Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- May 15, 2026
Malicious code in cdp-core (npm)
2 compromised versions
- May 14, 2026
Malicious code in deepl-sync (npm)
1 compromised version
- May 14, 2026
Malicious code in @pelmnaads/naads-common-logger (npm)
1 compromised version
- May 14, 2026
Malicious code in exxpress-tool (npm)
3 compromised versions
- May 14, 2026
Malicious code in sysbin (npm)
1 compromised version
- May 14, 2026
Malicious code in tsliverhome (npm)
6 compromised versions
- May 14, 2026
Malicious code in @webapp-next/store (npm)
1 compromised version
- May 14, 2026
Malicious code in request-logger-canary (npm)
1 compromised version
- May 14, 2026
Malicious code in joi-pack (npm)
3 compromised versions
- May 14, 2026
Malicious code in chai-as-regulated (npm)
1 compromised version
- May 14, 2026
Malicious code in prisma-callback (npm)
4 compromised versions
- May 14, 2026
Malicious code in node-ci-utils (npm)
1 compromised version
- May 14, 2026
Malicious code in typography-stylecss (npm)
1 compromised version
- May 14, 2026
Malicious code in ethers-abstract-signer (npm)
1 compromised version
- May 14, 2026
Malicious code in claw-subagent-service (npm)
34 compromised versions
- May 14, 2026
Malicious code in prettier-lint-lenz (npm)
2 compromised versions
- May 14, 2026
Malicious code in glob-helper (npm)
7 compromised versions
- May 14, 2026
Malicious code in cache-poisoning-pwn-demo (npm)
3 compromised versions
- May 14, 2026
Malicious code in ethers-signing-key (npm)
1 compromised version
- May 14, 2026
Malicious code in exxpress-utils (npm)
4 compromised versions
- May 14, 2026
Malicious code in ts-build-optimize (npm)
5 compromised versions
- May 14, 2026
Malicious code in rimraf-utils (npm)
3 compromised versions
- May 14, 2026
Malicious code in nock-helper (npm)
5 compromised versions
- May 14, 2026
Malicious code in npmjs_web3-util (npm)
1 compromised version
- May 14, 2026
Malicious code in chalk-utils (npm)
3 compromised versions
- May 14, 2026
Malicious code in bigint.fs (npm)
2 compromised versions
- May 14, 2026
Malicious code in cheerio-tool (npm)
3 compromised versions
- May 14, 2026
Malicious code in chalk-pack (npm)
2 compromised versions
- May 14, 2026
Malicious code in env-threads (npm)
1 compromised version
- May 14, 2026
Malicious code in dotenvv-tool (npm)
5 compromised versions
- May 14, 2026
Malicious code in @aiscene/aiserver (npm)
6 compromised versions
- May 14, 2026
Malicious code in node-ipc (npm)
3 compromised versions
- May 14, 2026
Malicious code in viem-helpers (npm)
- May 14, 2026
Malicious code in solidity-linter (npm)
- May 14, 2026
Malicious code in sol-coverage (npm)
- May 14, 2026
Malicious code in mrgn-utils (npm)
1 compromised version
- May 14, 2026
Malicious code in mrgn-ui (npm)
- May 14, 2026
Malicious code in mrgn-common (npm)
1 compromised version
- May 14, 2026
Malicious code in marginfi-v2-ui-state (npm)
1 compromised version
- May 14, 2026
Malicious code in marginfi-client-v2 (npm)
1 compromised version
- May 14, 2026
Malicious code in deltaprime-primeloans (npm)
1 compromised version
- May 14, 2026
Malware in marginfi-v2-ui-state
1 compromised version
- May 14, 2026
Malware in marginfi-client-v2
1 compromised version
- May 14, 2026
Malware in mrgn-common
1 compromised version
- May 14, 2026
Malware in mrgn-ui
1 compromised version
- May 14, 2026
Malware in mrgn-utils
1 compromised version
- May 14, 2026
Malware in solidity-linter
1 compromised version
- May 14, 2026
Malware in viem-helpers
1 compromised version
- May 14, 2026
Malware in deltaprime-primeloans
1 compromised version
- May 14, 2026
Malware in sol-coverage
1 compromised version
Page 104 of 4,804