Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- May 6, 2026
Malicious code in 24712-plv2 (npm)
4 compromised versions
- May 6, 2026
Malicious code in money-badger-open-rpc (npm)
2 compromised versions
- May 6, 2026
Malicious code in carbonite-internal (npm)
1 compromised version
- May 6, 2026
Malicious code in forge-jsxy (npm)
7 compromised versions
- May 5, 2026
Malicious code in @rivianlabs/bedrock (npm)
1 compromised version
- May 5, 2026
Malicious code in @rivianlabs/dc-fe-app-web-rivian-com (npm)
1 compromised version
- May 5, 2026
Malicious code in @rivianlabs/dt-shop-bag-v0 (npm)
1 compromised version
- May 5, 2026
Malicious code in @rivianlabs/dt-lib-lumberjack (npm)
1 compromised version
- May 5, 2026
Malicious code in generator-go-circleci (npm)
- May 5, 2026
Malicious code in deployment-core (npm)
- May 5, 2026
Malware in generator-go-circleci
1 compromised version
- May 5, 2026
Malware in internal-auth-provider
1 compromised version
- May 5, 2026
Malware in google-storage-cloud
1 compromised version
- May 5, 2026
Malware in react-video-canvas
1 compromised version
- May 5, 2026
Malware in @omni-corp-infra/sso-bridge-core
1 compromised version
- May 5, 2026
Malware in deployment-core
1 compromised version
- May 5, 2026
Malware in secrets-manager-wrapper
1 compromised version
- May 5, 2026
Malware in @tech-global/internal-gateway-core
1 compromised version
- May 5, 2026
Malware in service-gateway
1 compromised version
- May 5, 2026
Malware in @internal-infra/core-sso-bridge
1 compromised version
- May 5, 2026
Malware in @enterprise-core/auth-gateway-bridge
1 compromised version
- May 5, 2026
Malware in @corp-infra/sso-gateway-core
1 compromised version
- May 5, 2026
Malware in enterprise-auth-gateway-core
1 compromised version
- May 5, 2026
Malware in gweb-build-system
1 compromised version
- May 5, 2026
Malware in @saif777/codemirror5
1 compromised version
- May 5, 2026
Malware in bpmn-studio
1 compromised version
- May 5, 2026
Malware in react-native-parallax-scroll-view-updated
1 compromised version
- May 5, 2026
Malicious code in @bold-commerce/stacks-ui (npm)
1 compromised version
- May 5, 2026
Malicious code in @atlan/connectors (npm)
- May 5, 2026
Malware in @atlan/connectors
1 compromised version
- May 5, 2026
Malware in @bold-commerce/stacks-ui
1 compromised version
- May 5, 2026
Malware in @infinid-indonesia/ui-kit
1 compromised version
- May 5, 2026
Malware in eslint-plugin-skyscanner-dates
1 compromised version
- May 5, 2026
Malicious code in trevlo (npm)
7 compromised versions
- May 5, 2026
Malware in trevlo
1 compromised version
- May 5, 2026
Malicious code in nf-ui-components (npm)
2 compromised versions
- May 5, 2026
Malware in nf-ui-components
1 compromised version
- May 4, 2026
Malicious code in fanduel (npm)
1 compromised version
- May 4, 2026
Malicious code in lazyhtml-scripts (npm)
1 compromised version
- May 4, 2026
Malicious code in ms.analytics-web (npm)
1 compromised version
- May 4, 2026
Malicious code in api-typings (npm)
1 compromised version
- May 4, 2026
Malicious code in seek-pass (npm)
1 compromised version
- May 4, 2026
Malicious code in pocpoc2626 (npm)
2 compromised versions
- May 4, 2026
Malicious code in capacitor-plugin-service-worker (npm)
2 compromised versions
- May 4, 2026
Malicious code in @channel_bot/xa0 (npm)
2 compromised versions
- May 4, 2026
Malicious code in paychex-common-vendor-lib (npm)
1 compromised version
- May 4, 2026
Malicious code in @t-in-one/save_application_hid_to_storage (npm)
1 compromised version
- May 4, 2026
Malicious code in @bank-widgets/whats-new (npm)
1 compromised version
- May 4, 2026
Malicious code in @montanatonytest/app.web (npm)
- May 4, 2026
Malicious code in @google-pay-trust/start (npm)
3 compromised versions
Page 114 of 4,804