Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,408 total in npm · sorted newest first- Nov 24, 2025
Malicious code in react-native-modest-storage (npm)
1 compromised version
- Nov 24, 2025
Malware in react-native-modest-storage
1 compromised version
- Nov 24, 2025
Malicious code in react-native-log-level (npm)
2 compromised versions
- Nov 24, 2025
Malware in react-native-log-level
1 compromised version
- Nov 24, 2025
Malicious code in react-native-phone-call (npm)
2 compromised versions
- Nov 24, 2025
Malware in react-native-phone-call
1 compromised version
- Nov 24, 2025
Malicious code in react-native-retriable-fetch (npm)
2 compromised versions
- Nov 24, 2025
Malware in react-native-retriable-fetch
1 compromised version
- Nov 24, 2025
Malicious code in react-native-view-finder (npm)
2 compromised versions
- Nov 24, 2025
Malware in react-native-view-finder
1 compromised version
- Nov 24, 2025
Malicious code in react-native-websocket (npm)
2 compromised versions
- Nov 24, 2025
Malware in react-native-websocket
1 compromised version
- Nov 24, 2025
Malicious code in react-qr-image (npm)
1 compromised version
- Nov 24, 2025
Malware in react-qr-image
1 compromised version
- Nov 24, 2025
Malicious code in jacob-zuma (npm)
2 compromised versions
- Nov 24, 2025
Malware in jacob-zuma
1 compromised version
- Nov 24, 2025
Malicious code in itobuz-angular-button (npm)
1 compromised version
- Nov 24, 2025
Malware in itobuz-angular-button
1 compromised version
- Nov 24, 2025
Malicious code in itobuz-angular-auth (npm)
1 compromised version
- Nov 24, 2025
Malware in itobuz-angular-auth
1 compromised version
- Nov 24, 2025
Malicious code in itobuz-angular (npm)
1 compromised version
- Nov 24, 2025
Malware in itobuz-angular
1 compromised version
- Nov 24, 2025
Malicious code in ito-button (npm)
1 compromised version
- Nov 24, 2025
Malware in ito-button
1 compromised version
- Nov 24, 2025
Malicious code in invo (npm)
1 compromised version
- Nov 24, 2025
Malware in invo
1 compromised version
- Nov 24, 2025
Malicious code in image-to-uri (npm)
2 compromised versions
- Nov 24, 2025
Malware in image-to-uri
1 compromised version
- Nov 24, 2025
Malicious code in hyperterm-hipster (npm)
2 compromised versions
- Nov 24, 2025
Malware in hyperterm-hipster
1 compromised version
- Nov 24, 2025
Malicious code in httpness (npm)
2 compromised versions
- Nov 24, 2025
Malware in httpness
1 compromised version
- Nov 24, 2025
Malicious code in hover-design-prototype (npm)
1 compromised version
- Nov 24, 2025
Malware in hover-design-prototype
1 compromised version
- Nov 24, 2025
Malicious code in hopedraw (npm)
1 compromised version
- Nov 24, 2025
Malware in hopedraw
1 compromised version
- Nov 24, 2025
Malicious code in hope-mapboxdraw (npm)
1 compromised version
- Nov 24, 2025
Malware in hope-mapboxdraw
1 compromised version
- Nov 24, 2025
Malicious code in haufe-axera-api-client (npm)
2 compromised versions
- Nov 24, 2025
Malware in haufe-axera-api-client
1 compromised version
- Nov 24, 2025
Malicious code in pico-uid (npm)
2 compromised versions
- Nov 24, 2025
Malware in pico-uid
1 compromised version
- Nov 24, 2025
Malicious code in pdf-annotation (npm)
1 compromised version
- Nov 24, 2025
Malware in pdf-annotation
1 compromised version
- Nov 24, 2025
Malicious code in parcel-plugin-asset-copier (npm)
2 compromised versions
- Nov 24, 2025
Malware in parcel-plugin-asset-copier
1 compromised version
- Nov 24, 2025
Malicious code in package-tester (npm)
1 compromised version
- Nov 24, 2025
Malware in package-tester
1 compromised version
- Nov 24, 2025
Malicious code in orchestrix (npm)
1 compromised version
- Nov 24, 2025
Malware in orchestrix
1 compromised version
Page 251 of 4,809