Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- Apr 25, 2026
Malicious code in @google-pay-trust/authorize-payment (npm)
2 compromised versions
- Apr 25, 2026
Malicious code in @apple-pay-trust/start (npm)
2 compromised versions
- Apr 25, 2026
Malicious code in @google-pay-trust/init-google-pay (npm)
1 compromised version
- Apr 25, 2026
Malicious code in @google-pay-trust/finish (npm)
1 compromised version
- Apr 25, 2026
Malicious code in @apple-pay-trust/validate-merchant (npm)
2 compromised versions
- Apr 25, 2026
Malicious code in apollo-vertex (npm)
1 compromised version
- Apr 25, 2026
Malicious code in apollo-landing (npm)
1 compromised version
- Apr 25, 2026
Malicious code in process-app-task (npm)
1 compromised version
- Apr 25, 2026
Malicious code in @tw-models/storage (npm)
3 compromised versions
- Apr 25, 2026
Malicious code in @tw-marionette/input (npm)
3 compromised versions
- Apr 25, 2026
Malicious code in @tw-utils/static (npm)
3 compromised versions
- Apr 25, 2026
Malicious code in standalone-apps (npm)
1 compromised version
- Apr 25, 2026
Malicious code in uipath-ui-widgets (npm)
1 compromised version
- Apr 25, 2026
Malicious code in kl-b2c-ui-kit (npm)
3 compromised versions
- Apr 25, 2026
Malicious code in @sbt_gitverse/analytics-client (npm)
4 compromised versions
- Apr 25, 2026
Malicious code in tether-base (npm)
1 compromised version
- Apr 25, 2026
Malicious code in axis-ui-generator (npm)
3 compromised versions
- Apr 25, 2026
Malicious code in axis-abc-search-address (npm)
3 compromised versions
- Apr 25, 2026
Malicious code in axis-abc-portal-menu (npm)
3 compromised versions
- Apr 25, 2026
Malicious code in axis-abc-search-account (npm)
3 compromised versions
- Apr 25, 2026
Malicious code in axis-notification (npm)
3 compromised versions
- Apr 25, 2026
Malicious code in axis-charts (npm)
3 compromised versions
- Apr 25, 2026
Malicious code in js-component-explorer (npm)
2 compromised versions
- Apr 24, 2026
Malicious code in @tochka-ui/foundation (npm)
5 compromised versions
- Apr 24, 2026
Malicious code in @frengki0707/google-cloud-clone (npm)
1 compromised version
- Apr 24, 2026
Malicious code in @alfa.life.mapp/app.web (npm)
6 compromised versions
- Apr 24, 2026
Malware in modern-events
1 compromised version
- Apr 24, 2026
Malicious code in @m0ntana/app.web (npm)
4 compromised versions
- Apr 24, 2026
Malicious code in model-poc-suhail (npm)
3 compromised versions
- Apr 24, 2026
Malware in chain-promised-await
1 compromised version
- Apr 24, 2026
Malware in env_express
1 compromised version
- Apr 24, 2026
Malicious code in next-rwa (npm)
- Apr 24, 2026
Malicious code in auth0-ui-components-docs (npm)
- Apr 24, 2026
Malware in next-rwa
1 compromised version
- Apr 24, 2026
Malware in react-spa-shadcn
1 compromised version
- Apr 24, 2026
Malware in auth0-ui-components-docs
1 compromised version
- Apr 24, 2026
Malware in react-spa-npm
1 compromised version
- Apr 24, 2026
Malicious code in wrapped-logger-utils (npm)
1 compromised version
- Apr 24, 2026
Malware in wrapped-logger-utils
1 compromised version
- Apr 24, 2026
Malicious code in sagat-core (npm)
- Apr 24, 2026
Malware in sagat-core
1 compromised version
- Apr 24, 2026
Malicious code in amplitude-ma-ts (npm)
1 compromised version
- Apr 23, 2026
Malicious code in lightspark-js (npm)
1 compromised version
- Apr 23, 2026
Malicious code in @bitwarden/cli (npm)
1 compromised version
- Apr 23, 2026
Malware in @bitwarden/cli
1 compromised version
- Apr 23, 2026
Malicious code in microsoft-employee-experience (npm)
2 compromised versions
- Apr 23, 2026
Malicious code in hls.js (npm)
2 compromised versions
- Apr 23, 2026
Malware in hls.js
1 compromised version
- Apr 23, 2026
Malicious code in react-spa-npm (npm)
1 compromised version
- Apr 23, 2026
Malicious code in amazon-q-developer-streaming-client (npm)
3 compromised versions
Page 120 of 4,804