Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
239,899 total in npm · sorted newest first- Jul 14, 2026
Malicious code in @flcik/flick.js (npm)
9 compromised versions
- Jul 14, 2026
Malicious code in fastify-bundler (npm)
1 compromised version
- Jul 14, 2026
Malicious code in @tqm-mfe/main (npm)
1 compromised version
- Jul 14, 2026
Malicious code in chai-as-sets (npm)
1 compromised version
- Jul 14, 2026
Malicious code in chai-as-auth (npm)
1 compromised version
- Jul 13, 2026
Malicious code in polymarket-bot-logger (npm)
1 compromised version
- Jul 13, 2026
Malicious code in nodemon-client (npm)
- Jul 13, 2026
Malicious code in nodemon-eslint (npm)
- Jul 13, 2026
Malicious code in nodemon-web (npm)
1 compromised version
- Jul 13, 2026
Malicious code in type-astr (npm)
1 compromised version
- Jul 13, 2026
Malicious code in type-swap (npm)
1 compromised version
- Jul 13, 2026
Malicious code in type-unique (npm)
1 compromised version
- Jul 13, 2026
Malicious code in nodemon-delog (npm)
1 compromised version
- Jul 13, 2026
Malicious code in nodemon-elint (npm)
1 compromised version
- Jul 13, 2026
Malicious code in chai-as-verified (npm)
1 compromised version
- Jul 13, 2026
Malicious code in node-fsagent (npm)
9 compromised versions
- Jul 13, 2026
Malicious code in test_adminet (npm)
1 compromised version
- Jul 13, 2026
Malicious code in express-ini (npm)
1 compromised version
- Jul 13, 2026
Malicious code in filewisee (npm)
2 compromised versions
- Jul 13, 2026
Malicious code in bubblestring (npm)
1 compromised version
- Jul 13, 2026
Malicious code in ddok-modal (npm)
1 compromised version
- Jul 13, 2026
Malicious code in n8n-nodes-rce-poc (npm)
1 compromised version
- Jul 13, 2026
Malicious code in gamified-trading-system (npm)
2 compromised versions
- Jul 13, 2026
Malicious code in eslint-angular-react (npm)
1 compromised version
- Jul 13, 2026
Malicious code in express-bunker (npm)
1 compromised version
- Jul 13, 2026
Malicious code in @quukk/opencode-clawmessenger (npm)
1 compromised version
- Jul 13, 2026
Malicious code in @quickcall/krew (npm)
1 compromised version
- Jul 13, 2026
Malicious code in eth-lib-utils (npm)
3 compromised versions
- Jul 13, 2026
Malicious code in insomnia-plugin-poc-m4gester-run (npm)
1 compromised version
- Jul 13, 2026
Malicious code in assertcoreutils (npm)
2 compromised versions
- Jul 13, 2026
Malicious code in font-huge (npm)
1 compromised version
- Jul 13, 2026
Malicious code in @sqlite-panel/createsql (npm)
1 compromised version
- Jul 13, 2026
Malicious code in permcarmserver (npm)
1 compromised version
- Jul 13, 2026
Malicious code in permcserver (npm)
3 compromised versions
- Jul 13, 2026
Malicious code in @omniwatch-wick/cli (npm)
1 compromised version
- Jul 13, 2026
Malicious code in @outsmartly/metaobjects (npm)
1 compromised version
- Jul 13, 2026
Malicious code in polymarket-stake-kelly-math-check (npm)
1 compromised version
- Jul 13, 2026
Malicious code in react-icons-svgo (npm)
3 compromised versions
- Jul 13, 2026
Malicious code in node-fsmetrics-data (npm)
2 compromised versions
- Jul 13, 2026
Malicious code in route-processor (npm)
1 compromised version
- Jul 13, 2026
Malicious code in node-fsmetrics-native (npm)
1 compromised version
- Jul 13, 2026
Malicious code in polymarket-mcp-v2 (npm)
1 compromised version
- Jul 13, 2026
Malicious code in @sectest429/hello-npm-world (npm)
1 compromised version
- Jul 13, 2026
Malicious code in @torbeck/priority-queue (npm)
3 compromised versions
- Jul 13, 2026
Malicious code in claude-team-tracker (npm)
3 compromised versions
- Jul 13, 2026
Malicious code in @dervix/socket.io (npm)
7 compromised versions
- Jul 13, 2026
Malicious code in @dervix/engine.io (npm)
6 compromised versions
- Jul 13, 2026
Malicious code in @gleamkit/socket.io (npm)
3 compromised versions
- Jul 13, 2026
Malicious code in @gleamkit/engine.io (npm)
3 compromised versions
- Jul 13, 2026
Malicious code in loading-sessions (npm)
1 compromised version
Page 2 of 4,798