Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- May 12, 2026
Malicious code in @supersurkhet/sdk (npm)
6 compromised versions
- May 12, 2026
Malware in @supersurkhet/sdk
1 compromised version
- May 12, 2026
Malicious code in @mistralai/mistralai-gcp (npm)
3 compromised versions
- May 12, 2026
Malware in @mistralai/mistralai-gcp
1 compromised version
- May 12, 2026
Malicious code in @mistralai/mistralai-azure (npm)
3 compromised versions
- May 12, 2026
Malware in @mistralai/mistralai-azure
1 compromised version
- May 12, 2026
Malicious code in @mesadev/rest (npm)
1 compromised version
- May 12, 2026
Malware in @mesadev/rest
1 compromised version
- May 12, 2026
Malicious code in @supersurkhet/cli (npm)
6 compromised versions
- May 12, 2026
Malware in @supersurkhet/cli
1 compromised version
- May 12, 2026
Malicious code in @tallyui/connector-vendure (npm)
3 compromised versions
- May 12, 2026
Malware in @tallyui/connector-vendure
1 compromised version
- May 12, 2026
Malicious code in @tallyui/pos (npm)
3 compromised versions
- May 12, 2026
Malware in @tallyui/pos
1 compromised version
- May 12, 2026
Malicious code in git-branch-selector (npm)
5 compromised versions
- May 12, 2026
Malware in git-branch-selector
1 compromised version
- May 12, 2026
Malicious code in git-git-git (npm)
5 compromised versions
- May 12, 2026
Malware in git-git-git
1 compromised version
- May 12, 2026
Malicious code in @opensearch-project/opensearch (npm)
4 compromised versions
- May 12, 2026
Malware in @opensearch-project/opensearch
1 compromised version
- May 12, 2026
Malicious code in @tanstack/vue-start-client (npm)
2 compromised versions
- May 12, 2026
Malware in @tanstack/vue-start-client
1 compromised version
- May 12, 2026
Malicious code in @beproduct/nestjs-auth (npm)
18 compromised versions
- May 12, 2026
Malware in @beproduct/nestjs-auth
1 compromised version
- May 12, 2026
Malicious code in @squawk/airway-data (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/airway-data
1 compromised version
- May 12, 2026
Malicious code in @squawk/navaid-data (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/navaid-data
1 compromised version
- May 12, 2026
Malicious code in @squawk/geo (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/geo
1 compromised version
- May 12, 2026
Malicious code in @squawk/airspace (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/airspace
1 compromised version
- May 12, 2026
Malicious code in @squawk/icao-registry (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/icao-registry
1 compromised version
- May 12, 2026
Malicious code in @squawk/types (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/types
1 compromised version
- May 12, 2026
Malicious code in ts-dna (npm)
5 compromised versions
- May 12, 2026
Malware in ts-dna
1 compromised version
- May 12, 2026
Malicious code in @squawk/airports (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/airports
1 compromised version
- May 12, 2026
Malicious code in @squawk/airways (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/airways
1 compromised version
- May 12, 2026
Malicious code in @squawk/notams (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/notams
1 compromised version
- May 12, 2026
Malicious code in @squawk/procedures (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/procedures
1 compromised version
- May 12, 2026
Malicious code in @squawk/navaids (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/navaids
1 compromised version
- May 12, 2026
Malicious code in @tanstack/router-vite-plugin (npm)
2 compromised versions
- May 12, 2026
Malware in @tanstack/router-vite-plugin
1 compromised version
Page 110 of 4,804