Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,322 total in npm · sorted newest first- Jan 19, 2026
Malware in libsignal-yazxzcode
1 compromised version
- Jan 19, 2026
Malicious code in zod-js (npm)
- Jan 19, 2026
Malware in zod-js
1 compromised version
- Jan 19, 2026
Malicious code in wac-react-relay (npm)
- Jan 19, 2026
Malicious code in @brokenzzz/garfish (npm)
1 compromised version
- Jan 19, 2026
Malware in @brokenzzz/garfish
1 compromised version
- Jan 19, 2026
Malware in wac-react-relay
1 compromised version
- Jan 19, 2026
Malicious code in 1231dai (npm)
1 compromised version
- Jan 19, 2026
Malware in 1231dai
1 compromised version
- Jan 19, 2026
Malicious code in viem-js (npm)
3 compromised versions
- Jan 19, 2026
Malicious code in tailwin (npm)
3 compromised versions
- Jan 19, 2026
Malicious code in cyrpto (npm)
3 compromised versions
- Jan 19, 2026
Malware in tailwin
1 compromised version
- Jan 19, 2026
Malware in supabase-js
1 compromised version
- Jan 19, 2026
Malware in cyrpto
1 compromised version
- Jan 19, 2026
Malware in viem-js
1 compromised version
- Jan 19, 2026
Malicious code in tronweb-tool (npm)
- Jan 19, 2026
Malware in tronweb-tool
1 compromised version
- Jan 19, 2026
Malicious code in @daffadeveloper/signal-node (npm)
1 compromised version
- Jan 19, 2026
Malware in @daffadeveloper/signal-node
1 compromised version
- Jan 17, 2026
Malicious code in typedoc-plugin-fuel-variants (npm)
1 compromised version
- Jan 17, 2026
Malicious code in eslint-plugin-fuel-react (npm)
1 compromised version
- Jan 17, 2026
Malicious code in mapkit-example-vanillajs (npm)
1 compromised version
- Jan 16, 2026
Malware in chakra-ui-2--styled-system
1 compromised version
- Jan 16, 2026
Malware in chakra-ui-2--theme-tools
1 compromised version
- Jan 16, 2026
Malware in experian-design-system
1 compromised version
- Jan 16, 2026
Malware in chakra-ui-2--react-utils
1 compromised version
- Jan 16, 2026
Malware in silvermine
1 compromised version
- Jan 16, 2026
Malware in comstrap
1 compromised version
- Jan 16, 2026
Malware in closure-net
1 compromised version
- Jan 16, 2026
Malware in vet-bones
1 compromised version
- Jan 16, 2026
Malware in bve-react-ui-kit
1 compromised version
- Jan 16, 2026
Malware in wac-react
1 compromised version
- Jan 16, 2026
Malware in wac-react-dom
1 compromised version
- Jan 16, 2026
Malware in auc-2-lib
1 compromised version
- Jan 16, 2026
Malware in wac-relay-runtime
1 compromised version
- Jan 16, 2026
Malware in chakra-ui-2--react
1 compromised version
- Jan 16, 2026
Malware in base-ui-vue3
1 compromised version
- Jan 16, 2026
Malware in sd-ccp-module-client
1 compromised version
- Jan 16, 2026
Malware in resto_ui_components
1 compromised version
- Jan 16, 2026
Malware in alf-ui-js
1 compromised version
- Jan 16, 2026
Malware in idel2-content
1 compromised version
- Jan 16, 2026
Malware in insightvm-ui-nav-menus
1 compromised version
- Jan 16, 2026
Malware in origin_response_handler
1 compromised version
- Jan 16, 2026
Malware in cognito-auth-plugin
1 compromised version
- Jan 16, 2026
Malware in sd-cip-module-client
1 compromised version
- Jan 16, 2026
Malware in nyse-web-tools-common
1 compromised version
- Jan 16, 2026
Malware in lead-ion
1 compromised version
- Jan 16, 2026
Malware in lusha-integrations-widgets
1 compromised version
- Jan 16, 2026
Malware in focus-trap-v2
1 compromised version
Page 193 of 4,807