Skip to content
OpenAdvisories

Supply chain

Malicious packages

Packages published with intentionally malicious code — typosquats, dependency confusion, credential stealers. If any of these is installed, treat the machine as compromised and rotate its secrets.

Source: OpenSSF Malicious Packages via OSV.dev

All 240,377 npm 223,238 PyPI 11,995 RubyGems 4,316 NuGet 782 crates.io 23 Go 20 Maven 2 Packagist 1

240,377 reports · Feed

  • npm
    sycm-vendors 55.0.0
    MAL-2026-15523 amazon-inspector, ghsa-malware
  • npm
    nx-app 9999.0.0-security-test
    MAL-2026-15516 amazon-inspector, ghsa-malware, reversing-labs
  • npm
    grafeno-utils 1.0.0
    MAL-2026-15509 amazon-inspector
  • npm
    grafeno-sdk 1.0.0, 1.0.1
    MAL-2026-15508 amazon-inspector
  • npm
    grafeno-config 1.0.0
    MAL-2026-15504 amazon-inspector
  • npm
    grafeno-api 1.0.0, 1.0.1
    MAL-2026-15501 amazon-inspector, ossf-package-analysis
  • npm
    grafeno-client 1.0.0
    MAL-2026-15503 amazon-inspector
  • npm
    grafeno-auth 1.0.0
    MAL-2026-15502 amazon-inspector, ossf-package-analysis
  • npm
    grafeno-logger 1.0.0, 1.0.1
    MAL-2026-15506 amazon-inspector
  • npm
    spc-grafeno 1.0.0
    MAL-2026-15522 amazon-inspector
  • npm
    grafeno-core 1.0.0, 1.0.1
    MAL-2026-15505 amazon-inspector
  • npm
    grafeno-pix 1.0.0, 1.0.1
    MAL-2026-15507 amazon-inspector, ossf-package-analysis
  • npm
    @7nohe/openapi-react-query-codegen 3.0.4, 1.6.3, 3.0.3, 0.5.4, 0.5.5, 2.2.1, 2.2.2, 1.6.4, 0.0.0-ec7876d6c917dad51…
    MAL-2026-15494 amazon-inspector, ghsa-malware
  • npm
    grafeno-actions 999.0.0
    MAL-2026-15596 ossf-package-analysis
  • npm
    ozturk-mfa 1.0.0, 1.0.3, 1.0.6
    MAL-2026-15493 ghsa-malware, reversing-labs
  • npm
    mfa-js 1.0.4, 1.0.3
    MAL-2026-15492 ghsa-malware, amazon-inspector
  • npm
    eip712-lite 1.0.2, 1.0.1, 1.0.3, 1.0.0
    MAL-2026-15491 ghsa-malware, amazon-inspector
  • npm
    clmm-fee-audit 0.1.1, 0.1.0
    MAL-2026-15490 ghsa-malware, amazon-inspector
  • npm
    borsh-lite 1.0.0
    MAL-2026-15489 ghsa-malware, amazon-inspector
  • PyPI
    calcboxlite 1.0
    MAL-2026-15488 amazon-inspector
  • npm
    3layerdipstackulgnp8 0.1.4
    MAL-2026-14949 ghsa-malware, amazon-inspector
  • npm
    3layerdipstacktfieac 0.1.4
    MAL-2026-14929 ghsa-malware, amazon-inspector
  • npm
    3layerdipstackt3wr5f 0.1.4
    MAL-2026-14925 ghsa-malware, amazon-inspector
  • npm
    3layerdipstackru7mfn 0.1.4
    MAL-2026-14909 ghsa-malware, amazon-inspector
  • npm
    3layerdipstackpcv17m 0.1.4
    MAL-2026-14872 ghsa-malware, amazon-inspector
  • npm
    3layerdipstackm7mock 0.1.4
    MAL-2026-14827 ghsa-malware, amazon-inspector
  • npm
    3layerdipstackjsuvtk 0.1.4
    MAL-2026-14791 ghsa-malware, amazon-inspector
  • npm
    3layerdipstackhr3ocw 0.1.4
    MAL-2026-14774 ghsa-malware, amazon-inspector
  • npm
    3layerdipstackev4sn5 0.1.4
    MAL-2026-14745 ghsa-malware, amazon-inspector
  • npm
    3layerdipstackesp1lb 0.1.4
    MAL-2026-14743 ghsa-malware, amazon-inspector
  • npm
    3layerdipstackcyqc7o 0.1.4
    MAL-2026-14716 ghsa-malware, amazon-inspector
  • npm
    3layerdipstackx26ujd 0.1.4
    MAL-2026-14978 ghsa-malware, amazon-inspector
  • npm
    3layerdipstackvnmth1 0.1.4
    MAL-2026-14965 ghsa-malware, amazon-inspector
  • npm
    3layerdipstackvm4qaj 0.1.4
    MAL-2026-14964 ghsa-malware, amazon-inspector
  • npm
    3layerdipstackvld3fr 0.1.4
    MAL-2026-14963 ghsa-malware, amazon-inspector
  • npm
    3layerdipstackvdy7nf 0.1.4
    MAL-2026-14960 ghsa-malware, amazon-inspector
  • npm
    3layerdipstackvcdkrp 0.1.4
    MAL-2026-14958 ghsa-malware, amazon-inspector
  • npm
    3layerdipstackuyd45d 0.1.4
    MAL-2026-14954 ghsa-malware, amazon-inspector
  • npm
    3layerdipstacktm8xp5 0.1.4
    MAL-2026-14933 ghsa-malware, amazon-inspector
  • npm
    3layerdipstackr5ga2v 0.1.4
    MAL-2026-14898 ghsa-malware, amazon-inspector