Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,372 total in npm · sorted newest first- Nov 25, 2025
Malicious code in @oku-ui/toolbar (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/toggle-group (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/toggle (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/toast (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/tabs (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/switch (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/slider (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/separator (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/scroll-area (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/roving-focus (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/radio-group (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/provide (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/progress (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/primitives-nuxt (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/primitive (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/presence (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/portal (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/popper (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/popover (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/motion-nuxt (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/menu (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/hover-card (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/focus-guards (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/dismissable-layer (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/direction (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/dialog (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/collection (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/collapsible (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/checkbox (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/avatar (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/aspect-ratio (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/arrow (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @oku-ui/alert-dialog (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @mizzle-dev/orm (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @livecms/nuxt-live-edit (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @livecms/live-edit (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @kvytech/medusa-plugin-promotion (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @huntersofbook/ui (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @huntersofbook/i18n (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @huntersofbook/form-naiveui (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @huntersofbook/core-nuxt (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @huntersofbook/auth-vue (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @dev-blinq/ui-systems (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @dev-blinq/cucumber-js (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @dev-blinq/blinqioclient (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @dev-blinq/ai-qa-logic (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @browserbasehq/stagehand (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @browserbasehq/sdk-functions (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @browserbasehq/mcp-server-browserbase (npm)
1 compromised version
- Nov 25, 2025
Malicious code in @antstackio/shelbysam (npm)
1 compromised version
Page 238 of 4,808