Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,408 total in npm · sorted newest first- Nov 24, 2025
Malicious code in prime-one-table (npm)
1 compromised version
- Nov 24, 2025
Malware in prime-one-table
1 compromised version
- Nov 24, 2025
Malicious code in prompt-eng (npm)
1 compromised version
- Nov 24, 2025
Malware in prompt-eng
1 compromised version
- Nov 24, 2025
Malicious code in next-styled-nprogress (npm)
2 compromised versions
- Nov 24, 2025
Malware in next-styled-nprogress
1 compromised version
- Nov 24, 2025
Malware in @postman/final-node-keytar
1 compromised version
- Nov 24, 2025
Malicious code in react-component-taggers (npm)
1 compromised version
- Nov 24, 2025
Malware in react-component-taggers
1 compromised version
- Nov 24, 2025
Malicious code in next-simple-google-analytics (npm)
2 compromised versions
- Nov 24, 2025
Malware in next-simple-google-analytics
1 compromised version
- Nov 24, 2025
Malicious code in react-hook-form-persist (npm)
2 compromised versions
- Nov 24, 2025
Malware in react-hook-form-persist
1 compromised version
- Nov 24, 2025
Malicious code in react-jam-icons (npm)
2 compromised versions
- Nov 24, 2025
Malicious code in @posthog/plugin-server (npm)
1 compromised version
- Nov 24, 2025
Malware in react-jam-icons
1 compromised version
- Nov 24, 2025
Malware in @posthog/plugin-server
1 compromised version
- Nov 24, 2025
Malicious code in react-keycloak-context (npm)
2 compromised versions
- Nov 24, 2025
Malware in react-keycloak-context
1 compromised version
- Nov 24, 2025
Malicious code in next-circular-dependency (npm)
2 compromised versions
- Nov 24, 2025
Malware in next-circular-dependency
1 compromised version
- Nov 24, 2025
Malicious code in react-linear-loader (npm)
1 compromised version
- Nov 24, 2025
Malware in react-linear-loader
1 compromised version
- Nov 24, 2025
Malicious code in react-micromodal.js (npm)
2 compromised versions
- Nov 24, 2025
Malware in react-micromodal.js
1 compromised version
- Nov 24, 2025
Malware in @posthog/github-release-tracking-plugin
1 compromised version
- Nov 24, 2025
Malicious code in nanoreset (npm)
2 compromised versions
- Nov 24, 2025
Malware in nanoreset
1 compromised version
- Nov 24, 2025
Malicious code in react-native-datepicker-modal (npm)
2 compromised versions
- Nov 24, 2025
Malware in react-native-datepicker-modal
1 compromised version
- Nov 24, 2025
Malicious code in n8n-nodes-vercel-ai-sdk (npm)
1 compromised version
- Nov 24, 2025
Malware in n8n-nodes-vercel-ai-sdk
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/drop-events-on-property-plugin (npm)
1 compromised version
- Nov 24, 2025
Malware in @posthog/drop-events-on-property-plugin
1 compromised version
- Nov 24, 2025
Malicious code in react-native-email (npm)
2 compromised versions
- Nov 24, 2025
Malware in react-native-email
1 compromised version
- Nov 24, 2025
Malicious code in mon-package-react-typescript (npm)
1 compromised version
- Nov 24, 2025
Malware in mon-package-react-typescript
1 compromised version
- Nov 24, 2025
Malicious code in react-native-fetch (npm)
2 compromised versions
- Nov 24, 2025
Malware in react-native-fetch
1 compromised version
- Nov 24, 2025
Malicious code in react-native-get-pixel-dimensions (npm)
2 compromised versions
- Nov 24, 2025
Malware in react-native-get-pixel-dimensions
1 compromised version
- Nov 24, 2025
Malicious code in react-native-google-maps-directions (npm)
1 compromised version
- Nov 24, 2025
Malware in react-native-google-maps-directions
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/clickhouse (npm)
1 compromised version
- Nov 24, 2025
Malware in @posthog/clickhouse
1 compromised version
- Nov 24, 2025
Malicious code in mod10-check-digit (npm)
1 compromised version
- Nov 24, 2025
Malware in mod10-check-digit
1 compromised version
- Nov 24, 2025
Malicious code in react-native-modest-checkbox (npm)
1 compromised version
- Nov 24, 2025
Malware in react-native-modest-checkbox
1 compromised version
Page 250 of 4,809