Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,293 total in npm · sorted newest first- Mar 24, 2026
Malicious code in merchant-rps (npm)
1 compromised version
- Mar 24, 2026
Malicious code in mcc-data (npm)
1 compromised version
- Mar 24, 2026
Malicious code in loadshh (npm)
1 compromised version
- Mar 24, 2026
Malicious code in json-mapping-token (npm)
1 compromised version
- Mar 24, 2026
Malicious code in json-mapping-fetch (npm)
1 compromised version
- Mar 24, 2026
Malicious code in ghost-module (npm)
1 compromised version
- Mar 24, 2026
Malicious code in env-nodejs (npm)
1 compromised version
- Mar 24, 2026
Malicious code in env-node-cli (npm)
1 compromised version
- Mar 24, 2026
Malicious code in env-extend (npm)
1 compromised version
- Mar 24, 2026
Malicious code in env-express-cli (npm)
1 compromised version
- Mar 24, 2026
Malicious code in env-express (npm)
1 compromised version
- Mar 24, 2026
Malicious code in env-expanded (npm)
1 compromised version
- Mar 24, 2026
Malicious code in env-embed (npm)
1 compromised version
- Mar 24, 2026
Malicious code in env-cli-express (npm)
1 compromised version
- Mar 24, 2026
Malicious code in ectoplast-spirit (npm)
1 compromised version
- Mar 24, 2026
Malicious code in ecto-spirit-core (npm)
4 compromised versions
- Mar 24, 2026
Malicious code in ecto-spirit (npm)
1 compromised version
- Mar 24, 2026
Malicious code in ecto-registry (npm)
3 compromised versions
- Mar 24, 2026
Malicious code in ecto-engine (npm)
1 compromised version
- Mar 24, 2026
Malicious code in ecto-corsair-lwirz (npm)
1 compromised version
- Mar 24, 2026
Malicious code in dotenv-xtend (npm)
1 compromised version
- Mar 24, 2026
Malicious code in dotenv-express (npm)
6 compromised versions
- Mar 24, 2026
Malicious code in deriv_ppetest (npm)
1 compromised version
- Mar 24, 2026
Malicious code in cursed-module (npm)
4 compromised versions
- Mar 24, 2026
Malicious code in ctf-package-onetimeuseforctf (npm)
5 compromised versions
- Mar 24, 2026
Malicious code in corsair-module (npm)
1 compromised version
- Mar 24, 2026
Malicious code in codecoverage-tools (npm)
2 compromised versions
- Mar 24, 2026
Malicious code in codeanalysis-common (npm)
2 compromised versions
- Mar 24, 2026
Malicious code in chain-multer (npm)
1 compromised version
- Mar 24, 2026
Malicious code in chai-set (npm)
1 compromised version
- Mar 24, 2026
Malicious code in chai-chain-cognivault (npm)
1 compromised version
- Mar 24, 2026
Malicious code in chai-chain-argon (npm)
1 compromised version
- Mar 24, 2026
Malicious code in chai-as-chains (npm)
3 compromised versions
- Mar 24, 2026
Malicious code in chai-as-attached (npm)
1 compromised version
- Mar 24, 2026
Malicious code in chai-as-aligned (npm)
2 compromised versions
- Mar 24, 2026
Malicious code in cdnjavacss (npm)
1 compromised version
- Mar 24, 2026
Malicious code in azurestack-common (npm)
2 compromised versions
- Mar 24, 2026
Malicious code in argon-node (npm)
1 compromised version
- Mar 24, 2026
Malicious code in @pansycareful/github-helper (npm)
2 compromised versions
- Mar 24, 2026
Malicious code in @hsbc-mfe/host (npm)
1 compromised version
- Mar 24, 2026
Malicious code in @girirajravichandran/corp-build-utils-poc (npm)
2 compromised versions
- Mar 24, 2026
Malicious code in @fyxer-ai/shared (npm)
1 compromised version
- Mar 24, 2026
Malicious code in @abi-labs-frontend/standards (npm)
1 compromised version
- Mar 24, 2026
Malicious code in @one-site/europcar (npm)
2 compromised versions
- Mar 24, 2026
Malicious code in express-session-validator (npm)
- Mar 24, 2026
Malicious code in express-session-vailidator (npm)
- Mar 24, 2026
Malware in express-session-vailidator
1 compromised version
- Mar 24, 2026
Malware in express-session-validator
1 compromised version
- Mar 24, 2026
Malicious code in sbx-mask (npm)
3 compromised versions
- Mar 24, 2026
Malware in sbx-mask
1 compromised version
Page 142 of 4,806