Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,301 total in npm · sorted newest first- Mar 18, 2026
Malicious code in chai-conf (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chai-cli-async (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chai-chai-chain-promised (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chai-await-promised (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chai-await-cli (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chai-await-chain (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in chai-as-sync (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chai-as-resolved (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chai-as-prop (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chai-as-prompt (npm)
1 compromised version
- Mar 18, 2026
Malicious code in chai-as-produced (npm)
1 compromised version
- Mar 18, 2026
Malicious code in cat-ecommerce-alloy (npm)
1 compromised version
- Mar 18, 2026
Malicious code in carbon-mac-copy-cloner (npm)
12 compromised versions
- Mar 18, 2026
Malicious code in browser-compat-data (npm)
1 compromised version
- Mar 18, 2026
Malicious code in brisk-web-ssr (npm)
1 compromised version
- Mar 18, 2026
Malicious code in braze-content-card-island (npm)
3 compromised versions
- Mar 18, 2026
Malicious code in blob-internal-security-test-f63eabf7 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in blackstone-core (npm)
1 compromised version
- Mar 18, 2026
Malicious code in bis-schemas (npm)
1 compromised version
- Mar 18, 2026
Malicious code in bcp-security-updates (npm)
1 compromised version
- Mar 18, 2026
Malicious code in bcp-security-update (npm)
1 compromised version
- Mar 18, 2026
Malicious code in backstage-plugin-wpe-catalog (npm)
1 compromised version
- Mar 18, 2026
Malicious code in argonnode (npm)
1 compromised version
- Mar 18, 2026
Malicious code in aligntyper (npm)
1 compromised version
- Mar 18, 2026
Malicious code in aligntypeer (npm)
1 compromised version
- Mar 18, 2026
Malicious code in align-configer (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in alfasec (npm)
8 compromised versions
- Mar 18, 2026
Malicious code in ai-fast-auto-trader (npm)
6 compromised versions
- Mar 18, 2026
Malicious code in advertising-shared (npm)
3 compromised versions
- Mar 18, 2026
Malicious code in advertising-podlet (npm)
3 compromised versions
- Mar 18, 2026
Malicious code in advertising-events (npm)
3 compromised versions
- Mar 18, 2026
Malicious code in adobe-tracking (npm)
1 compromised version
- Mar 18, 2026
Malicious code in abstract-http-request (npm)
3 compromised versions
- Mar 18, 2026
Malicious code in aboba-initial (npm)
1 compromised version
- Mar 18, 2026
Malicious code in aboba-docker-check (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @vampirchik147/libxmljs2 (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @upstashed/context7-mcp (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @uc-platform/user-service-client-ts (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @uc-platform/auth (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @uc-platform/advertisement-service-client (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @tl-icons/core (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @spot-dapp/web (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @sommos/create-leaverule-or-terminationrule-form-data (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @polymarket-developers/clob-client (npm)
5 compromised versions
- Mar 18, 2026
Malicious code in @panopto/api-core (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @nxt-costco-com/forge-icons (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @nxt-costco-com/forge-design-tokens (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @nxt-costco-com/forge-components (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @measures/responsive (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @legacy-utils/core (npm)
1 compromised version
Page 154 of 4,807