Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- Apr 2, 2026
Malicious code in bytefrontier-sdk (npm)
1 compromised version
- Apr 2, 2026
Malicious code in vv-ftend-api (npm)
1 compromised version
- Apr 2, 2026
Malicious code in bytefrontier-tracker (npm)
1 compromised version
- Apr 2, 2026
Malicious code in partner-tracker (npm)
1 compromised version
- Apr 2, 2026
Malicious code in bytefrontier-partner (npm)
1 compromised version
- Apr 2, 2026
Malicious code in bytefrontier-api (npm)
1 compromised version
- Apr 2, 2026
Malicious code in partner-tracker-api (npm)
1 compromised version
- Apr 2, 2026
Malicious code in vv-ftend-core (npm)
1 compromised version
- Apr 2, 2026
Malicious code in @mgcrae/pino-pretty-logger (npm)
6 compromised versions
- Apr 2, 2026
Malware in @mgcrae/pino-pretty-logger
1 compromised version
- Apr 2, 2026
Malicious code in express-session-js (npm)
1 compromised version
- Apr 2, 2026
Malicious code in @_wnpm/wnpm-cli (npm)
1 compromised version
- Apr 1, 2026
Malicious code in mcp-server-todo (npm)
- Apr 1, 2026
Malware in mcp-server-todo
1 compromised version
- Apr 1, 2026
Malicious code in raydium-bs58 (npm)
- Apr 1, 2026
Malicious code in ethersproject-wallet (npm)
- Apr 1, 2026
Malicious code in bs58-basic (npm)
- Apr 1, 2026
Malware in ethersproject-wallet
1 compromised version
- Apr 1, 2026
Malware in raydium-bs58
1 compromised version
- Apr 1, 2026
Malware in bs58-basic
1 compromised version
- Apr 1, 2026
Malicious code in base-x-64 (npm)
- Apr 1, 2026
Malware in base-x-64
1 compromised version
- Apr 1, 2026
Malicious code in jonas-prettier-logger (npm)
- Apr 1, 2026
Malicious code in jellyfi-pino-pretty-logger (npm)
- Apr 1, 2026
Malicious code in base58-engine (npm)
- Apr 1, 2026
Malicious code in base-or-engine (npm)
- Apr 1, 2026
Malicious code in @logcore/pino-pretty-logger (npm)
- Apr 1, 2026
Malware in jellyfi-pino-pretty-logger
1 compromised version
- Apr 1, 2026
Malware in base58-engine
1 compromised version
- Apr 1, 2026
Malware in jonas-prettier-logger
1 compromised version
- Apr 1, 2026
Malware in @logcore/pino-pretty-logger
1 compromised version
- Apr 1, 2026
Malware in base-or-engine
1 compromised version
- Mar 31, 2026
Malicious code in @c8o/nimbus-core (npm)
1 compromised version
- Mar 31, 2026
Malware in @c8o/nimbus-core
1 compromised version
- Mar 31, 2026
Malicious code in tailwindcss-typeface-inter (npm)
- Mar 31, 2026
Malware in tailwindcss-typeface-inter
1 compromised version
- Mar 31, 2026
Malware in autoshipment-public-front
1 compromised version
- Mar 31, 2026
Malware in plain-crypto-js
1 compromised version
- Mar 31, 2026
Malicious code in axios (npm)
2 compromised versions
- Mar 31, 2026
Malware in axios
1 compromised version
- Mar 31, 2026
Malicious code in plain-crypto-js (npm)
3 compromised versions
- Mar 30, 2026
Malicious code in eslint-validator (npm)
- Mar 30, 2026
Malware in eslint-validator
1 compromised version
- Mar 30, 2026
Malicious code in earthengine-api (npm)
1 compromised version
- Mar 29, 2026
Malicious code in bos-decoration-elements (npm)
1 compromised version
- Mar 29, 2026
Malicious code in f0-state-manager (npm)
1 compromised version
- Mar 29, 2026
Malicious code in merchservicingnodeserv (npm)
1 compromised version
- Mar 29, 2026
Malicious code in dial-app-version (npm)
3 compromised versions
- Mar 29, 2026
Malicious code in bizsignupnodeweb (npm)
1 compromised version
- Mar 29, 2026
Malicious code in sn3akysnak3-test (npm)
1 compromised version
Page 135 of 4,804