Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,372 total in npm · sorted newest first- Nov 25, 2025
Malware in @commute/market-data
1 compromised version
- Nov 25, 2025
Malicious code in @commute/bloom (npm)
1 compromised version
- Nov 25, 2025
Malware in @commute/bloom
1 compromised version
- Nov 25, 2025
Malicious code in @cllbk/ghl (npm)
1 compromised version
- Nov 25, 2025
Malware in @cllbk/ghl
1 compromised version
- Nov 25, 2025
Malicious code in @clausehq/flows-step-taskscreateurl (npm)
1 compromised version
- Nov 25, 2025
Malware in @clausehq/flows-step-taskscreateurl
1 compromised version
- Nov 25, 2025
Malicious code in @clausehq/flows-step-sendgridemail (npm)
1 compromised version
- Nov 25, 2025
Malware in @clausehq/flows-step-sendgridemail
1 compromised version
- Nov 25, 2025
Malicious code in @clausehq/flows-step-mqtt (npm)
1 compromised version
- Nov 25, 2025
Malware in @clausehq/flows-step-mqtt
1 compromised version
- Nov 25, 2025
Malicious code in @clausehq/flows-step-jsontoxml (npm)
1 compromised version
- Nov 25, 2025
Malware in @clausehq/flows-step-jsontoxml
1 compromised version
- Nov 25, 2025
Malicious code in @clausehq/flows-step-httprequest (npm)
1 compromised version
- Nov 25, 2025
Malware in @clausehq/flows-step-httprequest
1 compromised version
- Nov 25, 2025
Malicious code in @chtijs/eslint-config (npm)
1 compromised version
- Nov 25, 2025
Malware in @chtijs/eslint-config
1 compromised version
- Nov 24, 2025
Malicious code in @micado-digital/stadtmarketing-kufstein-external (npm)
1 compromised version
- Nov 24, 2025
Malware in @micado-digital/stadtmarketing-kufstein-external
1 compromised version
- Nov 24, 2025
Malicious code in @medusajs/medusa-oas-cli (npm)
3 compromised versions
- Nov 24, 2025
Malware in @medusajs/medusa-oas-cli
1 compromised version
- Nov 24, 2025
Malicious code in @medusajs/medusa (npm)
2 compromised versions
- Nov 24, 2025
Malware in @medusajs/medusa
1 compromised version
- Nov 24, 2025
Malicious code in @medusajs/analytics-posthog (npm)
2 compromised versions
- Nov 24, 2025
Malware in @medusajs/analytics-posthog
1 compromised version
- Nov 24, 2025
Malicious code in quickswap-v2-sdk (npm)
1 compromised version
- Nov 24, 2025
Malware in quickswap-v2-sdk
1 compromised version
- Nov 24, 2025
Malicious code in @lui-ui/lui-vue (npm)
1 compromised version
- Nov 24, 2025
Malware in @lui-ui/lui-vue
1 compromised version
- Nov 24, 2025
Malicious code in quickswap-token-lists (npm)
1 compromised version
- Nov 24, 2025
Malware in quickswap-token-lists
1 compromised version
- Nov 24, 2025
Malicious code in @lui-ui/lui-tailwindcss (npm)
1 compromised version
- Nov 24, 2025
Malware in @lui-ui/lui-tailwindcss
1 compromised version
- Nov 24, 2025
Malicious code in quickswap-smart-order-router (npm)
1 compromised version
- Nov 24, 2025
Malware in quickswap-smart-order-router
1 compromised version
- Nov 24, 2025
Malicious code in @lui-ui/lui-nuxt (npm)
1 compromised version
- Nov 24, 2025
Malware in @lui-ui/lui-nuxt
1 compromised version
- Nov 24, 2025
Malicious code in quickswap-sdk (npm)
1 compromised version
- Nov 24, 2025
Malware in quickswap-sdk
1 compromised version
- Nov 24, 2025
Malicious code in quickswap-router-sdk (npm)
1 compromised version
- Nov 24, 2025
Malware in quickswap-router-sdk
1 compromised version
- Nov 24, 2025
Malicious code in quickswap-default-token-list (npm)
1 compromised version
- Nov 24, 2025
Malware in quickswap-default-token-list
1 compromised version
- Nov 24, 2025
Malicious code in @kvytech/habbit-e2e-test (npm)
1 compromised version
- Nov 24, 2025
Malware in @kvytech/habbit-e2e-test
1 compromised version
- Nov 24, 2025
Malicious code in quickswap-default-staking-list-address (npm)
1 compromised version
- Nov 24, 2025
Malware in quickswap-default-staking-list-address
1 compromised version
- Nov 24, 2025
Malicious code in @kong/spec-renderer (npm)
1 compromised version
- Nov 24, 2025
Malware in @kong/spec-renderer
1 compromised version
- Nov 24, 2025
Malicious code in quickswap-default-staking-list (npm)
1 compromised version
Page 240 of 4,808