Malicious package index — page 9 of 37

Every malicious-package advisory O3 Security publishes, listed so each one is reachable in a few clicks. 7,342 packages across 37 pages.

• npm/@bmg-web/bmg-spinner
• npm/@ceeferenderer/fe-renderer-sdk
• npm/@dxcl/customer-js
• npm/@indriver-tools/whisperwind
• npm/@karakuri-web-fgsfgehfg/common
• npm/@lodash-en/lodash-en
• npm/@pluxee-connect/api-client
• npm/@public-for-cdao/api
• npm/@solana-labs/ancor
• npm/@solana-labs/spl-toke
• npm/@solana-labs/web3js
• npm/@tostringtag/nsettostringtag
• npm/@uwr/colors
• npm/airbnb-airlock
• npm/anguharjs
• npm/angularls
• npm/angularus
• npm/angulaujs
• npm/angulorjs
• npm/angxlarjs
• npm/anthropic-shared-logger
• npm/apache-arrow-17
• npm/api-changelly
• npm/apple-mycelium-internal-research
• npm/ash-session-tracker
• npm/awesome-cli-logger
• npm/axois-utils
• npm/better-tailwindcss
• npm/big256-ts
• npm/bitu-sdk
• npm/bitu-trade
• npm/bitu-user
• npm/bitu-wallet
• npm/bmg-user-interaction-tracker
• npm/bode-which
• npm/browserslist-db-sync
• npm/buffer-util-extend
• npm/chai-as-chains
• npm/chai-as-consisted
• npm/chai-as-inspired
• npm/chai-as-polished
• npm/chai-as-type
• npm/chai-beta
• npm/chai-deflect
• npm/chai-guard
• npm/chai-smart
• npm/chain-async-dom
• npm/chalk-standard
• npm/chalk-tempalte
• npm/claude-internal-utils
• npm/clover-codelab-remote-pay-cloud
• npm/color-cli-log
• npm/color-style-utils
• npm/commons-ui-styles
• npm/competion
• npm/conversionvaluemanager
• npm/dotenv-express
• npm/dwagger-express-router
• npm/electron-internal-utils
• npm/elf-stats-frosty-hammer-191
• npm/elf-stats-snowdusted-bauble-546
• npm/evil-helper-pkg
• npm/fiat-token-admin
• npm/fkext-browser-min
• npm/frontend-vue-next
• npm/gator-client
• npm/getd-typescript-eslint-rules
• npm/google-tag-manager-integration-sample
• npm/hyperpure
• npm/js-shared-modules
• npm/jsonupper
• npm/jwt-path
• npm/launchdarkly-ai-tooling
• npm/mcp-ci-runner-poc
• npm/n8n-nodes-rce-poc
• npm/next-runtimejs
• npm/notepad-frontend
• npm/npm-doc-dev
• npm/oztxrk-mfa
• npm/params-valid-js
• npm/path-extend
• npm/path-internal
• npm/pino-slite
• npm/ratelimitsucks
• npm/react-datepicker-next
• npm/react-next-dom
• npm/reavctjs
• npm/rei-internal-logger
• npm/rendezvous-js
• npm/rnx-align-deps
• npm/sea-bound-siren
• npm/sendgrid-sdk
• npm/serverless-twi-testing
• npm/sleek-pretty
• npm/solana-mev-bot
• npm/solana-web3-fixed
• npm/swiper-css-normalize
• npm/tailwind-scroller
• npm/token-prices-cron
• npm/ve-hemi-rewards
• npm/voyager-web
• npm/vscode-component-explorer
• npm/whaleco-assets-json
• npm/workspace-lint
• pypi/qlinforge
• npm/mjs-eslint
• npm/new-eslint
• npm/tailwind-custom-forms
• npm/vite-plugin-logo
• npm/chalk-plus-ts
• npm/node-pino
• pypi/discordnv
• pypi/spadata
• pypi/spaysdata
• pypi/spaysrbx
• npm/express-security-policy
• npm/model-poc-suhail
• npm/renovate-config-doctolib
• npm/conversa-sdk
• npm/sidecar-mcp
• npm/streak-core-bucket
• npm/taiga-ui-proprietary-navigation
• npm/transform-es2015-sticky-regex
• npm/ulid-xyz
• npm/vortnode
• npm/vue-compiler-sfc-plugin
• npm/vue-template-compiler-plugin
• npm/wm-idp-sdk
• npm/saturn-bail
• npm/security-node
• npm/sme-scripts-cli
• npm/sotqa-test
• npm/spotify-url-resolver
• npm/tailwind-animationpack
• npm/rollup-runtime-polyfill-core
• npm/polymarket-auto-trade
• npm/polymarket-bot
• npm/polymarket-claude-code
• npm/polymarket-copy-trading
• npm/polymarket-terminal
• npm/polymarket-trade
• npm/polymarket-trader
• npm/polymarket-trading-cli
• npm/polymarket-trading-developer-tool
• npm/react-hook-use-debounce-throttle-12
• npm/yastatic-s3
• npm/db-rake
• npm/evil-pkg
• npm/express-enrouten-async
• npm/express-request-engine
• npm/fe-utils-core
• npm/gehneb
• npm/jest-test-plugin-utils
• npm/loadutils
• npm/mc-reg
• npm/mcp-server-figma
• npm/mcp-server-github
• npm/mcp-server-postgres
• npm/mcp-server-redis
• npm/mcp-server-sentry
• npm/mcp-server-supabase
• npm/n8n-nodes-pentest-rce
• npm/o3forms
• npm/postcss-selector-minify
• npm/rallycoding
• npm/sigchain-js
• npm/test-pkg-yarn
• npm/axios-test-one
• npm/crypto-validate-lib
• npm/hehehee
• npm/@zizie071/libsignal-node
• npm/@zynkit/jwtbytes
• npm/agentsync-pkg
• npm/arc-diag-util
• npm/async-mutex-v2
• npm/awesome-ts-jest
• npm/celonix-otp-react
• npm/chlklib
• npm/claudechor
• npm/cold-debug-elevator
• npm/colorpicker-ui
• npm/envfile-sync-cli
• npm/@convera/ui-shared
• npm/@corpweb-ui/wmkt-library
• npm/@withgoogle/stitch-sdk
• npm/a2a-chat-canvas
• npm/checkout-desktop-total
• npm/rtms-manager
• npm/tether-base
• npm/akamaijs-sensor
• npm/supplyhub
• npm/tokocrytodev
• npm/tw-pkgprobe-7731
• npm/@epic-common/observability-node
• npm/@gbrlxvi/ts-form-utils
• npm/@hotcappuccino/nodepull
• npm/@qwedqwed/axios
• npm/@torbeck/heap
• npm/@torbeck/priority-queue
• npm/@ts-apis/ts-utils