Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,322 total in npm · sorted newest first- Jan 5, 2026
Malicious code in @crepo/crepo-url-query-mapper (npm)
1 compromised version
- Jan 5, 2026
Malicious code in faceplate-ui (npm)
1 compromised version
- Jan 5, 2026
Malicious code in diskho (npm)
1 compromised version
- Jan 5, 2026
Malicious code in shop-state (npm)
1 compromised version
- Jan 5, 2026
Malware in github-badge-bot
1 compromised version
- Jan 5, 2026
Malware in tiny-model-update
1 compromised version
- Jan 5, 2026
Malware in utif-updated
1 compromised version
- Jan 5, 2026
Malicious code in @signify/vue-components (npm)
- Jan 5, 2026
Malicious code in @airtel-web/legos (npm)
- Jan 5, 2026
Malware in @signify/vue-components
1 compromised version
- Jan 5, 2026
Malware in @airtel-web/clickstream
1 compromised version
- Jan 5, 2026
Malware in @airtel-web/legos
1 compromised version
- Jan 5, 2026
Malware in bettermode-common
1 compromised version
- Jan 5, 2026
Malicious code in published_at (npm)
3 compromised versions
- Jan 5, 2026
Malware in published_at
1 compromised version
- Jan 5, 2026
Malicious code in spire.officejs-document (npm)
1 compromised version
- Jan 5, 2026
Malicious code in spire.officejs-common (npm)
1 compromised version
- Jan 5, 2026
Malicious code in spire.officejs-editors (npm)
2 compromised versions
- Jan 4, 2026
Malicious code in atm_bmw (npm)
1 compromised version
- Jan 4, 2026
Malicious code in blobhunter-depconf-poc (npm)
1 compromised version
- Jan 3, 2026
Malicious code in dstny-utils (npm)
1 compromised version
- Jan 3, 2026
Malicious code in ipvision-selfcare (npm)
1 compromised version
- Jan 2, 2026
Malicious code in 511fola (npm)
2 compromised versions
- Jan 2, 2026
Malicious code in usaa-authentication-mocks (npm)
- Jan 2, 2026
Malicious code in tickncook-robot (npm)
- Jan 2, 2026
Malicious code in showdownxss (npm)
- Jan 2, 2026
Malicious code in pkg1bate5apg1 (npm)
1 compromised version
- Jan 2, 2026
Malicious code in orchestration-node-common-errors (npm)
- Jan 2, 2026
Malicious code in kid-api (npm)
1 compromised version
- Jan 2, 2026
Malicious code in jest-config-ibm-cloud-cognitive (npm)
- Jan 2, 2026
Malicious code in initializers (npm)
- Jan 2, 2026
Malicious code in identity-emitter (npm)
5 compromised versions
- Jan 2, 2026
Malicious code in fix-cc-raiesy (npm)
- Jan 2, 2026
Malicious code in eslint-config-skynet (npm)
- Jan 2, 2026
Malicious code in ent-profile-unauth-msr-stop (npm)
- Jan 2, 2026
Malicious code in ent-file-upload-widget-v2 (npm)
- Jan 2, 2026
Malicious code in datatables-editor (npm)
- Jan 2, 2026
Malicious code in cc-double-1 (npm)
1 compromised version
- Jan 2, 2026
Malicious code in babel-preset-ibm-cloud-cognitive (npm)
- Jan 2, 2026
Malicious code in @nitaiapiiro/rand_emoji (npm)
- Jan 1, 2026
Malicious code in rules-playground (npm)
1 compromised version
- Jan 1, 2026
Malicious code in rules-deployer (npm)
1 compromised version
- Jan 1, 2026
Malicious code in common-cli-utils (npm)
1 compromised version
- Dec 31, 2025
Malicious code in @polystream/streaming (npm)
2 compromised versions
- Dec 31, 2025
Malware in @polystream/streaming
1 compromised version
- Dec 31, 2025
Malicious code in landingpage-service (npm)
- Dec 31, 2025
Malicious code in @vietmoney/vision-camera-code-scanner (npm)
- Dec 31, 2025
Malicious code in @vietmoney/vietmoneywork (npm)
- Dec 31, 2025
Malicious code in @vietmoney/react-native-vnpay-merchant (npm)
- Dec 31, 2025
Malicious code in @vietmoney/react-native-true-id (npm)
Page 203 of 4,807