Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,458 npm 223,292 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,458 reports · Feed

  • npm
    chai-chain-dom 1.3.9, 1.3.7, 1.3.8
    MAL-2026-6919 ghsa-malware, amazon-inspector
  • npm
    typescript-base58 1.0.0
    MAL-2026-6925 ghsa-malware, amazon-inspector
  • npm
    crypto-base58 1.0.0, 1.0.4, 1.0.1, 1.0.3, 1.0.2
    MAL-2026-6920 ghsa-malware, amazon-inspector
  • npm
    solana-address-codec 1.0.1, 1.0.0, 1.0.5, 1.0.3, 1.0.4, 1.0.2
    MAL-2026-6924 ghsa-malware, amazon-inspector
  • npm
    base58-cli 1.0.1, 1.0.4, 1.0.5, 1.0.2, 1.0.0, 1.0.3
    MAL-2026-6918 ghsa-malware, amazon-inspector
  • npm
    @sqlite-list/schema-generator all versions
    MAL-2026-6916 ghsa-malware
  • npm
    @sqlite-list/sql-creator all versions
    MAL-2026-6917 ghsa-malware
  • npm
    @sqlite-list/createsql all versions
    MAL-2026-6915 ghsa-malware
  • npm
    @sqlite-access/nodesql 1.0.2
    MAL-2026-6914 ghsa-malware, amazon-inspector
  • npm
    mcp-server-pg 1.2.1, 1.1.0, 1.2.2, 1.1.1, 0.7.0, 0.1.0, 0.2.1, 0.2.0, 0.6.0, 0.8.0, 0.3.1, 0.…
    MAL-2026-6922 ghsa-malware, amazon-inspector
  • npm
    @engagehub/test-claim all versions
    MAL-2026-6912 ghsa-malware
  • npm
    brunomenozzi-test-pkg all versions
    MAL-2026-6913 ghsa-malware
  • npm
    zreactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7447 reversing-labs
  • npm
    zircuit-vault 99.0.0
    MAL-2026-7446 reversing-labs
  • npm
    zircuit-reporter 99.0.0
    MAL-2026-7445 reversing-labs
  • npm
    zircuit-oracle 99.0.0
    MAL-2026-7444 reversing-labs
  • npm
    zircuit-keeper 99.0.0
    MAL-2026-7443 reversing-labs
  • npm
    yreactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7442 reversing-labs
  • npm
    wreactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7441 reversing-labs
  • npm
    winston-middleware 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.3.1, 1.0.0, 1.…
    MAL-2026-7440 reversing-labs
  • npm
    win-env-setup 3.0.5, 3.0.6
    MAL-2026-7439 reversing-labs
  • npm
    whaleco-assets-json 99.9.9, 100.0.5
    MAL-2026-7438 reversing-labs
  • npm
    web3-runtime-engine 1.0.3
    MAL-2026-7437 reversing-labs
  • npm
    wazirx-localtestnpm 9.9.9
    MAL-2026-7436 reversing-labs
  • npm
    wazir-xlocaletstnpm 9.9.2, 9.9.9
    MAL-2026-7435 reversing-labs
  • npm
    wallarm-design-system 1.1.0
    MAL-2026-7434 reversing-labs
  • npm
    vubiquity-website 3.9.10
    MAL-2026-7433 reversing-labs
  • npm
    vscode-component-explorer 99.9.9, 99.9.15
    MAL-2026-7432 reversing-labs
  • npm
    vreactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7431 reversing-labs
  • npm
    ureactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7430 reversing-labs
  • npm
    treactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7429 reversing-labs
  • npm
    timelycare 1.0.0
    MAL-2026-7428 reversing-labs
  • npm
    swiper-css-normalize 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13…
    MAL-2026-7427 reversing-labs
  • npm
    suit-base 45.0.0
    MAL-2026-7426 reversing-labs
  • npm
    style-to-objact 99.9.0
    MAL-2026-7425 reversing-labs
  • npm
    strapi-plugin-pocvk 0.0.1
    MAL-2026-7424 reversing-labs
  • npm
    stellar-stablecoin-scripts 99.1.0
    MAL-2026-7423 reversing-labs
  • npm
    smtp-test-server-node 99.2.1, 99.2.2
    MAL-2026-7422 reversing-labs
  • npm
    sitefinitywebapp 99.0.0
    MAL-2026-7421 reversing-labs
  • npm
    sim-apis-chatbot 1.1.0
    MAL-2026-7420 reversing-labs