OpenSSF Malicious Packages · OSV format
MAL-2026-13687 · Malicious code in tokocrytodev (npm)MAL-2026-14056 · Malicious code in gunzip-js (npm)MAL-2026-14054 · Malicious code in depcruise-fmt (npm)MAL-2026-14053 · Malicious code in depcruise-baseline (npm)MAL-2026-14068 · Malicious code in depcruise-wrap-stream-in-html (npm)MAL-2026-12337 · Malicious code in akamaijs-sensor (npm)MAL-2026-14067 · Malicious code in upload-to-gcp (npm)MAL-2026-12331 · Malicious code in @wololasod/tiny-id (npm)MAL-2026-14066 · Malicious code in akamaijs-sensorv1 (npm)MAL-2026-14065 · Malicious code in akamai-sensor (npm)MAL-2026-14064 · Malicious code in @finaxis/common-js (npm)MAL-2026-14063 · Malicious code in twilio-hackerone-poc-afe6937c (npm)MAL-2026-14062 · Malicious code in tw-pkgprobe-7731 (npm)MAL-2026-11043 · Malicious code in supplyhub (npm)MAL-2024-9443 · Malicious code in sn-flow-client (npm)MAL-2026-14052 · Malicious code in require-i18next (npm)MAL-2026-14061 · Malicious code in hunterone-build-probe-9210 (npm)MAL-2026-14055 · Malicious code in harmony-app-toolkit (npm)MAL-2026-14059 · Malicious code in autbank-core (npm)MAL-2026-14057 · Malicious code in @openrepl/shared (npm)MAL-2026-14058 · Malicious code in adxaa (npm)MAL-2026-14060 · Malicious code in fastly-vcl-language-client (npm)MAL-2026-14051 · Malicious code in @velliajs/discord (npm)MAL-2026-14048 · Malicious code in @lodash-js/lodash-js (npm)MAL-2026-14050 · Malicious code in @polymarkets/clob-client-v2 (npm)MAL-2026-14049 · Malicious code in @mexc/shared-utils (npm)MAL-2026-10711 · Malicious code in @funny-booth/agent-core (npm)MAL-2026-14047 · Malicious code in @guangnao/agent-proxy (npm)MAL-2026-14046 · Malicious code in @ghost_debugger/nanocache (npm)MAL-2026-14045 · Malicious code in @ferudionz/webautomation (npm)Source: OpenSSF Malicious Packages. Withdrawn records are retained for audit and should not be treated as active detections.