Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,293 total in npm · sorted newest first- Mar 18, 2026
Malicious code in player-common-controls (npm)
1 compromised version
- Mar 18, 2026
Malicious code in player-common-composites (npm)
1 compromised version
- Mar 18, 2026
Malicious code in player-button (npm)
1 compromised version
- Mar 18, 2026
Malicious code in plate-playground-template (npm)
1 compromised version
- Mar 18, 2026
Malicious code in pkgnewfefame1 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in pkg1511222 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in phx-core5 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in phx-core4 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in phx-core3 (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in phx-core2 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in phx-core1 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in ph-common (npm)
1 compromised version
- Mar 18, 2026
Malicious code in path-to-regexp-updated (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in paramount-cmp-html5 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in ok-jest-config (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in notification-settings-layout (npm)
3 compromised versions
- Mar 18, 2026
Malicious code in not-remix (npm)
4 compromised versions
- Mar 18, 2026
Malicious code in node-intend (npm)
1 compromised version
- Mar 18, 2026
Malicious code in node-cli-dotenv (npm)
1 compromised version
- Mar 18, 2026
Malicious code in no6gg (npm)
11 compromised versions
- Mar 18, 2026
Malicious code in nicfv (npm)
3 compromised versions
- Mar 18, 2026
Malicious code in nf-cl-logger-test2 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in nf-cl-logger-test (npm)
1 compromised version
- Mar 18, 2026
Malicious code in nextiva-dot-com (npm)
1 compromised version
- Mar 18, 2026
Malicious code in netlify-claude-ai (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in nchain-clone (npm)
1 compromised version
- Mar 18, 2026
Malicious code in my-benefits-web (npm)
3 compromised versions
- Mar 18, 2026
Malicious code in mitel (npm)
1 compromised version
- Mar 18, 2026
Malicious code in metro-evaluator (npm)
4 compromised versions
- Mar 18, 2026
Malicious code in meridix (npm)
1 compromised version
- Mar 18, 2026
Malicious code in manifest-confusion-poc-audit (npm)
1 compromised version
- Mar 18, 2026
Malicious code in loyalty-card (npm)
1 compromised version
- Mar 18, 2026
Malicious code in libxmlrussia2 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in libxmljsololoq (npm)
1 compromised version
- Mar 18, 2026
Malicious code in libxmljs9 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in libxmljs8 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in libxmljs2varkek (npm)
1 compromised version
- Mar 18, 2026
Malicious code in libxmljs2var-ctf (npm)
1 compromised version
- Mar 18, 2026
Malicious code in libxmljs2var (npm)
1 compromised version
- Mar 18, 2026
Malicious code in libxmljs2v2 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in libxmljs2qaz (npm)
1 compromised version
- Mar 18, 2026
Malicious code in libxmljs2as (npm)
1 compromised version
- Mar 18, 2026
Malicious code in libxmljs21471479 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in libxmljs2147147 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in libxmljs2147 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in libxmljs2-malicious (npm)
1 compromised version
- Mar 18, 2026
Malicious code in libxmljs2-1 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in libxmljs13 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in libxmljs12 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in libxmlaboba (npm)
1 compromised version
Page 151 of 4,806