Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,301 total in npm · sorted newest first- Mar 18, 2026
Malicious code in escaux (npm)
1 compromised version
- Mar 18, 2026
Malicious code in es1int-configer (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in ersagent-frontend (npm)
1 compromised version
- Mar 18, 2026
Malicious code in env-workflow-test (npm)
19 compromised versions
- Mar 18, 2026
Malicious code in engineers (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in elf-stats-velvet-ledger-928 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in ehance-assistant33 (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in ehance-assistant (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in dubbo-web-example (npm)
1 compromised version
- Mar 18, 2026
Malicious code in dstny (npm)
1 compromised version
- Mar 18, 2026
Malicious code in dpc-sign (npm)
1 compromised version
- Mar 18, 2026
Malicious code in dotenvx-int (npm)
1 compromised version
- Mar 18, 2026
Malicious code in dotenv-plugin (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in dotenv-nodejs (npm)
1 compromised version
- Mar 18, 2026
Malicious code in dotenv-node-promised (npm)
1 compromised version
- Mar 18, 2026
Malicious code in dotenv-node-cli (npm)
1 compromised version
- Mar 18, 2026
Malicious code in dotenv-mono-cli (npm)
1 compromised version
- Mar 18, 2026
Malicious code in dotenv-int (npm)
1 compromised version
- Mar 18, 2026
Malicious code in dotenv-cli-node (npm)
1 compromised version
- Mar 18, 2026
Malicious code in dnsfilter-frontend (npm)
1 compromised version
- Mar 18, 2026
Malicious code in dns-filter-dashboard (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in dev_ppe-test (npm)
1 compromised version
- Mar 18, 2026
Malicious code in ddddddd1d (npm)
73 compromised versions
- Mar 18, 2026
Malicious code in dazz-redirects (npm)
69 compromised versions
- Mar 18, 2026
Malicious code in date-fns-scripts (npm)
1 compromised version
- Mar 18, 2026
Malicious code in dataterminal-ui (npm)
1 compromised version
- Mar 18, 2026
Malicious code in d4sp (npm)
1 compromised version
- Mar 18, 2026
Malicious code in corp-sign-core-js (npm)
3 compromised versions
- Mar 18, 2026
Malicious code in corp-internal-logger (npm)
3 compromised versions
- Mar 18, 2026
Malicious code in constant-values (npm)
1 compromised version
- Mar 18, 2026
Malicious code in connect-me-icon (npm)
1 compromised version
- Mar 18, 2026
Malicious code in conduit-core (npm)
1 compromised version
- Mar 18, 2026
Malicious code in components-design-system (npm)
1 compromised version
- Mar 18, 2026
Malicious code in company-billing-sdk-bugbounty (npm)
1 compromised version
- Mar 18, 2026
Malicious code in collabs-merchants (npm)
3 compromised versions
- Mar 18, 2026
Malicious code in coinbase-desktop-sdk (npm)
5 compromised versions
- Mar 18, 2026
Malicious code in circuit-playground (npm)
3 compromised versions
- Mar 18, 2026
Malicious code in chromecast-receiver (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in chain-promised-cli (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chain-promised-async (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chain-promised (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chain-cli-promised (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chain-argon (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chai-types (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chai-proxy (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in chai-promised-tools (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chai-promised-plugin (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chai-promised-cli (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chai-promised-await (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chai-promised-async (npm)
2 compromised versions
Page 153 of 4,807