Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,408 total in npm · sorted newest first- Nov 24, 2025
Malware in @thedelta/eslint-config
1 compromised version
- Nov 24, 2025
Malware in insomnia-plugin-random-pick
1 compromised version
- Nov 24, 2025
Malicious code in @suraj_h/medium-common (npm)
1 compromised version
- Nov 24, 2025
Malware in @suraj_h/medium-common
1 compromised version
- Nov 24, 2025
Malicious code in inmaa-map (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @seezo/sdr-mcp-server (npm)
1 compromised version
- Nov 24, 2025
Malware in inmaa-map
1 compromised version
- Nov 24, 2025
Malware in @seezo/sdr-mcp-server
1 compromised version
- Nov 24, 2025
Malicious code in ids-enterprise-typings (npm)
1 compromised version
- Nov 24, 2025
Malware in ids-enterprise-typings
1 compromised version
- Nov 24, 2025
Malicious code in ids-enterprise-ng (npm)
1 compromised version
- Nov 24, 2025
Malware in ids-enterprise-ng
1 compromised version
- Nov 24, 2025
Malicious code in @relyt/mcp-server-relytone (npm)
1 compromised version
- Nov 24, 2025
Malware in @relyt/mcp-server-relytone
1 compromised version
- Nov 24, 2025
Malicious code in @relyt/claude-context-mcp (npm)
1 compromised version
- Nov 24, 2025
Malware in @relyt/claude-context-mcp
1 compromised version
- Nov 24, 2025
Malicious code in ids-enterprise-mcp-server (npm)
1 compromised version
- Nov 24, 2025
Malware in ids-enterprise-mcp-server
1 compromised version
- Nov 24, 2025
Malicious code in ids-css (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @relyt/claude-context-core (npm)
1 compromised version
- Nov 24, 2025
Malware in ids-css
1 compromised version
- Nov 24, 2025
Malware in @relyt/claude-context-core
1 compromised version
- Nov 24, 2025
Malicious code in @pruthvi21/use-debounce (npm)
1 compromised version
- Nov 24, 2025
Malware in @pruthvi21/use-debounce
1 compromised version
- Nov 24, 2025
Malicious code in @pradhumngautam/common-app (npm)
1 compromised version
- Nov 24, 2025
Malware in @pradhumngautam/common-app
1 compromised version
- Nov 24, 2025
Malicious code in @osmanekrem/error-handler (npm)
1 compromised version
- Nov 24, 2025
Malware in @osmanekrem/error-handler
1 compromised version
- Nov 24, 2025
Malicious code in @osmanekrem/bmad (npm)
1 compromised version
- Nov 24, 2025
Malware in @osmanekrem/bmad
1 compromised version
- Nov 24, 2025
Malicious code in @ntnx/t (npm)
1 compromised version
- Nov 24, 2025
Malware in @ntnx/t
1 compromised version
- Nov 24, 2025
Malicious code in frontity-starter-theme (npm)
1 compromised version
- Nov 24, 2025
Malware in frontity-starter-theme
1 compromised version
- Nov 24, 2025
Malicious code in bun-plugin-httpfile (npm)
1 compromised version
- Nov 24, 2025
Malware in bun-plugin-httpfile
1 compromised version
- Nov 24, 2025
Malicious code in express-starter-template (npm)
1 compromised version
- Nov 24, 2025
Malware in express-starter-template
1 compromised version
- Nov 24, 2025
Malicious code in expo-router-on-rails (npm)
1 compromised version
- Nov 24, 2025
Malware in expo-router-on-rails
1 compromised version
- Nov 24, 2025
Malicious code in buffered-interpolation-babylon6 (npm)
1 compromised version
- Nov 24, 2025
Malware in buffered-interpolation-babylon6
1 compromised version
- Nov 24, 2025
Malicious code in esbuild-plugin-brotli (npm)
1 compromised version
- Nov 24, 2025
Malware in esbuild-plugin-brotli
1 compromised version
- Nov 24, 2025
Malicious code in @orbitgtbelgium/mapbox-gl-draw-cut-polygon-mode (npm)
1 compromised version
- Nov 24, 2025
Malware in @orbitgtbelgium/mapbox-gl-draw-cut-polygon-mode
1 compromised version
- Nov 24, 2025
Malicious code in electron-volt (npm)
1 compromised version
- Nov 24, 2025
Malware in electron-volt
1 compromised version
- Nov 24, 2025
Malicious code in @ntnx/passport-wso2 (npm)
1 compromised version
- Nov 24, 2025
Malware in @ntnx/passport-wso2
1 compromised version
Page 246 of 4,809