Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,346 total in npm · sorted newest first- Dec 11, 2025
Malicious code in libxmlfinal4 (npm)
1 compromised version
- Dec 11, 2025
Malicious code in libxmlfinal3 (npm)
- Dec 11, 2025
Malicious code in libxmlfinal (npm)
1 compromised version
- Dec 11, 2025
Malicious code in fadafas3 (npm)
- Dec 11, 2025
Malicious code in elf-stats-sugarplum-mitten-141 (npm)
1 compromised version
- Dec 11, 2025
Malicious code in elf-stats-sparkly-snowglobe-243 (npm)
1 compromised version
- Dec 11, 2025
Malicious code in elf-stats-snowy-toolkit-186 (npm)
1 compromised version
- Dec 11, 2025
Malicious code in elf-stats-silvered-wishlist-243 (npm)
1 compromised version
- Dec 11, 2025
Malicious code in elf-stats-silvered-mailbag-755 (npm)
1 compromised version
- Dec 11, 2025
Malicious code in elf-stats-merry-icicle-449 (npm)
1 compromised version
- Dec 11, 2025
Malicious code in elf-stats-jolly-hammer-980 (npm)
1 compromised version
- Dec 11, 2025
Malicious code in elf-stats-ember-stockpile-448 (npm)
1 compromised version
- Dec 11, 2025
Malicious code in elf-stats-cosy-garland-592 (npm)
1 compromised version
- Dec 11, 2025
Malicious code in elf-stats-candystriped-snowglobe-426 (npm)
1 compromised version
- Dec 11, 2025
Malicious code in asdfgh3 (npm)
- Dec 10, 2025
Malicious code in @cheqplease/structured-logger (npm)
5 compromised versions
- Dec 10, 2025
Malicious code in mws-common-ui (npm)
1 compromised version
- Dec 10, 2025
Malicious code in vue2-amis-custom-widget-pro (npm)
2 compromised versions
- Dec 10, 2025
Malicious code in yunxohang3 (npm)
1 compromised version
- Dec 10, 2025
Malicious code in yunxoahng2 (npm)
1 compromised version
- Dec 10, 2025
Malicious code in real-time-tweet-streamer (npm)
1 compromised version
- Dec 10, 2025
Malware in express-my-error-handler
1 compromised version
- Dec 10, 2025
Malware in real-time-tweet-streamer
1 compromised version
- Dec 10, 2025
Malware in package-with-conditions
1 compromised version
- Dec 10, 2025
Malware in near-fast-auth-signer
1 compromised version
- Dec 10, 2025
Malware in non-modular-buildable
1 compromised version
- Dec 10, 2025
Malware in native-component-list
1 compromised version
- Dec 10, 2025
Malicious code in near-fast-auth-signer (npm)
1 compromised version
- Dec 10, 2025
Malicious code in vue2-amis-custom-widget123 (npm)
4 compromised versions
- Dec 10, 2025
Malicious code in mongo-decimal (npm)
- Dec 10, 2025
Malicious code in modules-runtime (npm)
- Dec 10, 2025
Malicious code in meteor-developer-oauth (npm)
- Dec 10, 2025
Malicious code in facts-base (npm)
- Dec 10, 2025
Malicious code in ecmascript-runtime-client (npm)
- Dec 10, 2025
Malicious code in ddp-common (npm)
- Dec 10, 2025
Malicious code in callback-hook (npm)
- Dec 10, 2025
Malicious code in allow-deny (npm)
- Dec 10, 2025
Malware in ecmascript-runtime-client
1 compromised version
- Dec 10, 2025
Malware in callback-hook
1 compromised version
- Dec 10, 2025
Malware in allow-deny
1 compromised version
- Dec 10, 2025
Malware in modules-runtime
1 compromised version
- Dec 10, 2025
Malware in ddp-common
1 compromised version
- Dec 10, 2025
Malware in accounts-base
1 compromised version
- Dec 10, 2025
Malware in mongo-decimal
1 compromised version
- Dec 10, 2025
Malware in facts-base
1 compromised version
- Dec 10, 2025
Malware in meteor-developer-oauth
1 compromised version
- Dec 10, 2025
Malicious code in wasm-bindgen (npm)
- Dec 10, 2025
Malicious code in sfdc-abstract-legend (npm)
- Dec 10, 2025
Malicious code in rum-events-format (npm)
2 compromised versions
- Dec 10, 2025
Malicious code in pymongo (npm)
Page 219 of 4,807