Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,307 total in npm · sorted newest first- Jan 22, 2026
Malicious code in @mailpoet/components (npm)
- Jan 22, 2026
Malicious code in @mailpoet/component (npm)
- Jan 22, 2026
Malicious code in @fortinet/fortigate-autoscale (npm)
- Jan 22, 2026
Malware in @mailpoet/component
1 compromised version
- Jan 22, 2026
Malware in @fortinet/fortigate-autoscale
1 compromised version
- Jan 22, 2026
Malware in @mailpoet/components
1 compromised version
- Jan 22, 2026
Malware in @mailpoet/eslint-config
1 compromised version
- Jan 22, 2026
Malicious code in @brl-laiwb/ng-laiwb-api (npm)
- Jan 22, 2026
Malicious code in @alluxio/common-ui (npm)
- Jan 22, 2026
Malware in @alluxio/common-ui
1 compromised version
- Jan 22, 2026
Malware in @brl-laiwb/ng-laiwb-api
1 compromised version
- Jan 22, 2026
Malicious code in csv-parsing-xz (npm)
- Jan 22, 2026
Malware in csv-parsing-xz
1 compromised version
- Jan 22, 2026
Malicious code in csv-parsing-xx (npm)
- Jan 22, 2026
Malware in csv-parsing-xx
1 compromised version
- Jan 22, 2026
Malicious code in rank253222 (npm)
4 compromised versions
- Jan 21, 2026
Malicious code in tv-admin-commons (npm)
2 compromised versions
- Jan 21, 2026
Malware in tv-admin-commons
1 compromised version
- Jan 21, 2026
Malicious code in ts-tweetnacl-utils (npm)
- Jan 21, 2026
Malware in ts-tweetnacl
1 compromised version
- Jan 21, 2026
Malware in ts-tweetnacl-utils
1 compromised version
- Jan 21, 2026
Malicious code in lumo-api-client (npm)
- Jan 21, 2026
Malicious code in jquery-ajaxchimp (npm)
- Jan 21, 2026
Malware in jquery-ajaxchimp
1 compromised version
- Jan 21, 2026
Malware in lumo-api-client
1 compromised version
- Jan 21, 2026
Malicious code in aligntype (npm)
2 compromised versions
- Jan 21, 2026
Malware in aligntype
1 compromised version
- Jan 21, 2026
Malicious code in chai-async-test (npm)
1 compromised version
- Jan 21, 2026
Malware in chai-async-test
1 compromised version
- Jan 21, 2026
Malicious code in dotenv-expanded (npm)
1 compromised version
- Jan 21, 2026
Malware in dotenv-expanded
1 compromised version
- Jan 21, 2026
Malicious code in weaviate-js (npm)
- Jan 21, 2026
Malicious code in replicate-js (npm)
- Jan 21, 2026
Malicious code in qdrant-js (npm)
- Jan 21, 2026
Malware in replicate-js
1 compromised version
- Jan 21, 2026
Malware in weaviate-js
1 compromised version
- Jan 21, 2026
Malware in qdrant-js
1 compromised version
- Jan 21, 2026
Malware in client-s3
1 compromised version
- Jan 21, 2026
Malicious code in storage-types (npm)
1 compromised version
- Jan 21, 2026
Malicious code in plugin-vue (npm)
1 compromised version
- Jan 21, 2026
Malicious code in plugin-react-swc (npm)
1 compromised version
- Jan 21, 2026
Malicious code in nanoid-js (npm)
- Jan 21, 2026
Malicious code in babel-js (npm)
1 compromised version
- Jan 21, 2026
Malware in plugin-react-swc
1 compromised version
- Jan 21, 2026
Malware in babel-js
1 compromised version
- Jan 21, 2026
Malware in plugin-vue
1 compromised version
- Jan 21, 2026
Malware in storage-types
1 compromised version
- Jan 21, 2026
Malware in nanoid-js
1 compromised version
- Jan 21, 2026
Malicious code in aws-crt-nodejs (npm)
- Jan 21, 2026
Malware in aws-crt-nodejs
1 compromised version
Page 188 of 4,807