Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- Apr 22, 2026
Malicious code in @bmg-web/bmg-ajax (npm)
1 compromised version
- Apr 22, 2026
Malicious code in @bmg-web-features/bmg-user-interaction-tracker (npm)
1 compromised version
- Apr 22, 2026
Malicious code in @bmg-web/bmg-card (npm)
1 compromised version
- Apr 22, 2026
Malicious code in @bmg-web/bmg-external-link (npm)
1 compromised version
- Apr 22, 2026
Malicious code in tsdoc-build-rig (npm)
1 compromised version
- Apr 22, 2026
Malicious code in @oec-settlement/react-router (npm)
1 compromised version
- Apr 22, 2026
Malware in trackora-node
1 compromised version
- Apr 22, 2026
Malware in trackora-chain
1 compromised version
- Apr 22, 2026
Malicious code in crypto-keccak-js (npm)
- Apr 22, 2026
Malware in crypto-keccak-js
1 compromised version
- Apr 22, 2026
Malicious code in ts-utils-dev (npm)
- Apr 22, 2026
Malicious code in gleb-js (npm)
1 compromised version
- Apr 22, 2026
Malware in ts-utils-dev
1 compromised version
- Apr 22, 2026
Malware in gleb-js
1 compromised version
- Apr 22, 2026
Malware in js-logger-pack
1 compromised version
- Apr 22, 2026
Malicious code in claudcode-mcp (npm)
- Apr 22, 2026
Malicious code in claudcode-cli (npm)
- Apr 22, 2026
Malware in claudcode-cli
1 compromised version
- Apr 22, 2026
Malware in claudcode-mcp
1 compromised version
- Apr 22, 2026
Malicious code in aven_types (npm)
1 compromised version
- Apr 22, 2026
Malicious code in @usealloy/typegen (npm)
1 compromised version
- Apr 22, 2026
Malicious code in @usealloy/component-library (npm)
1 compromised version
- Apr 22, 2026
Malicious code in @usealloy/api-contract (npm)
1 compromised version
- Apr 22, 2026
Malicious code in @bitunix/test (npm)
- Apr 22, 2026
Malware in aven_types
1 compromised version
- Apr 22, 2026
Malware in @usealloy/typegen
1 compromised version
- Apr 22, 2026
Malware in @bitunix/test
1 compromised version
- Apr 22, 2026
Malware in @usealloy/api-contract
1 compromised version
- Apr 22, 2026
Malware in @usealloy/component-library
1 compromised version
- Apr 22, 2026
Malware in chai-as-encrypted
1 compromised version
- Apr 21, 2026
Malicious code in 6161test1234 (npm)
1 compromised version
- Apr 21, 2026
Malicious code in com.tencent.puerts.agent (npm)
4 compromised versions
- Apr 21, 2026
Malware in com.tencent.puerts.agent
1 compromised version
- Apr 21, 2026
Malware in internal_insights_enabled
1 compromised version
- Apr 21, 2026
Malicious code in apple-internal-security-poc-frank (npm)
1 compromised version
- Apr 21, 2026
Malicious code in apple-auth-internal (npm)
- Apr 21, 2026
Malware in apple-idms-internal
1 compromised version
- Apr 21, 2026
Malware in apple-cloudkit-internal
1 compromised version
- Apr 21, 2026
Malware in apple-auth-internal
1 compromised version
- Apr 21, 2026
Malware in ac-sasskit-internal
1 compromised version
- Apr 21, 2026
Malware in apple-internal-security-poc-frank
1 compromised version
- Apr 21, 2026
Malware in cktool.api
1 compromised version
- Apr 21, 2026
Malware in cktool.core.internal
1 compromised version
- Apr 21, 2026
Malware in cktool.internal
1 compromised version
- Apr 21, 2026
Malware in cktool.config
1 compromised version
- Apr 20, 2026
Malicious code in @serasa/core (npm)
1 compromised version
- Apr 20, 2026
Malicious code in @settle-sea/supporting-documents (npm)
1 compromised version
- Apr 20, 2026
Malicious code in bmg-web-features (npm)
1 compromised version
- Apr 20, 2026
Malicious code in bmg-web (npm)
1 compromised version
- Apr 20, 2026
Malicious code in megabank-worklist (npm)
1 compromised version
Page 122 of 4,804