Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,307 total in npm · sorted newest first- Feb 13, 2026
Malicious code in pyrefly (npm)
- Feb 13, 2026
Malicious code in open-answer-engine-frontend (npm)
- Feb 13, 2026
Malicious code in ecosystem_ui (npm)
5 compromised versions
- Feb 13, 2026
Malware in open-answer-engine-frontend
1 compromised version
- Feb 13, 2026
Malware in ecosystem_ui
1 compromised version
- Feb 13, 2026
Malware in pyright-root
1 compromised version
- Feb 13, 2026
Malware in pyrefly
1 compromised version
- Feb 13, 2026
Malware in responses-starter-app
1 compromised version
- Feb 13, 2026
Malicious code in hxz-protection (npm)
- Feb 13, 2026
Malware in hxz-protection
1 compromised version
- Feb 13, 2026
Malicious code in wropz-6module (npm)
- Feb 13, 2026
Malware in wropz-6module
1 compromised version
- Feb 13, 2026
Malicious code in wropz-module (npm)
- Feb 13, 2026
Malware in wropz-module
1 compromised version
- Feb 13, 2026
Malicious code in xsstesting (npm)
- Feb 13, 2026
Malicious code in metadata-stripper (npm)
- Feb 13, 2026
Malicious code in despicable-me (npm)
- Feb 13, 2026
Malicious code in console-style-pro0o0o0o (npm)
- Feb 13, 2026
Malware in despicable-me
1 compromised version
- Feb 13, 2026
Malware in console-style-pro0o0o0o
1 compromised version
- Feb 13, 2026
Malware in xsstesting
1 compromised version
- Feb 13, 2026
Malware in metadata-stripper
1 compromised version
- Feb 12, 2026
Malicious code in @depro0x/despicable-me (npm)
7 compromised versions
- Feb 12, 2026
Malicious code in stylelint-recommended (npm)
8 compromised versions
- Feb 12, 2026
Malware in stylelint-recommended
1 compromised version
- Feb 12, 2026
Malicious code in envoy1 (npm)
8 compromised versions
- Feb 12, 2026
Malicious code in ether-lint (npm)
2 compromised versions
- Feb 11, 2026
Malicious code in express-gueues (npm)
1 compromised version
- Feb 11, 2026
Malware in express-gueues
1 compromised version
- Feb 11, 2026
Malicious code in systemtest-network (npm)
- Feb 11, 2026
Malicious code in systemtest-information (npm)
- Feb 11, 2026
Malicious code in osopackage (npm)
- Feb 11, 2026
Malware in systemtest-information
1 compromised version
- Feb 11, 2026
Malware in osopackage
1 compromised version
- Feb 11, 2026
Malware in systemtest-network
1 compromised version
- Feb 11, 2026
Malicious code in chai-prop (npm)
1 compromised version
- Feb 11, 2026
Malware in chai-prop
1 compromised version
- Feb 11, 2026
Malicious code in sinon-node (npm)
- Feb 11, 2026
Malicious code in node-dotenv-cli (npm)
1 compromised version
- Feb 11, 2026
Malware in sinon-node
1 compromised version
- Feb 11, 2026
Malware in node-dotenv-cli
1 compromised version
- Feb 11, 2026
Malicious code in chai-await (npm)
- Feb 11, 2026
Malware in chai-await
1 compromised version
- Feb 11, 2026
Malicious code in npm_cimetadata (npm)
2 compromised versions
- Feb 10, 2026
Malicious code in search-newfrontier-podlet (npm)
1 compromised version
- Feb 10, 2026
Malicious code in notification-saved-search-settings-podlet (npm)
1 compromised version
- Feb 10, 2026
Malicious code in search-savedsearch-podlet (npm)
1 compromised version
- Feb 10, 2026
Malicious code in myads-layout (npm)
1 compromised version
- Feb 10, 2026
Malicious code in realestate-atlas (npm)
1 compromised version
- Feb 10, 2026
Malware in @ux-foundry/palette
1 compromised version
Page 176 of 4,807