Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- Apr 17, 2026
Malicious code in @indriver-poc/whisperwind (npm)
1 compromised version
- Apr 17, 2026
Malicious code in value-slider (npm)
1 compromised version
- Apr 17, 2026
Malware in value-slider
1 compromised version
- Apr 17, 2026
Malicious code in @than-xs/libsignal-node (npm)
- Apr 17, 2026
Malware in @than-xs/libsignal-node
1 compromised version
- Apr 17, 2026
Malicious code in @than1st/baileys (npm)
2 compromised versions
- Apr 17, 2026
Malware in @than1st/baileys
1 compromised version
- Apr 17, 2026
Malicious code in eslint-plugin-totara (npm)
1 compromised version
- Apr 17, 2026
Malicious code in node-red-contrib-yolo-object-detection (npm)
1 compromised version
- Apr 17, 2026
Malware in node-red-contrib-yolo-object-detection
1 compromised version
- Apr 17, 2026
Malware in koa-v3
1 compromised version
- Apr 17, 2026
Malicious code in koa-v3 (npm)
3 compromised versions
- Apr 17, 2026
Malicious code in express-security-policy (npm)
- Apr 17, 2026
Malicious code in renovate-config-doctolib (npm)
- Apr 17, 2026
Malicious code in paddle-internal-scripts (npm)
- Apr 17, 2026
Malicious code in ing-web-v5 (npm)
1 compromised version
- Apr 16, 2026
Malicious code in chai-as-optimized (npm)
- Apr 16, 2026
Malicious code in chai-as-init (npm)
3 compromised versions
- Apr 16, 2026
Malicious code in chai-as-ide (npm)
- Apr 16, 2026
Malicious code in lightweight-charts-4.1 (npm)
2 compromised versions
- Apr 16, 2026
Malicious code in modern-events (npm)
10 compromised versions
- Apr 16, 2026
Malicious code in sanitize-url (npm)
1 compromised version
- Apr 16, 2026
Malicious code in conventional-changelog-dash (npm)
1 compromised version
- Apr 16, 2026
Malicious code in youpin (npm)
1 compromised version
- Apr 16, 2026
Malicious code in winston-prisma (npm)
13 compromised versions
- Apr 16, 2026
Malicious code in transcript-viewer-ui-demo (npm)
1 compromised version
- Apr 16, 2026
Malicious code in tailwind-configuration (npm)
1 compromised version
- Apr 16, 2026
Malicious code in synthetics-sdk-node (npm)
1 compromised version
- Apr 16, 2026
Malicious code in sfx-data (npm)
3 compromised versions
- Apr 16, 2026
Malicious code in separadordeinfo (npm)
1 compromised version
- Apr 16, 2026
Malicious code in rtxaspnet (npm)
1 compromised version
- Apr 16, 2026
Malicious code in request-easy-validator (npm)
6 compromised versions
- Apr 16, 2026
Malicious code in relion-node (npm)
1 compromised version
- Apr 16, 2026
Malicious code in relion-chain (npm)
1 compromised version
- Apr 16, 2026
Malicious code in react-appfabric-shell (npm)
4 compromised versions
- Apr 16, 2026
Malicious code in puzzle-fragment (npm)
1 compromised version
- Apr 16, 2026
Malicious code in pil2-stark-js (npm)
1 compromised version
- Apr 16, 2026
Malicious code in pil2-proofman-js (npm)
1 compromised version
- Apr 16, 2026
Malicious code in payments-ui (npm)
1 compromised version
- Apr 16, 2026
Malicious code in package-with-import-assertions (npm)
1 compromised version
- Apr 16, 2026
Malicious code in otomi-tasks (npm)
1 compromised version
- Apr 16, 2026
Malicious code in otomi-console (npm)
1 compromised version
- Apr 16, 2026
Malicious code in node-syncora (npm)
1 compromised version
- Apr 16, 2026
Malicious code in node-metrica (npm)
1 compromised version
- Apr 16, 2026
Malicious code in nemo-jaws (npm)
2 compromised versions
- Apr 16, 2026
Malicious code in nemo-datadrive (npm)
1 compromised version
- Apr 16, 2026
Malicious code in mypeopledoc (npm)
1 compromised version
- Apr 16, 2026
Malicious code in mybibilabu (npm)
1 compromised version
- Apr 16, 2026
Malicious code in minecraft_image_to_blocks (npm)
1 compromised version
- Apr 16, 2026
Malicious code in metrify-node (npm)
1 compromised version
Page 124 of 4,804