JFrog Security Research
< Back

Malicious Packages

Last Updated On 2 Apr, 2026

5241
Malicious packages
disclosed
  • twitter
    express-session-js
    npm•<1k total downloads
    Published on 2 Apr, 2026
  • twitter
    gdjs_extension_npm_dependency
    npm•<1k total downloads
    Published on 2 Apr, 2026
  • twitter
    cdnjavacss
    npm•<1k total downloads
    Published on 1 Apr, 2026
  • twitter
    ether-account
    pypi•<1k total downloads
    Published on 1 Apr, 2026
  • twitter
    @typescript_eslinter/eslint
    npm•<1k total downloads
    Published on 1 Apr, 2026
  • twitter
    eht-account
    pypi•<1k total downloads
    Published on 1 Apr, 2026
  • twitter
    coredxloader
    pypi•<1k total downloads
    Published on 31 Mar, 2026
  • twitter
    @evoja-web/redaction
    npm•<1k total downloads
    Published on 31 Mar, 2026
  • twitter
    @evoja-web/create-react-project
    npm•<1k total downloads
    Published on 31 Mar, 2026
  • twitter
    claude-home
    npm•<1k total downloads
    Published on 31 Mar, 2026