Malicious Package
A malicious package is a software library published to a package registry that intentionally contains harmful code, designed to compromise developers or applications that install it as a dependency.
A malicious package is a component uploaded to an open source registry that is deliberately crafted to harm whoever installs it. Unlike a vulnerable package, which contains an accidental flaw, a malicious package embeds intentional payloads such as credential stealers, backdoors, cryptominers, or data-exfiltration code, often executed during installation or at runtime.
Attackers distribute malicious packages through several techniques. Typosquatting publishes packages with names similar to popular ones to catch typos; dependency confusion tricks tooling into pulling a public package that shadows a private internal one; and account or maintainer compromise injects malicious code into an otherwise trusted package. The payload frequently runs automatically via install scripts, making a single careless install dangerous.
For developers, malicious packages are a direct software supply chain threat because a single poisoned dependency can compromise developer machines, build systems, and production. Defenses include pinning and reviewing dependencies, verifying package integrity and provenance, monitoring for suspicious install behavior, and scanning dependencies against threat intelligence.