Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,307 total in npm · sorted newest first- Feb 27, 2026
Malware in sokettry
1 compromised version
- Feb 27, 2026
Malicious code in libsignal-skyzopedia (npm)
- Feb 27, 2026
Malicious code in @skyzopedia/ubot (npm)
- Feb 27, 2026
Malicious code in @skyzopedia/libsignal-node (npm)
- Feb 27, 2026
Malicious code in @skyzopedia/brat (npm)
- Feb 27, 2026
Malicious code in @skyzopedia/baileys-pro (npm)
- Feb 27, 2026
Malicious code in @skyzopedia/baileys-mod (npm)
- Feb 27, 2026
Malicious code in @skyzopedia/baileys (npm)
- Feb 27, 2026
Malware in @skyzopedia/brat
1 compromised version
- Feb 27, 2026
Malware in @skyzopedia/ubot
1 compromised version
- Feb 27, 2026
Malware in @skyzopedia/baileys-mod
1 compromised version
- Feb 27, 2026
Malware in libsignal-skyzopedia
1 compromised version
- Feb 27, 2026
Malware in @skyzopedia/libsignal-node
1 compromised version
- Feb 27, 2026
Malware in @skyzopedia/baileys-pro
1 compromised version
- Feb 27, 2026
Malware in @skyzopedia/baileys
1 compromised version
- Feb 27, 2026
Malicious code in @zinley/orion (npm)
6 compromised versions
- Feb 27, 2026
Malicious code in newman-reporter-genuinepoc (npm)
1 compromised version
- Feb 27, 2026
Malicious code in express-core-validator (npm)
- Feb 27, 2026
Malware in express-core-validator
1 compromised version
- Feb 27, 2026
Malicious code in nuget-task-common (npm)
2 compromised versions
- Feb 26, 2026
Malicious code in foundry-toolkit (npm)
6 compromised versions
- Feb 26, 2026
Malicious code in launch-darkly-js (npm)
6 compromised versions
- Feb 26, 2026
Malicious code in windowston (npm)
1 compromised version
- Feb 26, 2026
Malicious code in jslint-config (npm)
1 compromised version
- Feb 26, 2026
Malicious code in hardhat-node (npm)
2 compromised versions
- Feb 26, 2026
Malicious code in zoddle (npm)
1 compromised version
- Feb 26, 2026
Malicious code in ts-packer (npm)
- Feb 26, 2026
Malicious code in jest-param-validator (npm)
- Feb 26, 2026
Malicious code in jest-node-paramset (npm)
- Feb 26, 2026
Malware in ts-packer
1 compromised version
- Feb 26, 2026
Malware in jest-node-paramset
1 compromised version
- Feb 26, 2026
Malware in jest-param-validator
1 compromised version
- Feb 26, 2026
Malicious code in corstoken (npm)
1 compromised version
- Feb 26, 2026
Malicious code in iosysredis (npm)
1 compromised version
- Feb 26, 2026
Malicious code in undicy-lint (npm)
1 compromised version
- Feb 25, 2026
Malicious code in promanage (npm)
1 compromised version
- Feb 25, 2026
Malicious code in uuindex (npm)
1 compromised version
- Feb 25, 2026
Malicious code in chai-lite-lib (npm)
1 compromised version
- Feb 25, 2026
Malware in chai-lite-lib
1 compromised version
- Feb 25, 2026
Malicious code in duer-js (npm)
- Feb 25, 2026
Malware in duer-js
1 compromised version
- Feb 25, 2026
Malicious code in react-svg-helper-fast (npm)
- Feb 25, 2026
Malware in react-svg-helper-fast
1 compromised version
- Feb 25, 2026
Malicious code in chai-as-utils (npm)
1 compromised version
- Feb 25, 2026
Malware in chai-as-utils
1 compromised version
- Feb 25, 2026
Malicious code in sample-custom-component (npm)
2 compromised versions
- Feb 25, 2026
Malware in sample-custom-component
1 compromised version
- Feb 25, 2026
Malware in microsoft-cms-client
1 compromised version
- Feb 25, 2026
Malware in en-thrift-internal
1 compromised version
- Feb 25, 2026
Malicious code in @schedaero/react-core (npm)
Page 172 of 4,807