Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,460 npm 223,294 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,460 reports · Feed

  • npm
    regactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7381 reversing-labs
  • npm
    reeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7380 reversing-labs
  • npm
    rebactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7379 reversing-labs
  • npm
    reayctjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7378 reversing-labs
  • npm
    reavctjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7377 reversing-labs
  • npm
    reauctjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7376 reversing-labs
  • npm
    reatctjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7375 reversing-labs
  • npm
    rearctjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7374 reversing-labs
  • npm
    reamctjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7373 reversing-labs
  • npm
    realtime-voice-component 99.9.1
    MAL-2026-7372 reversing-labs
  • npm
    reafctjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7371 reversing-labs
  • npm
    reacytjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7370 reversing-labs
  • npm
    reacxtjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7369 reversing-labs
  • npm
    reacvtjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7368 reversing-labs
  • npm
    react-tiny-popover-next 93.98.5
    MAL-2026-7367 reversing-labs
  • npm
    react-native-paysafe-apple-pay 1.0.0
    MAL-2026-7366 reversing-labs
  • npm
    react-datepicker-next 93.98.5
    MAL-2026-7365 reversing-labs
  • npm
    reacrtjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7364 reversing-labs
  • npm
    reacptjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7363 reversing-labs
  • npm
    reacktjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7362 reversing-labs
  • npm
    reachtjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7361 reversing-labs
  • npm
    reacetjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7360 reversing-labs
  • npm
    reabctjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7359 reversing-labs
  • npm
    reaactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7358 reversing-labs
  • npm
    rdeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7357 reversing-labs
  • npm
    rceactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7356 reversing-labs
  • npm
    rbeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7355 reversing-labs
  • npm
    raeactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7354 reversing-labs
  • npm
    qreactjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7353 reversing-labs
  • npm
    pull-request-comment-branch 9.9.1
    MAL-2026-7352 reversing-labs
  • npm
    private-packages-sharingsession 9.9.8
    MAL-2026-7351 reversing-labs
  • npm
    private-packages-sharing-sessionz 1.9.8
    MAL-2026-7350 reversing-labs
  • npm
    postgres-docker-utils 99.9.9
    MAL-2026-7349 reversing-labs
  • npm
    plugin-proposal 99.1.1
    MAL-2026-7348 reversing-labs
  • npm
    picnic-work-app-terms-of-use-nl 9999.0.0
    MAL-2026-7347 reversing-labs
  • npm
    picnic-work-app-terms-of-use-fr 9999.0.0
    MAL-2026-7346 reversing-labs
  • npm
    picnic-work-app-terms-of-use-de 9999.0.0
    MAL-2026-7345 reversing-labs
  • npm
    picnic-store-page-platform 9999.0.0
    MAL-2026-7344 reversing-labs
  • npm
    picnic-store-design-system 9999.0.0
    MAL-2026-7343 reversing-labs
  • npm
    picnic-store-delivery-miniapp 9999.0.0
    MAL-2026-7342 reversing-labs