Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
239,996 total in npm · sorted newest first- Jul 7, 2026
Malicious code in sitefinitywebapp (npm)
1 compromised version
- Jul 7, 2026
Malicious code in sim-apis-chatbot (npm)
1 compromised version
- Jul 7, 2026
Malicious code in shiphero-dashboard (npm)
1 compromised version
- Jul 7, 2026
Malicious code in serverless-twi-testing (npm)
1 compromised version
- Jul 7, 2026
Malicious code in rzeactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in ryeactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rxeactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rweactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rveactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rueactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rteactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rseactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rreactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rqeactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rpeactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in roeactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in roblox-lua-promise (npm)
1 compromised version
- Jul 7, 2026
Malicious code in rngularjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rneactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rn-bitu-user (npm)
1 compromised version
- Jul 7, 2026
Malicious code in rn-bitu (npm)
1 compromised version
- Jul 7, 2026
Malicious code in rmeactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rleactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rkeactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rjeactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rieactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rheactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rgeactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rfeactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rezactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rewactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in revactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reuactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in retactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in resource-library-engine (npm)
1 compromised version
- Jul 7, 2026
Malicious code in resolve-uri-internal (npm)
1 compromised version
- Jul 7, 2026
Malicious code in resactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in remactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reiactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rei-internal-logger (npm)
2 compromised versions
- Jul 7, 2026
Malicious code in regactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reeactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rebactjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reayctjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reavctjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reauctjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reatctjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in rearctjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in reamctjs (npm)
3 compromised versions
- Jul 7, 2026
Malicious code in realtime-voice-component (npm)
1 compromised version
Page 16 of 4,800