Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,301 total in npm · sorted newest first- Mar 16, 2026
Malicious code in typescript-resolvers (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-dev-warning (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-dev (npm)
1 compromised version
- Mar 16, 2026
Malicious code in todo-plz (npm)
1 compromised version
- Mar 16, 2026
Malicious code in syntax-exponentiation-operator (npm)
1 compromised version
- Mar 16, 2026
Malicious code in syntax-decorators (npm)
1 compromised version
- Mar 16, 2026
Malicious code in styled-components-a11y (npm)
1 compromised version
- Mar 16, 2026
Malicious code in require-in-package (npm)
1 compromised version
- Mar 16, 2026
Malicious code in react-you-might-not-need-an-effect (npm)
1 compromised version
- Mar 16, 2026
Malicious code in proposal-typescript (npm)
1 compromised version
- Mar 16, 2026
Malicious code in prefer-let (npm)
1 compromised version
- Mar 16, 2026
Malicious code in peer-deps-external (npm)
1 compromised version
- Mar 16, 2026
Malicious code in no-type-assertion (npm)
1 compromised version
- Mar 16, 2026
Malicious code in monorepo-cop (npm)
1 compromised version
- Mar 16, 2026
Malicious code in minify-mangle-names (npm)
1 compromised version
- Mar 16, 2026
Malicious code in lit-a11y (npm)
1 compromised version
- Mar 16, 2026
Malicious code in jam3 (npm)
1 compromised version
- Mar 16, 2026
Malicious code in import-newlines (npm)
1 compromised version
- Mar 16, 2026
Malicious code in ignore-html-and-css-imports (npm)
1 compromised version
- Mar 16, 2026
Malicious code in filenames-simple (npm)
1 compromised version
- Mar 16, 2026
Malicious code in es6-recommended (npm)
1 compromised version
- Mar 16, 2026
Malicious code in developit (npm)
1 compromised version
- Mar 16, 2026
Malicious code in declaration-block-no-ignored-properties (npm)
1 compromised version
- Mar 16, 2026
Malicious code in vitest-globals (npm)
1 compromised version
- Mar 16, 2026
Malicious code in undeclared-variables-check (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-undefined-to-void (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-simplify-comparison-operators (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-remove-debugger (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-react-jsx (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-property-literals (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-minify-booleans (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-jscript (npm)
1 compromised version
- Mar 16, 2026
Malicious code in transform-jsbi-to-bigint (npm)
1 compromised version
- Mar 16, 2026
Malicious code in minify-replace (npm)
1 compromised version
- Mar 16, 2026
Malicious code in better-styled-components (npm)
1 compromised version
- Mar 16, 2026
Malicious code in @storylane/uikit (npm)
1 compromised version
- Mar 16, 2026
Malicious code in @storylane/shared-packages (npm)
1 compromised version
- Mar 15, 2026
Malware in devlino
1 compromised version
- Mar 15, 2026
Malicious code in @3stripes/common (npm)
1 compromised version
- Mar 15, 2026
Malicious code in @3stripes/helpers (npm)
1 compromised version
- Mar 15, 2026
Malicious code in @3stripes/auth (npm)
1 compromised version
- Mar 15, 2026
Malicious code in @3stripes/api-client (npm)
1 compromised version
- Mar 15, 2026
Malicious code in @3stripes/utils (npm)
1 compromised version
- Mar 15, 2026
Malicious code in @3stripes/ui (npm)
1 compromised version
- Mar 15, 2026
Malicious code in @3stripes/lib (npm)
1 compromised version
- Mar 15, 2026
Malicious code in n8n-nodes-text-helpers (npm)
3 compromised versions
- Mar 14, 2026
Malicious code in tracking-service-config (npm)
1 compromised version
- Mar 14, 2026
Malicious code in test_pkg_forppe (npm)
1 compromised version
- Mar 14, 2026
Malicious code in native_dep (npm)
3 compromised versions
- Mar 13, 2026
Malicious code in devlino (npm)
6 compromised versions
Page 160 of 4,807