Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,307 total in npm · sorted newest first- Feb 5, 2026
Malicious code in tailwindcss-forms-starter (npm)
- Feb 5, 2026
Malware in tailwindcss-forms-starter
1 compromised version
- Feb 5, 2026
Malicious code in cat-retail-app (npm)
- Feb 5, 2026
Malware in cat-retail-app
1 compromised version
- Feb 5, 2026
Malicious code in @jes4l/react-pkg (npm)
- Feb 5, 2026
Malware in @jes4l/react-pkg
1 compromised version
- Feb 5, 2026
Malicious code in express_update (npm)
- Feb 5, 2026
Malware in express_update
1 compromised version
- Feb 5, 2026
Malicious code in log-symbols_updated (npm)
- Feb 5, 2026
Malicious code in locate-path_updated (npm)
- Feb 5, 2026
Malware in log-symbols_updated
1 compromised version
- Feb 5, 2026
Malware in locate-path_updated
1 compromised version
- Feb 5, 2026
Malicious code in @purecore/rabbitmq (npm)
1 compromised version
- Feb 5, 2026
Malware in @purecore/rabbitmq
1 compromised version
- Feb 5, 2026
Malicious code in dspmobile (npm)
- Feb 5, 2026
Malware in dspmobile
1 compromised version
- Feb 5, 2026
Malicious code in tailwindcss-animation-modern (npm)
- Feb 5, 2026
Malware in tailwindcss-animation-modern
1 compromised version
- Feb 4, 2026
Malicious code in react-vite-sync (npm)
- Feb 4, 2026
Malware in react-vite-sync
1 compromised version
- Feb 4, 2026
Malicious code in web3-chain-sync (npm)
2 compromised versions
- Feb 4, 2026
Malicious code in react-count-sync (npm)
2 compromised versions
- Feb 4, 2026
Malware in web3-chain-sync
1 compromised version
- Feb 4, 2026
Malware in react-count-sync
1 compromised version
- Feb 4, 2026
Malicious code in dcf-commons (npm)
- Feb 4, 2026
Malware in dcf-commons
1 compromised version
- Feb 4, 2026
Malicious code in @msecscc/gaia (npm)
3 compromised versions
- Feb 4, 2026
Malware in @msecscc/gaia
1 compromised version
- Feb 4, 2026
Malicious code in internationalized (npm)
- Feb 4, 2026
Malware in internationalized
1 compromised version
- Feb 4, 2026
Malware in banquet-runtime-modules
1 compromised version
- Feb 4, 2026
Malicious code in mdp-client-web (npm)
2 compromised versions
- Feb 4, 2026
Malicious code in confluence-analytics-support (npm)
2 compromised versions
- Feb 4, 2026
Malware in mdp-client-web
1 compromised version
- Feb 4, 2026
Malware in confluence-analytics-support
1 compromised version
- Feb 4, 2026
Malware in @casaverso/frontend-core
1 compromised version
- Feb 4, 2026
Malicious code in remark-gfm-v4 (npm)
- Feb 4, 2026
Malicious code in ggajsvjsg (npm)
- Feb 4, 2026
Malicious code in docusaurus-plugin-launchdarkly (npm)
- Feb 4, 2026
Malware in remark-gfm-v4
1 compromised version
- Feb 4, 2026
Malware in docusaurus-plugin-launchdarkly
1 compromised version
- Feb 4, 2026
Malware in ggajsvjsg
1 compromised version
- Feb 4, 2026
Malicious code in xpack-subscription-test (npm)
1 compromised version
- Feb 4, 2026
Malicious code in deuro-landing-page (npm)
1 compromised version
- Feb 4, 2026
Malware in incode-kyc-backend
1 compromised version
- Feb 4, 2026
Malware in idv-script
1 compromised version
- Feb 4, 2026
Malicious code in partnerss (npm)
1 compromised version
- Feb 4, 2026
Malicious code in json-mapping-source (npm)
- Feb 4, 2026
Malware in json-mapping-source
1 compromised version
- Feb 4, 2026
Malicious code in chai-grab (npm)
Page 179 of 4,807