27,959
Malicious packages blocked by default
Malicious packages blocked by default
8
Ecosystems covered
Ecosystems covered
39
Allow-listed trusted packages
Allow-listed trusted packages
4
Intel sources
Intel sources
npm: 14,777 · pypi: 11,407 · rubygems: 972 · nuget: 773 · go: 18 · crates: 9 · maven: 2 · packagist: 1
| Package | Status | Summary | Detected |
|---|---|---|---|
expresss@0.0.0 | rejected | Package name 'expresss' is a clear typosquat of the popular 'express' package (one character edit), with no other functionality present. This matches the definition of malicious typosquatting to deceive users. | 08/07/2026 |
@esbuild/darwin-arm64@0.21.5 | rejected | Platform-specific native binary (os: darwin, cpu: arm64) — Malicious indicator in prebuilt binary. | 07/17/2026 |
test-weavedb-sdk@1.1.1 | rejected | Re-evaluated: now known malicious (blocked by updated intel) | 07/16/2026 |
@redhat-cloud-services/frontend-components-advisor-components@3.8.4 | rejected | Re-evaluated: now known malicious (blocked by updated intel) | 07/16/2026 |
tensor-fi-crypto-utils@1.0.0 | rejected | Re-evaluated: now known malicious (blocked by updated intel) | 07/16/2026 |
partner-tracker@99.0.0 | rejected | Re-evaluated: now known malicious (blocked by updated intel) | 07/16/2026 |
elf-stats-starlit-mitten-980@1.2.25 | rejected | Re-evaluated: now known malicious (blocked by updated intel) | 07/16/2026 |
autotel-subscribers@23.0.2 | rejected | Re-evaluated: now known malicious (blocked by updated intel) | 07/16/2026 |
@lint-md/parser@0.2.14 | rejected | Re-evaluated: now known malicious (blocked by updated intel) | 07/16/2026 |
@voiceflow/nestjs-timeout@1.3.2 | rejected | Re-evaluated: now known malicious (blocked by updated intel) | 07/16/2026 |
@sage-active/ui@99.9.0 | rejected | Re-evaluated: now known malicious (blocked by updated intel) | 07/16/2026 |
npm-global-util@1.3.4 | rejected | Re-evaluated: now known malicious (blocked by updated intel) | 07/16/2026 |
yolov8@0.3.3 | rejected | Re-evaluated: now known malicious (blocked by updated intel) | 07/16/2026 |
elf-stats-starlit-mitten-980@1.2.23 | rejected | Re-evaluated: now known malicious (blocked by updated intel) | 07/16/2026 |
@beproduct/nestjs-auth@0.1.7 | rejected | Re-evaluated: now known malicious (blocked by updated intel) | 07/16/2026 |
sirens-lament@212.0.0 | rejected | Re-evaluated: now known malicious (blocked by updated intel) | 07/16/2026 |
requestts@1.0.0 | rejected | Re-evaluated: now known malicious — MAL-2022-7439 | 07/16/2026 |
@typescript/typescript-linux-ppc64@7.0.2 | rejected | Package name is clear typosquatting of the real 'typescript' package (wrong scope + platform-specific naming that does not exist in the official distribution). Contents are only declaration files and metadata; no execution paths visible, but the deceptive naming alone qualifies as supply-chain deception. | 07/16/2026 |
@typescript/typescript-linux-x64@7.0.2 | rejected | Package name is a clear typosquat of the real 'typescript' package (scoped under @typescript and platform-specific). Contents are only .d.ts files and metadata; no active malicious payload is present in the captured files, but the deceptive naming alone qualifies as malicious per the criteria. | 07/12/2026 |
@typescript/typescript-openbsd-x64@7.0.2 | rejected | Package name is a clear typosquat of the real 'typescript' package (platform-specific variant that does not exist upstream). Contains only .d.ts files and metadata; no actual malicious payload visible but intent to deceive via name is evident. | 07/12/2026 |