Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,708 total in npm · sorted newest first- Oct 27, 2026
Malware in agentenact
1 compromised version
- Oct 27, 2026
Malware in dsh-vm-tester
1 compromised version
- Oct 27, 2026
Malware in 6161test1234
1 compromised version
- Oct 27, 2026
Malware in adyen-web-v6
1 compromised version
- Oct 27, 2026
Malware in buttoncontent
1 compromised version
- Oct 27, 2026
Malware in @tableau__catalog-messages/database_lower
1 compromised version
- Oct 27, 2026
Malware in string-target-mapper-hash
1 compromised version
- Oct 27, 2026
Malware in fetch-hash-cache-atomic
1 compromised version
- Oct 27, 2026
Malware in @flexmr/survey-client
1 compromised version
- Oct 27, 2026
Malware in @flexmr/utils
1 compromised version
- Oct 27, 2026
Malware in @flexmr/survey-conversation
1 compromised version
- Oct 27, 2026
Malware in macro-kernel-record-reader
1 compromised version
- Oct 27, 2026
Malware in ccl-global-shopping
1 compromised version
- Oct 27, 2026
Malware in sc-announcer
1 compromised version
- Oct 27, 2026
Malware in paychex-pdftron
1 compromised version
- Oct 27, 2026
Malware in sc-hydrate-carousel-price
1 compromised version
- Oct 27, 2026
Malicious code in @azure-growth/signup-ux-components (npm)
1 compromised version
- Oct 27, 2026
Malicious code in @azure-growth/signup-ux-components (npm)
1 compromised version
- Oct 27, 2026
Malicious code in @camera.ui/camera-ui-nvr-windows-amd64 (npm)
1 compromised version
- Oct 27, 2026
Malware in @camera.ui/camera-ui-nvr-windows-amd64
1 compromised version
- Oct 26, 2026
Malicious code in ctf-agent (npm)
1 compromised version
- Oct 26, 2026
Malware in ctf-agent
1 compromised version
- Oct 26, 2026
Malicious code in @iobandamwer/native-helper (npm)
2 compromised versions
- Oct 26, 2026
Malware in @iobandamwer/native-helper
1 compromised version
- Oct 26, 2026
Malicious code in path-stream-utils-testmetest (npm)
4 compromised versions
- Oct 26, 2026
Malware in path-stream-utils-testmetest
1 compromised version
- Oct 26, 2026
Malware in @sxm-web/client-sdk-core
1 compromised version
- Oct 26, 2026
Malware in @ppa-web-components/ppa-navigation
1 compromised version
- Oct 26, 2026
Malware in @ppa-web-components/ppa-headerfooter
1 compromised version
- Oct 26, 2026
Malware in @ppa-web-components/ppa-banner
1 compromised version
- Oct 26, 2026
Malware in @greenlake/common-context
1 compromised version
- Oct 26, 2026
Malware in @drone-js-ext/vip-badge
1 compromised version
- Oct 26, 2026
Malware in @greenlake/auth
1 compromised version
- Oct 26, 2026
Malware in @ppa-web-components/ppa-searchform
1 compromised version
- Oct 26, 2026
Malware in @drone-js-ext/core
1 compromised version
- Oct 26, 2026
Malware in @greenlake/mfe-login-url
1 compromised version
- Oct 26, 2026
Malware in @ppa-web-components/ppa-builder
1 compromised version
- Oct 26, 2026
Malware in @greenlake/context-pane
1 compromised version
- Oct 26, 2026
Malware in @ppa-web-components/ppa-hotel-collection
1 compromised version
- Oct 26, 2026
Malware in @greenlake/session
1 compromised version
- Oct 26, 2026
Malicious code in @iobandamwer/cache-helper (npm)
13 compromised versions
- Oct 26, 2026
Malware in @iobandamwer/cache-helper
1 compromised version
- Oct 26, 2026
Malware in jshelperdependenceny
1 compromised version
- Oct 26, 2026
Malware in @eforms/forms-api
1 compromised version
- Oct 26, 2026
Malware in @capsense/ccx-welcome-page
1 compromised version
- Oct 26, 2026
Malware in @capsense/core-ui
1 compromised version
- Oct 26, 2026
Malicious code in postcss-semantic-themes (npm)
2 compromised versions
- Oct 26, 2026
Malicious code in birch-css-utils (npm)
2 compromised versions
- Oct 26, 2026
Malware in birch-css-utils
1 compromised version
- Oct 26, 2026
Malware in postcss-semantic-themes
1 compromised version
Page 1 of 6,635