Supply-chain attacks we’ve detected

Popular npm packages whose release stream was tampered with — either a version OSV confirmed as malicious code, or a version our own analysis flagged as a likely account takeover before any public advisory. None of these versions were ever served from this registry; where the package still has clean releases, those keep flowing.

108

Packages hit

531

Blocked versions

Confirmed malware (OSV)

Detected before any advisory

Show all · updated 2026/05/13 19:33

Confirmed malicious releases

Versions OSV’s malicious-packages dataset confirms contained malicious code. We blocked these the moment the advisory landed — or before, then OSV agreed.

fsevents Malicious code clean versions still served

31,737,795 weekly downloads

MAL-2023-462 Malicious code in fsevents (npm)

Native Access to MacOS FSEvents

Blocked 29 versions: 1.2.10 1.2.9 1.2.8 1.2.7 1.2.6 1.2.4 1.2.3 1.2.2 +21 more

First detected 2026/04/24 · most recent 2026/04/24

fs Malicious code clean versions still served

1,946,205 weekly downloads

MAL-2025-21003 Malicious code in fs (npm)

This package name is not currently in use, but was formerly occupied by another package. To avoid malicious use, npm is hanging on to the package name, but loosely, and we'll probably give it to you if you want it.

Blocked 2 versions: 0.0.2 0.0.0

First detected 2026/04/24 · most recent 2026/04/24

@bitwarden/cli Malicious code clean versions still served

71,038 weekly downloads

MAL-2026-3020 Malicious code in @bitwarden/cli (npm)

A secure and free password manager for all of your devices.

Blocked 1 version: 2026.4.0

detected 2026/05/08

common-tg-service Malicious code clean versions still served

31,636 weekly downloads

MAL-2026-3288 Malicious code in common-tg-service (npm)

Common Telegram service for NestJS applications

Blocked 366 versions: 1.3.214 1.3.213 1.3.212 1.3.209 1.3.208 1.3.207 1.3.206 1.3.205 +358 more

First detected 2026/05/07 · most recent 2026/05/10

axis-charts Malicious code

429 weekly downloads

MAL-2026-3077 Malicious code in axis-charts (npm)

Internal automation library.

Blocked 3 versions: 100.0.0 99.99.99 1.0.0

First detected 2026/04/28 · most recent 2026/05/12

axis-notification Malicious code

428 weekly downloads

MAL-2026-3078 Malicious code in axis-notification (npm)

Internal automation library.

Blocked 3 versions: 100.0.0 99.99.99 1.0.0

First detected 2026/04/28 · most recent 2026/05/12

axis-ui-generator Malicious code

416 weekly downloads

MAL-2026-3079 Malicious code in axis-ui-generator (npm)

Internal automation library.

Blocked 3 versions: 100.0.0 99.99.99 1.0.0

First detected 2026/04/28 · most recent 2026/05/12

@clearpool/utils Malicious code

346 weekly downloads

MAL-2026-3059 Malicious code in @clearpool/utils (npm)

Internal automation library.

Blocked 3 versions: 100.0.0 99.99.99 9.9.9

First detected 2026/04/28 · most recent 2026/05/12

@tochka-ui/foundation Malicious code

271 weekly downloads

MAL-2026-3069 Malicious code in @tochka-ui/foundation (npm)

gigaid utilities

Blocked 4 versions: 99.0.7 99.0.5 99.0.4 99.0.3

First detected 2026/04/29 · most recent 2026/04/30

@sbt_gitverse/analytics-client Malicious code

259 weekly downloads

MAL-2026-3068 Malicious code in @sbt_gitverse/analytics-client (npm)

analytics-client utilities

Blocked 4 versions: 99.0.7 99.0.5 99.0.4 99.0.3

First detected 2026/04/29 · most recent 2026/04/30

apcyber-test-package Malicious code

246 weekly downloads

MAL-2026-3304 Malicious code in apcyber-test-package (npm)

Internal automation library.

Blocked 2 versions: 100.0.0 99.99.99

First detected 2026/05/12 · most recent 2026/05/12

axis-abc-search-account Malicious code

243 weekly downloads

MAL-2026-3075 Malicious code in axis-abc-search-account (npm)

Internal automation library.

Blocked 3 versions: 100.0.0 99.99.99 1.0.0

First detected 2026/04/28 · most recent 2026/05/12

axis-abc-portal-menu Malicious code

239 weekly downloads

MAL-2026-3074 Malicious code in axis-abc-portal-menu (npm)

Internal automation library.

Blocked 3 versions: 100.0.0 99.99.99 1.0.0

First detected 2026/04/28 · most recent 2026/05/12

axis-abc-search-address Malicious code

208 weekly downloads

MAL-2026-3076 Malicious code in axis-abc-search-address (npm)

Internal automation library.

Blocked 3 versions: 100.0.0 99.99.99 1.0.0

First detected 2026/04/28 · most recent 2026/05/12

rtms-manager Malicious code

197 weekly downloads

MAL-2026-2862 Malicious code in rtms-manager (npm)

Dependency Confusion poc

Blocked 2 versions: 1.4.0 1.2.0

First detected 2026/04/28 · most recent 2026/04/28

apollo-vertex Malicious code

150 weekly downloads

MAL-2026-3040 Malicious code in apollo-vertex (npm)

Blocked 1 version: 1.0.1

detected 2026/04/28

apollo-landing Malicious code

148 weekly downloads

MAL-2026-3038 Malicious code in apollo-landing (npm)

Blocked 1 version: 1.0.1

detected 2026/04/28

standalone-apps Malicious code

136 weekly downloads

MAL-2026-3037 Malicious code in standalone-apps (npm)

Blocked 1 version: 1.0.1

detected 2026/04/28

uipath-ui-widgets Malicious code

135 weekly downloads

MAL-2026-3036 Malicious code in uipath-ui-widgets (npm)

Blocked 1 version: 1.0.1

detected 2026/04/28

process-app-task Malicious code

134 weekly downloads

MAL-2026-3039 Malicious code in process-app-task (npm)

Blocked 1 version: 1.0.1

detected 2026/04/28

tether-base Malicious code

69 weekly downloads

MAL-2026-3033 Malicious code in tether-base (npm)

Test package for dependency confusion detection

Blocked 1 version: 99.0.0

detected 2026/04/28

@alfa.life.mapp/app.web Malicious code

32 weekly downloads

MAL-2026-3052 Malicious code in @alfa.life.mapp/app.web (npm)

app.web utilities

Blocked 3 versions: 99.0.18 99.0.16 99.0.15

First detected 2026/04/30 · most recent 2026/04/30