inspector, ghsa-malware
  • npm
    babel-eslint-parser-legacy 99.9.1
    MAL-2026-6992 amazon-inspector, ghsa-malware
  • npm
    ag-charts-test 99.9.1
    MAL-2026-6989 amazon-inspector, ghsa-malware
  • npm
    visa-cli-tools 99.9.1
    MAL-2026-7005 amazon-inspector, ghsa-malware
  • npm
    ai-gen-ai-opt-in 99.0.0
    MAL-2026-6990 amazon-inspector
  • npm
    @luminarycloudinternal/frodo 9999.0.1, 9999.0.2, 9999.0.3
    MAL-2026-6986 amazon-inspector, ghsa-malware
  • npm
    promo-helper 1.0.4, 1.0.7, 1.0.0, 1.0.6, 1.0.5, 1.0.8, 1.0.3, 1.0.14
    MAL-2026-6985 ghsa-malware, amazon-inspector
  • PyPI
    manom 1.2.2
    MAL-2026-7007 kam193
  • PyPI
    manik 1.2.1
    MAL-2026-7006 kam193
  • PyPI
    tronpak 0.0.1
    MAL-2026-6983 kam193 4 IOCs
  • npm
    @vite-ln/build-ts 5.15.10, 5.17.0
    MAL-2026-6984 ghsa-malware, amazon-inspector
  • npm
    paysafe-cards 1.0.0
    MAL-2026-6982 amazon-inspector