Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- May 13, 2026
Malicious code in auth-javascript (npm)
1 compromised version
- May 12, 2026
Malicious code in @gusmano/reext (npm)
34 compromised versions
- May 12, 2026
Malicious code in afk-react-intl (npm)
1 compromised version
- May 12, 2026
Malicious code in katal-platform-versions (npm)
1 compromised version
- May 12, 2026
Malicious code in @a91082900/test_package (npm)
1 compromised version
- May 12, 2026
Malicious code in aoflmkt (npm)
1 compromised version
- May 12, 2026
Malicious code in aoflcorp (npm)
1 compromised version
- May 12, 2026
Malicious code in jwscube (npm)
1 compromised version
- May 12, 2026
Malicious code in justenv (npm)
- May 12, 2026
Malware in justenv
1 compromised version
- May 12, 2026
Malware in jwscube
1 compromised version
- May 12, 2026
Malicious code in mimecast-web-components (npm)
1 compromised version
- May 12, 2026
Malicious code in 88q (npm)
18 compromised versions
- May 12, 2026
Malicious code in 66o (npm)
6 compromised versions
- May 12, 2026
Malicious code in 6cc (npm)
1 compromised version
- May 12, 2026
Malicious code in 0xegg2024 (npm)
1 compromised version
- May 12, 2026
Malicious code in @catamania/ui-components (npm)
1 compromised version
- May 12, 2026
Malicious code in 01-0redi7qgbz0uv (npm)
1 compromised version
- May 12, 2026
Malicious code in 8q (npm)
1 compromised version
- May 12, 2026
Malicious code in 100jsss (npm)
1 compromised version
- May 12, 2026
Malicious code in 1mi (npm)
1 compromised version
- May 12, 2026
Malicious code in @2oolkit/hyperliquid-cli (npm)
2 compromised versions
- May 12, 2026
Malicious code in 1co (npm)
1 compromised version
- May 12, 2026
Malicious code in @chahuadev/junk-sweeper-app (npm)
1 compromised version
- May 12, 2026
Malicious code in 8oo (npm)
16 compromised versions
- May 12, 2026
Malicious code in 11j (npm)
6 compromised versions
- May 12, 2026
Malicious code in 3pool-sushibar (npm)
1 compromised version
- May 12, 2026
Malicious code in 0ctf-chalweb (npm)
1 compromised version
- May 12, 2026
Malicious code in housecallpro (npm)
1 compromised version
- May 12, 2026
Malicious code in ml-toolkit-ts (npm)
2 compromised versions
- May 12, 2026
Malicious code in agentwork-cli (npm)
2 compromised versions
- May 12, 2026
Malicious code in @tallyui/storage-sqlite (npm)
3 compromised versions
- May 12, 2026
Malicious code in @tallyui/core (npm)
3 compromised versions
- May 12, 2026
Malicious code in @ml-toolkit-ts/xgboost (npm)
2 compromised versions
- May 12, 2026
Malicious code in @ml-toolkit-ts/preprocessing (npm)
2 compromised versions
- May 12, 2026
Malicious code in @mesadev/sdk (npm)
1 compromised version
- May 12, 2026
Malicious code in @mesadev/saguaro (npm)
1 compromised version
- May 12, 2026
Malicious code in @draftlab/db (npm)
2 compromised versions
- May 12, 2026
Malicious code in @draftlab/auth-router (npm)
2 compromised versions
- May 12, 2026
Malicious code in @draftlab/auth (npm)
2 compromised versions
- May 12, 2026
Malicious code in @draftauth/core (npm)
2 compromised versions
- May 12, 2026
Malicious code in @draftauth/client (npm)
2 compromised versions
- May 12, 2026
Malicious code in @dirigible-ai/sdk (npm)
2 compromised versions
- May 12, 2026
Malicious code in hedwig-tsconfig (npm)
1 compromised version
- May 12, 2026
Malicious code in @uipath/widget.sdk (npm)
1 compromised version
- May 12, 2026
Malware in @uipath/widget.sdk
1 compromised version
- May 12, 2026
Malicious code in @uipath/vss (npm)
1 compromised version
- May 12, 2026
Malware in @uipath/vss
1 compromised version
- May 12, 2026
Malicious code in @uipath/vertical-solutions-tool (npm)
1 compromised version
- May 12, 2026
Malware in @uipath/vertical-solutions-tool
1 compromised version
Page 106 of 4,804