Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,301 total in npm · sorted newest first- Mar 3, 2026
Malicious code in mvn-runtime (npm)
2 compromised versions
- Mar 3, 2026
Malware in mvn-runtime
1 compromised version
- Mar 3, 2026
Malicious code in tailwindcss-form-bundler (npm)
- Mar 3, 2026
Malicious code in alpha-replicator (npm)
- Mar 3, 2026
Malware in tailwindcss-form-bundler
1 compromised version
- Mar 3, 2026
Malware in alpha-replicator
1 compromised version
- Mar 3, 2026
Malicious code in tailwindcss-fonts-bundler (npm)
- Mar 3, 2026
Malware in tailwindcss-fonts-bundler
1 compromised version
- Mar 3, 2026
Malicious code in tailwindcss-forms-animation (npm)
- Mar 3, 2026
Malicious code in polygon-bitquery-api (npm)
- Mar 3, 2026
Malicious code in mongos-api (npm)
- Mar 3, 2026
Malicious code in mongoose-apis (npm)
- Mar 3, 2026
Malicious code in cloud-apis (npm)
- Mar 3, 2026
Malware in cloud-apis
1 compromised version
- Mar 3, 2026
Malware in mongoose-apis
1 compromised version
- Mar 3, 2026
Malware in tailwindcss-forms-animation
1 compromised version
- Mar 3, 2026
Malware in mongos-api
1 compromised version
- Mar 3, 2026
Malware in polygon-bitquery-api
1 compromised version
- Mar 3, 2026
Malicious code in turbo-json-parser (npm)
- Mar 3, 2026
Malware in turbo-json-parser
1 compromised version
- Mar 3, 2026
Malicious code in typescript-constructors (npm)
- Mar 3, 2026
Malicious code in tailwindcss-forms-componentes (npm)
- Mar 3, 2026
Malicious code in tailwindcss-forms-component (npm)
- Mar 3, 2026
Malware in typescript-constructors
1 compromised version
- Mar 3, 2026
Malware in tailwindcss-forms-componentes
1 compromised version
- Mar 3, 2026
Malware in tailwindcss-forms-component
1 compromised version
- Mar 3, 2026
Malicious code in bubblemap-bypass-sdk (npm)
- Mar 3, 2026
Malware in bubblemap-bypass-sdk
1 compromised version
- Mar 3, 2026
Malicious code in selfbot-lofy (npm)
- Mar 3, 2026
Malicious code in consolelofy (npm)
- Mar 3, 2026
Malware in consolelofy
1 compromised version
- Mar 3, 2026
Malware in selfbot-lofy
1 compromised version
- Mar 3, 2026
Malicious code in bmath (npm)
- Mar 3, 2026
Malware in bmath
1 compromised version
- Mar 3, 2026
Malicious code in @powpegtest/powpeg (npm)
- Mar 3, 2026
Malware in @powpegtest/powpeg
1 compromised version
- Mar 3, 2026
Malicious code in demo-ip-package-cm (npm)
2 compromised versions
- Mar 3, 2026
Malicious code in demo-ip-package (npm)
3 compromised versions
- Mar 3, 2026
Malware in demo-ip-package-cm
1 compromised version
- Mar 3, 2026
Malware in demo-ip-package
1 compromised version
- Mar 3, 2026
Malware in monkey-tags
1 compromised version
- Mar 3, 2026
Malicious code in flycord (npm)
8 compromised versions
- Mar 3, 2026
Malware in flycord
1 compromised version
- Mar 3, 2026
Malware in ably-forks
1 compromised version
- Mar 3, 2026
Malicious code in fps-logger (npm)
1 compromised version
- Mar 3, 2026
Malicious code in @twilio-client/twilio-client (npm)
2 compromised versions
- Mar 3, 2026
Malicious code in @bookings.microsoft.com/s (npm)
- Mar 3, 2026
Malware in @twilio-client/twilio-client
1 compromised version
- Mar 3, 2026
Malware in @bookings.microsoft.com/s
1 compromised version
- Mar 3, 2026
Malware in fps-logger
1 compromised version
Page 167 of 4,807