Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,003 total in npm · sorted newest first- Jul 6, 2026
Malicious code in polymarket-onchain-plugin (npm)
3 compromised versions
- Jul 6, 2026
Malicious code in pino-utils (npm)
2 compromised versions
- Jul 6, 2026
Malicious code in polymarket-onchain-sdk (npm)
3 compromised versions
- Jul 6, 2026
Malicious code in pino-pretty-logs (npm)
4 compromised versions
- Jul 6, 2026
Malicious code in picocolor-logger (npm)
3 compromised versions
- Jul 6, 2026
Malicious code in peptideenv (npm)
6 compromised versions
- Jul 6, 2026
Malicious code in lint-builds (npm)
2 compromised versions
- Jul 6, 2026
Malicious code in older_morgan (npm)
2 compromised versions
- Jul 6, 2026
Malicious code in npm-eslint-helper (npm)
1 compromised version
- Jul 6, 2026
Malicious code in npm-doc-dev (npm)
8 compromised versions
- Jul 6, 2026
Malicious code in node-env-detector (npm)
2 compromised versions
- Jul 6, 2026
Malicious code in df-vision (npm)
9 compromised versions
- Jul 6, 2026
Malicious code in debug-glitzs (npm)
5 compromised versions
- Jul 6, 2026
Malicious code in next-bignumber.js (npm)
1 compromised version
- Jul 6, 2026
Malicious code in color-logger-console (npm)
2 compromised versions
- Jul 6, 2026
Malicious code in linter-entry (npm)
1 compromised version
- Jul 6, 2026
Malicious code in lint-null (npm)
1 compromised version
- Jul 6, 2026
Malicious code in modulyn (npm)
1 compromised version
- Jul 6, 2026
Malicious code in chalki-pretty (npm)
1 compromised version
- Jul 6, 2026
Malicious code in metrica-node (npm)
1 compromised version
- Jul 6, 2026
Malicious code in js-unimode (npm)
10 compromised versions
- Jul 6, 2026
Malicious code in chalk-pro-logger (npm)
2 compromised versions
- Jul 6, 2026
Malicious code in mjs-biginteger (npm)
2 compromised versions
- Jul 6, 2026
Malicious code in logger-beauty (npm)
5 compromised versions
- Jul 6, 2026
Malicious code in log-upgrade (npm)
1 compromised version
- Jul 6, 2026
Malicious code in log-format-thread (npm)
2 compromised versions
- Jul 6, 2026
Malicious code in hjs-biginteger (npm)
1 compromised version
- Jul 6, 2026
Malicious code in chai-guard (npm)
2 compromised versions
- Jul 6, 2026
Malicious code in metrica-chain (npm)
1 compromised version
- Jul 6, 2026
Malicious code in lint-builders (npm)
1 compromised version
- Jul 6, 2026
Malicious code in lint-nuler (npm)
1 compromised version
- Jul 6, 2026
Malicious code in lint-nule (npm)
1 compromised version
- Jul 6, 2026
Malicious code in eth-tick (npm)
2 compromised versions
- Jul 6, 2026
Malicious code in eslint-vite (npm)
3 compromised versions
- Jul 6, 2026
Malicious code in es-lint-entry (npm)
1 compromised version
- Jul 6, 2026
Malicious code in jsonupper (npm)
2 compromised versions
- Jul 6, 2026
Malicious code in hjs-lint-builders (npm)
1 compromised version
- Jul 6, 2026
Malicious code in grid-settings-align (npm)
2 compromised versions
- Jul 6, 2026
Malicious code in graphpilot (npm)
5 compromised versions
- Jul 6, 2026
Malicious code in fastnodemailer (npm)
3 compromised versions
- Jul 6, 2026
Malicious code in express-guardrail (npm)
2 compromised versions
- Jul 6, 2026
Malicious code in env-axios (npm)
1 compromised version
- Jul 6, 2026
Malicious code in elevate-log (npm)
1 compromised version
- Jul 6, 2026
Malicious code in express-dotenv (npm)
1 compromised version
- Jul 6, 2026
Malicious code in es-lint-builders (npm)
4 compromised versions
- Jul 6, 2026
Malicious code in custom-log-viewer (npm)
1 compromised version
- Jul 6, 2026
Malicious code in emojiprint-prettier (npm)
1 compromised version
- Jul 6, 2026
Malicious code in bootstrap-utils (npm)
1 compromised version
- Jul 6, 2026
Malicious code in emojiprint-logger (npm)
2 compromised versions
- Jul 6, 2026
Malicious code in devkit-scripts (npm)
2 compromised versions
Page 25 of 4,801