Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,307 total in npm · sorted newest first- Jan 28, 2026
Malicious code in vuejavascript (npm)
- Jan 28, 2026
Malicious code in somsodamsd (npm)
- Jan 28, 2026
Malicious code in somesomesomesome (npm)
- Jan 28, 2026
Malicious code in somesomesome (npm)
- Jan 28, 2026
Malicious code in skndkjasndkjan (npm)
- Jan 28, 2026
Malicious code in @pukpuk1/somsodamsd (npm)
- Jan 28, 2026
Malware in @pukpuk1/somsodamsd
1 compromised version
- Jan 28, 2026
Malware in somsodamsd
1 compromised version
- Jan 28, 2026
Malware in somesomesomesome
1 compromised version
- Jan 28, 2026
Malware in somesomesome
1 compromised version
- Jan 28, 2026
Malware in skndkjasndkjan
1 compromised version
- Jan 28, 2026
Malware in vuejavascript
1 compromised version
- Jan 28, 2026
Malicious code in react-toast-cold (npm)
1 compromised version
- Jan 28, 2026
Malicious code in lyatly-utils (npm)
3 compromised versions
- Jan 28, 2026
Malware in lyatly-utils
1 compromised version
- Jan 28, 2026
Malicious code in okijuh (npm)
- Jan 28, 2026
Malware in okijuh
1 compromised version
- Jan 28, 2026
Malicious code in chai-as-hashed (npm)
1 compromised version
- Jan 28, 2026
Malware in chai-as-hashed
1 compromised version
- Jan 28, 2026
Malicious code in converse-rn-lib (npm)
1 compromised version
- Jan 28, 2026
Malware in converse-rn-lib
1 compromised version
- Jan 28, 2026
Malicious code in teslaone (npm)
- Jan 28, 2026
Malware in teslaone
1 compromised version
- Jan 28, 2026
Malicious code in ern-picking2-api (npm)
- Jan 28, 2026
Malware in ern-picking2-api
1 compromised version
- Jan 28, 2026
Malicious code in transform-vue-jsx (npm)
- Jan 28, 2026
Malicious code in syntax-jsx (npm)
- Jan 28, 2026
Malicious code in syntax-flow (npm)
- Jan 28, 2026
Malware in syntax-jsx
1 compromised version
- Jan 28, 2026
Malware in transform-vue-jsx
1 compromised version
- Jan 28, 2026
Malware in syntax-flow
1 compromised version
- Jan 28, 2026
Malicious code in equimper (npm)
- Jan 28, 2026
Malware in equimper
1 compromised version
- Jan 28, 2026
Malware in translation-note
1 compromised version
- Jan 28, 2026
Malicious code in pino-debugger (npm)
- Jan 28, 2026
Malicious code in debug-glitz (npm)
- Jan 28, 2026
Malicious code in debug-fmt (npm)
- Jan 28, 2026
Malware in debug-fmt
1 compromised version
- Jan 28, 2026
Malware in debug-glitz
1 compromised version
- Jan 28, 2026
Malware in pino-debugger
1 compromised version
- Jan 28, 2026
Malicious code in primebeem-db (npm)
- Jan 28, 2026
Malicious code in @nayzak51/primebeem-db (npm)
- Jan 28, 2026
Malware in primebeem-db
1 compromised version
- Jan 28, 2026
Malware in @nayzak51/primebeem-db
1 compromised version
- Jan 28, 2026
Malicious code in acuitymobileapp (npm)
- Jan 28, 2026
Malware in acuitymobileapp
1 compromised version
- Jan 28, 2026
Malicious code in n8n-zalo-fevox (npm)
- Jan 28, 2026
Malicious code in n8n-nodes-zalo-fevox (npm)
- Jan 28, 2026
Malware in n8n-zalo-fevox
1 compromised version
- Jan 28, 2026
Malware in n8n-nodes-zalo-fevox
1 compromised version
Page 184 of 4,807