Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
212,929 total in npm · sorted newest first- May 20, 2026
Malicious code in @limebike/supreme (npm)
- May 20, 2026
Malicious code in @limebike/frontend-core-api (npm)
- May 20, 2026
Malicious code in @doctolib-apps/native-personalized-services (npm)
- May 20, 2026
Malicious code in uolcs-host-uol-anuncios-fe (npm)
1 compromised version
- May 20, 2026
Malicious code in stripe-internal-utils (npm)
1 compromised version
- May 20, 2026
Malicious code in pinno-loggers (npm)
1 compromised version
- May 20, 2026
Malicious code in pretty-logger-utils (npm)
1 compromised version
- May 20, 2026
Malicious code in art-template (npm)
3 compromised versions
- May 20, 2026
Malicious code in ts-logger-pack (npm)
1 compromised version
- May 20, 2026
Malicious code in terminal-logger-utils (npm)
2 compromised versions
- May 19, 2026
Malicious code in did-0091 (npm)
5 compromised versions
- May 19, 2026
Malicious code in collected-forms-embed-js (npm)
4 compromised versions
- May 19, 2026
Malicious code in @mc-xp/mc-monolith-js-src-package (npm)
1 compromised version
- May 19, 2026
Malicious code in @piewasm/pie-web-npm-package (npm)
1 compromised version
- May 19, 2026
Malicious code in is-really-odd (npm)
- May 19, 2026
Malicious code in psxjson (npm)
- May 19, 2026
Malicious code in paysafe-gbp-virtual-assistant-lib-fe (npm)
1 compromised version
- May 19, 2026
Malicious code in chai-as-attracted (npm)
- May 19, 2026
Malicious code in chai-as-vec (npm)
- May 19, 2026
Malicious code in paysafe-gbp-virtual-terminal-lib-fe (npm)
2 compromised versions
- May 19, 2026
Malicious code in identitysecuretokenserv (npm)
2 compromised versions
- May 19, 2026
Malicious code in @apps-home-dashboard/events (npm)
1 compromised version
- May 19, 2026
Malicious code in @cap-js/openapi (npm)
1 compromised version
- May 19, 2026
Malicious code in openclaw-cn (npm)
1 compromised version
- May 19, 2026
Malicious code in @starmind/collector-cli (npm)
1 compromised version
- May 19, 2026
Malicious code in @openclaw-cn/toutiao-ops (npm)
1 compromised version
- May 19, 2026
Malicious code in @openclaw-cn/libsignal (npm)
1 compromised version
- May 19, 2026
Malicious code in @openclaw-cn/feishu (npm)
1 compromised version
- May 19, 2026
Malicious code in @openclaw-cn/cli (npm)
1 compromised version
- May 19, 2026
Malicious code in vfat-tools (npm)
1 compromised version
- May 19, 2026
Malicious code in sickle-wrapper (npm)
1 compromised version
- May 19, 2026
Malicious code in xmorse (npm)
2 compromised versions
- May 19, 2026
Malicious code in word-width (npm)
2 compromised versions
- May 19, 2026
Malicious code in uri-parse (npm)
2 compromised versions
- May 19, 2026
Malicious code in timeago.js (npm)
2 compromised versions
- May 19, 2026
Malicious code in timeago-react (npm)
2 compromised versions
- May 19, 2026
Malicious code in slice.js (npm)
2 compromised versions
- May 19, 2026
Malicious code in size-sensor (npm)
3 compromised versions
- May 19, 2026
Malicious code in ribbon.js (npm)
1 compromised version
- May 19, 2026
Malicious code in relationship.js (npm)
2 compromised versions
- May 19, 2026
Malicious code in react-adsense (npm)
2 compromised versions
- May 19, 2026
Malicious code in onfire.js (npm)
2 compromised versions
- May 19, 2026
Malicious code in miz (npm)
2 compromised versions
- May 19, 2026
Malicious code in mcp-mermaid (npm)
2 compromised versions
- May 19, 2026
Malicious code in mcp-echarts (npm)
2 compromised versions
- May 19, 2026
Malicious code in lint-md-cli (npm)
2 compromised versions
- May 19, 2026
Malicious code in lint-md (npm)
2 compromised versions
- May 19, 2026
Malicious code in limit-size (npm)
2 compromised versions
- May 19, 2026
Malicious code in jest-url-loader (npm)
2 compromised versions
- May 19, 2026
Malicious code in jest-random-mock (npm)
2 compromised versions
Page 2 of 4,259