Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,307 total in npm · sorted newest first- Feb 4, 2026
Malware in chai-grab
1 compromised version
- Feb 4, 2026
Malicious code in zappr (npm)
2 compromised versions
- Feb 4, 2026
Malicious code in zalando-consent-api (npm)
2 compromised versions
- Feb 4, 2026
Malicious code in z-shop-ui (npm)
2 compromised versions
- Feb 4, 2026
Malicious code in z-shop-js-env (npm)
2 compromised versions
- Feb 4, 2026
Malicious code in z-shop-event-bus (npm)
3 compromised versions
- Feb 4, 2026
Malware in z-shop-event-bus
1 compromised version
- Feb 4, 2026
Malware in zalando-consent-api
1 compromised version
- Feb 4, 2026
Malware in z-shop-ui
1 compromised version
- Feb 4, 2026
Malware in z-shop-js-env
1 compromised version
- Feb 4, 2026
Malware in zappr
1 compromised version
- Feb 4, 2026
Malicious code in dotenv-embedded (npm)
2 compromised versions
- Feb 4, 2026
Malicious code in chai-async-promised (npm)
2 compromised versions
- Feb 4, 2026
Malware in dotenv-embedded
1 compromised version
- Feb 4, 2026
Malware in chai-async-promised
1 compromised version
- Feb 4, 2026
Malicious code in https-emailjs (npm)
- Feb 4, 2026
Malicious code in http-emailjs (npm)
- Feb 4, 2026
Malware in react-toast-cold
1 compromised version
- Feb 4, 2026
Malware in http-emailjs
1 compromised version
- Feb 4, 2026
Malware in https-emailjs
1 compromised version
- Feb 4, 2026
Malicious code in @fxinternal/netdiagnostics (npm)
4 compromised versions
- Feb 4, 2026
Malware in @fxinternal/netdiagnostics
1 compromised version
- Feb 4, 2026
Malicious code in express-groups-routes (npm)
3 compromised versions
- Feb 4, 2026
Malware in express-groups-routes
1 compromised version
- Feb 4, 2026
Malicious code in si-wsl (npm)
- Feb 4, 2026
Malicious code in rreact-sdk (npm)
- Feb 4, 2026
Malicious code in reactt-sdkk (npm)
- Feb 4, 2026
Malicious code in react-sdkk (npm)
- Feb 4, 2026
Malicious code in ongose (npm)
- Feb 4, 2026
Malicious code in mongoose_update (npm)
- Feb 4, 2026
Malicious code in mongooose_update (npm)
- Feb 4, 2026
Malware in rreact-sdk
1 compromised version
- Feb 4, 2026
Malware in si-wsl
1 compromised version
- Feb 4, 2026
Malware in react-sdkk
1 compromised version
- Feb 4, 2026
Malware in mongoose_update
1 compromised version
- Feb 4, 2026
Malware in mongooose_update
1 compromised version
- Feb 4, 2026
Malware in reactt-sdkk
1 compromised version
- Feb 4, 2026
Malware in ongose
1 compromised version
- Feb 4, 2026
Malicious code in mongooose_updated (npm)
- Feb 4, 2026
Malware in mongooose_updated
1 compromised version
- Feb 3, 2026
Malicious code in incode-kyc-backend (npm)
1 compromised version
- Feb 3, 2026
Malicious code in js-unpack (npm)
3 compromised versions
- Feb 3, 2026
Malware in js-unpack
1 compromised version
- Feb 3, 2026
Malicious code in @devgandhi/healthpulse (npm)
- Feb 3, 2026
Malicious code in @devgandhi/cpp (npm)
- Feb 3, 2026
Malware in @devgandhi/cpp
1 compromised version
- Feb 3, 2026
Malware in @devgandhi/healthpulse
1 compromised version
- Feb 3, 2026
Malicious code in testing-package-xdsfdsfsc (npm)
4 compromised versions
- Feb 3, 2026
Malicious code in @x-clients/features (npm)
1 compromised version
- Feb 3, 2026
Malicious code in fileupload-util (npm)
1 compromised version
Page 180 of 4,807