Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- Apr 12, 2026
Malicious code in upstart.previewcss (npm)
1 compromised version
- Apr 12, 2026
Malicious code in pinstatsd (npm)
1 compromised version
- Apr 12, 2026
Malicious code in pinlogger (npm)
1 compromised version
- Apr 12, 2026
Malicious code in wm-plugin-visions-recorder (npm)
1 compromised version
- Apr 12, 2026
Malicious code in gp-auth-lib (npm)
1 compromised version
- Apr 12, 2026
Malicious code in portal-common-ui (npm)
1 compromised version
- Apr 12, 2026
Malicious code in ts-schema-helpers (npm)
1 compromised version
- Apr 11, 2026
Malicious code in unisys-uka (npm)
1 compromised version
- Apr 11, 2026
Malicious code in unisys-common (npm)
1 compromised version
- Apr 11, 2026
Malicious code in unisys-sdk (npm)
1 compromised version
- Apr 11, 2026
Malicious code in unisys-core (npm)
1 compromised version
- Apr 11, 2026
Malicious code in unisys-auth (npm)
1 compromised version
- Apr 11, 2026
Malicious code in unisys-agentic-ai-playground (npm)
1 compromised version
- Apr 11, 2026
Malicious code in arlo-meeting-assistant-rtms (npm)
1 compromised version
- Apr 11, 2026
Malicious code in arlo-meeting-assistant-frontend (npm)
1 compromised version
- Apr 11, 2026
Malicious code in arlo-meeting-assistant-backend (npm)
1 compromised version
- Apr 11, 2026
Malicious code in @b2b-portal/uch (npm)
1 compromised version
- Apr 11, 2026
Malicious code in ts-form-helpers (npm)
16 compromised versions
- Apr 11, 2026
Malicious code in paysafe-card-payments (npm)
2 compromised versions
- Apr 11, 2026
Malicious code in paysafe-apple-pay (npm)
2 compromised versions
- Apr 11, 2026
Malicious code in paysafe-google-pay (npm)
2 compromised versions
- Apr 11, 2026
Malicious code in paysafe-venmo (npm)
2 compromised versions
- Apr 11, 2026
Malicious code in paysafe-payments-sdk-common (npm)
2 compromised versions
- Apr 11, 2026
Malicious code in @sap-px/pxapi (npm)
1 compromised version
- Apr 10, 2026
Malicious code in @b2b-portal/form (npm)
1 compromised version
- Apr 10, 2026
Malicious code in @lamoda/seller-ui-kit (npm)
5 compromised versions
- Apr 10, 2026
Malicious code in @genoma-ui/components (npm)
- Apr 9, 2026
Malicious code in sjs-biginteger (npm)
2 compromised versions
- Apr 9, 2026
Malicious code in sjs-lint-build1 (npm)
1 compromised version
- Apr 9, 2026
Malicious code in @signals-notebook/utils (npm)
1 compromised version
- Apr 9, 2026
Malicious code in @tableau__catalog-messages/database_lower (npm)
1 compromised version
- Apr 9, 2026
Malicious code in @telekom-wfa/auth-core (npm)
1 compromised version
- Apr 9, 2026
Malicious code in viewer-assets-generator (npm)
1 compromised version
- Apr 8, 2026
Malicious code in black-moon-js (npm)
1 compromised version
- Apr 8, 2026
Malware in @fairwords/encryption
1 compromised version
- Apr 8, 2026
Malware in @fairwords/websocket
1 compromised version
- Apr 8, 2026
Malicious code in gprofiler (npm)
1 compromised version
- Apr 8, 2026
Malicious code in @fairwords/encryption (npm)
2 compromised versions
- Apr 8, 2026
Malicious code in @fairwords/loopback-connector-es (npm)
2 compromised versions
- Apr 8, 2026
Malicious code in @fairwords/websocket (npm)
2 compromised versions
- Apr 7, 2026
Malicious code in @sie-ppr-web-checkout/app (npm)
1 compromised version
- Apr 7, 2026
Malware in @opengov/form-renderer
1 compromised version
- Apr 7, 2026
Malicious code in @velora-dex/sdk (npm)
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-nordica
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-blurhash
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-advanced-uuid
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-guardarian-ext
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-health-check
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-debug-tools
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-content-sync
1 compromised version
Page 132 of 4,804