Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,307 total in npm · sorted newest first- Jan 20, 2026
Malware in dux-portal-privacy
1 compromised version
- Jan 20, 2026
Malicious code in react-server-dom-unbundled (npm)
- Jan 20, 2026
Malware in react-server-dom-unbundled
1 compromised version
- Jan 19, 2026
Malicious code in tutor_table (npm)
2 compromised versions
- Jan 19, 2026
Malware in tutor_table
1 compromised version
- Jan 19, 2026
Malicious code in react-native-webview-forked (npm)
- Jan 19, 2026
Malware in conmiyagi-map
1 compromised version
- Jan 19, 2026
Malware in mapkit-example-vanillajs
1 compromised version
- Jan 19, 2026
Malware in sparkling-router
1 compromised version
- Jan 19, 2026
Malware in react-native-webview-forked
1 compromised version
- Jan 19, 2026
Malware in updox
1 compromised version
- Jan 19, 2026
Malicious code in @bingads-webui-theme-2018/theme-fluent (npm)
- Jan 19, 2026
Malware in @bingads-webui-theme-2018/theme-fluent
1 compromised version
- Jan 19, 2026
Malware in admin10001
1 compromised version
- Jan 19, 2026
Malicious code in internallib_v355 (npm)
- Jan 19, 2026
Malware in internallib_v355
1 compromised version
- Jan 19, 2026
Malicious code in private-payment-lib (npm)
- Jan 19, 2026
Malicious code in ofjaaah-security-lib (npm)
- Jan 19, 2026
Malicious code in ofjaaah-internal-utils (npm)
- Jan 19, 2026
Malicious code in ofjaaah-build-tools (npm)
- Jan 19, 2026
Malicious code in ofjaaah-auth-module (npm)
- Jan 19, 2026
Malicious code in internal-company-sdk (npm)
- Jan 19, 2026
Malware in blobhunter-depconf-poc
1 compromised version
- Jan 19, 2026
Malware in internal-company-sdk
1 compromised version
- Jan 19, 2026
Malware in ofjaaah-internal-utils
1 compromised version
- Jan 19, 2026
Malware in private-payment-lib
1 compromised version
- Jan 19, 2026
Malware in ofjaaah-build-tools
1 compromised version
- Jan 19, 2026
Malware in ofjaaah-security-lib
1 compromised version
- Jan 19, 2026
Malware in ofjaaah-auth-module
1 compromised version
- Jan 19, 2026
Malicious code in @cda-apps/source (npm)
- Jan 19, 2026
Malware in @cda-apps/source
1 compromised version
- Jan 19, 2026
Malicious code in chai-as-executed (npm)
3 compromised versions
- Jan 19, 2026
Malware in chai-as-validated
1 compromised version
- Jan 19, 2026
Malware in chai-as-executed
1 compromised version
- Jan 19, 2026
Malicious code in libsignal-yazxzcode (npm)
1 compromised version
- Jan 19, 2026
Malware in libsignal-yazxzcode
1 compromised version
- Jan 19, 2026
Malicious code in zod-js (npm)
- Jan 19, 2026
Malware in zod-js
1 compromised version
- Jan 19, 2026
Malicious code in wac-react-relay (npm)
- Jan 19, 2026
Malicious code in @brokenzzz/garfish (npm)
1 compromised version
- Jan 19, 2026
Malware in @brokenzzz/garfish
1 compromised version
- Jan 19, 2026
Malware in wac-react-relay
1 compromised version
- Jan 19, 2026
Malicious code in 1231dai (npm)
1 compromised version
- Jan 19, 2026
Malware in 1231dai
1 compromised version
- Jan 19, 2026
Malicious code in viem-js (npm)
3 compromised versions
- Jan 19, 2026
Malicious code in tailwin (npm)
3 compromised versions
- Jan 19, 2026
Malicious code in cyrpto (npm)
3 compromised versions
- Jan 19, 2026
Malware in tailwin
1 compromised version
- Jan 19, 2026
Malware in supabase-js
1 compromised version
- Jan 19, 2026
Malware in cyrpto
1 compromised version
Page 192 of 4,807