Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,301 total in npm · sorted newest first- Mar 18, 2026
Malware in transform-for-of
1 compromised version
- Mar 18, 2026
Malware in transform-new-target
1 compromised version
- Mar 18, 2026
Malware in transform-typescript
1 compromised version
- Mar 18, 2026
Malware in transform-es2015-shorthand-properties
1 compromised version
- Mar 18, 2026
Malware in transform-es2015-parameters
1 compromised version
- Mar 18, 2026
Malware in add-react-displayname
1 compromised version
- Mar 18, 2026
Malware in transform-member-expression-literals
1 compromised version
- Mar 18, 2026
Malware in transform-proto-to-assign
1 compromised version
- Mar 18, 2026
Malware in transform-function-bind
1 compromised version
- Mar 18, 2026
Malware in syntax-async-generators
1 compromised version
- Mar 18, 2026
Malware in transform-es2015-spread
1 compromised version
- Mar 18, 2026
Malware in transform-export-extensions
1 compromised version
- Mar 18, 2026
Malware in transform-es2015-duplicate-keys
1 compromised version
- Mar 18, 2026
Malware in syntax-export-extensions
1 compromised version
- Mar 18, 2026
Malware in syntax-class-constructor-call
1 compromised version
- Mar 18, 2026
Malware in syntax-do-expressions
1 compromised version
- Mar 18, 2026
Malware in syntax-function-bind
1 compromised version
- Mar 18, 2026
Malware in dazaar-payment
1 compromised version
- Mar 18, 2026
Malware in dazaar-cli
1 compromised version
- Mar 18, 2026
Malware in pear-wrk-wdk
1 compromised version
- Mar 18, 2026
Malware in typescript-nhost
1 compromised version
- Mar 18, 2026
Malware in yoshi-base
1 compromised version
- Mar 18, 2026
Malware in typescript-validation-schema
1 compromised version
- Mar 18, 2026
Malware in typescript-react-query
1 compromised version
- Mar 18, 2026
Malware in typescript-vue-apollo-smart-ops
1 compromised version
- Mar 18, 2026
Malicious code in bugbounty-test-123 (npm)
1 compromised version
- Mar 18, 2026
Malware in relay-optimizer-plugin
1 compromised version
- Mar 18, 2026
Malware in urql-introspection
1 compromised version
- Mar 18, 2026
Malware in typescript-type-graphql
1 compromised version
- Mar 18, 2026
Malware in typescript-rtk-query
1 compromised version
- Mar 18, 2026
Malware in typescript-resolvers
1 compromised version
- Mar 18, 2026
Malware in ignore-html-and-css-imports
1 compromised version
- Mar 18, 2026
Malware in transform-dev-warning
1 compromised version
- Mar 18, 2026
Malware in transform-dev
1 compromised version
- Mar 18, 2026
Malware in es6-recommended
1 compromised version
- Mar 18, 2026
Malware in minify-mangle-names
1 compromised version
- Mar 18, 2026
Malware in developit
1 compromised version
- Mar 18, 2026
Malware in syntax-decorators
1 compromised version
- Mar 18, 2026
Malware in syntax-exponentiation-operator
1 compromised version
- Mar 18, 2026
Malware in prefer-let
1 compromised version
- Mar 18, 2026
Malware in jam3
1 compromised version
- Mar 18, 2026
Malware in declaration-block-no-ignored-properties
1 compromised version
- Mar 18, 2026
Malware in peer-deps-external
1 compromised version
- Mar 18, 2026
Malware in import-newlines
1 compromised version
- Mar 18, 2026
Malware in react-you-might-not-need-an-effect
1 compromised version
- Mar 18, 2026
Malware in require-in-package
1 compromised version
- Mar 18, 2026
Malware in filenames-simple
1 compromised version
- Mar 18, 2026
Malware in proposal-typescript
1 compromised version
- Mar 18, 2026
Malware in monorepo-cop
1 compromised version
- Mar 18, 2026
Malware in todo-plz
1 compromised version
Page 156 of 4,807