Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,307 total in npm · sorted newest first- Mar 2, 2026
Malicious code in @nazi-team/baileys (npm)
- Mar 2, 2026
Malware in @nazi-team/baileys
1 compromised version
- Mar 2, 2026
Malware in @nazi-team/libsignal-node
1 compromised version
- Mar 2, 2026
Malware in colorize-console
1 compromised version
- Mar 2, 2026
Malicious code in @sanzxcode/libsignal-node (npm)
- Mar 2, 2026
Malicious code in @sanzxcode/baileys (npm)
- Mar 2, 2026
Malware in @sanzxcode/libsignal-node
1 compromised version
- Mar 2, 2026
Malware in @sanzxcode/baileys
1 compromised version
- Mar 2, 2026
Malicious code in @daffadeveloper/libsignal-node (npm)
- Mar 2, 2026
Malicious code in @daffadeveloper/baileys (npm)
- Mar 2, 2026
Malware in @daffadeveloper/libsignal-node
1 compromised version
- Mar 2, 2026
Malware in @daffadeveloper/baileys
1 compromised version
- Mar 2, 2026
Malicious code in yuji-baileys (npm)
- Mar 2, 2026
Malicious code in sukuna-baileys (npm)
- Mar 2, 2026
Malicious code in ngaturkids (npm)
- Mar 2, 2026
Malicious code in danzxz (npm)
- Mar 2, 2026
Malware in yuji-baileys
1 compromised version
- Mar 2, 2026
Malware in sukuna-baileys
1 compromised version
- Mar 2, 2026
Malware in ngaturkids
1 compromised version
- Mar 2, 2026
Malware in danzxz
1 compromised version
- Mar 2, 2026
Malicious code in kazumarii (npm)
- Mar 2, 2026
Malware in kazumarii
1 compromised version
- Mar 2, 2026
Malicious code in ts-big-number (npm)
- Mar 2, 2026
Malicious code in npm-doc-builder (npm)
- Mar 2, 2026
Malware in npm-doc-builder
1 compromised version
- Mar 2, 2026
Malware in ts-big-number
1 compromised version
- Mar 2, 2026
Malicious code in @yaoii-bails/yaoii-baileys (npm)
- Mar 2, 2026
Malicious code in @yaoii-bails/socket (npm)
- Mar 2, 2026
Malicious code in @yaoii-bails/libsignall-node (npm)
- Mar 2, 2026
Malicious code in @yaoii-bails/libsignal-node (npm)
- Mar 2, 2026
Malicious code in @yaoii-bails/baileys (npm)
- Mar 2, 2026
Malware in @yaoii-bails/yaoii-baileys
1 compromised version
- Mar 2, 2026
Malware in @yaoii-bails/libsignall-node
1 compromised version
- Mar 2, 2026
Malware in @yaoii-bails/baileys
1 compromised version
- Mar 2, 2026
Malware in @yaoii-bails/socket
1 compromised version
- Mar 2, 2026
Malware in @yaoii-bails/libsignal-node
1 compromised version
- Mar 2, 2026
Malicious code in chai-vest (npm)
- Mar 2, 2026
Malware in chai-vest
1 compromised version
- Mar 2, 2026
Malicious code in js-nodecat (npm)
1 compromised version
- Mar 2, 2026
Malware in js-nodecat
1 compromised version
- Mar 2, 2026
Malware in ether-lint
1 compromised version
- Mar 2, 2026
Malicious code in hapi-lint (npm)
- Mar 2, 2026
Malware in hapi-lint
1 compromised version
- Mar 2, 2026
Malicious code in bcryptance (npm)
- Mar 2, 2026
Malware in bcryptance
1 compromised version
- Mar 2, 2026
Malware in uuindex
1 compromised version
- Mar 2, 2026
Malicious code in argonist (npm)
- Mar 2, 2026
Malware in argonist
1 compromised version
- Mar 2, 2026
Malicious code in typoriem (npm)
- Mar 2, 2026
Malware in typoriem
1 compromised version
Page 170 of 4,807