Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,301 total in npm · sorted newest first- Mar 18, 2026
Malicious code in @legacy-ui/core (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @legacy-components/core (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @kui-react/table (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @kui-react/button (npm)
3 compromised versions
- Mar 18, 2026
Malicious code in @inter-ikea-gallery/integration (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @f5rest/odata-v4-service-metadata (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @f5rest/odata-v4-server (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @f5rest/odata-v4-parser (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @f5rest/odata-v4-metadata (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @f5rest/odata-v4-inmemory (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @f5rest/odata-lens (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @f5rest/icr-odata-adapter (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @f5rest/icr-metadata-generator (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @emerald-react/menu (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/list (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/label (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/input (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/icon-button (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/icon (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/ellis-ai-icon (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/dropdown (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/divider (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/datepicker (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/data-table (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/core (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/checkbox (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/chat-bot (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/button (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/banner (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/badge (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/avatar (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/autocomplete (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @emerald-react/app-header (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @commonschema/blackstone-core (npm)
8 compromised versions
- Mar 18, 2026
Malicious code in @cewe-onsitesearch/schemas (npm)
4 compromised versions
- Mar 18, 2026
Malicious code in @cbreone/utilities (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @cbreone/survey-ui (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @cbreone/micro-ui-survey (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @cbreone/core-ui (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @cbreone/core-services (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @bingads-webui-help/apex.core.v3.min (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @bingads-webui-cc-react/edit-primary-contact (npm)
1 compromised version
- Mar 18, 2026
Malicious code in @at-point/valiant-widgets-v2 (npm)
2 compromised versions
- Mar 18, 2026
Malicious code in @anchor-ds/core (npm)
1 compromised version
- Mar 18, 2026
Malware in transform-modules-systemjs
1 compromised version
- Mar 18, 2026
Malware in transform-dynamic-import
1 compromised version
- Mar 18, 2026
Malware in transform-json-strings
1 compromised version
- Mar 18, 2026
Malware in transform-spread
1 compromised version
- Mar 18, 2026
Malware in transform-inline-consecutive-adds
1 compromised version
- Mar 18, 2026
Malware in transform-charcodes
1 compromised version
Page 155 of 4,807