Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,377 npm 223,238 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,377 reports · Feed

  • npm
    sentrykit 30.0.0
    MAL-2026-15544 amazon-inspector, ghsa-malware
  • npm
    analytics-web-client 30.0.0
    MAL-2026-15526 amazon-inspector, ghsa-malware
  • npm
    confluence-create-content 30.0.0
    MAL-2026-15530 amazon-inspector, ghsa-malware
  • npm
    confluence-editor 30.0.0
    MAL-2026-15531 amazon-inspector, ghsa-malware
  • npm
    confluence-rest 30.0.0
    MAL-2026-15532 amazon-inspector, ghsa-malware
  • npm
    prm-bundles 45.0.0
    MAL-2026-15543 amazon-inspector, ghsa-malware
  • npm
    ir-annuities-client-authentication-module 30.0.0
    MAL-2026-15536 amazon-inspector, ghsa-malware
  • npm
    paper-password-input 45.0.0
    MAL-2026-15542 amazon-inspector, ghsa-malware
  • npm
    aura-instrumentation 45.0.0
    MAL-2026-15527 amazon-inspector, ghsa-malware
  • npm
    loading-performance-instrumentation 45.0.0
    MAL-2026-15539 amazon-inspector, ghsa-malware
  • npm
    axis-datagrid 45.0.0
    MAL-2026-15528 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    ux-metrics-client-interaction-subscriber 45.0.0
    MAL-2026-15545 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    bui-react-10themes 45.0.0
    MAL-2026-15529 amazon-inspector, ghsa-malware
  • npm
    mkt-ui-library 45.0.0
    MAL-2026-15540 amazon-inspector, ghsa-malware
  • npm
    firestore-lite 45.0.0
    MAL-2026-15534 amazon-inspector, ghsa-malware
  • npm
    librastandardlib 45.0.0
    MAL-2026-15538 amazon-inspector, ghsa-malware
  • npm
    vui-gateway 45.0.0
    MAL-2026-15546 amazon-inspector, ghsa-malware
  • npm
    jira-projects-backbone 45.0.0
    MAL-2026-15537 amazon-inspector, ghsa-malware
  • npm
    data-value 45.0.0
    MAL-2026-15533 amazon-inspector, ghsa-malware
  • npm
    oit-lib-oracle-util 45.0.0
    MAL-2026-15541 amazon-inspector, ghsa-malware
  • npm
    gridster-coords 45.0.0
    MAL-2026-15535 amazon-inspector, ghsa-malware
  • npm
    amplitude-react-native 45.0.0
    MAL-2026-15525 amazon-inspector, ghsa-malware
  • npm
    qbo-ui-services 45.0.0
    MAL-2026-15519 amazon-inspector, ghsa-malware
  • npm
    framework-zero 45.0.0
    MAL-2026-15500 amazon-inspector, ghsa-malware
  • npm
    ring-device-settings-library 45.0.0, 30.0.0
    MAL-2026-15520 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    katal-logger 45.0.0
    MAL-2026-15513 amazon-inspector, ghsa-malware
  • npm
    payments-ui-services 45.0.0
    MAL-2026-15518 amazon-inspector, ghsa-malware
  • npm
    calcite-web 45.0.0
    MAL-2026-15499 amazon-inspector, ghsa-malware
  • npm
    tabbables 45.0.0
    MAL-2026-15524 amazon-inspector, ghsa-malware
  • npm
    jsb-adapter 45.0.0
    MAL-2026-15512 amazon-inspector, ghsa-malware
  • npm
    alimama-minisite 45.0.0
    MAL-2026-15495 amazon-inspector, ghsa-malware
  • npm
    one-intuit-help-system-utils 45.0.0
    MAL-2026-15517 amazon-inspector, ghsa-malware
  • npm
    npm-extension 45.0.0
    MAL-2026-15515 amazon-inspector, ghsa-malware
  • npm
    mintel-taskbar 45.0.0
    MAL-2026-15514 amazon-inspector, ghsa-malware
  • npm
    amplitude-session-replay 45.0.0
    MAL-2026-15497 amazon-inspector, ghsa-malware
  • npm
    integration-amplitude 45.0.0
    MAL-2026-15510 amazon-inspector, ghsa-malware
  • npm
    aws-blog 45.0.1, 45.0.2, 45.0.0
    MAL-2026-15498 amazon-inspector, ghsa-malware
  • npm
    intuit-authz 55.0.0
    MAL-2026-15511 amazon-inspector, ghsa-malware
  • npm
    amplitude-experiment 55.0.0
    MAL-2026-15496 amazon-inspector, ghsa-malware
  • npm
    search-reservation 55.0.0
    MAL-2026-15521 amazon-inspector, ghsa-malware