Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,301 total in npm · sorted newest first- Mar 16, 2026
Malicious code in @omhc/libsignal-node (npm)
- Mar 16, 2026
Malware in omhcsilence-bails
1 compromised version
- Mar 16, 2026
Malware in @omhc/libsignal-node
1 compromised version
- Mar 16, 2026
Malicious code in vtimmmmmm-test (npm)
- Mar 16, 2026
Malicious code in @vtim/xss-poc (npm)
- Mar 16, 2026
Malware in vtimmmmmm-test
1 compromised version
- Mar 16, 2026
Malware in @vtim/xss-poc
1 compromised version
- Mar 16, 2026
Malicious code in nest-moralis (npm)
4 compromised versions
- Mar 16, 2026
Malware in nest-moralis
1 compromised version
- Mar 16, 2026
Malware in spectral-corsair-my-backdoor
1 compromised version
- Mar 16, 2026
Malware in spectral-corsair-navigator
1 compromised version
- Mar 16, 2026
Malicious code in up2-daemon (npm)
- Mar 16, 2026
Malware in up2-daemon
1 compromised version
- Mar 16, 2026
Malicious code in transform-regexp-constructors (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-typescript (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-spread (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-proto-to-assign (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-new-target (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-modules-systemjs (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-member-expression-literals (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-json-strings (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-inline-consecutive-adds (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-function-bind (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-for-of (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-export-extensions (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-es2015-spread (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-es2015-shorthand-properties (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-es2015-parameters (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-es2015-duplicate-keys (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-dynamic-import (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-charcodes (npm)
1 compromised version
- Mar 16, 2026
Malicious code in syntax-async-generators (npm)
1 compromised version
- Mar 16, 2026
Malicious code in add-react-displayname (npm)
3 compromised versions
- Mar 16, 2026
Malicious code in yoshi-base (npm)
1 compromised version
- Mar 16, 2026
Malicious code in typescript-vue-apollo-smart-ops (npm)
1 compromised version
- Mar 16, 2026
Malicious code in typescript-validation-schema (npm)
1 compromised version
- Mar 16, 2026
Malicious code in typescript-react-query (npm)
1 compromised version
- Mar 16, 2026
Malicious code in typescript-nhost (npm)
1 compromised version
- Mar 16, 2026
Malicious code in syntax-function-bind (npm)
1 compromised version
- Mar 16, 2026
Malicious code in syntax-export-extensions (npm)
1 compromised version
- Mar 16, 2026
Malicious code in syntax-do-expressions (npm)
1 compromised version
- Mar 16, 2026
Malicious code in syntax-class-constructor-call (npm)
1 compromised version
- Mar 16, 2026
Malicious code in pear-wrk-wdk (npm)
1 compromised version
- Mar 16, 2026
Malicious code in dazaar-payment (npm)
1 compromised version
- Mar 16, 2026
Malicious code in dazaar-cli (npm)
1 compromised version
- Mar 16, 2026
Malicious code in urql-introspection (npm)
1 compromised version
- Mar 16, 2026
Malicious code in typescript-type-graphql (npm)
1 compromised version
- Mar 16, 2026
Malicious code in relay-optimizer-plugin (npm)
1 compromised version
- Mar 16, 2026
Malicious code in vue-scoped-css (npm)
1 compromised version
- Mar 16, 2026
Malicious code in typescript-rtk-query (npm)
1 compromised version
Page 159 of 4,807