Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,322 total in npm · sorted newest first- Jan 6, 2026
Malware in smartspacestoreapp
1 compromised version
- Jan 6, 2026
Malware in react-native-kyc
1 compromised version
- Jan 6, 2026
Malicious code in chai-as-required (npm)
- Jan 6, 2026
Malware in chai-as-required
1 compromised version
- Jan 6, 2026
Malicious code in redis-request-parser (npm)
1 compromised version
- Jan 6, 2026
Malicious code in @shop-cicd/webpack-package-artifact (npm)
- Jan 6, 2026
Malware in @shop-cicd/webpack-package-artifact
1 compromised version
- Jan 6, 2026
Malware in @nosinovacao/nosid-mfe-common
1 compromised version
- Jan 6, 2026
Malicious code in n8n-performance-metrics (npm)
- Jan 6, 2026
Malicious code in n8n-nodes-performance-metrics (npm)
- Jan 6, 2026
Malware in n8n-nodes-performance-metrics
1 compromised version
- Jan 6, 2026
Malware in n8n-performance-metrics
1 compromised version
- Jan 6, 2026
Malware in usaa-authentication-mocks
1 compromised version
- Jan 6, 2026
Malware in ugc-kit
1 compromised version
- Jan 6, 2026
Malware in gbiz-next
1 compromised version
- Jan 6, 2026
Malware in ent-profile-unauth-msr-stop
1 compromised version
- Jan 6, 2026
Malware in datatables-editor
1 compromised version
- Jan 6, 2026
Malware in ent-file-upload-widget-v2
1 compromised version
- Jan 6, 2026
Malware in api-umbrella-admin-ui
1 compromised version
- Jan 6, 2026
Malware in tickncook-robot
1 compromised version
- Jan 6, 2026
Malware in kc-next
1 compromised version
- Jan 6, 2026
Malware in ing-feat-malware-detection
1 compromised version
- Jan 6, 2026
Malware in ing-feat-ui-image
1 compromised version
- Jan 6, 2026
Malware in orchestration-node-common-errors
1 compromised version
- Jan 6, 2026
Malware in ing-feat-kyc-consent
1 compromised version
- Jan 6, 2026
Malware in ing-feat-auth-idin
1 compromised version
- Jan 6, 2026
Malware in initializers
1 compromised version
- Jan 6, 2026
Malware in fix-cc-raiesy
1 compromised version
- Jan 6, 2026
Malware in intl-tel-input-utils
1 compromised version
- Jan 6, 2026
Malicious code in redis-cookie-parser (npm)
- Jan 6, 2026
Malicious code in redis-cookie-js (npm)
- Jan 6, 2026
Malicious code in eslint-supertest (npm)
- Jan 6, 2026
Malware in redis-cookie-js
1 compromised version
- Jan 6, 2026
Malware in eslint-supertest
1 compromised version
- Jan 6, 2026
Malware in redis-cookie-parser
1 compromised version
- Jan 6, 2026
Malicious code in oj-sp-messages-banner (npm)
- Jan 6, 2026
Malicious code in oj-sp-css-additions (npm)
- Jan 6, 2026
Malicious code in oj-sp-common-util (npm)
- Jan 6, 2026
Malware in oj-sp-css-additions
1 compromised version
- Jan 6, 2026
Malware in oj-sp-messages-banner
1 compromised version
- Jan 6, 2026
Malware in oj-sp-common-util
1 compromised version
- Jan 6, 2026
Malicious code in oj-sp-common-strings (npm)
- Jan 6, 2026
Malicious code in oj-sp-common (npm)
- Jan 6, 2026
Malicious code in oj-sp-about-page (npm)
- Jan 6, 2026
Malware in oj-sp-common-strings
1 compromised version
- Jan 6, 2026
Malware in oj-sp-about-page
1 compromised version
- Jan 6, 2026
Malware in oj-sp-common
1 compromised version
- Jan 6, 2026
Malicious code in hello-world-npm-demo-example (npm)
- Jan 6, 2026
Malware in hello-world-npm-demo-example
1 compromised version
- Jan 5, 2026
Malicious code in react-transition-group-legacy (npm)
1 compromised version
Page 202 of 4,807