Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,322 total in npm · sorted newest first- Dec 30, 2025
Malicious code in react-devtools-extensions (npm)
- Dec 30, 2025
Malicious code in eb-csr (npm)
2 compromised versions
- Dec 30, 2025
Malicious code in cdd-plugin-for-datawarrior (npm)
1 compromised version
- Dec 30, 2025
Malicious code in awsmcc (npm)
- Dec 30, 2025
Malware in eb-csr
1 compromised version
- Dec 30, 2025
Malware in stitch-ui-toolbox
1 compromised version
- Dec 30, 2025
Malware in baas-admin-sdk
1 compromised version
- Dec 30, 2025
Malware in shopify-app-react-router
1 compromised version
- Dec 30, 2025
Malware in awsmcc
1 compromised version
- Dec 30, 2025
Malware in react-dom-bindings
1 compromised version
- Dec 30, 2025
Malware in react-devtools-extensions
1 compromised version
- Dec 30, 2025
Malware in internal-test-utils
1 compromised version
- Dec 30, 2025
Malware in rt-text-media-collection
1 compromised version
- Dec 30, 2025
Malware in react-devtools-shared
1 compromised version
- Dec 30, 2025
Malware in float-kit
1 compromised version
- Dec 30, 2025
Malware in rt-interactive-card-collection
1 compromised version
- Dec 30, 2025
Malware in cdd-plugin-for-datawarrior
1 compromised version
- Dec 30, 2025
Malware in react-server-dom-fb
1 compromised version
- Dec 30, 2025
Malware in shop-minis-docs
1 compromised version
- Dec 30, 2025
Malicious code in express-js-web (npm)
- Dec 30, 2025
Malicious code in @peter_wilson12091/internal-json-test-parser (npm)
- Dec 30, 2025
Malware in express-js-web
1 compromised version
- Dec 30, 2025
Malware in @peter_wilson12091/internal-json-test-parser
1 compromised version
- Dec 30, 2025
Malicious code in tailwindcss-typography-style (npm)
- Dec 30, 2025
Malware in tailwindcss-typography-style
1 compromised version
- Dec 30, 2025
Malicious code in pepsico-ds (npm)
- Dec 30, 2025
Malicious code in @bugdtest/test1 (npm)
- Dec 30, 2025
Malware in @bugdtest/test1
1 compromised version
- Dec 30, 2025
Malware in pepsico-ds
1 compromised version
- Dec 30, 2025
Malware in @ikarem/telemetry
1 compromised version
- Dec 29, 2025
Malicious code in kcheck (npm)
2 compromised versions
- Dec 29, 2025
Malicious code in intl-tel-input-utils (npm)
2 compromised versions
- Dec 29, 2025
Malicious code in crypto-trade-analyzer (npm)
1 compromised version
- Dec 28, 2025
Malicious code in eslint-config-pexip-engage (npm)
1 compromised version
- Dec 28, 2025
Malicious code in api-umbrella-admin-ui (npm)
1 compromised version
- Dec 27, 2025
Malicious code in eslint-config-sdk (npm)
10 compromised versions
- Dec 27, 2025
Malicious code in ugc-kit (npm)
1 compromised version
- Dec 27, 2025
Malicious code in ing-feat-malware-detection (npm)
1 compromised version
- Dec 27, 2025
Malicious code in ing-feat-ui-image (npm)
1 compromised version
- Dec 27, 2025
Malicious code in backstage-plugin-glean (npm)
1 compromised version
- Dec 26, 2025
Malicious code in bola511 (npm)
1 compromised version
- Dec 26, 2025
Malicious code in yunxohang4 (npm)
1 compromised version
- Dec 26, 2025
Malicious code in magic-poc (npm)
1 compromised version
- Dec 25, 2025
Malicious code in bettermode-icons (npm)
2 compromised versions
- Dec 25, 2025
Malicious code in bettermode-common (npm)
1 compromised version
- Dec 25, 2025
Malicious code in ing-feat-kyc-consent (npm)
2 compromised versions
- Dec 25, 2025
Malicious code in ing-feat-auth-idin (npm)
1 compromised version
- Dec 25, 2025
Malicious code in ing-feat-mortgage-consent-starter (npm)
1 compromised version
- Dec 25, 2025
Malicious code in ing-feat-pis-single-payments (npm)
1 compromised version
- Dec 25, 2025
Malicious code in cc-raiesy (npm)
1 compromised version
Page 205 of 4,807