Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
239,899 total in npm · sorted newest first- Jul 14, 2026
Malicious code in @sqlite-group/sql-creator (npm)
- Jul 14, 2026
Malicious code in @sqlite-clone/nodesql (npm)
- Jul 14, 2026
Malicious code in @wrenfield/viem (npm)
1 compromised version
- Jul 14, 2026
Malicious code in vite-plugin-config-paths (npm)
1 compromised version
- Jul 14, 2026
Malicious code in harpoon-package (npm)
3 compromised versions
- Jul 14, 2026
Malicious code in web-pop (npm)
1 compromised version
- Jul 14, 2026
Malicious code in eth-wallet-helpers (npm)
1 compromised version
- Jul 14, 2026
Malicious code in akshajrawat.utils (npm)
- Jul 14, 2026
Malicious code in @akshajrawat/plugin-repo-cli (npm)
- Jul 14, 2026
Malicious code in micro-ui-loader (npm)
- Jul 14, 2026
Malicious code in @cw-ui/micro-ui-loader (npm)
- Jul 14, 2026
Malicious code in @cw-ui/asio-neon-themes (npm)
- Jul 14, 2026
Malicious code in valid-scope (npm)
- Jul 14, 2026
Malicious code in temp-cloak (npm)
- Jul 14, 2026
Malicious code in sync-logger (npm)
- Jul 14, 2026
Malicious code in string-morph (npm)
- Jul 14, 2026
Malicious code in sight-bind (npm)
- Jul 14, 2026
Malicious code in relative-time-live (npm)
- Jul 14, 2026
Malicious code in humanize-kit (npm)
- Jul 14, 2026
Malicious code in duration-kit (npm)
- Jul 14, 2026
Malicious code in dom-weave (npm)
- Jul 14, 2026
Malicious code in clipboard-drop (npm)
- Jul 14, 2026
Malicious code in avatar-forge (npm)
- Jul 14, 2026
Malicious code in @codex2005/logger-core (npm)
- Jul 14, 2026
Malicious code in viteplugiin (npm)
1 compromised version
- Jul 14, 2026
Malicious code in chain-devkit (npm)
1 compromised version
- Jul 14, 2026
Malicious code in my-empty-package (npm)
1 compromised version
- Jul 14, 2026
Malicious code in fluterjs (npm)
1 compromised version
- Jul 14, 2026
Malicious code in cbr-internal-utils (npm)
1 compromised version
- Jul 14, 2026
Malicious code in neon-postgres (npm)
2 compromised versions
- Jul 14, 2026
Malicious code in lusha-iam-widgets (npm)
1 compromised version
- Jul 14, 2026
Malicious code in n8n-nodes-social-facebook (npm)
1 compromised version
- Jul 14, 2026
Malicious code in proxy-seller-mcp (npm)
1 compromised version
- Jul 14, 2026
Malicious code in skrill-payments (npm)
1 compromised version
- Jul 14, 2026
Malicious code in neteller (npm)
1 compromised version
- Jul 14, 2026
Malicious code in skrill-sdk (npm)
1 compromised version
- Jul 14, 2026
Malicious code in skrill (npm)
1 compromised version
- Jul 14, 2026
Malicious code in postcss-processor-utils (npm)
1 compromised version
- Jul 14, 2026
Malicious code in postcss-animatecss (npm)
2 compromised versions
- Jul 14, 2026
Malicious code in vite-plugin-model (npm)
1 compromised version
- Jul 14, 2026
Malicious code in motion-pull (npm)
1 compromised version
- Jul 14, 2026
Malicious code in @velkov/isows (npm)
1 compromised version
- Jul 14, 2026
Malicious code in @wrenfield/abitype (npm)
2 compromised versions
- Jul 14, 2026
Malicious code in @tabrex/bs58 (npm)
1 compromised version
- Jul 14, 2026
Malicious code in @vite-mcp/vite-type (npm)
1 compromised version
- Jul 14, 2026
Malicious code in @vitets/vite-ts (npm)
1 compromised version
- Jul 14, 2026
Malicious code in @vite-ts/vite-ui (npm)
1 compromised version
- Jul 14, 2026
Malicious code in @vite-pro/vite-ui (npm)
1 compromised version
- Jul 14, 2026
Malicious code in @amedit/vercel-builder-probe (npm)
- Jul 14, 2026
Malicious code in flick-test-app (npm)
1 compromised version
Page 1 of 4,798