Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,307 total in npm · sorted newest first- Jan 21, 2026
Malware in internallib_v962
1 compromised version
- Jan 21, 2026
Malicious code in jsonwebauth (npm)
1 compromised version
- Jan 21, 2026
Malware in jsonwebauth
1 compromised version
- Jan 21, 2026
Malicious code in chai-dex (npm)
1 compromised version
- Jan 21, 2026
Malware in chai-dex
1 compromised version
- Jan 21, 2026
Malicious code in chai-chain-async (npm)
1 compromised version
- Jan 21, 2026
Malware in chai-chain-async
1 compromised version
- Jan 21, 2026
Malicious code in worldposition (npm)
- Jan 21, 2026
Malicious code in worldnormal (npm)
- Jan 21, 2026
Malicious code in vworldviewdir (npm)
- Jan 21, 2026
Malicious code in private-internal-sdk (npm)
- Jan 21, 2026
Malicious code in manage-root (npm)
- Jan 21, 2026
Malware in vworldviewdir
1 compromised version
- Jan 21, 2026
Malware in manage-root
1 compromised version
- Jan 21, 2026
Malware in worldposition
1 compromised version
- Jan 21, 2026
Malware in irradiance
1 compromised version
- Jan 21, 2026
Malware in worldnormal
1 compromised version
- Jan 21, 2026
Malware in unescaped
1 compromised version
- Jan 21, 2026
Malware in private-internal-sdk
1 compromised version
- Jan 21, 2026
Malware in presentation-test-utilities
1 compromised version
- Jan 21, 2026
Malware in forms-new-design
1 compromised version
- Jan 21, 2026
Malware in cko-ui-toolkit
1 compromised version
- Jan 21, 2026
Malicious code in @mikudev/signal (npm)
- Jan 21, 2026
Malicious code in @mikudev/ridwan-baileys-mod (npm)
- Jan 21, 2026
Malicious code in @mikudev/beles (npm)
- Jan 21, 2026
Malware in @mikudev/signal
1 compromised version
- Jan 21, 2026
Malware in @mikudev/ridwan-baileys-mod
1 compromised version
- Jan 21, 2026
Malware in @mikudev/beles
1 compromised version
- Jan 21, 2026
Malicious code in @mikudev/ridwan-signal (npm)
- Jan 21, 2026
Malware in @mikudev/ridwan-signal
1 compromised version
- Jan 21, 2026
Malicious code in torbaileys (npm)
- Jan 21, 2026
Malicious code in tor-libsignal (npm)
- Jan 21, 2026
Malware in torbaileys
1 compromised version
- Jan 21, 2026
Malware in tor-libsignal
1 compromised version
- Jan 21, 2026
Malware in atm_bmw
1 compromised version
- Jan 21, 2026
Malicious code in genki-analytics (npm)
- Jan 21, 2026
Malware in genki-analytics
1 compromised version
- Jan 21, 2026
Malicious code in charlie_charlie_kirky (npm)
- Jan 21, 2026
Malware in charlie_charlie_kirky
1 compromised version
- Jan 21, 2026
Malicious code in recaptcha-cors (npm)
- Jan 21, 2026
Malware in recaptcha-cors
1 compromised version
- Jan 21, 2026
Malicious code in n8n-nodes-zl-vietts (npm)
- Jan 21, 2026
Malicious code in @diendh/n8n-nodes-tiktok-v2 (npm)
- Jan 21, 2026
Malware in @diendh/n8n-nodes-tiktok-v2
1 compromised version
- Jan 21, 2026
Malware in n8n-nodes-zl-vietts
1 compromised version
- Jan 21, 2026
Malicious code in blocks-builder-manifest-generator (npm)
- Jan 21, 2026
Malware in vue_frontend_rpc
1 compromised version
- Jan 21, 2026
Malware in blocks-builder-manifest-generator
1 compromised version
- Jan 21, 2026
Malicious code in natateste (npm)
1 compromised version
- Jan 21, 2026
Malware in natateste
1 compromised version
Page 190 of 4,807