Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,460 npm 223,294 PyPI 12,017 RubyGems 4,319 NuGet 782 crates.io 25 Go 20 Maven 2 Packagist 1

240,460 reports · Feed

  • npm
    bitu-protocol 99.0.0
    MAL-2026-7221 reversing-labs
  • npm
    bitu-core 99.0.0
    MAL-2026-7220 reversing-labs
  • npm
    bitu-app 99.0.0
    MAL-2026-7219 reversing-labs
  • npm
    bitopro-trade-guard 1.1.0
    MAL-2026-7218 reversing-labs
  • npm
    backoff-table 99.9.1
    MAL-2026-7217 reversing-labs
  • npm
    babelcode_js 99.12.9
    MAL-2026-7216 reversing-labs
  • npm
    axgularjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7215 reversing-labs
  • npm
    autoprethixer 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7214 reversing-labs
  • npm
    autoprafixar 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7213 reversing-labs
  • npm
    atgularjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7212 reversing-labs
  • npm
    ashcare-ui-ember 99.99.99
    MAL-2026-7211 reversing-labs
  • npm
    ash-session-tracker 99.99.99
    MAL-2026-7210 reversing-labs
  • npm
    areactjs 1.1.1, 1.1.4, 8.7.6
    MAL-2026-7209 reversing-labs
  • npm
    apple-mycelium-internal-research 99.9.11
    MAL-2026-7208 reversing-labs
  • npm
    appauthhelper-enduser 99.0.0
    MAL-2026-7207 reversing-labs
  • npm
    apache-arrow-17 9.9.9
    MAL-2026-7206 reversing-labs
  • npm
    anjularjs 1.1.2, 1.1.4, 8.7.6
    MAL-2026-7205 reversing-labs
  • npm
    angzlarjs 1.1.4, 8.7.6
    MAL-2026-7204 reversing-labs
  • npm
    angylarjs 1.1.4, 8.7.6
    MAL-2026-7203 reversing-labs
  • npm
    angxlarjs 1.1.4, 8.7.6
    MAL-2026-7202 reversing-labs
  • npm
    angwlarjs 1.1.4, 8.7.6
    MAL-2026-7201 reversing-labs
  • npm
    angvlarjs 1.1.4, 8.7.6
    MAL-2026-7200 reversing-labs
  • npm
    anguzarjs 1.1.4, 8.7.6
    MAL-2026-7199 reversing-labs
  • npm
    anguyarjs 1.1.4, 8.7.6
    MAL-2026-7198 reversing-labs
  • npm
    anguxarjs 1.1.4, 8.7.6
    MAL-2026-7197 reversing-labs
  • npm
    anguwarjs 1.1.4, 8.7.6
    MAL-2026-7196 reversing-labs
  • npm
    anguvarjs 1.1.4, 8.7.6
    MAL-2026-7195 reversing-labs
  • npm
    anguuarjs 1.1.4
    MAL-2026-7194 reversing-labs
  • npm
    angutarjs 1.1.4, 8.7.6
    MAL-2026-7193 reversing-labs
  • npm
    angusarjs 1.1.4, 8.7.6
    MAL-2026-7192 reversing-labs
  • npm
    angurarjs 1.1.4, 8.7.6
    MAL-2026-7191 reversing-labs
  • npm
    anguparjs 1.1.4, 8.7.6
    MAL-2026-7190 reversing-labs
  • npm
    anguoarjs 1.1.4, 8.7.6
    MAL-2026-7189 reversing-labs
  • npm
    angunarjs 1.1.4
    MAL-2026-7188 reversing-labs
  • npm
    angumarjs 1.1.4, 8.7.6
    MAL-2026-7187 reversing-labs
  • npm
    angulzrjs 8.7.6
    MAL-2026-7186 reversing-labs
  • npm
    angulyrjs 8.7.6
    MAL-2026-7185 reversing-labs
  • npm
    angulxrjs 8.7.6
    MAL-2026-7184 reversing-labs
  • npm
    angulwrjs 8.7.6
    MAL-2026-7183 reversing-labs
  • npm
    angulvrjs 8.7.6
    MAL-2026-7182 reversing-labs