Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,689 total in npm · sorted newest first- Oct 26, 2026
Malicious code in bow-test (npm)
- Oct 26, 2026
Malware in bow-test
1 compromised version
- Oct 26, 2026
Malware in brass-common
1 compromised version
- Oct 26, 2026
Malicious code in css-hnhxwd-polyfill (npm)
- Oct 26, 2026
Malicious code in css-flexgap-shim (npm)
- Oct 26, 2026
Malicious code in util-foriepft (npm)
1 compromised version
- Oct 26, 2026
Malware in css-flexgap-shim
1 compromised version
- Oct 26, 2026
Malware in css-overscroll-contain
1 compromised version
- Oct 26, 2026
Malware in util-foriepft
1 compromised version
- Oct 26, 2026
Malware in css-hnhxwd-polyfill
1 compromised version
- Oct 26, 2026
Malicious code in css-grid-snap-util (npm)
- Oct 26, 2026
Malicious code in @regex33-hackerone/tb-compat (npm)
- Oct 26, 2026
Malware in css-grid-snap-util
1 compromised version
- Oct 26, 2026
Malware in @regex33-hackerone/tb-compat
1 compromised version
- Oct 26, 2026
Malware in ap3-foundations-ui
1 compromised version
- Oct 26, 2026
Malware in react-dropzone-v4
1 compromised version
- Oct 26, 2026
Malware in orderly-plugin-liquidity-heatmap
1 compromised version
- Oct 26, 2026
Malicious code in @walknpm/todo-cli (npm)
1 compromised version
- Oct 26, 2026
Malicious code in dsh-plugin-blender-3d (npm)
1 compromised version
- Oct 26, 2026
Malicious code in @s4yhiitestpoc/scan-https-dualuse-e (npm)
- Oct 26, 2026
Malicious code in @s4yhiitestpoc/scan-echo-b (npm)
- Oct 26, 2026
Malicious code in @s4yhiitestpoc/scan-dns-c (npm)
- Oct 26, 2026
Malicious code in @s4yhiitestpoc/scan-control-a (npm)
- Oct 26, 2026
Malicious code in @s4yhiitestpoc/r2-https-dualuse (npm)
- Oct 26, 2026
Malicious code in @s4yhiitestpoc/r2-echo (npm)
- Oct 26, 2026
Malicious code in @s4yhiitestpoc/r2-dns (npm)
- Oct 26, 2026
Malicious code in @s4yhiitestpoc/r2-control (npm)
- Oct 26, 2026
Malware in @s4yhiitestpoc/scan-dns-c
1 compromised version
- Oct 26, 2026
Malware in @s4yhiitestpoc/r2-https-dualuse
1 compromised version
- Oct 26, 2026
Malware in @s4yhiitestpoc/r2-control
1 compromised version
- Oct 26, 2026
Malware in @s4yhiitestpoc/scan-control-a
1 compromised version
- Oct 26, 2026
Malware in @s4yhiitestpoc/r2-dns
1 compromised version
- Oct 26, 2026
Malware in @s4yhiitestpoc/r2-https-b
1 compromised version
- Oct 26, 2026
Malware in @s4yhiitestpoc/r2-echo
1 compromised version
- Oct 26, 2026
Malware in @s4yhiitestpoc/scan-https-d
1 compromised version
- Oct 26, 2026
Malware in @s4yhiitestpoc/scan-https-dualuse-e
1 compromised version
- Oct 26, 2026
Malware in @s4yhiitestpoc/scan-echo-b
1 compromised version
- Oct 26, 2026
Malware in monitoring-agent
1 compromised version
- Oct 25, 2026
Malicious code in @capsense/core-ui (npm)
1 compromised version
- Oct 25, 2026
Malicious code in @capsense/core-ui (npm)
2 compromised versions
- Oct 25, 2026
Malicious code in @capsense/ccx-welcome-page (npm)
1 compromised version
- Oct 25, 2026
Malicious code in event-bus-lite-testmetest (npm)
1 compromised version
- Oct 25, 2026
Malicious code in @capsense/ccx-welcome-page (npm)
2 compromised versions
- Oct 25, 2026
Malicious code in event-bus-lite-testmetest (npm)
1 compromised version
- Oct 25, 2026
Malicious code in w-mousekey (npm)
2 compromised versions
- Oct 25, 2026
Malware in w-mousekey
1 compromised version
- Oct 25, 2026
Malicious code in @ppa-web-components/ppa-headerfooter (npm)
1 compromised version
- Oct 25, 2026
Malicious code in @ppa-web-components/ppa-hotel-collection (npm)
1 compromised version
- Oct 25, 2026
Malicious code in @ppa-web-components/ppa-searchform (npm)
1 compromised version
- Oct 25, 2026
Malicious code in paychex-pdftron (npm)
1 compromised version
Page 2 of 6,634