Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,307 total in npm · sorted newest first- Feb 10, 2026
Malware in @snazah/davey
1 compromised version
- Feb 10, 2026
Malicious code in @uniconvex/dotenv (npm)
- Feb 10, 2026
Malicious code in @reimorg/config (npm)
- Feb 10, 2026
Malware in @uniconvex/dotenv
1 compromised version
- Feb 10, 2026
Malware in @reimorg/config
1 compromised version
- Feb 10, 2026
Malicious code in express-configer (npm)
3 compromised versions
- Feb 10, 2026
Malware in express-configer
1 compromised version
- Feb 10, 2026
Malicious code in aligners (npm)
1 compromised version
- Feb 10, 2026
Malware in aligners
1 compromised version
- Feb 10, 2026
Malicious code in sap-code-style-guides (npm)
5 compromised versions
- Feb 10, 2026
Malware in sap-code-style-guides
1 compromised version
- Feb 10, 2026
Malicious code in chai-as-approved (npm)
2 compromised versions
- Feb 10, 2026
Malware in chai-as-approved
1 compromised version
- Feb 10, 2026
Malicious code in bigmathix (npm)
11 compromised versions
- Feb 10, 2026
Malware in bigmathix
1 compromised version
- Feb 10, 2026
Malicious code in graphflowx (npm)
4 compromised versions
- Feb 10, 2026
Malware in graphflowx
1 compromised version
- Feb 10, 2026
Malicious code in narrow-array (npm)
2 compromised versions
- Feb 10, 2026
Malware in narrow-array
1 compromised version
- Feb 9, 2026
Malicious code in jwtdotenv (npm)
- Feb 9, 2026
Malware in jwtdotenv
1 compromised version
- Feb 9, 2026
Malicious code in json-web-sources (npm)
- Feb 9, 2026
Malicious code in json-mapping-sources (npm)
3 compromised versions
- Feb 9, 2026
Malware in json-mapping-sources
1 compromised version
- Feb 9, 2026
Malware in json-web-sources
1 compromised version
- Feb 9, 2026
Malicious code in react-svg-handler (npm)
- Feb 9, 2026
Malware in react-svg-handler
1 compromised version
- Feb 9, 2026
Malicious code in @skyeng/libs (npm)
6 compromised versions
- Feb 9, 2026
Malware in @skyeng/libs
1 compromised version
- Feb 6, 2026
Malicious code in web3-sinon (npm)
- Feb 6, 2026
Malicious code in web3-chain-sinon (npm)
- Feb 6, 2026
Malware in web3-chain-sinon
1 compromised version
- Feb 6, 2026
Malware in web3-sinon
1 compromised version
- Feb 6, 2026
Malicious code in aligned-arrays (npm)
- Feb 6, 2026
Malware in aligned-arrays
1 compromised version
- Feb 6, 2026
Malicious code in breadcrumb-service (npm)
1 compromised version
- Feb 6, 2026
Malicious code in @sbseg-plugin/qbo-web-app-ui (npm)
- Feb 6, 2026
Malicious code in @rsgweb/utils (npm)
- Feb 6, 2026
Malicious code in @rsgweb/tina (npm)
- Feb 6, 2026
Malicious code in @rsgweb/rockstar-account (npm)
- Feb 6, 2026
Malicious code in @rsgweb/modules-core-www-page (npm)
- Feb 6, 2026
Malicious code in @rsgweb/modules-core-feedback (npm)
- Feb 6, 2026
Malicious code in @rdxportal/ui-components (npm)
- Feb 6, 2026
Malware in @rsgweb/modules-core-www-page
1 compromised version
- Feb 6, 2026
Malware in @rsgweb/rockstar-account
1 compromised version
- Feb 6, 2026
Malware in @sbseg-plugin/qbo-web-app-ui
1 compromised version
- Feb 6, 2026
Malware in @rdxportal/ui-components
1 compromised version
- Feb 6, 2026
Malware in @sporting-life/sportinglife-betslip-sdk
1 compromised version
- Feb 6, 2026
Malware in @sporting-life/sportinglife-be
1 compromised version
- Feb 6, 2026
Malware in @rsgweb/modules-core-feedback
1 compromised version
Page 177 of 4,807