Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,307 total in npm · sorted newest first- Feb 2, 2026
Malware in c11dff444
1 compromised version
- Feb 2, 2026
Malicious code in solhint-plugin-hyperlane (npm)
3 compromised versions
- Feb 2, 2026
Malicious code in launchdarkly-cpp-networking (npm)
- Feb 2, 2026
Malicious code in idv-script (npm)
5 compromised versions
- Feb 2, 2026
Malicious code in finnairshop (npm)
1 compromised version
- Feb 2, 2026
Malicious code in eslint-config-minecraft-scripting (npm)
3 compromised versions
- Feb 2, 2026
Malicious code in cowsay-fancy (npm)
- Feb 2, 2026
Malicious code in cowsay-deluxe (npm)
- Feb 2, 2026
Malicious code in cowsay-caps (npm)
- Feb 2, 2026
Malicious code in cowsay-allcaps (npm)
- Feb 2, 2026
Malicious code in client-desktop-web-installer (npm)
- Feb 2, 2026
Malicious code in @casaverso/frontend-core (npm)
- Jan 31, 2026
Malicious code in roots-cms-client (npm)
1 compromised version
- Jan 31, 2026
Malicious code in c11dff444 (npm)
3 compromised versions
- Jan 31, 2026
Malicious code in teaser-nav (npm)
2 compromised versions
- Jan 30, 2026
Malicious code in sharedclasses (npm)
2 compromised versions
- Jan 30, 2026
Malicious code in mbo-letters-cl (npm)
2 compromised versions
- Jan 30, 2026
Malicious code in euskalplantxa (npm)
1 compromised version
- Jan 30, 2026
Malicious code in ezviz-shop-mall (npm)
1 compromised version
- Jan 30, 2026
Malicious code in banquet-runtime-modules (npm)
1 compromised version
- Jan 29, 2026
Malicious code in dhgshop (npm)
2 compromised versions
- Jan 29, 2026
Malicious code in researchpoc2 (npm)
- Jan 29, 2026
Malware in researchpoc2
1 compromised version
- Jan 29, 2026
Malicious code in jwt-pack (npm)
- Jan 29, 2026
Malware in jwt-pack
1 compromised version
- Jan 29, 2026
Malicious code in n8n-nodes-comfyui-illu (npm)
- Jan 29, 2026
Malware in n8n-nodes-comfyui-illu
1 compromised version
- Jan 29, 2026
Malicious code in wallet-icon-font (npm)
- Jan 29, 2026
Malware in wallet-icon-font
1 compromised version
- Jan 29, 2026
Malicious code in turbotax (npm)
2 compromised versions
- Jan 28, 2026
Malicious code in epic-asset-uploader (npm)
1 compromised version
- Jan 28, 2026
Malware in oxnoxon
1 compromised version
- Jan 28, 2026
Malicious code in lvldragdrop (npm)
- Jan 28, 2026
Malicious code in kol7a (npm)
- Jan 28, 2026
Malware in kol7a
1 compromised version
- Jan 28, 2026
Malware in lvldragdrop
1 compromised version
- Jan 28, 2026
Malware in eits
1 compromised version
- Jan 28, 2026
Malware in h-jsencrypt
1 compromised version
- Jan 28, 2026
Malicious code in chai-as-extended (npm)
1 compromised version
- Jan 28, 2026
Malware in chai-as-extended
1 compromised version
- Jan 28, 2026
Malicious code in dotenv-embed (npm)
1 compromised version
- Jan 28, 2026
Malicious code in chai-async-tests (npm)
1 compromised version
- Jan 28, 2026
Malware in dotenv-embed
1 compromised version
- Jan 28, 2026
Malware in chai-async-tests
1 compromised version
- Jan 28, 2026
Malicious code in chai-sub (npm)
1 compromised version
- Jan 28, 2026
Malware in chai-sub
1 compromised version
- Jan 28, 2026
Malicious code in chai-px (npm)
1 compromised version
- Jan 28, 2026
Malware in chai-px
1 compromised version
- Jan 28, 2026
Malicious code in chai-chains-async (npm)
1 compromised version
- Jan 28, 2026
Malware in chai-chains-async
1 compromised version
Page 183 of 4,807