Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- Apr 20, 2026
Malicious code in internal_insights_enabled (npm)
7 compromised versions
- Apr 20, 2026
Malicious code in hifromhere1 (npm)
1 compromised version
- Apr 20, 2026
Malicious code in tailwind-text-fill (npm)
- Apr 20, 2026
Malware in tailwind-text-fill
1 compromised version
- Apr 20, 2026
Malware in tailwindthml-flips
1 compromised version
- Apr 20, 2026
Malicious code in npm-doc-deploy (npm)
4 compromised versions
- Apr 20, 2026
Malicious code in bignum-ts-v2 (npm)
- Apr 20, 2026
Malware in bignum-ts-v2
1 compromised version
- Apr 20, 2026
Malware in npm-doc-deploy
1 compromised version
- Apr 20, 2026
Malicious code in @tushar-br/file11 (npm)
- Apr 20, 2026
Malicious code in @tushar-br/editing-pack (npm)
- Apr 20, 2026
Malicious code in @tushar-br/desktop (npm)
- Apr 20, 2026
Malware in @tushar-br/file11
1 compromised version
- Apr 20, 2026
Malware in @tushar-br/desktop
1 compromised version
- Apr 20, 2026
Malware in @tushar-br/editing-pack
1 compromised version
- Apr 20, 2026
Malicious code in krdfonts (npm)
- Apr 20, 2026
Malware in krdfonts
1 compromised version
- Apr 20, 2026
Malicious code in @otaxayuns/baileys (npm)
- Apr 20, 2026
Malware in @otaxayuns/baileys
1 compromised version
- Apr 20, 2026
Malicious code in turbo-leven (npm)
3 compromised versions
- Apr 20, 2026
Malicious code in turbo-he (npm)
1 compromised version
- Apr 20, 2026
Malicious code in optimized-fastest-levenshtein (npm)
3 compromised versions
- Apr 20, 2026
Malicious code in mailcraftjs (npm)
- Apr 20, 2026
Malicious code in @kjma/mailcraft (npm)
- Apr 20, 2026
Malware in @kjma/mailcraft
1 compromised version
- Apr 20, 2026
Malware in turbo-leven
1 compromised version
- Apr 20, 2026
Malware in mailcraftjs
1 compromised version
- Apr 20, 2026
Malware in optimized-fastest-levenshtein
1 compromised version
- Apr 20, 2026
Malware in turbo-he
1 compromised version
- Apr 19, 2026
Malicious code in chandan-module-test (npm)
1 compromised version
- Apr 19, 2026
Malicious code in pa-marked-internal (npm)
2 compromised versions
- Apr 19, 2026
Malicious code in react-spa-shadcn (npm)
2 compromised versions
- Apr 19, 2026
Malicious code in pa-marked (npm)
3 compromised versions
- Apr 19, 2026
Malicious code in rtms-manager (npm)
2 compromised versions
- Apr 19, 2026
Malicious code in vinext-monorepo (npm)
3 compromised versions
- Apr 19, 2026
Malicious code in sy-editor-v3 (npm)
1 compromised version
- Apr 18, 2026
Malicious code in @shoobx/types (npm)
1 compromised version
- Apr 18, 2026
Malicious code in @source-row/source-container (npm)
1 compromised version
- Apr 18, 2026
Malicious code in @ataslkit/profilecard (npm)
1 compromised version
- Apr 18, 2026
Malicious code in react-resource-router-next (npm)
1 compromised version
- Apr 18, 2026
Malicious code in cktool.core.internal (npm)
1 compromised version
- Apr 18, 2026
Malicious code in cktool.config (npm)
1 compromised version
- Apr 18, 2026
Malicious code in cktool.api (npm)
1 compromised version
- Apr 18, 2026
Malicious code in cktool.internal (npm)
1 compromised version
- Apr 18, 2026
Malicious code in apple-idms-internal (npm)
1 compromised version
- Apr 18, 2026
Malicious code in apple-cloudkit-internal (npm)
1 compromised version
- Apr 18, 2026
Malicious code in react-hook-form (npm)
1 compromised version
- Apr 18, 2026
Malware in react-hook-form
1 compromised version
- Apr 18, 2026
Malicious code in ac-sasskit-internal (npm)
3 compromised versions
- Apr 17, 2026
Malicious code in material-ui-plugin-cache-endpoint (npm)
1 compromised version
Page 123 of 4,804