Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,372 total in npm · sorted newest first- Nov 25, 2025
Malicious code in prompt-eng-server (npm)
1 compromised version
- Nov 25, 2025
Malicious code in posthog-js (npm)
1 compromised version
- Nov 25, 2025
Malicious code in pkg-readme (npm)
1 compromised version
- Nov 25, 2025
Malicious code in nuxt-keycloak (npm)
1 compromised version
- Nov 25, 2025
Malicious code in n8n-nodes-viral-app (npm)
1 compromised version
- Nov 25, 2025
Malicious code in my-saeed-lib (npm)
1 compromised version
- Nov 25, 2025
Malicious code in hyper-fullfacing (npm)
1 compromised version
- Nov 25, 2025
Malicious code in gatsby-plugin-antd (npm)
1 compromised version
- Nov 25, 2025
Malicious code in eslint-config-kinvey-flex-service (npm)
1 compromised version
- Nov 25, 2025
Malicious code in drop-events-on-property-plugin (npm)
1 compromised version
- Nov 25, 2025
Malicious code in dialogflow-es (npm)
4 compromised versions
- Nov 25, 2025
Malicious code in create-silgi (npm)
1 compromised version
- Nov 25, 2025
Malicious code in command-irail (npm)
1 compromised version
- Nov 25, 2025
Malicious code in ceviz (npm)
1 compromised version
- Nov 25, 2025
Malicious code in axios-cancelable (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @vucod/email (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @voiceflow/widget (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/voiceflow-types (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/voice-types (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/vitest-config (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/vite-config (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/verror (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/utils-designer (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/tsconfig-paths (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/tsconfig (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/test-common (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/stylelint-config (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/storybook-config (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/stitches-react (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/slate-serializer (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/serverless-plugin-typescript (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/semantic-release-config (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/secrets-provider (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/sdk-runtime (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/runtime-client-js (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/runtime (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/react-chat (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/prettier-config (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/pino-pretty (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/pino (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/openai (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/npm-package-json-lint-config (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/nestjs-timeout (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/nestjs-redis (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/nestjs-rate-limit (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/nestjs-mongodb (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/nestjs-common (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/natural-language-commander (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/metrics (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/logger (npm)
2 compromised versions
Page 236 of 4,808