Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,322 total in npm · sorted newest first- Jan 13, 2026
Malicious code in francium-ui (npm)
2 compromised versions
- Jan 13, 2026
Malware in francium-web-visitors
1 compromised version
- Jan 13, 2026
Malware in francium-ui
1 compromised version
- Jan 13, 2026
Malware in francium-utils
1 compromised version
- Jan 13, 2026
Malicious code in extended-path (npm)
- Jan 13, 2026
Malware in extended-path
1 compromised version
- Jan 13, 2026
Malicious code in chai-as-enhanced (npm)
3 compromised versions
- Jan 13, 2026
Malware in chai-as-enhanced
1 compromised version
- Jan 13, 2026
Malicious code in paytmsiddlewaree (npm)
1 compromised version
- Jan 13, 2026
Malware in paytmsiddlewaree
1 compromised version
- Jan 12, 2026
Malicious code in tailwindcss-animate-tool (npm)
- Jan 12, 2026
Malware in tailwindcss-animate-tool
1 compromised version
- Jan 12, 2026
Malicious code in express-sessions-id (npm)
4 compromised versions
- Jan 12, 2026
Malware in express-sessions-id
1 compromised version
- Jan 12, 2026
Malicious code in cors-base (npm)
- Jan 12, 2026
Malware in cors-base
1 compromised version
- Jan 12, 2026
Malicious code in simple-string-utils3 (npm)
- Jan 12, 2026
Malicious code in passport-google-auth-token (npm)
- Jan 12, 2026
Malicious code in @maxcointech/simple-string-utils (npm)
- Jan 12, 2026
Malware in @maxcointech/simple-string-utils
1 compromised version
- Jan 12, 2026
Malware in passport-google-auth-token
1 compromised version
- Jan 12, 2026
Malware in simple-string-utils3
1 compromised version
- Jan 12, 2026
Malicious code in jz-test-npm (npm)
4 compromised versions
- Jan 12, 2026
Malware in jz-test-npm
1 compromised version
- Jan 12, 2026
Malicious code in react-hook-form-js (npm)
- Jan 12, 2026
Malicious code in luxon-js (npm)
- Jan 12, 2026
Malicious code in jsdom-js (npm)
- Jan 12, 2026
Malicious code in inquirer-js (npm)
- Jan 12, 2026
Malicious code in immer-js (npm)
- Jan 12, 2026
Malicious code in framer-motion-js (npm)
- Jan 12, 2026
Malware in react-hook-form-js
1 compromised version
- Jan 12, 2026
Malware in luxon-js
1 compromised version
- Jan 12, 2026
Malware in immer-js
1 compromised version
- Jan 12, 2026
Malware in jsdom-js
1 compromised version
- Jan 12, 2026
Malware in inquirer-js
1 compromised version
- Jan 12, 2026
Malware in framer-motion-js
1 compromised version
- Jan 12, 2026
Malicious code in pinecone-js (npm)
- Jan 12, 2026
Malicious code in milvus-js (npm)
- Jan 12, 2026
Malicious code in llamaindex-js (npm)
- Jan 12, 2026
Malicious code in huggingface-js (npm)
- Jan 12, 2026
Malware in pinecone-js
1 compromised version
- Jan 12, 2026
Malware in milvus-js
1 compromised version
- Jan 12, 2026
Malware in llamaindex-js
1 compromised version
- Jan 12, 2026
Malware in huggingface-js
1 compromised version
- Jan 12, 2026
Malicious code in xml2js-js (npm)
- Jan 12, 2026
Malware in xml2js-js
1 compromised version
- Jan 12, 2026
Malicious code in gradle-plugin (npm)
- Jan 12, 2026
Malicious code in firestore-types (npm)
- Jan 12, 2026
Malicious code in experimental-utils (npm)
- Jan 12, 2026
Malicious code in auth-types (npm)
Page 196 of 4,807