Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
239,899 total in npm · sorted newest first- Jul 9, 2026
Malicious code in @andrewstory18/is-real-odd (npm)
1 compromised version
- Jul 9, 2026
Malicious code in vite-pwa-config (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in dl-pp-latm (npm)
1 compromised version
- Jul 9, 2026
Malicious code in neon-poly-utls (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chain-async-dom (npm)
1 compromised version
- Jul 9, 2026
Malicious code in clob-math-v2 (npm)
1 compromised version
- Jul 9, 2026
Malicious code in conversionvaluemanager (npm)
1 compromised version
- Jul 9, 2026
Malicious code in lovable-tager (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in eslint-plus (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in nonenull1 (npm)
10 compromised versions
- Jul 9, 2026
Malicious code in dependency_confusions (npm)
1 compromised version
- Jul 9, 2026
Malicious code in cookie-js-ease (npm)
1 compromised version
- Jul 9, 2026
Malicious code in cookie-parser-es (npm)
1 compromised version
- Jul 9, 2026
Malicious code in cookie-parser-js (npm)
7 compromised versions
- Jul 9, 2026
Malicious code in multer-orm (npm)
6 compromised versions
- Jul 9, 2026
Malicious code in express-router-engine (npm)
4 compromised versions
- Jul 9, 2026
Malicious code in chunk-parser (npm)
1 compromised version
- Jul 9, 2026
Malicious code in type-slint (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in nps-retrieval-diagnostics (npm)
1 compromised version
- Jul 9, 2026
Malicious code in cursed-ecto-d3ab00 (npm)
4 compromised versions
- Jul 9, 2026
Malicious code in polymarket-apis (npm)
1 compromised version
- Jul 9, 2026
Malicious code in polymarket-trader-apis (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in polymarket-kelly-math (npm)
1 compromised version
- Jul 9, 2026
Malicious code in polymarket-kelly-stake-math (npm)
1 compromised version
- Jul 9, 2026
Malicious code in polymarket-kit (npm)
1 compromised version
- Jul 9, 2026
Malicious code in polymarket-kelly-maths (npm)
1 compromised version
- Jul 9, 2026
Malicious code in es6-codify (npm)
9 compromised versions
- Jul 9, 2026
Malicious code in webrix-docs1 (npm)
1 compromised version
- Jul 9, 2026
Malicious code in webrix-docs (npm)
1 compromised version
- Jul 9, 2026
Malicious code in vybscan-testbed-obfuscated-postinstall (npm)
1 compromised version
- Jul 9, 2026
Malicious code in vybscan-testbed-inert-postinstall (npm)
1 compromised version
- Jul 9, 2026
Malicious code in ts-eslint-jest (npm)
1 compromised version
- Jul 9, 2026
Malicious code in nodemon-gulp (npm)
3 compromised versions
- Jul 9, 2026
Malicious code in chai-as-modified (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-as-buffered (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-await-dom (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-as-staged (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chain-chai-async (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-as-align (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-promised-test (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chain-chai-await (npm)
3 compromised versions
- Jul 9, 2026
Malicious code in chai-as-serialized (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-as-thread (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-as-balanced (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-deflect (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in chai-as-sharpened (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-secure (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in chai-smart (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-as-disarmed (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chai-defender (npm)
6 compromised versions
Page 10 of 4,798