Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- Apr 7, 2026
Malware in strapi-plugin-cms-tools
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-hextest
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-finseven
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-nordica-cms
1 compromised version
- Apr 7, 2026
Malicious code in strapi-plugin-cache (npm)
- Apr 7, 2026
Malware in strapi-plugin-nordica-lite
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-monitor
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-cache
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-nordica-deep
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-nordica-vhost
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-nordica-stage
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-nordica-recon
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-nordica-api
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-nordica-sync
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-nordica-tools
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-sitemap-gen
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-notify
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-form
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-locale
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-seed
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-sync
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-health
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-logger
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-hooks
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-core
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-database
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-config
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-cron
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-api
1 compromised version
- Apr 7, 2026
Malware in strapi-plugin-events
1 compromised version
- Apr 7, 2026
Malicious code in @aspect-security/argon2 (npm)
- Apr 7, 2026
Malicious code in argon2-napi (npm)
- Apr 7, 2026
Malicious code in @langgraphjs/toolkit (npm)
4 compromised versions
- Apr 7, 2026
Malware in mgc
1 compromised version
- Apr 7, 2026
Malicious code in devkitx (npm)
1 compromised version
- Apr 6, 2026
Malicious code in frontend-backoffice (npm)
- Apr 6, 2026
Malicious code in use-form-builder-plugin (npm)
- Apr 6, 2026
Malicious code in a2a-chat-canvas (npm)
- Apr 6, 2026
Malicious code in request-js-validator (npm)
3 compromised versions
- Apr 6, 2026
Malicious code in nerite-security-audit (npm)
- Apr 6, 2026
Malicious code in totally-safe-util (npm)
- Apr 6, 2026
Malicious code in df-sandbox-test (npm)
- Apr 6, 2026
Malicious code in commerce-utils (npm)
- Apr 6, 2026
Malicious code in chess-sec-ssrf1 (npm)
1 compromised version
- Apr 5, 2026
Malicious code in cloudera (npm)
1 compromised version
- Apr 5, 2026
Malicious code in cloudera-poc (npm)
1 compromised version
- Apr 5, 2026
Malicious code in admin0911 (npm)
47 compromised versions
- Apr 5, 2026
Malicious code in @not-nemo/crypto-tracker (npm)
3 compromised versions
- Apr 5, 2026
Malicious code in @needl-ai/common (npm)
2 compromised versions
- Apr 3, 2026
Malicious code in strapi-plugin-blurhash (npm)
1 compromised version
Page 133 of 4,804