Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,307 total in npm · sorted newest first- Feb 23, 2026
Malicious code in react-markdown-canvas (npm)
2 compromised versions
- Feb 23, 2026
Malicious code in secure-monkey (npm)
3 compromised versions
- Feb 23, 2026
Malicious code in react-dropzone-truffle (npm)
16 compromised versions
- Feb 23, 2026
Malware in react-dropzone-truffle
1 compromised version
- Feb 23, 2026
Malicious code in npm-security-testing (npm)
- Feb 23, 2026
Malware in npm-security-testing
1 compromised version
- Feb 23, 2026
Malicious code in rbxm-tools (npm)
- Feb 23, 2026
Malware in rbxm-tools
1 compromised version
- Feb 22, 2026
Malicious code in en-thrift-internal (npm)
2 compromised versions
- Feb 22, 2026
Malicious code in conduit-utils (npm)
2 compromised versions
- Feb 22, 2026
Malicious code in vl-ui-code-preview (npm)
1 compromised version
- Feb 22, 2026
Malicious code in vl-ui-contact-card (npm)
1 compromised version
- Feb 22, 2026
Malicious code in vl-ui-action-group (npm)
1 compromised version
- Feb 22, 2026
Malicious code in vl-ui-button (npm)
1 compromised version
- Feb 22, 2026
Malicious code in vl-ui-breadcrumb (npm)
1 compromised version
- Feb 22, 2026
Malicious code in vl-ui-body (npm)
1 compromised version
- Feb 22, 2026
Malicious code in vl-ui-checkbox (npm)
1 compromised version
- Feb 22, 2026
Malicious code in vl-ui-accessibility (npm)
1 compromised version
- Feb 22, 2026
Malicious code in vl-ui-alert (npm)
1 compromised version
- Feb 22, 2026
Malicious code in dt-fe-t2d-marketplace (npm)
1 compromised version
- Feb 22, 2026
Malicious code in the-storyverse (npm)
1 compromised version
- Feb 21, 2026
Malicious code in microsoft-cms-client (npm)
2 compromised versions
- Feb 20, 2026
Malicious code in azure-postgresql-auth (npm)
2 compromised versions
- Feb 20, 2026
Malicious code in rollup-plugin-polyfill-swc (npm)
- Feb 20, 2026
Malware in rollup-plugin-polyfill-swc
1 compromised version
- Feb 20, 2026
Malicious code in parse-compat (npm)
- Feb 20, 2026
Malware in parse-compat
1 compromised version
- Feb 20, 2026
Malicious code in uudi (npm)
- Feb 20, 2026
Malicious code in scan-store (npm)
- Feb 20, 2026
Malicious code in naniod (npm)
- Feb 20, 2026
Malicious code in locale-loader-pro (npm)
- Feb 20, 2026
Malicious code in detect-cache (npm)
- Feb 20, 2026
Malicious code in crypto-locale (npm)
- Feb 20, 2026
Malware in uudi
1 compromised version
- Feb 20, 2026
Malware in scan-store
1 compromised version
- Feb 20, 2026
Malware in locale-loader-pro
1 compromised version
- Feb 20, 2026
Malware in naniod
1 compromised version
- Feb 20, 2026
Malware in detect-cache
1 compromised version
- Feb 20, 2026
Malware in crypto-locale
1 compromised version
- Feb 20, 2026
Malicious code in yarsg (npm)
- Feb 20, 2026
Malicious code in veim (npm)
- Feb 20, 2026
Malicious code in ethres (npm)
- Feb 20, 2026
Malware in yarsg
1 compromised version
- Feb 20, 2026
Malware in veim
1 compromised version
- Feb 20, 2026
Malware in ethres
1 compromised version
- Feb 20, 2026
Malicious code in secp256 (npm)
- Feb 20, 2026
Malicious code in rimarf (npm)
- Feb 20, 2026
Malicious code in node-native-bridge (npm)
- Feb 20, 2026
Malicious code in hardhta (npm)
- Feb 20, 2026
Malicious code in format-defaults (npm)
Page 174 of 4,807