Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,322 total in npm · sorted newest first- Dec 23, 2025
Malicious code in chai-as-validated (npm)
1 compromised version
- Dec 23, 2025
Malicious code in chai-as-tested (npm)
1 compromised version
- Dec 23, 2025
Malicious code in chai-as-deploy (npm)
1 compromised version
- Dec 23, 2025
Malicious code in caterpillar-test (npm)
1 compromised version
- Dec 23, 2025
Malicious code in canva-test (npm)
1 compromised version
- Dec 23, 2025
Malicious code in calculator-40ed (npm)
2 compromised versions
- Dec 23, 2025
Malicious code in bootstrap-setflexcolor (npm)
1 compromised version
- Dec 23, 2025
Malicious code in bootstrap-setcolors (npm)
1 compromised version
- Dec 23, 2025
Malicious code in bootstrap-setcolor (npm)
2 compromised versions
- Dec 23, 2025
Malicious code in booms-ai (npm)
1 compromised version
- Dec 23, 2025
Malicious code in bignumberx (npm)
1 compromised version
- Dec 23, 2025
Malicious code in baidu-src-test4 (npm)
1 compromised version
- Dec 23, 2025
Malicious code in auth-handler (npm)
1 compromised version
- Dec 23, 2025
Malicious code in assert-json-not (npm)
1 compromised version
- Dec 23, 2025
Malicious code in amournapraia (npm)
1 compromised version
- Dec 23, 2025
Malicious code in amazon-testpackage (npm)
2 compromised versions
- Dec 23, 2025
Malicious code in alicenpmpackage (npm)
1 compromised version
- Dec 23, 2025
Malicious code in acz.view.src (npm)
8 compromised versions
- Dec 23, 2025
Malicious code in @ownbackup/ob-query-builder (npm)
1 compromised version
- Dec 23, 2025
Malicious code in @ownbackup/ob-loader (npm)
1 compromised version
- Dec 23, 2025
Malicious code in @ownbackup/ob-design-system (npm)
1 compromised version
- Dec 23, 2025
Malicious code in @ownbackup/icons (npm)
1 compromised version
- Dec 23, 2025
Malicious code in @ownbackup/data-grid (npm)
1 compromised version
- Dec 23, 2025
Malicious code in @ownbackup/data-chart (npm)
1 compromised version
- Dec 23, 2025
Malicious code in @ads-core/types (npm)
2 compromised versions
- Dec 22, 2025
Malicious code in ro-mobile (npm)
2 compromised versions
- Dec 22, 2025
Malicious code in mw-frontend-utils (npm)
- Dec 22, 2025
Malicious code in mui-wrapper-core (npm)
- Dec 22, 2025
Malicious code in ivx-cloud-client-v1 (npm)
- Dec 22, 2025
Malicious code in dc-extras (npm)
2 compromised versions
- Dec 22, 2025
Malicious code in airslate-dep-webpack (npm)
3 compromised versions
- Dec 22, 2025
Malicious code in @vienna_cancer_center_portal/js (npm)
- Dec 22, 2025
Malicious code in cloudy-uvi-sense-v11 (npm)
1 compromised version
- Dec 22, 2025
Malware in raven-hubspot
1 compromised version
- Dec 22, 2025
Malicious code in utif-updated (npm)
3 compromised versions
- Dec 22, 2025
Malicious code in tiny-model-update (npm)
4 compromised versions
- Dec 22, 2025
Malicious code in commander-stable (npm)
1 compromised version
- Dec 22, 2025
Malicious code in secguest-lib (npm)
1 compromised version
- Dec 21, 2025
Malicious code in github-badge-bot (npm)
24 compromised versions
- Dec 21, 2025
Malicious code in meta-code-verify (npm)
1 compromised version
- Dec 20, 2025
Malicious code in @nosinovacao/nosid-mfe-common (npm)
3 compromised versions
- Dec 20, 2025
Malicious code in othw (npm)
1 compromised version
- Dec 20, 2025
Malicious code in escaux-scrumboard-api (npm)
1 compromised version
- Dec 19, 2025
Malicious code in jest-stable (npm)
2 compromised versions
- Dec 19, 2025
Malicious code in shakti20261 (npm)
2 compromised versions
- Dec 19, 2025
Malware in libxmljs2woter
1 compromised version
- Dec 19, 2025
Malicious code in zebracros-bahlil (npm)
- Dec 19, 2025
Malicious code in xnetgpt-lite (npm)
- Dec 19, 2025
Malicious code in xnetgpt (npm)
- Dec 19, 2025
Malicious code in wifi-killer-xnet (npm)
Page 210 of 4,807