Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,322 total in npm · sorted newest first- Dec 23, 2025
Malicious code in dotenv-extend (npm)
1 compromised version
- Dec 23, 2025
Malicious code in chai-tests-await (npm)
1 compromised version
- Dec 23, 2025
Malware in dotenv-extend
1 compromised version
- Dec 23, 2025
Malware in chai-tests-await
1 compromised version
- Dec 23, 2025
Malicious code in huangmingming-demo (npm)
- Dec 23, 2025
Malware in huangmingming-demo
1 compromised version
- Dec 23, 2025
Malicious code in streamixer (npm)
- Dec 23, 2025
Malware in streamixer
1 compromised version
- Dec 23, 2025
Malicious code in workvivo-layout-extension (npm)
2 compromised versions
- Dec 23, 2025
Malicious code in workvivo-chatbot (npm)
2 compromised versions
- Dec 23, 2025
Malicious code in workvivo-anniversary-automation (npm)
1 compromised version
- Dec 23, 2025
Malicious code in wealthbox-marketing (npm)
2 compromised versions
- Dec 23, 2025
Malicious code in vite-react-setting (npm)
1 compromised version
- Dec 23, 2025
Malicious code in varshade-afc (npm)
5 compromised versions
- Dec 23, 2025
Malicious code in vapark-boost-v1 (npm)
1 compromised version
- Dec 23, 2025
Malicious code in typeface-maison-neue (npm)
1 compromised version
- Dec 23, 2025
Malicious code in tierlist (npm)
3 compromised versions
- Dec 23, 2025
Malicious code in tescoutils (npm)
2 compromised versions
- Dec 23, 2025
Malicious code in teeseest (npm)
1 compromised version
- Dec 23, 2025
Malicious code in tdm-react (npm)
4 compromised versions
- Dec 23, 2025
Malicious code in suntik-tiktok (npm)
5 compromised versions
- Dec 23, 2025
Malicious code in sturdyfetch9 (npm)
1 compromised version
- Dec 23, 2025
Malicious code in sturdyfetch5 (npm)
1 compromised version
- Dec 23, 2025
Malicious code in sturdyfetch4 (npm)
1 compromised version
- Dec 23, 2025
Malicious code in sturdyfetch3 (npm)
1 compromised version
- Dec 23, 2025
Malicious code in sturdyfetch22 (npm)
1 compromised version
- Dec 23, 2025
Malicious code in sturdyfetch21 (npm)
1 compromised version
- Dec 23, 2025
Malicious code in sturdyfetch19 (npm)
1 compromised version
- Dec 23, 2025
Malicious code in sturdyfetch18 (npm)
1 compromised version
- Dec 23, 2025
Malicious code in sturdyfetch17 (npm)
1 compromised version
- Dec 23, 2025
Malicious code in sturdyfetch15 (npm)
1 compromised version
- Dec 23, 2025
Malicious code in streamlinear (npm)
1 compromised version
- Dec 23, 2025
Malicious code in stream-chain-xor (npm)
1 compromised version
- Dec 23, 2025
Malicious code in smart-parser (npm)
1 compromised version
- Dec 23, 2025
Malicious code in session-parse (npm)
1 compromised version
- Dec 23, 2025
Malicious code in session-keeper (npm)
2 compromised versions
- Dec 23, 2025
Malicious code in security-testing-research99 (npm)
3 compromised versions
- Dec 23, 2025
Malicious code in security-testing-research- (npm)
1 compromised version
- Dec 23, 2025
Malicious code in resethp (npm)
2 compromised versions
- Dec 23, 2025
Malicious code in redux-motion (npm)
1 compromised version
- Dec 23, 2025
Malicious code in react-resizable-text (npm)
1 compromised version
- Dec 23, 2025
Malicious code in react-flex-tools (npm)
1 compromised version
- Dec 23, 2025
Malicious code in react-confetti-enhanced (npm)
1 compromised version
- Dec 23, 2025
Malicious code in portal-aes (npm)
1 compromised version
- Dec 23, 2025
Malicious code in polyfill-corejs2 (npm)
2 compromised versions
- Dec 23, 2025
Malicious code in petco-test (npm)
1 compromised version
- Dec 23, 2025
Malicious code in pentestlyio-testpackage (npm)
2 compromised versions
- Dec 23, 2025
Malicious code in oneday-worm-research (npm)
5 compromised versions
- Dec 23, 2025
Malicious code in nokaca (npm)
2 compromised versions
- Dec 23, 2025
Malicious code in node-calculator-x7k9-grabber (npm)
1 compromised version
Page 207 of 4,807