Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,322 total in npm · sorted newest first- Jan 9, 2026
Malware in yunxohang5
1 compromised version
- Jan 9, 2026
Malware in yunxohang4
1 compromised version
- Jan 9, 2026
Malware in yunxohang7
1 compromised version
- Jan 9, 2026
Malware in shreddit.styles
1 compromised version
- Jan 9, 2026
Malware in yunxohang11
1 compromised version
- Jan 9, 2026
Malware in yunxohang6
1 compromised version
- Jan 9, 2026
Malware in yunxohang10
1 compromised version
- Jan 9, 2026
Malicious code in dotenv-intended (npm)
1 compromised version
- Jan 9, 2026
Malicious code in chai-tests-async (npm)
1 compromised version
- Jan 9, 2026
Malware in dotenv-intended
1 compromised version
- Jan 9, 2026
Malware in chai-tests-async
1 compromised version
- Jan 9, 2026
Malicious code in jwtdapp (npm)
- Jan 9, 2026
Malware in jwtdapp
1 compromised version
- Jan 9, 2026
Malicious code in smintio-portals-component-sdk (npm)
- Jan 9, 2026
Malicious code in mixpanel-lib (npm)
- Jan 9, 2026
Malicious code in cng-web-lib (npm)
- Jan 9, 2026
Malicious code in amdocs-core (npm)
- Jan 9, 2026
Malware in amdocs-core
1 compromised version
- Jan 9, 2026
Malware in cng-web-lib
1 compromised version
- Jan 9, 2026
Malware in smintio-portals-component-sdk
1 compromised version
- Jan 9, 2026
Malware in mixpanel-lib
1 compromised version
- Jan 9, 2026
Malware in secguest-react-lib
1 compromised version
- Jan 9, 2026
Malware in secguest-lib
1 compromised version
- Jan 8, 2026
Malicious code in @zuora-marketing/linting (npm)
2 compromised versions
- Jan 8, 2026
Malicious code in icon-service (npm)
7 compromised versions
- Jan 8, 2026
Malicious code in @kyriba/mf-kit (npm)
1 compromised version
- Jan 8, 2026
Malicious code in @kyriba/ui-workspace (npm)
1 compromised version
- Jan 8, 2026
Malicious code in @kyriba/data-frontend (npm)
2 compromised versions
- Jan 8, 2026
Malicious code in chai-min (npm)
- Jan 8, 2026
Malware in chai-min
1 compromised version
- Jan 8, 2026
Malicious code in jsonify-setting (npm)
- Jan 8, 2026
Malicious code in json-mappings (npm)
- Jan 8, 2026
Malware in json-mappings
1 compromised version
- Jan 8, 2026
Malware in jsonify-setting
1 compromised version
- Jan 8, 2026
Malicious code in shaktihacker2026 (npm)
- Jan 8, 2026
Malware in shaktihacker2026
1 compromised version
- Jan 8, 2026
Malware in shakti20261
1 compromised version
- Jan 8, 2026
Malicious code in ncodeauth (npm)
- Jan 8, 2026
Malware in ncodeauth
1 compromised version
- Jan 8, 2026
Malicious code in test-thegenetic-module (npm)
- Jan 8, 2026
Malicious code in darknet-dispatches-internal (npm)
- Jan 8, 2026
Malware in test-thegenetic-module
1 compromised version
- Jan 8, 2026
Malware in darknet-dispatches-internal
1 compromised version
- Jan 8, 2026
Malicious code in timeout-ts (npm)
- Jan 8, 2026
Malicious code in sparkling-cli (npm)
- Jan 8, 2026
Malware in sparkling-cli
1 compromised version
- Jan 8, 2026
Malware in kcheck
1 compromised version
- Jan 8, 2026
Malware in magic-poc
1 compromised version
- Jan 8, 2026
Malware in vscode-ui5-language-assistant
1 compromised version
- Jan 8, 2026
Malware in backstage-plugin-glean
1 compromised version
Page 198 of 4,807