Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- May 12, 2026
Malicious code in @tanstack/solid-start-client (npm)
2 compromised versions
- May 12, 2026
Malicious code in @tanstack/solid-router-ssr-query (npm)
2 compromised versions
- May 12, 2026
Malicious code in @squawk/procedure-data (npm)
5 compromised versions
- May 12, 2026
Malware in @tanstack/solid-router-ssr-query
1 compromised version
- May 12, 2026
Malware in @tanstack/solid-start-client
1 compromised version
- May 12, 2026
Malware in @squawk/procedure-data
1 compromised version
- May 12, 2026
Malicious code in @tanstack/solid-router-devtools (npm)
2 compromised versions
- May 12, 2026
Malicious code in @tanstack/solid-router (npm)
2 compromised versions
- May 12, 2026
Malware in @tanstack/solid-router-devtools
1 compromised version
- May 12, 2026
Malware in @tanstack/solid-router
1 compromised version
- May 12, 2026
Malicious code in @squawk/airspace-data (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/airspace-data
1 compromised version
- May 12, 2026
Malicious code in @tanstack/router-utils (npm)
2 compromised versions
- May 12, 2026
Malicious code in @tanstack/router-ssr-query-core (npm)
2 compromised versions
- May 12, 2026
Malware in @tanstack/router-ssr-query-core
1 compromised version
- May 12, 2026
Malware in @tanstack/router-utils
1 compromised version
- May 12, 2026
Malicious code in @squawk/fixes (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/fixes
1 compromised version
- May 12, 2026
Malicious code in @squawk/mcp (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/mcp
1 compromised version
- May 12, 2026
Malicious code in @squawk/flight-math (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/flight-math
1 compromised version
- May 12, 2026
Malicious code in @squawk/units (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/units
1 compromised version
- May 12, 2026
Malicious code in @squawk/flightplan (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/flightplan
1 compromised version
- May 12, 2026
Malicious code in @squawk/airport-data (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/airport-data
1 compromised version
- May 12, 2026
Malicious code in @squawk/icao-registry-data (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/icao-registry-data
1 compromised version
- May 12, 2026
Malicious code in @squawk/weather (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/weather
1 compromised version
- May 12, 2026
Malicious code in @squawk/fix-data (npm)
5 compromised versions
- May 12, 2026
Malware in @squawk/fix-data
1 compromised version
- May 12, 2026
Malicious code in cross-stitch (npm)
5 compromised versions
- May 12, 2026
Malware in cross-stitch
1 compromised version
- May 12, 2026
Malicious code in @tanstack/solid-start-server (npm)
2 compromised versions
- May 12, 2026
Malware in @tanstack/solid-start-server
1 compromised version
- May 12, 2026
Malicious code in @tanstack/solid-start (npm)
2 compromised versions
- May 12, 2026
Malware in @tanstack/solid-start
1 compromised version
- May 12, 2026
Malicious code in @tanstack/start-client-core (npm)
2 compromised versions
- May 12, 2026
Malware in @tanstack/start-client-core
1 compromised version
- May 12, 2026
Malicious code in @tanstack/start-fn-stubs (npm)
2 compromised versions
- May 12, 2026
Malware in @tanstack/start-fn-stubs
1 compromised version
- May 12, 2026
Malicious code in @tanstack/start-plugin-core (npm)
2 compromised versions
- May 12, 2026
Malware in @tanstack/start-plugin-core
1 compromised version
- May 12, 2026
Malicious code in @tanstack/start-server-core (npm)
2 compromised versions
- May 12, 2026
Malware in @tanstack/start-server-core
1 compromised version
- May 12, 2026
Malicious code in @tanstack/start-static-server-functions (npm)
2 compromised versions
- May 12, 2026
Malware in @tanstack/start-static-server-functions
1 compromised version
Page 111 of 4,804