Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,293 total in npm · sorted newest first- Mar 22, 2026
Malicious code in @emilgroup/notification-sdk-node (npm)
2 compromised versions
- Mar 22, 2026
Malware in @emilgroup/notification-sdk-node
1 compromised version
- Mar 22, 2026
Malicious code in @emilgroup/public-api-sdk (npm)
2 compromised versions
- Mar 22, 2026
Malware in @emilgroup/public-api-sdk
1 compromised version
- Mar 22, 2026
Malicious code in @emilgroup/accounting-sdk-node (npm)
2 compromised versions
- Mar 22, 2026
Malware in @emilgroup/accounting-sdk-node
1 compromised version
- Mar 22, 2026
Malicious code in @emilgroup/payment-sdk (npm)
2 compromised versions
- Mar 22, 2026
Malware in @emilgroup/payment-sdk
1 compromised version
- Mar 22, 2026
Malicious code in @emilgroup/billing-sdk-node (npm)
2 compromised versions
- Mar 22, 2026
Malware in @emilgroup/billing-sdk-node
1 compromised version
- Mar 22, 2026
Malicious code in @emilgroup/payment-sdk-node (npm)
2 compromised versions
- Mar 22, 2026
Malware in @emilgroup/payment-sdk-node
1 compromised version
- Mar 22, 2026
Malicious code in @emilgroup/insurance-sdk (npm)
5 compromised versions
- Mar 22, 2026
Malware in @emilgroup/insurance-sdk
1 compromised version
- Mar 22, 2026
Malicious code in @emilgroup/customer-sdk-node (npm)
2 compromised versions
- Mar 22, 2026
Malware in @emilgroup/customer-sdk-node
1 compromised version
- Mar 22, 2026
Malicious code in @emilgroup/customer-sdk (npm)
5 compromised versions
- Mar 22, 2026
Malware in @emilgroup/customer-sdk
1 compromised version
- Mar 22, 2026
Malicious code in @emilgroup/claim-sdk (npm)
2 compromised versions
- Mar 22, 2026
Malware in @emilgroup/claim-sdk
1 compromised version
- Mar 22, 2026
Malicious code in eslint-config-ppf (npm)
1 compromised version
- Mar 22, 2026
Malware in eslint-config-ppf
1 compromised version
- Mar 22, 2026
Malicious code in @emilgroup/gdv-sdk-node (npm)
3 compromised versions
- Mar 22, 2026
Malware in @emilgroup/gdv-sdk-node
1 compromised version
- Mar 22, 2026
Malicious code in react-leaflet-heatmap-layer (npm)
1 compromised version
- Mar 22, 2026
Malware in react-leaflet-heatmap-layer
1 compromised version
- Mar 22, 2026
Malicious code in react-leaflet-cluster-layer (npm)
1 compromised version
- Mar 22, 2026
Malware in react-leaflet-cluster-layer
1 compromised version
- Mar 22, 2026
Malicious code in @opengov/ppf-eslint-config (npm)
1 compromised version
- Mar 22, 2026
Malware in @opengov/ppf-eslint-config
1 compromised version
- Mar 22, 2026
Malicious code in @emilgroup/auth-sdk (npm)
2 compromised versions
- Mar 22, 2026
Malware in @emilgroup/auth-sdk
1 compromised version
- Mar 22, 2026
Malicious code in @emilgroup/accounting-sdk (npm)
3 compromised versions
- Mar 22, 2026
Malware in @emilgroup/accounting-sdk
1 compromised version
- Mar 22, 2026
Malicious code in @emilgroup/account-sdk (npm)
2 compromised versions
- Mar 22, 2026
Malware in @emilgroup/account-sdk
1 compromised version
- Mar 22, 2026
Malicious code in babel-plugin-react-pure-component (npm)
1 compromised version
- Mar 22, 2026
Malware in babel-plugin-react-pure-component
1 compromised version
- Mar 22, 2026
Malicious code in @pypestream/floating-ui-dom (npm)
1 compromised version
- Mar 22, 2026
Malware in @pypestream/floating-ui-dom
1 compromised version
- Mar 22, 2026
Malicious code in opengov-k6-core (npm)
1 compromised version
- Mar 22, 2026
Malware in opengov-k6-core
1 compromised version
- Mar 22, 2026
Malicious code in remitly-blog (npm)
1 compromised version
- Mar 22, 2026
Malicious code in @mesh-helpers/themehelper (npm)
1 compromised version
- Mar 22, 2026
Malicious code in @mesh-components/card (npm)
1 compromised version
- Mar 22, 2026
Malicious code in @mesh-components/customthemeprovider (npm)
1 compromised version
- Mar 22, 2026
Malicious code in @mesh-helpers/common (npm)
1 compromised version
- Mar 21, 2026
Malicious code in @modals/blockchain (npm)
2 compromised versions
- Mar 21, 2026
Malicious code in @modals/layout (npm)
2 compromised versions
- Mar 21, 2026
Malicious code in lingewindows (npm)
1 compromised version
Page 146 of 4,806