Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,307 total in npm · sorted newest first- Jan 28, 2026
Malicious code in digital-music-dynmsg-ribbon (npm)
- Jan 28, 2026
Malware in digital-music-dynmsg-ribbon
1 compromised version
- Jan 28, 2026
Malicious code in transform-regenerator (npm)
- Jan 28, 2026
Malicious code in transform-async-to-generator (npm)
- Jan 28, 2026
Malicious code in syntax-async-functions (npm)
- Jan 28, 2026
Malware in syntax-async-functions
1 compromised version
- Jan 28, 2026
Malware in transform-regenerator
1 compromised version
- Jan 28, 2026
Malware in transform-async-to-generator
1 compromised version
- Jan 28, 2026
Malicious code in express-lists-routes (npm)
1 compromised version
- Jan 28, 2026
Malware in express-lists-routes
1 compromised version
- Jan 28, 2026
Malicious code in json-mapping-web (npm)
- Jan 28, 2026
Malware in json-mapping-web
1 compromised version
- Jan 28, 2026
Malicious code in cdnhost (npm)
1 compromised version
- Jan 28, 2026
Malware in cdnhost
1 compromised version
- Jan 28, 2026
Malicious code in blockchain-helper-lib (npm)
28 compromised versions
- Jan 28, 2026
Malware in blockchain-helper-lib
1 compromised version
- Jan 27, 2026
Malware in @wbgo/shared
1 compromised version
- Jan 27, 2026
Malware in @wb-team/uikit-myteam-web
1 compromised version
- Jan 27, 2026
Malicious code in @santandergroup-uk/edgehome-components (npm)
4 compromised versions
- Jan 27, 2026
Malware in @santandergroup-uk/edgehome-components
1 compromised version
- Jan 27, 2026
Malware in @riag-libs/pattern-library-react-hooks
1 compromised version
- Jan 27, 2026
Malware in @spx-smartsorting/vue
1 compromised version
- Jan 27, 2026
Malware in @servicepoint/vue-project
1 compromised version
- Jan 27, 2026
Malware in @spx-delivery/react
1 compromised version
- Jan 27, 2026
Malware in @spx-workforceops/shared-vue
1 compromised version
- Jan 27, 2026
Malicious code in internallib_v828 (npm)
- Jan 27, 2026
Malware in internallib_v828
1 compromised version
- Jan 27, 2026
Malware in kwp-shared-components-production-system
1 compromised version
- Jan 27, 2026
Malware in @flipster/utils
1 compromised version
- Jan 27, 2026
Malicious code in stylus.js (npm)
- Jan 27, 2026
Malicious code in pump.js (npm)
- Jan 27, 2026
Malicious code in mysql2.js (npm)
- Jan 27, 2026
Malicious code in morgan.js (npm)
- Jan 27, 2026
Malicious code in knex.js (npm)
- Jan 27, 2026
Malware in pump.js
1 compromised version
- Jan 27, 2026
Malware in knex.js
1 compromised version
- Jan 27, 2026
Malware in mysql2.js
1 compromised version
- Jan 27, 2026
Malware in morgan.js
1 compromised version
- Jan 27, 2026
Malware in stylus.js
1 compromised version
- Jan 27, 2026
Malicious code in grepleaks (npm)
- Jan 27, 2026
Withdrawn Advisory: Malware in grepleaks
1 compromised version
- Jan 27, 2026
Malicious code in xhjxhjhiagent (npm)
2 compromised versions
- Jan 27, 2026
Malicious code in testxhjhka (npm)
- Jan 27, 2026
Malicious code in testxhjhk (npm)
- Jan 27, 2026
Malicious code in hackerxhj (npm)
- Jan 27, 2026
Malware in testxhjhk
1 compromised version
- Jan 27, 2026
Malware in xhjxhjhiagent
1 compromised version
- Jan 27, 2026
Malware in testxhjhka
1 compromised version
- Jan 27, 2026
Malware in hackerxhj
1 compromised version
- Jan 27, 2026
Malicious code in hiagentxhjrceme (npm)
Page 185 of 4,807