Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,372 total in npm · sorted newest first- Nov 24, 2025
Malicious code in @fishingbooker/react-raty (npm)
1 compromised version
- Nov 24, 2025
Malware in simplejsonform
1 compromised version
- Nov 24, 2025
Malware in @fishingbooker/react-raty
1 compromised version
- Nov 24, 2025
Malicious code in solomon-api-stories (npm)
1 compromised version
- Nov 24, 2025
Malware in solomon-api-stories
1 compromised version
- Nov 24, 2025
Malicious code in @fishingbooker/react-pagination (npm)
1 compromised version
- Nov 24, 2025
Malware in @fishingbooker/react-pagination
1 compromised version
- Nov 24, 2025
Malicious code in solomon-v3-stories (npm)
1 compromised version
- Nov 24, 2025
Malware in solomon-v3-stories
1 compromised version
- Nov 24, 2025
Malicious code in @fishingbooker/react-loader (npm)
1 compromised version
- Nov 24, 2025
Malware in @fishingbooker/react-loader
1 compromised version
- Nov 24, 2025
Malicious code in @fishingbooker/browser-sync-plugin (npm)
1 compromised version
- Nov 24, 2025
Malware in @fishingbooker/browser-sync-plugin
1 compromised version
- Nov 24, 2025
Malicious code in solomon-v3-ui-wrapper (npm)
1 compromised version
- Nov 24, 2025
Malware in solomon-v3-ui-wrapper
1 compromised version
- Nov 24, 2025
Malicious code in @faq-component/react (npm)
1 compromised version
- Nov 24, 2025
Malware in @faq-component/react
1 compromised version
- Nov 24, 2025
Malicious code in soneium-acs (npm)
1 compromised version
- Nov 24, 2025
Malware in soneium-acs
1 compromised version
- Nov 24, 2025
Malicious code in @faq-component/core (npm)
1 compromised version
- Nov 24, 2025
Malware in @faq-component/core
1 compromised version
- Nov 24, 2025
Malicious code in sufetch (npm)
1 compromised version
- Nov 24, 2025
Malware in sufetch
1 compromised version
- Nov 24, 2025
Malicious code in tavily-module (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @everreal/web-analytics (npm)
2 compromised versions
- Nov 24, 2025
Malware in @everreal/web-analytics
1 compromised version
- Nov 24, 2025
Malware in tavily-module
1 compromised version
- Nov 24, 2025
Malicious code in test23112222-api (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @everreal/validate-esmoduleinterop-imports (npm)
2 compromised versions
- Nov 24, 2025
Malware in @everreal/validate-esmoduleinterop-imports
1 compromised version
- Nov 24, 2025
Malware in test23112222-api
1 compromised version
- Nov 24, 2025
Malicious code in tiptap-shadcn-vue (npm)
1 compromised version
- Nov 24, 2025
Malware in tiptap-shadcn-vue
1 compromised version
- Nov 24, 2025
Malicious code in @everreal/react-charts (npm)
2 compromised versions
- Nov 24, 2025
Malware in @everreal/react-charts
1 compromised version
- Nov 24, 2025
Malicious code in toonfetch (npm)
1 compromised version
- Nov 24, 2025
Malware in toonfetch
1 compromised version
- Nov 24, 2025
Malicious code in @eventcatalog/generator-asyncapi (npm)
1 compromised version
- Nov 24, 2025
Malware in @eventcatalog/generator-asyncapi
1 compromised version
- Nov 24, 2025
Malicious code in ts-relay-cursor-paging (npm)
1 compromised version
- Nov 24, 2025
Malware in ts-relay-cursor-paging
1 compromised version
- Nov 24, 2025
Malicious code in typeface-antonio-complete (npm)
1 compromised version
- Nov 24, 2025
Malware in typeface-antonio-complete
1 compromised version
- Nov 24, 2025
Malicious code in @devx-commerce/plugin-discounts (npm)
1 compromised version
- Nov 24, 2025
Malware in @devx-commerce/plugin-discounts
1 compromised version
- Nov 24, 2025
Malicious code in @dev-blinq/cucumber_client (npm)
7 compromised versions
- Nov 24, 2025
Malware in @dev-blinq/cucumber_client
1 compromised version
- Nov 24, 2025
Malicious code in @vishadtyagi/full-year-calendar (npm)
1 compromised version
- Nov 24, 2025
Malware in @vishadtyagi/full-year-calendar
1 compromised version
- Nov 24, 2025
Malicious code in @viapip/eslint-config (npm)
1 compromised version
Page 242 of 4,808