Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- Apr 29, 2026
Malicious code in npm-global-util (npm)
2 compromised versions
- Apr 29, 2026
Malicious code in apple-pki-cert-validator (npm)
1 compromised version
- Apr 29, 2026
Malicious code in apple-internal-telemetry-service (npm)
1 compromised version
- Apr 29, 2026
Malicious code in apple-internal-pki-utils (npm)
2 compromised versions
- Apr 29, 2026
Malicious code in apple-internal-pki-trust-v5 (npm)
1 compromised version
- Apr 29, 2026
Malicious code in apple-internal-pki-trust (npm)
1 compromised version
- Apr 29, 2026
Malicious code in apple-internal-auth-v3 (npm)
1 compromised version
- Apr 29, 2026
Malicious code in apple-infra-ultimate-bypass (npm)
1 compromised version
- Apr 29, 2026
Malicious code in apple-infra-network-v2 (npm)
1 compromised version
- Apr 29, 2026
Malicious code in apple-infra-gcp-leak (npm)
1 compromised version
- Apr 29, 2026
Malicious code in apple-infra-final-escape (npm)
1 compromised version
- Apr 29, 2026
Malicious code in apple-coredata-internal-service (npm)
2 compromised versions
- Apr 29, 2026
Malicious code in apple-cloud-infrastructure-monitor (npm)
1 compromised version
- Apr 29, 2026
Malicious code in apple-cktool-api-v2 (npm)
1 compromised version
- Apr 29, 2026
Malicious code in agents-a365-runtime (npm)
1 compromised version
- Apr 29, 2026
Malicious code in coinmate-typescript-client (npm)
1 compromised version
- Apr 28, 2026
Malicious code in fivem-monitor (npm)
1 compromised version
- Apr 28, 2026
Malicious code in wm-plugin-teach-me-widget (npm)
1 compromised version
- Apr 27, 2026
Malicious code in apple-app-store-server-library-poc (npm)
9 compromised versions
- Apr 27, 2026
Malicious code in @w3m-frame/session_update (npm)
1 compromised version
- Apr 27, 2026
Malicious code in @pyme-web/web-api (npm)
1 compromised version
- Apr 27, 2026
Malicious code in @pyme-web/ui-widget (npm)
1 compromised version
- Apr 27, 2026
Malicious code in @pyme-web/ui-base (npm)
1 compromised version
- Apr 27, 2026
Malicious code in @taxmoninor/taxmon (npm)
1 compromised version
- Apr 27, 2026
Malicious code in @apple-pay-trust/authorize-payment (npm)
1 compromised version
- Apr 27, 2026
Malicious code in @activation_code/success (npm)
1 compromised version
- Apr 27, 2026
Malicious code in @apple-pay-trust/cancelled (npm)
4 compromised versions
- Apr 27, 2026
Malicious code in @apiary-annex/meta (npm)
1 compromised version
- Apr 27, 2026
Malicious code in @business_promocode/cancel_promocode (npm)
1 compromised version
- Apr 27, 2026
Malicious code in @activation_code/activate (npm)
1 compromised version
- Apr 27, 2026
Malicious code in @business_promocode/apply_promocode (npm)
1 compromised version
- Apr 27, 2026
Malicious code in @b2b_blocker/show_activation_error (npm)
1 compromised version
- Apr 27, 2026
Malicious code in @activation_code/error (npm)
1 compromised version
- Apr 27, 2026
Malicious code in @apple-pay-trust/finish (npm)
1 compromised version
- Apr 27, 2026
Malicious code in @apple-pay-trust/check-apple-pay-result (npm)
1 compromised version
- Apr 27, 2026
Malicious code in @apiary-annex/title (npm)
1 compromised version
- Apr 27, 2026
Malicious code in apple-internal-dev-check (npm)
1 compromised version
- Apr 26, 2026
Malicious code in shopify-app-extension-template (npm)
1 compromised version
- Apr 26, 2026
Malicious code in frank-research-poc-apple (npm)
1 compromised version
- Apr 26, 2026
Malicious code in @clearpool/streaming (npm)
3 compromised versions
- Apr 26, 2026
Malicious code in @clearpool/table (npm)
3 compromised versions
- Apr 26, 2026
Malicious code in @clearpool/comms (npm)
3 compromised versions
- Apr 26, 2026
Malicious code in @clearpool/utils (npm)
3 compromised versions
- Apr 26, 2026
Malicious code in classlink (npm)
4 compromised versions
- Apr 26, 2026
Malicious code in frank-bot-gogle-cloning (npm)
1 compromised version
- Apr 26, 2026
Malicious code in @tw-marionette/clipboard (npm)
2 compromised versions
- Apr 26, 2026
Malicious code in @ozon-complt/antibot-handler (npm)
2 compromised versions
- Apr 26, 2026
Malicious code in @ozon-complt/split (npm)
2 compromised versions
- Apr 25, 2026
Malicious code in @apple-pay-trust/merchant-session (npm)
2 compromised versions
- Apr 25, 2026
Malicious code in @google-pay-trust/cancelled (npm)
1 compromised version
Page 119 of 4,804