Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,307 total in npm · sorted newest first- Feb 25, 2026
Malicious code in @schedaero/yukon (npm)
- Feb 25, 2026
Malicious code in @schedaero/bacon (npm)
- Feb 25, 2026
Malicious code in @schedaero/net-common (npm)
- Feb 25, 2026
Malicious code in uxproject11 (npm)
1 compromised version
- Feb 25, 2026
Malicious code in projectrtert (npm)
1 compromised version
- Feb 25, 2026
Malicious code in @schedaero/shared (npm)
- Feb 25, 2026
Malicious code in react-devtools-raycast (npm)
1 compromised version
- Feb 25, 2026
Malicious code in get-fonts (npm)
1 compromised version
- Feb 25, 2026
Malicious code in trae-browser-inspect (npm)
1 compromised version
- Feb 24, 2026
Malicious code in examplereactnative76 (npm)
1 compromised version
- Feb 24, 2026
Malicious code in rncalendareventsexample (npm)
1 compromised version
- Feb 24, 2026
Malicious code in rtxbbtyols (npm)
1 compromised version
- Feb 24, 2026
Malicious code in @unitedcapitalfinancialadvisors/finlife-component-library (npm)
- Feb 24, 2026
Malicious code in @protonme/routing (npm)
- Feb 24, 2026
Malware in @unitedcapitalfinancialadvisors/finlife-component-library
1 compromised version
- Feb 24, 2026
Malware in @protonme/routing
1 compromised version
- Feb 24, 2026
Malicious code in @kiukicom/sidebar (npm)
- Feb 24, 2026
Malicious code in @coinmetro/app (npm)
- Feb 24, 2026
Malicious code in @atg-aml-shared/kyc-domain (npm)
- Feb 24, 2026
Malicious code in @ai-studio-web/app (npm)
- Feb 24, 2026
Malware in @ai-studio-web/app
1 compromised version
- Feb 24, 2026
Malware in @coinmetro/app
1 compromised version
- Feb 24, 2026
Malware in @atg-aml-shared/kyc-domain
1 compromised version
- Feb 24, 2026
Malware in @kiukicom/sidebar
1 compromised version
- Feb 24, 2026
Malicious code in js-multer (npm)
- Feb 24, 2026
Malicious code in chai-iotype (npm)
1 compromised version
- Feb 24, 2026
Malware in chai-iotype
1 compromised version
- Feb 24, 2026
Malware in js-multer
1 compromised version
- Feb 24, 2026
Malicious code in chai-as-pause (npm)
1 compromised version
- Feb 24, 2026
Malware in chai-as-pause
1 compromised version
- Feb 24, 2026
Malicious code in json-mapping-srcs (npm)
1 compromised version
- Feb 24, 2026
Malware in json-mapping-srcs
1 compromised version
- Feb 24, 2026
Malicious code in es1int-config (npm)
1 compromised version
- Feb 24, 2026
Malware in es1int-config
1 compromised version
- Feb 24, 2026
Malicious code in chai-tools (npm)
1 compromised version
- Feb 24, 2026
Malware in chai-tools
1 compromised version
- Feb 24, 2026
Malicious code in node-argon (npm)
1 compromised version
- Feb 24, 2026
Malicious code in argon-web3-chain (npm)
- Feb 24, 2026
Malware in argon-web3-chain
1 compromised version
- Feb 24, 2026
Malware in node-argon
1 compromised version
- Feb 24, 2026
Malicious code in dotenvx-ext (npm)
1 compromised version
- Feb 24, 2026
Malware in dotenvx-ext
1 compromised version
- Feb 24, 2026
Malicious code in modify-setting (npm)
1 compromised version
- Feb 24, 2026
Malware in modify-setting
1 compromised version
- Feb 24, 2026
Malicious code in es1int-re1ease (npm)
1 compromised version
- Feb 24, 2026
Malware in es1int-re1ease
1 compromised version
- Feb 24, 2026
Malicious code in ultimates-express (npm)
1 compromised version
- Feb 24, 2026
Malicious code in express-soaps (npm)
1 compromised version
- Feb 24, 2026
Malware in express-soaps
1 compromised version
- Feb 24, 2026
Malware in ultimates-express
1 compromised version
Page 173 of 4,807