Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,372 total in npm · sorted newest first- Nov 25, 2025
Malicious code in @voiceflow/husky-config (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/google-types (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/google-dfes-types (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/git-branch-check (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/general-types (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/fetch (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/exception (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/eslint-plugin (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/eslint-config (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/encryption (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/dtos-interact (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/dependency-cruiser-config (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/default-prompt-wrappers (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/common (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/commitlint-config (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/circleci-config-sdk-orb-import (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/chat-types (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/body-parser (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/base-types (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/backend-utils (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/api-sdk (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/anthropic (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @voiceflow/alexa-types (npm)
2 compromised versions
- Nov 25, 2025
Malicious code in @silgi/yoga (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @silgi/scalar (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @silgi/ratelimit (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @productdevbook/ts-i18n (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @productdevbook/motion (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @productdevbook/chatwoot (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @productdevbook/auth (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @productdevbook/animejs-vue (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @posthog/zendesk-plugin (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @posthog/postgres-plugin (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @posthog/netdata-event-processing (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @posthog/migrator3000-plugin (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @posthog/lemon-ui (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @posthog/laudspeaker-plugin (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @posthog/intercom-plugin (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @posthog/icons (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @posthog/heartbeat-plugin (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @posthog/filter-out-plugin (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @posthog/bitbucket-release-tracker (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @pergel/nuxt (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @pergel/module-ui (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @pergel/module-graphql (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @pergel/module-box (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @pergel/cli (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/visually-hidden (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/utils (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/tooltip (npm)
1 compromised version
Page 237 of 4,808