Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- Apr 13, 2026
Malware in paysafe-card-payments
1 compromised version
- Apr 13, 2026
Malicious code in @zgny/onboarding-consumer (npm)
1 compromised version
- Apr 13, 2026
Malicious code in @spreadjs/js-calc (npm)
1 compromised version
- Apr 13, 2026
Malicious code in @sports-api/api-sdk (npm)
2 compromised versions
- Apr 13, 2026
Malicious code in @spoonflower/ui (npm)
- Apr 13, 2026
Malicious code in @sage-active/ui (npm)
2 compromised versions
- Apr 13, 2026
Malicious code in @relxui/react (npm)
1 compromised version
- Apr 13, 2026
Malicious code in @pes-ui/components (npm)
2 compromised versions
- Apr 13, 2026
Malicious code in @op-microfrontends/config (npm)
2 compromised versions
- Apr 13, 2026
Malicious code in @mx-shared/utils (npm)
- Apr 13, 2026
Malicious code in @kucoin-gbiz-next/tools (npm)
1 compromised version
- Apr 13, 2026
Malicious code in @ids-alpha/theme (npm)
1 compromised version
- Apr 13, 2026
Malicious code in @hrb-web/nuxt (npm)
- Apr 13, 2026
Malicious code in @dtc-campaign-wizard/campaign-wizard (npm)
- Apr 13, 2026
Malware in @hrb-web/nuxt
1 compromised version
- Apr 13, 2026
Malware in @pes-ui/components
1 compromised version
- Apr 13, 2026
Malware in @relxui/react
1 compromised version
- Apr 13, 2026
Malware in @spoonflower/ui
1 compromised version
- Apr 13, 2026
Malware in @spreadjs/js-calc
1 compromised version
- Apr 13, 2026
Malware in @zgny/onboarding-consumer
1 compromised version
- Apr 13, 2026
Malware in @kucoin-gbiz-next/tools
1 compromised version
- Apr 13, 2026
Malware in @sage-active/ui
1 compromised version
- Apr 13, 2026
Malware in @sap-px/pxapi
1 compromised version
- Apr 13, 2026
Malware in @dtc-campaign-wizard/campaign-wizard
1 compromised version
- Apr 13, 2026
Malware in @mx-shared/utils
1 compromised version
- Apr 13, 2026
Malware in @ids-alpha/theme
1 compromised version
- Apr 13, 2026
Malware in @sports-api/api-sdk
1 compromised version
- Apr 13, 2026
Malware in @op-microfrontends/config
1 compromised version
- Apr 13, 2026
Malicious code in wm-plugin-wm-smart-tip-dont-embed-tooltip (npm)
- Apr 13, 2026
Malicious code in @hpcc/js-api (npm)
- Apr 13, 2026
Malicious code in @hmm-app/api (npm)
- Apr 13, 2026
Malicious code in @guards-lib/auth (npm)
2 compromised versions
- Apr 13, 2026
Malicious code in @cash-web/no-hardcoded-font-styles (npm)
- Apr 13, 2026
Malicious code in @bookiply/core (npm)
1 compromised version
- Apr 13, 2026
Malicious code in @bokehjs/core (npm)
- Apr 13, 2026
Malicious code in @ascend-ops/web-client (npm)
2 compromised versions
- Apr 13, 2026
Malicious code in @amplify-js/datastore (npm)
2 compromised versions
- Apr 13, 2026
Malicious code in @aircall-ecosystem/integrations-msteams-frontend (npm)
- Apr 13, 2026
Malware in wm-plugin-visions-recorder
1 compromised version
- Apr 13, 2026
Malware in viewer-assets-generator
1 compromised version
- Apr 13, 2026
Malware in @cash-web/no-hardcoded-font-styles
1 compromised version
- Apr 13, 2026
Malware in @aircall-ecosystem/integrations-msteams-frontend
1 compromised version
- Apr 13, 2026
Malware in @ascend-ops/web-client
1 compromised version
- Apr 13, 2026
Malware in portal-common-ui
1 compromised version
- Apr 13, 2026
Malware in @hmm-app/api
1 compromised version
- Apr 13, 2026
Malware in @bokehjs/core
1 compromised version
- Apr 13, 2026
Malware in @hpcc/js-api
1 compromised version
- Apr 13, 2026
Malware in @amplify-js/datastore
1 compromised version
- Apr 13, 2026
Malware in @bookiply/core
1 compromised version
- Apr 13, 2026
Malware in @guards-lib/auth
1 compromised version
Page 130 of 4,804