Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- Apr 3, 2026
Malicious code in strapi-plugin-advanced-uuid (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-guardarian-ext (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-health-check (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-debug-tools (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-content-sync (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-cms-tools (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-hextest (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-finseven (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-nordica (npm)
2 compromised versions
- Apr 3, 2026
Malicious code in strapi-plugin-nordica-deep (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-nordica-vhost (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-nordica-stage (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-nordica-recon (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-nordica-api (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-nordica-cms (npm)
- Apr 3, 2026
Malicious code in strapi-plugin-nordica-sync (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-nordica-lite (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-nordica-tools (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-sitemap-gen (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-locale (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-api (npm)
2 compromised versions
- Apr 3, 2026
Malicious code in strapi-plugin-notify (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-form (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-seed (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-sync (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-health (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-logger (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-monitor (npm)
- Apr 3, 2026
Malicious code in strapi-plugin-hooks (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-core (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-database (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-server (npm)
- Apr 3, 2026
Malicious code in strapi-plugin-config (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-cron (npm)
1 compromised version
- Apr 3, 2026
Malicious code in strapi-plugin-events (npm)
1 compromised version
- Apr 3, 2026
Malicious code in mgc (npm)
7 compromised versions
- Apr 3, 2026
Malicious code in @corpweb-ui/wmkt-library (npm)
2 compromised versions
- Apr 3, 2026
Malicious code in @toprank/partner (npm)
3 compromised versions
- Apr 2, 2026
Malicious code in exprrrress (npm)
1 compromised version
- Apr 2, 2026
Malicious code in expreeeess (npm)
1 compromised version
- Apr 2, 2026
Malicious code in expeewas (npm)
1 compromised version
- Apr 2, 2026
Malicious code in pro-express (npm)
1 compromised version
- Apr 2, 2026
Malicious code in expirs (npm)
1 compromised version
- Apr 2, 2026
Malicious code in exaprse (npm)
1 compromised version
- Apr 2, 2026
Malicious code in exszpe3szs (npm)
1 compromised version
- Apr 2, 2026
Malicious code in 4xperss (npm)
1 compromised version
- Apr 2, 2026
Malicious code in expeedsxs (npm)
1 compromised version
- Apr 2, 2026
Malicious code in 4exepreds (npm)
1 compromised version
- Apr 2, 2026
Malicious code in eixp4ressz (npm)
1 compromised version
- Apr 2, 2026
Malicious code in experedzss (npm)
1 compromised version
Page 134 of 4,804