Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,346 total in npm · sorted newest first- Dec 8, 2025
Malicious code in tensor-fi-utils-core (npm)
6 compromised versions
- Dec 8, 2025
Malicious code in solana-dexco-basic (npm)
- Dec 8, 2025
Malware in tensor-fi-utils-core
1 compromised version
- Dec 8, 2025
Malware in solana-dexco-basic
1 compromised version
- Dec 7, 2025
Malicious code in paysera-checkout-modal (npm)
1 compromised version
- Dec 7, 2025
Malicious code in tna_xmlparser (npm)
1 compromised version
- Dec 7, 2025
Malicious code in react-hook-form-5 (npm)
1 compromised version
- Dec 6, 2025
Malicious code in datadog-checks-base (npm)
1 compromised version
- Dec 6, 2025
Malicious code in fdir5 (npm)
1 compromised version
- Dec 6, 2025
Malicious code in ssf-desktop-api-browser (npm)
1 compromised version
- Dec 6, 2025
Malicious code in fdir1 (npm)
1 compromised version
- Dec 6, 2025
Malicious code in enclose-eslint (npm)
1 compromised version
- Dec 6, 2025
Malicious code in ido-sdk-web (npm)
1 compromised version
- Dec 6, 2025
Malicious code in sharp32 (npm)
1 compromised version
- Dec 6, 2025
Malicious code in fdir4 (npm)
1 compromised version
- Dec 6, 2025
Malicious code in fdir2 (npm)
1 compromised version
- Dec 6, 2025
Malicious code in ssf-desktop-api-openfin (npm)
1 compromised version
- Dec 6, 2025
Malicious code in express-my-error-handler (npm)
1 compromised version
- Dec 5, 2025
Malicious code in sd-123456 (npm)
- Dec 5, 2025
Malicious code in non-modular-buildable (npm)
- Dec 5, 2025
Malicious code in native-component-list (npm)
1 compromised version
- Dec 5, 2025
Malicious code in elf-stats-whimsical-pantry-974 (npm)
1 compromised version
- Dec 5, 2025
Malicious code in elf-stats-velvet-train-152 (npm)
1 compromised version
- Dec 5, 2025
Malicious code in elf-stats-tinsel-muffin-395 (npm)
1 compromised version
- Dec 5, 2025
Malicious code in elf-stats-sparkly-workbench-689 (npm)
1 compromised version
- Dec 5, 2025
Malicious code in elf-stats-sparkly-icicle-845 (npm)
1 compromised version
- Dec 5, 2025
Malicious code in elf-stats-snowdusted-chimney-406 (npm)
1 compromised version
- Dec 5, 2025
Malicious code in elf-stats-shimmering-toolkit-483 (npm)
3 compromised versions
- Dec 5, 2025
Malicious code in elf-stats-shimmering-garland-476 (npm)
1 compromised version
- Dec 5, 2025
Malicious code in elf-stats-northbound-drum-422 (npm)
1 compromised version
- Dec 5, 2025
Malicious code in elf-stats-mulled-snowglobe-636 (npm)
1 compromised version
- Dec 5, 2025
Malicious code in elf-stats-midnight-rocket-813 (npm)
2 compromised versions
- Dec 5, 2025
Malicious code in elf-stats-lanternlit-saddlebag-279 (npm)
1 compromised version
- Dec 5, 2025
Malicious code in elf-stats-flickering-lantern-502 (npm)
1 compromised version
- Dec 5, 2025
Malicious code in elf-stats-evergreen-satchel-264 (npm)
2 compromised versions
- Dec 5, 2025
Malicious code in elf-stats-cranberry-pinecone-878 (npm)
4 compromised versions
- Dec 5, 2025
Malicious code in elf-stats-cosy-toy-308 (npm)
1 compromised version
- Dec 5, 2025
Malicious code in elf-stats-cosy-sled-550 (npm)
1 compromised version
- Dec 5, 2025
Malicious code in elf-stats-candystriped-garland-735 (npm)
2 compromised versions
- Dec 5, 2025
Malicious code in elf-stats-candlelit-hollyberry-248 (npm)
1 compromised version
- Dec 5, 2025
Malicious code in elf-stats-aurora-mailbag-938 (npm)
1 compromised version
- Dec 5, 2025
Malicious code in ambient-map (npm)
1 compromised version
- Dec 5, 2025
Malicious code in json-map-source (npm)
2 compromised versions
- Dec 5, 2025
Malware in json-map-source
1 compromised version
- Dec 5, 2025
Malicious code in chai-as-deployed (npm)
2 compromised versions
- Dec 5, 2025
Malware in chai-as-deployed
1 compromised version
- Dec 5, 2025
Malicious code in chai-promised-chain (npm)
1 compromised version
- Dec 5, 2025
Malware in chai-promised-chain
1 compromised version
- Dec 5, 2025
Malicious code in dotnetenv (npm)
1 compromised version
- Dec 5, 2025
Malware in dotnetenv
1 compromised version
Page 221 of 4,807