Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,293 total in npm · sorted newest first- Mar 24, 2026
Malicious code in yelp-react-component-rating (npm)
- Mar 24, 2026
Malicious code in fancode-web-app (npm)
2 compromised versions
- Mar 24, 2026
Malicious code in agoda-test-poc (npm)
- Mar 24, 2026
Malicious code in agoda-dep-confusion (npm)
- Mar 24, 2026
Malware in yelp-react-component-rating
1 compromised version
- Mar 24, 2026
Malware in yelp-mobile-site-common
1 compromised version
- Mar 24, 2026
Malware in characterai-poc
1 compromised version
- Mar 24, 2026
Malware in agoda-dep-confusion
1 compromised version
- Mar 24, 2026
Malware in nintendoamerica-ncom
1 compromised version
- Mar 24, 2026
Malware in agoda-test-poc
1 compromised version
- Mar 24, 2026
Malware in yelp-react-component-badge
1 compromised version
- Mar 24, 2026
Malware in fancode-web-app
1 compromised version
- Mar 24, 2026
Malware in repo-typescript-config
1 compromised version
- Mar 24, 2026
Malicious code in yelp-react-component-photo-upload (npm)
- Mar 24, 2026
Malicious code in yelp-biz-action-constants-js-generated (npm)
- Mar 24, 2026
Malware in yelp-biz-action-constants-js-generated
1 compromised version
- Mar 24, 2026
Malware in yelp-react-component-photo-upload
1 compromised version
- Mar 24, 2026
Malicious code in server-fpti (npm)
- Mar 24, 2026
Malicious code in nemo-fpti (npm)
- Mar 24, 2026
Malware in nemo-fpti
1 compromised version
- Mar 24, 2026
Malware in f0-service-address-doctor
1 compromised version
- Mar 24, 2026
Malware in server-fpti
1 compromised version
- Mar 24, 2026
Malicious code in customerdigital-ui-components-lib (npm)
- Mar 24, 2026
Malware in corehome
1 compromised version
- Mar 24, 2026
Malware in customerdigital-ui-components-lib
1 compromised version
- Mar 24, 2026
Malicious code in @wame/ngx-frf-utilities (npm)
- Mar 24, 2026
Malicious code in @wame/ngx-adfs (npm)
- Mar 24, 2026
Malicious code in tombac-chronos (npm)
- Mar 24, 2026
Malicious code in @the-coca-cola-company/ngps-global-common-utils (npm)
3 compromised versions
- Mar 24, 2026
Malicious code in @phonos/types (npm)
- Mar 24, 2026
Malicious code in oc-navbar-module-client (npm)
- Mar 24, 2026
Malicious code in oc-ccp-module-client (npm)
- Mar 24, 2026
Malicious code in oc-aa-module-client (npm)
- Mar 24, 2026
Malicious code in ftapi-core (npm)
- Mar 24, 2026
Malicious code in cr-static-shared-components (npm)
2 compromised versions
- Mar 24, 2026
Malicious code in @cloudsop/hmoment (npm)
- Mar 24, 2026
Malicious code in @ceeferenderer/itg-renderer-sdk (npm)
1 compromised version
- Mar 24, 2026
Malicious code in @ceeferenderer/fe-renderer-sdk (npm)
1 compromised version
- Mar 24, 2026
Malicious code in cclr-component-resources (npm)
- Mar 24, 2026
Malicious code in yelp-mobile-site-common (npm)
1 compromised version
- Mar 23, 2026
Malicious code in tailwind-font-inter (npm)
- Mar 23, 2026
Malicious code in react-tailwindcss-style (npm)
- Mar 23, 2026
Malware in react-tailwindcss-style
1 compromised version
- Mar 23, 2026
Malware in tailwind-font-inter
1 compromised version
- Mar 23, 2026
Malicious code in ty-search-suggestion (npm)
- Mar 23, 2026
Malicious code in sidebar-basket (npm)
- Mar 23, 2026
Malicious code in shakti-pwa (npm)
- Mar 23, 2026
Malicious code in pulse-shop-section (npm)
- Mar 23, 2026
Malicious code in pulse-scroll-triggered-list-items (npm)
- Mar 23, 2026
Malicious code in pulse-rsvp-card-entity (npm)
Page 143 of 4,806