Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- May 4, 2026
Malicious code in edj-shopify-theme (npm)
- May 4, 2026
Malicious code in @kills_sh/bootstrap (npm)
- May 4, 2026
Malware in vpi-guides
1 compromised version
- May 4, 2026
Malware in edj-shopify-theme
1 compromised version
- May 4, 2026
Malware in muenxo
1 compromised version
- May 4, 2026
Malware in wagner-horizon
1 compromised version
- May 4, 2026
Malware in @kills_sh/bootstrap
1 compromised version
- May 4, 2026
Malware in honcho-theme
1 compromised version
- May 4, 2026
Malware in pi-exa-mcp
1 compromised version
- May 4, 2026
Malware in temhe-dev
1 compromised version
- May 4, 2026
Malware in pos-next-react-native
1 compromised version
- May 4, 2026
Malware in tinfoil-shops
1 compromised version
- May 4, 2026
Malware in shopify-draggable
1 compromised version
- May 4, 2026
Malware in forge-jsx
1 compromised version
- May 4, 2026
Malicious code in @w3m-app/switch_network (npm)
- May 4, 2026
Malicious code in @w3m-app/is_connected (npm)
- May 4, 2026
Malicious code in @w3m-app/get_chain_id (npm)
- May 4, 2026
Malware in @w3m-app/get_chain_id
1 compromised version
- May 4, 2026
Malware in @w3m-app/is_connected
1 compromised version
- May 4, 2026
Malware in @w3m-app/switch_network
1 compromised version
- May 4, 2026
Malware in @w3m-frame/session_update
1 compromised version
- May 4, 2026
Malicious code in @bcs-ui/theme (npm)
- May 4, 2026
Malicious code in @bcs-react-ui/select (npm)
- May 4, 2026
Malware in @bcs-react-ui/select
1 compromised version
- May 4, 2026
Malware in @taxmoninor/taxmon
1 compromised version
- May 4, 2026
Malware in @pyme-web/web-api
1 compromised version
- May 4, 2026
Malware in @bcs-ui/theme
1 compromised version
- May 4, 2026
Malware in @pyme-web/ui-base
1 compromised version
- May 4, 2026
Malware in @pyme-web/ui-widget
1 compromised version
- May 4, 2026
Malicious code in @bcs-react-ui/context-menu (npm)
- May 4, 2026
Malicious code in @bcs-mi/store (npm)
- May 4, 2026
Malicious code in @bcs-bank-react-ui/swiper-slider (npm)
- May 4, 2026
Malicious code in @bcs-bank/init (npm)
- May 4, 2026
Malicious code in @bcs-bank/common-constants (npm)
- May 4, 2026
Malware in @bcs-mi/store
1 compromised version
- May 4, 2026
Malware in @bcs-bank-react-ui/swiper-slider
1 compromised version
- May 4, 2026
Malware in @bcs-react-ui/context-menu
1 compromised version
- May 4, 2026
Malware in @bcs-bank/common-constants
1 compromised version
- May 4, 2026
Malware in @bcs-bank/init
1 compromised version
- May 4, 2026
Malicious code in @bcs-adapters/keycloak-api-adapter (npm)
- May 4, 2026
Malicious code in @bcs-adapters/core-adapter (npm)
- May 4, 2026
Malware in @bcs-adapters/core-adapter
1 compromised version
- May 4, 2026
Malware in @bcs-adapters/keycloak-api-adapter
1 compromised version
- May 4, 2026
Malicious code in paypal-payouts-bridge (npm)
- May 4, 2026
Malicious code in microsoft-agents-auth-service (npm)
- May 3, 2026
Malicious code in feature-flag-service (npm)
2 compromised versions
- May 3, 2026
Malicious code in google-cloud-secret-manager-config-poc (npm)
1 compromised version
- May 3, 2026
Malicious code in internal-company-module-test-1337 (npm)
4 compromised versions
- May 3, 2026
Malicious code in ally-call-wait-time (npm)
2 compromised versions
- May 3, 2026
Malicious code in @allybank/ally-sdk (npm)
2 compromised versions
Page 116 of 4,804