Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,293 total in npm · sorted newest first- Mar 20, 2026
Malicious code in fadlsjf (npm)
5 compromised versions
- Mar 20, 2026
Malware in fadlsjf
1 compromised version
- Mar 20, 2026
Malicious code in el-icon (npm)
3 compromised versions
- Mar 20, 2026
Malware in el-icon
1 compromised version
- Mar 20, 2026
Malicious code in mtpmysql (npm)
- Mar 20, 2026
Malware in mtpmysql
1 compromised version
- Mar 20, 2026
Malicious code in mtpdb (npm)
- Mar 20, 2026
Malware in mtpdb
1 compromised version
- Mar 20, 2026
Malicious code in safe-json-parsex (npm)
1 compromised version
- Mar 20, 2026
Malicious code in parsejson-pro (npm)
1 compromised version
- Mar 20, 2026
Malware in safe-json-parsex
1 compromised version
- Mar 20, 2026
Malware in parsejson-pro
1 compromised version
- Mar 20, 2026
Malicious code in nodex-db (npm)
3 compromised versions
- Mar 20, 2026
Malicious code in node-business (npm)
5 compromised versions
- Mar 20, 2026
Malware in node-business
1 compromised version
- Mar 20, 2026
Malware in nodex-db
1 compromised version
- Mar 20, 2026
Malicious code in rollup-plugin-polyfill-build (npm)
- Mar 20, 2026
Malware in rollup-plugin-polyfill-build
1 compromised version
- Mar 20, 2026
Malicious code in hackerhacker (npm)
1 compromised version
- Mar 20, 2026
Malware in hackerhacker
1 compromised version
- Mar 20, 2026
Malicious code in trex-proxy-browser-extension-sdk (npm)
- Mar 20, 2026
Malware in trex-proxy-browser-extension-sdk
1 compromised version
- Mar 20, 2026
Malicious code in spstargm (npm)
2 compromised versions
- Mar 20, 2026
Malware in spstargm
1 compromised version
- Mar 20, 2026
Malicious code in llmstash (npm)
- Mar 20, 2026
Malware in llmstash
1 compromised version
- Mar 20, 2026
Malicious code in pretty-loggers (npm)
- Mar 20, 2026
Malicious code in polymarket-onchain (npm)
- Mar 20, 2026
Malicious code in decode-sdk (npm)
- Mar 20, 2026
Malicious code in clob-client-sdks (npm)
- Mar 20, 2026
Malicious code in @validates-sdk/v3 (npm)
2 compromised versions
- Mar 20, 2026
Malicious code in @solana-launchpads/sdk (npm)
- Mar 20, 2026
Malicious code in @metaplex-foundations/umi-public-keys (npm)
3 compromised versions
- Mar 20, 2026
Malware in polymarket-onchain
1 compromised version
- Mar 20, 2026
Malware in @solana-launchpads/sdk
1 compromised version
- Mar 20, 2026
Malware in clob-client-sdks
1 compromised version
- Mar 20, 2026
Malware in decode-sdk
1 compromised version
- Mar 20, 2026
Malware in @validates-sdk/v3
1 compromised version
- Mar 20, 2026
Malware in pretty-loggers
1 compromised version
- Mar 20, 2026
Malware in @metaplex-foundations/umi-public-keys
1 compromised version
- Mar 20, 2026
Malicious code in @dotprompt/promptly-darwin-arm64 (npm)
- Mar 20, 2026
Malware in @dotprompt/promptly-darwin-arm64
1 compromised version
- Mar 20, 2026
Malicious code in pretty-ts-logger (npm)
- Mar 20, 2026
Malicious code in clob-utils-sdks (npm)
- Mar 20, 2026
Malicious code in client-hash-sdk (npm)
- Mar 20, 2026
Malware in clob-utils-sdks
1 compromised version
- Mar 20, 2026
Malware in client-hash-sdk
1 compromised version
- Mar 20, 2026
Malware in pretty-ts-logger
1 compromised version
- Mar 20, 2026
Malicious code in wildhunter (npm)
- Mar 20, 2026
Malware in wildhunter
1 compromised version
Page 148 of 4,806