Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,408 total in npm · sorted newest first- Nov 24, 2025
Malicious code in @oku-ui/motion (npm)
1 compromised version
- Nov 24, 2025
Malware in @oku-ui/motion
1 compromised version
- Nov 24, 2025
Malicious code in @oku-ui/label (npm)
1 compromised version
- Nov 24, 2025
Malware in @oku-ui/label
1 compromised version
- Nov 24, 2025
Malicious code in @oku-ui/focus-scope (npm)
1 compromised version
- Nov 24, 2025
Malware in @oku-ui/focus-scope
1 compromised version
- Nov 24, 2025
Malicious code in puny-req (npm)
1 compromised version
- Nov 24, 2025
Malware in puny-req
1 compromised version
- Nov 24, 2025
Malicious code in pergeltest (npm)
1 compromised version
- Nov 24, 2025
Malware in pergeltest
1 compromised version
- Nov 24, 2025
Malicious code in pergel (npm)
1 compromised version
- Nov 24, 2025
Malware in pergel
1 compromised version
- Nov 24, 2025
Malicious code in nitroping (npm)
12 compromised versions
- Nov 24, 2025
Malware in nitroping
1 compromised version
- Nov 24, 2025
Malicious code in nitro-kutu (npm)
1 compromised version
- Nov 24, 2025
Malware in nitro-kutu
1 compromised version
- Nov 24, 2025
Malicious code in nitro-graphql (npm)
1 compromised version
- Nov 24, 2025
Malware in nitro-graphql
1 compromised version
- Nov 24, 2025
Malicious code in nitrodeploy (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @oku-ui/accordion (npm)
1 compromised version
- Nov 24, 2025
Malware in @oku-ui/accordion
1 compromised version
- Nov 24, 2025
Malware in nitrodeploy
1 compromised version
- Nov 24, 2025
Malicious code in m25-transaction-utils (npm)
1 compromised version
- Nov 24, 2025
Malware in m25-transaction-utils
1 compromised version
- Nov 24, 2025
Malicious code in lui-vue-test (npm)
1 compromised version
- Nov 24, 2025
Malware in lui-vue-test
1 compromised version
- Nov 24, 2025
Malicious code in @trigo/atrix-swagger (npm)
1 compromised version
- Nov 24, 2025
Malware in @trigo/atrix-swagger
1 compromised version
- Nov 24, 2025
Malicious code in kns-error-code (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @trefox/sleekshop-js (npm)
1 compromised version
- Nov 24, 2025
Malware in @trefox/sleekshop-js
1 compromised version
- Nov 24, 2025
Malware in kns-error-code
1 compromised version
- Nov 24, 2025
Malicious code in kinvey-flex-scripts (npm)
1 compromised version
- Nov 24, 2025
Malware in kinvey-flex-scripts
1 compromised version
- Nov 24, 2025
Malicious code in kinvey-cli-wrapper (npm)
1 compromised version
- Nov 24, 2025
Malware in kinvey-cli-wrapper
1 compromised version
- Nov 24, 2025
Malicious code in kinetix-default-token-list (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @tiaanduplessis/react-progressbar (npm)
2 compromised versions
- Nov 24, 2025
Malware in kinetix-default-token-list
1 compromised version
- Nov 24, 2025
Malware in @tiaanduplessis/react-progressbar
1 compromised version
- Nov 24, 2025
Malicious code in just-toasty (npm)
1 compromised version
- Nov 24, 2025
Malware in just-toasty
1 compromised version
- Nov 24, 2025
Malicious code in jsonsurge (npm)
1 compromised version
- Nov 24, 2025
Malware in jsonsurge
1 compromised version
- Nov 24, 2025
Malicious code in jaetut-varit-test (npm)
1 compromised version
- Nov 24, 2025
Malware in jaetut-varit-test
1 compromised version
- Nov 24, 2025
Malicious code in @tiaanduplessis/json (npm)
2 compromised versions
- Nov 24, 2025
Malware in @tiaanduplessis/json
1 compromised version
- Nov 24, 2025
Malicious code in insomnia-plugin-random-pick (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @thedelta/eslint-config (npm)
1 compromised version
Page 245 of 4,809