Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,408 total in npm · sorted newest first- Nov 24, 2025
Malicious code in easypanel-sdk (npm)
1 compromised version
- Nov 24, 2025
Malicious code in better-queue-nedb (npm)
1 compromised version
- Nov 24, 2025
Malware in easypanel-sdk
1 compromised version
- Nov 24, 2025
Malware in better-queue-nedb
1 compromised version
- Nov 24, 2025
Malicious code in @lpdjs/firestore-repo-service (npm)
1 compromised version
- Nov 24, 2025
Malware in @lpdjs/firestore-repo-service
1 compromised version
- Nov 24, 2025
Malicious code in @louisle2/core (npm)
1 compromised version
- Nov 24, 2025
Malware in @louisle2/core
1 compromised version
- Nov 24, 2025
Malicious code in create-director-app (npm)
1 compromised version
- Nov 24, 2025
Malware in create-director-app
1 compromised version
- Nov 24, 2025
Malicious code in better-auth-nuxt (npm)
1 compromised version
- Nov 24, 2025
Malware in better-auth-nuxt
1 compromised version
- Nov 24, 2025
Malicious code in create-kinvey-flex-service (npm)
1 compromised version
- Nov 24, 2025
Malware in create-kinvey-flex-service
1 compromised version
- Nov 24, 2025
Malicious code in @lessondesk/schoolbus (npm)
2 compromised versions
- Nov 24, 2025
Malware in @lessondesk/schoolbus
1 compromised version
- Nov 24, 2025
Malicious code in best_gpio_controller (npm)
1 compromised version
- Nov 24, 2025
Malware in best_gpio_controller
1 compromised version
- Nov 24, 2025
Malicious code in csv-tool-cli (npm)
1 compromised version
- Nov 24, 2025
Malware in csv-tool-cli
1 compromised version
- Nov 24, 2025
Malicious code in @lessondesk/react-table-context (npm)
1 compromised version
- Nov 24, 2025
Malware in @lessondesk/react-table-context
1 compromised version
- Nov 24, 2025
Malicious code in babel-preset-kinvey-flex-service (npm)
1 compromised version
- Nov 24, 2025
Malware in babel-preset-kinvey-flex-service
1 compromised version
- Nov 24, 2025
Malicious code in @lessondesk/material-icons (npm)
1 compromised version
- Nov 24, 2025
Malware in @lessondesk/material-icons
1 compromised version
- Nov 24, 2025
Malicious code in @lessondesk/eslint-config (npm)
1 compromised version
- Nov 24, 2025
Malware in @lessondesk/eslint-config
1 compromised version
- Nov 24, 2025
Malicious code in @lessondesk/electron-group-api-client (npm)
1 compromised version
- Nov 24, 2025
Malware in @lessondesk/electron-group-api-client
1 compromised version
- Nov 24, 2025
Malicious code in @lessondesk/babel-preset (npm)
1 compromised version
- Nov 24, 2025
Malware in @lessondesk/babel-preset
1 compromised version
- Nov 24, 2025
Malicious code in @lessondesk/api-client (npm)
2 compromised versions
- Nov 24, 2025
Malware in @lessondesk/api-client
1 compromised version
- Nov 24, 2025
Malicious code in bytes-to-x (npm)
1 compromised version
- Nov 24, 2025
Malware in bytes-to-x
1 compromised version
- Nov 24, 2025
Malicious code in chrome-extension-downloads (npm)
2 compromised versions
- Nov 24, 2025
Malware in chrome-extension-downloads
1 compromised version
- Nov 24, 2025
Malicious code in benmostyn-frame-print (npm)
1 compromised version
- Nov 24, 2025
Malware in benmostyn-frame-print
1 compromised version
- Nov 24, 2025
Malicious code in barebones-css (npm)
2 compromised versions
- Nov 24, 2025
Malware in barebones-css
1 compromised version
- Nov 24, 2025
Malicious code in blinqio-executions-cli (npm)
1 compromised version
- Nov 24, 2025
Malware in blinqio-executions-cli
1 compromised version
- Nov 24, 2025
Malicious code in blob-to-base64 (npm)
1 compromised version
- Nov 24, 2025
Malware in blob-to-base64
1 compromised version
- Nov 24, 2025
Malicious code in axios-timed (npm)
2 compromised versions
- Nov 24, 2025
Malware in axios-timed
1 compromised version
- Nov 24, 2025
Malicious code in asciitranslator (npm)
1 compromised version
- Nov 24, 2025
Malware in asciitranslator
1 compromised version
Page 247 of 4,809