Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,458 npm 223,292 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,458 reports · Feed

  • npm
    shiphero-dashboard 1.1.0
    MAL-2026-7419 reversing-labs
  • npm
    serverless-twi-testing 1.0.7
    MAL-2026-7418 reversing-labs
  • npm
    rzeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7417 reversing-labs
  • npm
    ryeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7416 reversing-labs
  • npm
    rxeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7415 reversing-labs
  • npm
    rweactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7414 reversing-labs
  • npm
    rveactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7413 reversing-labs
  • npm
    rueactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7412 reversing-labs
  • npm
    rteactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7411 reversing-labs
  • npm
    rseactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7410 reversing-labs
  • npm
    rreactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7409 reversing-labs
  • npm
    rqeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7408 reversing-labs
  • npm
    rpeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7407 reversing-labs
  • npm
    roeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7406 reversing-labs
  • npm
    roblox-lua-promise 99.9.0
    MAL-2026-7405 reversing-labs
  • npm
    rngularjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7404 reversing-labs
  • npm
    rneactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7403 reversing-labs
  • npm
    rn-bitu-user 99.0.0
    MAL-2026-7402 reversing-labs
  • npm
    rn-bitu 99.0.0
    MAL-2026-7401 reversing-labs
  • npm
    rmeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7400 reversing-labs
  • npm
    rleactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7399 reversing-labs
  • npm
    rkeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7398 reversing-labs
  • npm
    rjeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7397 reversing-labs
  • npm
    rieactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7396 reversing-labs
  • npm
    rheactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7395 reversing-labs
  • npm
    rgeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7394 reversing-labs
  • npm
    rfeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7393 reversing-labs
  • npm
    rezactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7392 reversing-labs
  • npm
    rewactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7391 reversing-labs
  • npm
    revactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7390 reversing-labs
  • npm
    reuactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7389 reversing-labs
  • npm
    retactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7388 reversing-labs
  • npm
    resource-library-engine 99.99.99
    MAL-2026-7387 reversing-labs
  • npm
    resolve-uri-internal 99.1.0
    MAL-2026-7386 reversing-labs
  • npm
    resactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7385 reversing-labs
  • npm
    remactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7384 reversing-labs
  • npm
    reiactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7383 reversing-labs
  • npm
    rei-internal-logger 99.9.9, 100.0.0
    MAL-2026-7382 reversing-labs
  • npm
    regactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7381 reversing-labs
  • npm
    reeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7380 reversing-labs