Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- Apr 16, 2026
Malicious code in apl-announcements (npm)
1 compromised version
- Apr 16, 2026
Malicious code in agent-starter (npm)
1 compromised version
- Apr 16, 2026
Malicious code in agent-scheduler (npm)
1 compromised version
- Apr 16, 2026
Malicious code in agent-framework-web (npm)
1 compromised version
- Apr 16, 2026
Malicious code in agdebugger-frontend (npm)
1 compromised version
- Apr 16, 2026
Malicious code in actions-label-commenter (npm)
1 compromised version
- Apr 16, 2026
Malicious code in action-setup-enos (npm)
1 compromised version
- Apr 16, 2026
Malicious code in access-worker-test (npm)
1 compromised version
- Apr 16, 2026
Malicious code in aca-review-apps (npm)
1 compromised version
- Apr 16, 2026
Malicious code in @youcanneverguessthisonereally/test-pkg (npm)
1 compromised version
- Apr 16, 2026
Malicious code in @the-coca-cola-company/receipt-scanner-admin-lib (npm)
2 compromised versions
- Apr 16, 2026
Malicious code in @tax-taxdev/tools-scripts (npm)
1 compromised version
- Apr 16, 2026
Malicious code in @mesh-atoms/typography (npm)
1 compromised version
- Apr 16, 2026
Malicious code in @gameforge/http-server (npm)
1 compromised version
- Apr 16, 2026
Malicious code in @fuego-tools/analytics (npm)
1 compromised version
- Apr 16, 2026
Malicious code in @evoja-web/redaction (npm)
8 compromised versions
- Apr 16, 2026
Malicious code in @evoja-web/react-login (npm)
1 compromised version
- Apr 16, 2026
Malicious code in @evoja-web/create-react-project (npm)
2 compromised versions
- Apr 16, 2026
Malicious code in @appleseed-apple/ac-sass-kit (npm)
1 compromised version
- Apr 16, 2026
Malicious code in @3stripes/toolkit (npm)
3 compromised versions
- Apr 16, 2026
Malicious code in @3stripes/shared (npm)
3 compromised versions
- Apr 16, 2026
Malicious code in @3stripes/sdk (npm)
3 compromised versions
- Apr 16, 2026
Malicious code in @3stripes/core (npm)
3 compromised versions
- Apr 16, 2026
Malicious code in @3stripes/config (npm)
3 compromised versions
- Apr 16, 2026
Malicious code in @3stripes/components (npm)
3 compromised versions
- Apr 16, 2026
Malicious code in nj-logger (npm)
- Apr 16, 2026
Malicious code in vite-plugin-compress-plus (npm)
- Apr 16, 2026
Malicious code in pretty-logger-js (npm)
- Apr 16, 2026
Malicious code in terminal-formatter (npm)
- Apr 15, 2026
Malicious code in trgrip (npm)
- Apr 15, 2026
Malicious code in tailwindthml-flips (npm)
- Apr 15, 2026
Malicious code in tailwind-typography-cssstyle (npm)
- Apr 15, 2026
Malicious code in swplayer-react-sl (npm)
1 compromised version
- Apr 15, 2026
Malicious code in simple-auth-basic (npm)
6 compromised versions
- Apr 15, 2026
Malicious code in trackora-node (npm)
1 compromised version
- Apr 15, 2026
Malicious code in trackora-chain (npm)
1 compromised version
- Apr 15, 2026
Malicious code in lockedin-chai-chain (npm)
1 compromised version
- Apr 15, 2026
Malicious code in env_express (npm)
1 compromised version
- Apr 15, 2026
Malicious code in dotenv-pack (npm)
- Apr 15, 2026
Malicious code in chai-use-chains (npm)
2 compromised versions
- Apr 15, 2026
Malicious code in chai-str (npm)
1 compromised version
- Apr 15, 2026
Malicious code in chai-beta (npm)
1 compromised version
- Apr 15, 2026
Malicious code in chai-as-stream (npm)
- Apr 15, 2026
Malicious code in chai-as-nobj (npm)
- Apr 15, 2026
Malicious code in chai-as-mobj (npm)
1 compromised version
- Apr 15, 2026
Malicious code in chai-as-inserted (npm)
1 compromised version
- Apr 15, 2026
Malicious code in chai-as-evm (npm)
1 compromised version
- Apr 15, 2026
Malicious code in chai-as-encrypted (npm)
4 compromised versions
- Apr 15, 2026
Malicious code in chai-as-elevated (npm)
2 compromised versions
- Apr 15, 2026
Malicious code in chai-as-chain-v2 (npm)
1 compromised version
Page 126 of 4,804