Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,322 total in npm · sorted newest first- Jan 7, 2026
Malicious code in redis-cookie-ts (npm)
- Jan 7, 2026
Malicious code in eslint-plugin-supertest (npm)
- Jan 7, 2026
Malware in redis-request-parser
1 compromised version
- Jan 7, 2026
Malware in redis-cookie-ts
1 compromised version
- Jan 7, 2026
Malware in eslint-plugin-supertest
1 compromised version
- Jan 6, 2026
Malware in commander-stable
1 compromised version
- Jan 6, 2026
Malicious code in evm-gateway-contracts-private (npm)
- Jan 6, 2026
Malicious code in elastic-docs-v3-utilities (npm)
- Jan 6, 2026
Malware in evm-gateway-contracts-private
1 compromised version
- Jan 6, 2026
Malware in elastic-docs-v3-utilities
1 compromised version
- Jan 6, 2026
Malicious code in code-review-frontend (npm)
- Jan 6, 2026
Malware in code-review-frontend
1 compromised version
- Jan 6, 2026
Malicious code in x-clients-features (npm)
- Jan 6, 2026
Malware in x-clients-features
1 compromised version
- Jan 6, 2026
Malicious code in shopify-perf-kit (npm)
- Jan 6, 2026
Malicious code in okta-signin-widget (npm)
- Jan 6, 2026
Malicious code in okta-loginpage-render (npm)
- Jan 6, 2026
Malicious code in okta-auth-js (npm)
- Jan 6, 2026
Malicious code in matic-transfer-consumer (npm)
- Jan 6, 2026
Malicious code in importmap-polyfil (npm)
- Jan 6, 2026
Malicious code in electra-web-player-event (npm)
- Jan 6, 2026
Malicious code in electra-web-player (npm)
- Jan 6, 2026
Malware in okta-auth-js
1 compromised version
- Jan 6, 2026
Malware in okta-signin-widget
1 compromised version
- Jan 6, 2026
Malware in electra-web-player
1 compromised version
- Jan 6, 2026
Malware in matic-transfer-consumer
1 compromised version
- Jan 6, 2026
Malware in okta-loginpage-render
1 compromised version
- Jan 6, 2026
Malware in importmap-polyfil
1 compromised version
- Jan 6, 2026
Malware in shopify-perf-kit
1 compromised version
- Jan 6, 2026
Malware in electra-web-player-event
1 compromised version
- Jan 6, 2026
Malicious code in polymarket-clob (npm)
- Jan 6, 2026
Malware in polymarket-clob
1 compromised version
- Jan 6, 2026
Malicious code in ethos2.0 (npm)
- Jan 6, 2026
Malware in ethos2.0
1 compromised version
- Jan 6, 2026
Malicious code in wikibuy-mobile-analytics (npm)
- Jan 6, 2026
Malicious code in wikibuy-mobile (npm)
- Jan 6, 2026
Malicious code in upgrade-mobile (npm)
- Jan 6, 2026
Malicious code in smartspacestoreapp (npm)
- Jan 6, 2026
Malicious code in seanp-test-package-do-not-use2 (npm)
- Jan 6, 2026
Malicious code in react-native-kyc (npm)
- Jan 6, 2026
Malicious code in open-telemetry-mini-client (npm)
- Jan 6, 2026
Malicious code in cp_amm (npm)
- Jan 6, 2026
Malicious code in bignumber.js-new (npm)
- Jan 6, 2026
Malware in bignumber.js-new
1 compromised version
- Jan 6, 2026
Malware in cp_amm
1 compromised version
- Jan 6, 2026
Malware in wikibuy-mobile
1 compromised version
- Jan 6, 2026
Malware in upgrade-mobile
1 compromised version
- Jan 6, 2026
Malware in seanp-test-package-do-not-use2
1 compromised version
- Jan 6, 2026
Malware in open-telemetry-mini-client
1 compromised version
- Jan 6, 2026
Malware in wikibuy-mobile-analytics
1 compromised version
Page 201 of 4,807