Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,301 total in npm · sorted newest first- Mar 10, 2026
Malware in monoping
1 compromised version
- Mar 9, 2026
Malicious code in jsonify-core (npm)
1 compromised version
- Mar 9, 2026
Malicious code in json-merge-tool (npm)
1 compromised version
- Mar 9, 2026
Malware in json-merge-tool
1 compromised version
- Mar 9, 2026
Malware in jsonify-core
1 compromised version
- Mar 9, 2026
Malicious code in tw-modern-ui (npm)
- Mar 9, 2026
Malicious code in odds-analyzer (npm)
- Mar 9, 2026
Malware in tw-modern-ui
1 compromised version
- Mar 9, 2026
Malware in odds-analyzer
1 compromised version
- Mar 6, 2026
Malicious code in qq-console (npm)
- Mar 6, 2026
Malware in qq-console
1 compromised version
- Mar 6, 2026
Malicious code in @wgu-edu/wgu-icons (npm)
- Mar 6, 2026
Malicious code in @wgu-edu/wgu-core (npm)
- Mar 6, 2026
Malware in @wgu-edu/wgu-icons
1 compromised version
- Mar 6, 2026
Malware in @wgu-edu/wgu-core
1 compromised version
- Mar 6, 2026
Malicious code in @shenira/libsignal-node (npm)
- Mar 6, 2026
Malicious code in @shenira/baileysx (npm)
- Mar 6, 2026
Malicious code in @shenira/baileys (npm)
- Mar 6, 2026
Malware in @shenira/libsignal-node
1 compromised version
- Mar 6, 2026
Malware in @shenira/baileys
1 compromised version
- Mar 6, 2026
Malware in @shenira/baileysx
1 compromised version
- Mar 6, 2026
Malicious code in test-mal-npm-pkg-not-local (npm)
1 compromised version
- Mar 6, 2026
Malicious code in test-mal-npm-pkg-local (npm)
1 compromised version
- Mar 6, 2026
Malicious code in test-mal-npm-pkg-2 (npm)
- Mar 6, 2026
Malware in test-mal-npm-pkg-2
1 compromised version
- Mar 6, 2026
Malware in test-mal-npm-pkg-local
1 compromised version
- Mar 6, 2026
Malware in test-mal-npm-pkg-not-local
1 compromised version
- Mar 6, 2026
Malicious code in aaaaaxxxxx (npm)
1 compromised version
- Mar 6, 2026
Malware in aaaaaxxxxx
1 compromised version
- Mar 6, 2026
Malware in dc-web-app
1 compromised version
- Mar 6, 2026
Malicious code in webmd-url (npm)
- Mar 6, 2026
Malicious code in pino-sdk-v2 (npm)
1 compromised version
- Mar 6, 2026
Malicious code in tether-dev-docs (npm)
- Mar 6, 2026
Malware in tether-dev-docs
1 compromised version
- Mar 5, 2026
Malicious code in pdfjs-dist-fourth (npm)
1 compromised version
- Mar 5, 2026
Malicious code in @imhuman/corp-build-utils-poc (npm)
2 compromised versions
- Mar 5, 2026
Malware in @imhuman/corp-build-utils-poc
1 compromised version
- Mar 5, 2026
Malicious code in imhuman-fw-logger (npm)
- Mar 5, 2026
Malicious code in @imhuman/fw-logger (npm)
- Mar 5, 2026
Malware in imhuman-fw-logger
1 compromised version
- Mar 5, 2026
Malware in @imhuman/fw-logger
1 compromised version
- Mar 5, 2026
Malicious code in pear-apps-lib-ui-react-hooks (npm)
- Mar 5, 2026
Malware in pear-apps-lib-ui-react-hooks
1 compromised version
- Mar 5, 2026
Malicious code in pear-apps-utils-avatar-initials (npm)
- Mar 5, 2026
Malware in pear-apps-utils-avatar-initials
1 compromised version
- Mar 5, 2026
Malicious code in pear-apps-utils-date (npm)
- Mar 5, 2026
Malware in pear-apps-utils-date
1 compromised version
- Mar 5, 2026
Malicious code in pear-apps-utils-qr (npm)
- Mar 5, 2026
Malware in pear-apps-utils-qr
1 compromised version
- Mar 5, 2026
Malicious code in pearpass-lib-data-export (npm)
Page 165 of 4,807