Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,370 npm 223,232 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,370 reports · Feed

  • npm
    css-ikomdq-polyfill 1.0.0
    MAL-2026-17553 amazon-inspector
  • npm
    css-ogojwh-polyfill 1.0.0
    MAL-2026-17556 amazon-inspector
  • npm
    css-ayucyz-polyfill 1.0.0
    MAL-2026-17548 amazon-inspector
  • npm
    css-nbanqq-polyfill 1.0.0
    MAL-2026-17555 amazon-inspector
  • npm
    css-dwsawd-polyfill 1.0.0
    MAL-2026-17550 amazon-inspector
  • npm
    css-display-reading-polyfill 1.0.0
    MAL-2026-17549 amazon-inspector
  • npm
    insomnia-plugin-api-lint-helper 1.0.0
    MAL-2026-17561 amazon-inspector
  • npm
    abbishal-poc 1.1.0
    MAL-2026-17545 amazon-inspector
  • npm
    hardhat-kex 2.0.1
    MAL-2026-17559 amazon-inspector
  • npm
    tostpro 100.6.0, 100.2.0, 100.7.0, 99.101.0, 112.5.9, 99.100.0, 99.99.99
    MAL-2026-17564 amazon-inspector, ghsa-malware
  • npm
    @inpeek/odata 99.99.102, 99.99.100, 99.99.99, 99.99.101
    MAL-2026-17542 amazon-inspector, ghsa-malware
  • npm
    @inpeek/odata-angular 99.99.102, 99.99.101, 99.99.100, 99.99.99
    MAL-2026-17543 amazon-inspector, ghsa-malware
  • npm
    @angjlar/core 22.2.1
    MAL-2026-17534 amazon-inspector
  • npm
    hardhat-spack 3.0.2
    MAL-2026-17560 amazon-inspector
  • npm
    @angulaar/core 22.2.1
    MAL-2026-17537 amazon-inspector
  • npm
    @anguar/core 22.2.1
    MAL-2026-17535 amazon-inspector
  • npm
    @abgular/core 22.2.1
    MAL-2026-17532 amazon-inspector
  • npm
    @angulr/core 22.2.1
    MAL-2026-17538 amazon-inspector
  • npm
    @anuglar/core 22.2.1
    MAL-2026-17541 amazon-inspector
  • npm
    @anngular/core 22.2.1
    MAL-2026-17540 amazon-inspector
  • npm
    @angupar/core 22.2.1
    MAL-2026-17539 amazon-inspector
  • npm
    internallib_v923 1.0.3
    MAL-2026-17562 amazon-inspector
  • npm
    @qngular/core 22.2.1
    MAL-2026-17544 amazon-inspector
  • npm
    @angulaar/cli 22.2.1
    MAL-2026-17536 amazon-inspector
  • npm
    @anfular/core 22.2.1
    MAL-2026-17533 amazon-inspector
  • npm
    api-nebula 1.0.0
    MAL-2026-17531 amazon-inspector, ghsa-malware
  • npm
    dotenv-async 1.0.0
    MAL-2026-17504 amazon-inspector, ghsa-malware
  • npm
    dotenv-promises 1.0.0
    MAL-2026-17505 amazon-inspector
  • npm
    a11y-tabindex-manager 1.0.0
    MAL-2026-17501 amazon-inspector
  • npm
    dom-focus-sentinel 1.0.0
    MAL-2026-17503 amazon-inspector
  • npm
    hardhat-roof 2.21.0
    MAL-2026-17509 amazon-inspector
  • npm
    hardhat-plus 2.21.0
    MAL-2026-17508 amazon-inspector
  • npm
    hardhat-ftp 2.0.1
    MAL-2026-17506 amazon-inspector
  • npm
    hardhat-jsx 2.0.1
    MAL-2026-17507 amazon-inspector
  • npm
    internallib_v275 1.0.3
    MAL-2026-17510 amazon-inspector, ghsa-malware
  • npm
    lite-matte 1.0.0
    MAL-2026-17512 amazon-inspector
  • npm
    lite-matterr 1.0.0
    MAL-2026-17513 amazon-inspector
  • npm
    lite-mater 1.0.0
    MAL-2026-17511 amazon-inspector
  • npm
    oleh-modal 1.0.0
    MAL-2026-17516 amazon-inspector
  • npm
    minimal-a11y-contrast-check 1.0.0
    MAL-2026-17514 amazon-inspector