Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,372 total in npm · sorted newest first- Nov 24, 2025
Malicious code in react-native-jam-icons (npm)
2 compromised versions
- Nov 24, 2025
Malware in react-native-jam-icons
1 compromised version
- Nov 24, 2025
Malicious code in @opentermsarchive/engine (npm)
2 compromised versions
- Nov 24, 2025
Malware in @opentermsarchive/engine
1 compromised version
- Nov 24, 2025
Malicious code in @oku-ui/use-composable (npm)
1 compromised version
- Nov 24, 2025
Malware in @oku-ui/use-composable
1 compromised version
- Nov 24, 2025
Malicious code in react-favic (npm)
1 compromised version
- Nov 24, 2025
Malware in react-favic
1 compromised version
- Nov 24, 2025
Malicious code in react-data-to-export (npm)
1 compromised version
- Nov 24, 2025
Malware in react-data-to-export
1 compromised version
- Nov 24, 2025
Malicious code in @oku-ui/slot (npm)
1 compromised version
- Nov 24, 2025
Malware in @oku-ui/slot
1 compromised version
- Nov 24, 2025
Malicious code in @oku-ui/primitives (npm)
1 compromised version
- Nov 24, 2025
Malware in @oku-ui/primitives
1 compromised version
- Nov 24, 2025
Malicious code in @oku-ui/motion (npm)
1 compromised version
- Nov 24, 2025
Malware in @oku-ui/motion
1 compromised version
- Nov 24, 2025
Malicious code in @oku-ui/label (npm)
1 compromised version
- Nov 24, 2025
Malware in @oku-ui/label
1 compromised version
- Nov 24, 2025
Malicious code in @oku-ui/focus-scope (npm)
1 compromised version
- Nov 24, 2025
Malware in @oku-ui/focus-scope
1 compromised version
- Nov 24, 2025
Malicious code in puny-req (npm)
1 compromised version
- Nov 24, 2025
Malware in puny-req
1 compromised version
- Nov 24, 2025
Malicious code in pergeltest (npm)
1 compromised version
- Nov 24, 2025
Malware in pergeltest
1 compromised version
- Nov 24, 2025
Malicious code in pergel (npm)
1 compromised version
- Nov 24, 2025
Malware in pergel
1 compromised version
- Nov 24, 2025
Malicious code in nitroping (npm)
12 compromised versions
- Nov 24, 2025
Malware in nitroping
1 compromised version
- Nov 24, 2025
Malicious code in nitro-kutu (npm)
1 compromised version
- Nov 24, 2025
Malware in nitro-kutu
1 compromised version
- Nov 24, 2025
Malicious code in nitro-graphql (npm)
1 compromised version
- Nov 24, 2025
Malware in nitro-graphql
1 compromised version
- Nov 24, 2025
Malicious code in nitrodeploy (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @oku-ui/accordion (npm)
1 compromised version
- Nov 24, 2025
Malware in @oku-ui/accordion
1 compromised version
- Nov 24, 2025
Malware in nitrodeploy
1 compromised version
- Nov 24, 2025
Malicious code in m25-transaction-utils (npm)
1 compromised version
- Nov 24, 2025
Malware in m25-transaction-utils
1 compromised version
- Nov 24, 2025
Malicious code in lui-vue-test (npm)
1 compromised version
- Nov 24, 2025
Malware in lui-vue-test
1 compromised version
- Nov 24, 2025
Malicious code in @trigo/atrix-swagger (npm)
1 compromised version
- Nov 24, 2025
Malware in @trigo/atrix-swagger
1 compromised version
- Nov 24, 2025
Malicious code in kns-error-code (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @trefox/sleekshop-js (npm)
1 compromised version
- Nov 24, 2025
Malware in @trefox/sleekshop-js
1 compromised version
- Nov 24, 2025
Malware in kns-error-code
1 compromised version
- Nov 24, 2025
Malicious code in kinvey-flex-scripts (npm)
1 compromised version
- Nov 24, 2025
Malware in kinvey-flex-scripts
1 compromised version
- Nov 24, 2025
Malicious code in kinvey-cli-wrapper (npm)
1 compromised version
- Nov 24, 2025
Malware in kinvey-cli-wrapper
1 compromised version
Page 244 of 4,808