Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,347 total in npm · sorted newest first- Dec 1, 2025
Malicious code in m365-action-sdk (npm)
- Dec 1, 2025
Malicious code in libdebugrouter.so (npm)
- Dec 1, 2025
Malicious code in kmf-cookieservice (npm)
1 compromised version
- Dec 1, 2025
Malicious code in handtalk-test-app (npm)
1 compromised version
- Dec 1, 2025
Malicious code in @hand-talk/yotta-core (npm)
2 compromised versions
- Dec 1, 2025
Malicious code in @bingads-webui-clientcenter/instrumentation (npm)
2 compromised versions
- Dec 1, 2025
Malicious code in hl-naduccio (npm)
1 compromised version
- Dec 1, 2025
Malicious code in xmenddddl (npm)
1 compromised version
- Dec 1, 2025
Malicious code in web-uj65mn (npm)
1 compromised version
- Dec 1, 2025
Malicious code in web-nbq6lx (npm)
1 compromised version
- Dec 1, 2025
Malicious code in vite-dynamic-chunks (npm)
2 compromised versions
- Dec 1, 2025
Malicious code in vbails (npm)
2 compromised versions
- Dec 1, 2025
Malicious code in test-dependency-confusion-g3ksec (npm)
1 compromised version
- Dec 1, 2025
Malicious code in tensor-fi-crypto-utils (npm)
1 compromised version
- Dec 1, 2025
Malicious code in telegram-api-test (npm)
1 compromised version
- Dec 1, 2025
Malicious code in tailwindcss-forms (npm)
1 compromised version
- Dec 1, 2025
Malicious code in tailwind-style-override (npm)
1 compromised version
- Dec 1, 2025
Malicious code in tailwind-state (npm)
1 compromised version
- Dec 1, 2025
Malicious code in szsec-infoss-report (npm)
1 compromised version
- Dec 1, 2025
Malicious code in szsec-infos-report-wh2sper (npm)
1 compromised version
- Dec 1, 2025
Malicious code in szsec-infos-report-wh1sper (npm)
4 compromised versions
- Dec 1, 2025
Malicious code in szsec-info-report (npm)
1 compromised version
- Dec 1, 2025
Malicious code in stringify-coder (npm)
1 compromised version
- Dec 1, 2025
Malicious code in sing-fest-es-logger (npm)
1 compromised version
- Dec 1, 2025
Malicious code in session-validate (npm)
2 compromised versions
- Dec 1, 2025
Malicious code in revit-to-ifc-scheduler (npm)
1 compromised version
- Dec 1, 2025
Malicious code in redirect-clrm2u (npm)
1 compromised version
- Dec 1, 2025
Malicious code in redirect-5k9q5v (npm)
1 compromised version
- Dec 1, 2025
Malicious code in react-mandes (npm)
1 compromised version
- Dec 1, 2025
Malicious code in react-adparser (npm)
1 compromised version
- Dec 1, 2025
Malicious code in pixel-bloom (npm)
3 compromised versions
- Dec 1, 2025
Malicious code in lbank-connector-nodejs (npm)
2 compromised versions
- Dec 1, 2025
Malicious code in lbank-connector (npm)
1 compromised version
- Dec 1, 2025
Malicious code in kyjnzu (npm)
1 compromised version
- Dec 1, 2025
Malicious code in jqxcore (npm)
1 compromised version
- Dec 1, 2025
Malicious code in ing-ideal-acquiring-shared (npm)
1 compromised version
- Dec 1, 2025
Malicious code in eslint-lodash (npm)
1 compromised version
- Dec 1, 2025
Malware in tcsp
1 compromised version
- Dec 1, 2025
Malicious code in data-noxcqn (npm)
1 compromised version
- Dec 1, 2025
Malicious code in cwanner (npm)
1 compromised version
- Dec 1, 2025
Malicious code in ctf2libxmljs2 (npm)
1 compromised version
- Dec 1, 2025
Malware in hyper-fullfacing
1 compromised version
- Dec 1, 2025
Malicious code in core-ruw7ck (npm)
1 compromised version
- Dec 1, 2025
Malicious code in cookie-validate (npm)
1 compromised version
- Dec 1, 2025
Malicious code in client-6wr4qk (npm)
1 compromised version
- Dec 1, 2025
Malicious code in chai-sync (npm)
3 compromised versions
- Dec 1, 2025
Malicious code in chai-promise-chain (npm)
4 compromised versions
- Dec 1, 2025
Malware in @seung-ju/react-native-action-sheet
1 compromised version
- Dec 1, 2025
Malicious code in auth-1s7epg (npm)
1 compromised version
- Dec 1, 2025
Malicious code in aps-simple-viewer-nodejs (npm)
1 compromised version
Page 232 of 4,807