Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,322 total in npm · sorted newest first- Dec 31, 2025
Malicious code in @vietmoney/react-native-tags-input (npm)
- Dec 31, 2025
Malicious code in @vietmoney/react-native-smart-page (npm)
- Dec 31, 2025
Malicious code in @vietmoney/react-native-smart-gallery (npm)
- Dec 31, 2025
Malicious code in @vietmoney/react-native-image-transformer (npm)
- Dec 31, 2025
Malicious code in @vietmoney/react-native-htmlview (npm)
- Dec 31, 2025
Malicious code in @vietmoney/react-native-action-button (npm)
- Dec 31, 2025
Malicious code in @vietmoney/react-big-calendar (npm)
3 compromised versions
- Dec 31, 2025
Malware in @vietmoney/react-native-htmlview
1 compromised version
- Dec 31, 2025
Malware in @vietmoney/react-native-tags-input
1 compromised version
- Dec 31, 2025
Malware in @vietmoney/react-native-action-button
1 compromised version
- Dec 31, 2025
Malware in @vietmoney/react-native-vnpay-merchant
1 compromised version
- Dec 31, 2025
Malware in landingpage-service
1 compromised version
- Dec 31, 2025
Malware in @vietmoney/react-native-smart-gallery
1 compromised version
- Dec 31, 2025
Malware in @vietmoney/vision-camera-code-scanner
1 compromised version
- Dec 31, 2025
Malware in @vietmoney/react-native-smart-page
1 compromised version
- Dec 31, 2025
Malware in @vietmoney/react-native-image-transformer
1 compromised version
- Dec 31, 2025
Malware in @vietmoney/react-native-true-id
1 compromised version
- Dec 31, 2025
Malware in @vietmoney/vietmoneywork
1 compromised version
- Dec 31, 2025
Malware in @vietmoney/react-big-calendar
1 compromised version
- Dec 30, 2025
Malicious code in nbugs-video (npm)
- Dec 30, 2025
Malware in nbugs-video
1 compromised version
- Dec 30, 2025
Malware in ro-mobile
1 compromised version
- Dec 30, 2025
Malicious code in npm-xmt (npm)
2 compromised versions
- Dec 30, 2025
Malware in npm-xmt
1 compromised version
- Dec 30, 2025
Malicious code in error-fallback (npm)
- Dec 30, 2025
Malicious code in chai-promised-chains (npm)
1 compromised version
- Dec 30, 2025
Malware in chai-promised-chains
1 compromised version
- Dec 30, 2025
Malware in error-fallback
1 compromised version
- Dec 30, 2025
Malware in vscode-azure-mcp-server
1 compromised version
- Dec 30, 2025
Malware in dc-extras
1 compromised version
- Dec 30, 2025
Malicious code in @ptest2535/ui-core_mal (npm)
- Dec 30, 2025
Malicious code in @ptest2535/test_package (npm)
- Dec 30, 2025
Malicious code in @ptest2535/l_woker_mal (npm)
- Dec 30, 2025
Malicious code in @ptest2535/artifactory-demo-ptest (npm)
- Dec 30, 2025
Malware in @ptest2535/test_package
1 compromised version
- Dec 30, 2025
Malware in @ptest2535/l_woker_mal
1 compromised version
- Dec 30, 2025
Malware in @ptest2535/artifactory-demo-ptest
1 compromised version
- Dec 30, 2025
Malware in @ptest2535/ui-core_mal
1 compromised version
- Dec 30, 2025
Malicious code in yellowdiscordlookup (npm)
- Dec 30, 2025
Malware in yellowdiscordlookup
1 compromised version
- Dec 30, 2025
Malicious code in bigmathex (npm)
3 compromised versions
- Dec 30, 2025
Malware in bigmathex
1 compromised version
- Dec 30, 2025
Malicious code in portal-lise (npm)
1 compromised version
- Dec 30, 2025
Malware in portal-lise
1 compromised version
- Dec 30, 2025
Malicious code in shopify-app-react-router (npm)
- Dec 30, 2025
Malicious code in shop-minis-docs (npm)
- Dec 30, 2025
Malicious code in rt-text-media-collection (npm)
- Dec 30, 2025
Malicious code in rt-interactive-card-collection (npm)
- Dec 30, 2025
Malicious code in react-dom-bindings (npm)
- Dec 30, 2025
Malicious code in react-devtools-shared (npm)
Page 204 of 4,807