Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,322 total in npm · sorted newest first- Dec 19, 2025
Malicious code in tailwind-animationbased (npm)
- Dec 19, 2025
Malware in tailwind-logic
1 compromised version
- Dec 19, 2025
Malware in tailwind-animationbased
1 compromised version
- Dec 19, 2025
Malware in tailwind-color-shine
1 compromised version
- Dec 19, 2025
Malware in elf-stats-snowy-toolkit-186
1 compromised version
- Dec 19, 2025
Malware in elf-stats-sparkly-snowglobe-243
1 compromised version
- Dec 19, 2025
Malware in elf-stats-jolly-hammer-980
1 compromised version
- Dec 19, 2025
Malware in elf-stats-sugarplum-mitten-141
1 compromised version
- Dec 19, 2025
Malware in elf-stats-cosy-garland-592
1 compromised version
- Dec 19, 2025
Malware in elf-stats-silvered-mailbag-755
1 compromised version
- Dec 19, 2025
Malware in elf-stats-candystriped-snowglobe-426
1 compromised version
- Dec 19, 2025
Malware in elf-stats-silvered-wishlist-243
1 compromised version
- Dec 19, 2025
Malware in elf-stats-merry-icicle-449
1 compromised version
- Dec 19, 2025
Malware in elf-stats-ember-stockpile-448
1 compromised version
- Dec 19, 2025
Malicious code in elf-stats-sugarplum-fir-770 (npm)
- Dec 19, 2025
Malware in elf-stats-sugarplum-fir-770
1 compromised version
- Dec 19, 2025
Malicious code in chai-nerd (npm)
- Dec 19, 2025
Malicious code in chai-async (npm)
- Dec 19, 2025
Malware in chai-nerd
1 compromised version
- Dec 19, 2025
Malware in chai-async
1 compromised version
- Dec 19, 2025
Malware in elf-stats
1 compromised version
- Dec 19, 2025
Malicious code in android_teminator_x (npm)
- Dec 19, 2025
Malware in android_teminator_x
1 compromised version
- Dec 19, 2025
Malware in ofjaaah12
1 compromised version
- Dec 19, 2025
Malicious code in @pluxee-design-system/core (npm)
- Dec 19, 2025
Malware in @pluxee-design-system/core
1 compromised version
- Dec 19, 2025
Malicious code in ctfxmlflgcheck (npm)
- Dec 19, 2025
Malicious code in ctfparsertna (npm)
- Dec 19, 2025
Malware in ctfxmlflgcheck
1 compromised version
- Dec 19, 2025
Malware in ctfparsertna
1 compromised version
- Dec 19, 2025
Malicious code in parashaxmgflhg (npm)
- Dec 19, 2025
Malicious code in flagstealerfinal (npm)
- Dec 19, 2025
Malicious code in tnactgfds (npm)
- Dec 19, 2025
Malicious code in my-ctf-package (npm)
- Dec 19, 2025
Malicious code in ctfepakageflgs (npm)
- Dec 19, 2025
Malware in ctfepakageflgs
1 compromised version
- Dec 19, 2025
Malware in flagstealerfinal
1 compromised version
- Dec 19, 2025
Malware in tnactgfds
1 compromised version
- Dec 19, 2025
Malware in my-ctf-package
1 compromised version
- Dec 19, 2025
Malware in parashaxmgflhg
1 compromised version
- Dec 19, 2025
Malware in tnaparserxml
1 compromised version
- Dec 19, 2025
Malicious code in react-enhanced-glow (npm)
- Dec 19, 2025
Malware in react-enhanced-glow
1 compromised version
- Dec 18, 2025
Malicious code in sarumaan_a (npm)
2 compromised versions
- Dec 18, 2025
Malware in elf-stats-ember-stocking-807
1 compromised version
- Dec 18, 2025
Malware in elf-stats-rooftop-hammer-580
1 compromised version
- Dec 17, 2025
Malicious code in xbox-bottomnav (npm)
2 compromised versions
- Dec 17, 2025
Malware in elf-stats-festive-sparkler-275
1 compromised version
- Dec 17, 2025
Malware in vitor-js
1 compromised version
- Dec 17, 2025
Malware in plugin-senna
1 compromised version
Page 213 of 4,807