Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,371 npm 223,233 PyPI 11,994 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,371 reports · Feed

  • npm
    @hrmony/gutscheinverwaltung 1.99.0
    MAL-2026-17261 amazon-inspector, ghsa-malware
  • npm
    dotenv-precheck 1.1.1, 1.0.0, 1.1.0
    MAL-2026-17304 amazon-inspector, ossf-package-analysis
  • npm
    dotenv-preflight 1.0.0
    MAL-2026-17324 amazon-inspector, ossf-package-analysis
  • npm
    react-nodejs 19.3.0
    MAL-2026-17294 amazon-inspector 4 IOCs
  • npm
    xeprews 5.2.1, 5.2.2
    MAL-2026-17248 amazon-inspector 4 IOCs
  • npm
    exptredd 5.2.1, 5.2.3, 5.2.4
    MAL-2026-17247 amazon-inspector 4 IOCs
  • npm
    exptred 5.2.1, 5.2.2
    MAL-2026-17246 amazon-inspector 4 IOCs
  • npm
    exptrdd 5.2.1
    MAL-2026-17245 amazon-inspector 4 IOCs
  • npm
    exprrdd 5.2.1, 5.2.2
    MAL-2026-17244 amazon-inspector 4 IOCs
  • npm
    express-nodejs 5.2.1, 5.2.2
    MAL-2026-17243 amazon-inspector 4 IOCs
  • npm
    express-javascript 5.2.1, 5.2.2
    MAL-2026-17242 amazon-inspector 4 IOCs
  • npm
    exprdd 5.2.1, 5.2.2
    MAL-2026-17241 amazon-inspector 4 IOCs
  • npm
    rai6jaisahthaghee5ou-loader-package 1.0.0
    MAL-2026-17238 amazon-inspector
  • npm
    hardhat-zet 2.0.1
    MAL-2026-17234 amazon-inspector, ghsa-malware
  • npm
    hardhat-lock 2.21.0
    MAL-2026-17233 amazon-inspector
  • npm
    mini-hardhat 1.1.4
    MAL-2026-17236 amazon-inspector
  • npm
    native-env 1.0.1
    MAL-2026-17237 amazon-inspector
  • npm
    dotenv-native 1.0.1
    MAL-2026-17231 amazon-inspector
  • npm
    fabric-native-loader 1.0.0
    MAL-2026-17232 amazon-inspector
  • npm
    items-validator 1.0.5, 1.0.4
    MAL-2026-17235 amazon-inspector, ghsa-malware
  • npm
    test-agency-assignment 1.0.2
    MAL-2026-17239 amazon-inspector
  • PyPI
    aseitylab 0.1.0, 0.1.1
    MAL-2026-17240 kam193, amazon-inspector 4 IOCs
  • npm
    llm-nebula 1.0.0
    MAL-2026-17230 amazon-inspector, ghsa-malware
  • npm
    simple-date-formatter-new-12 1.0.0
    MAL-2026-17229 amazon-inspector
  • npm
    nebulaai-sdk 1.0.0
    MAL-2026-17228 amazon-inspector
  • npm
    figlet-chalk-render 1.2.1, 1.0.0
    MAL-2026-17226 amazon-inspector
  • npm
    chalk-figlet 1.2.0
    MAL-2026-17223 amazon-inspector
  • npm
    nebula-llm 1.0.0
    MAL-2026-17227 amazon-inspector
  • npm
    fabric-render-bridge 1.0.0
    MAL-2026-17225 amazon-inspector
  • npm
    fabric-asset-pipeline 1.0.1, 1.0.0
    MAL-2026-17224 amazon-inspector, ossf-package-analysis
  • npm
    img-to-native 1.0.0, 1.0.1, 1.0.3, 1.0.2
    MAL-2026-17216 ghsa-malware, amazon-inspector
  • npm
    native-runner 1.0.0, 1.0.1, 1.0.3, 1.0.2
    MAL-2026-17218 ghsa-malware, amazon-inspector
  • npm
    nebulajs-api 1.0.0
    MAL-2026-17220 ghsa-malware, amazon-inspector
  • npm
    nebula-sdk 1.0.0, 1.0.1
    MAL-2026-17219 ghsa-malware, amazon-inspector
  • npm
    vite-plugin-crypto 1.0.2, 1.0.6, 1.0.5, 1.0.1, 1.0.0
    MAL-2026-17222 ghsa-malware, amazon-inspector
  • npm
    tailwindcss-form-kit 0.5.2, 0.5.6, 0.5.1
    MAL-2026-17221 ghsa-malware, amazon-inspector
  • npm
    my-skibidi 1.1.6, 1.1.5, 1.1.4, 1.1.3, 1.1.2, 1.1.1, 1.0.3, 1.0.2, 1.0.0
    MAL-2026-17217 ghsa-malware, amazon-inspector
  • npm
    eslint-plugin-skywagon-web 100.0.0
    MAL-2026-17215 amazon-inspector
  • npm
    git-en-boite-logging 0.0.0
    MAL-2026-17214 amazon-inspector
  • npm
    godsplan 3.0.2
    MAL-2026-17315 amazon-inspector 2 IOCs