Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,408 total in npm · sorted newest first- Nov 24, 2025
Malicious code in tcsp-draw-test (npm)
1 compromised version
- Nov 24, 2025
Malware in tcsp-draw-test
1 compromised version
- Nov 24, 2025
Malicious code in tcsp-test-vd (npm)
1 compromised version
- Nov 24, 2025
Malware in tcsp-test-vd
1 compromised version
- Nov 24, 2025
Malicious code in template-lib (npm)
2 compromised versions
- Nov 24, 2025
Malware in template-lib
1 compromised version
- Nov 24, 2025
Malicious code in template-micro-service (npm)
2 compromised versions
- Nov 24, 2025
Malware in template-micro-service
1 compromised version
- Nov 24, 2025
Malicious code in tenacious-fetch (npm)
2 compromised versions
- Nov 24, 2025
Malware in tenacious-fetch
1 compromised version
- Nov 24, 2025
Malicious code in tiaan (npm)
1 compromised version
- Nov 24, 2025
Malware in tiaan
1 compromised version
- Nov 24, 2025
Malicious code in typefence (npm)
2 compromised versions
- Nov 24, 2025
Malware in typefence
1 compromised version
- Nov 24, 2025
Malicious code in undefsafe-typed (npm)
2 compromised versions
- Nov 24, 2025
Malware in undefsafe-typed
1 compromised version
- Nov 24, 2025
Malicious code in uplandui (npm)
1 compromised version
- Nov 24, 2025
Malware in uplandui
1 compromised version
- Nov 24, 2025
Malicious code in upload-to-play-store (npm)
2 compromised versions
- Nov 24, 2025
Malware in upload-to-play-store
1 compromised version
- Nov 24, 2025
Malicious code in url-encode-decode (npm)
2 compromised versions
- Nov 24, 2025
Malware in url-encode-decode
1 compromised version
- Nov 24, 2025
Malicious code in use-unsaved-changes (npm)
1 compromised version
- Nov 24, 2025
Malware in use-unsaved-changes
1 compromised version
- Nov 24, 2025
Malicious code in valid-south-african-id (npm)
1 compromised version
- Nov 24, 2025
Malware in valid-south-african-id
1 compromised version
- Nov 24, 2025
Malicious code in web-scraper-mcp (npm)
1 compromised version
- Nov 24, 2025
Malware in web-scraper-mcp
1 compromised version
- Nov 24, 2025
Malicious code in wellness-expert-ng-gallery (npm)
1 compromised version
- Nov 24, 2025
Malware in wellness-expert-ng-gallery
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/ensjs (npm)
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/ensjs
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/ensjs-react (npm)
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/ensjs-react
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/ccip-read-cf-worker (npm)
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/ccip-read-cf-worker
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/op-resolver-contracts (npm)
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/op-resolver-contracts
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/ens-test-env (npm)
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/ens-test-env
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/durin (npm)
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/durin
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/ens-contracts (npm)
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/ens-contracts
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/buffer
1 compromised version
- Nov 24, 2025
Malicious code in zapier-platform-legacy-scripting-runner (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in web-types-lit (npm)
1 compromised version
- Nov 24, 2025
Malicious code in posthog-react-native (npm)
2 compromised versions
- Nov 24, 2025
Malicious code in posthog-node (npm)
3 compromised versions
- Nov 24, 2025
Malicious code in posthog-docusaurus (npm)
1 compromised version
Page 253 of 4,809