Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,422 total in npm · sorted newest first- Nov 24, 2025
Malware in devstart-cli
1 compromised version
- Nov 24, 2025
Malicious code in dotnet-template (npm)
2 compromised versions
- Nov 24, 2025
Malware in dotnet-template
1 compromised version
- Nov 24, 2025
Malicious code in capacitor-plugin-scgssigninwithgoogle (npm)
1 compromised version
- Nov 24, 2025
Malware in capacitor-plugin-scgssigninwithgoogle
1 compromised version
- Nov 24, 2025
Malicious code in @zapier/eslint-plugin-zapier (npm)
3 compromised versions
- Nov 24, 2025
Malware in @zapier/eslint-plugin-zapier
1 compromised version
- Nov 24, 2025
Malicious code in capacitor-purchase-history (npm)
1 compromised version
- Nov 24, 2025
Malware in capacitor-purchase-history
1 compromised version
- Nov 24, 2025
Malicious code in posthog-plugin-hello-world (npm)
1 compromised version
- Nov 24, 2025
Malware in posthog-plugin-hello-world
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/java-spring-cloud-stream-template (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/java-spring-cloud-stream-template
1 compromised version
- Nov 24, 2025
Malicious code in esbuild-plugin-httpfile (npm)
1 compromised version
- Nov 24, 2025
Malware in esbuild-plugin-httpfile
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/hardhat-chai-matchers-viem (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/blacklist (npm)
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/blacklist
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/hardhat-chai-matchers-viem
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/test-utils (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/renewal-widget (npm)
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/renewal-widget
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/test-utils
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/hackathon-registrar (npm)
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/hackathon-registrar
1 compromised version
- Nov 24, 2025
Malicious code in zapier-async-storage (npm)
3 compromised versions
- Nov 24, 2025
Malware in zapier-async-storage
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/ccip-read-router (npm)
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/ccip-read-router
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/nodejs-template (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/nodejs-template
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/thorin (npm)
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/thorin
1 compromised version
- Nov 24, 2025
Malicious code in @zapier/babel-preset-zapier (npm)
3 compromised versions
- Nov 24, 2025
Malware in @zapier/babel-preset-zapier
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/dnssecoraclejs (npm)
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/dnssecoraclejs
1 compromised version
- Nov 24, 2025
Malicious code in redux-router-kit (npm)
3 compromised versions
- Nov 24, 2025
Malware in redux-router-kit
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/ens-avatar (npm)
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/ens-avatar
1 compromised version
- Nov 24, 2025
Malicious code in token.js-fork (npm)
1 compromised version
- Nov 24, 2025
Malware in token.js-fork
1 compromised version
- Nov 24, 2025
Malicious code in @actbase/react-daum-postcode (npm)
1 compromised version
- Nov 24, 2025
Malware in @actbase/react-daum-postcode
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/nodejs-ws-template (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/nodejs-ws-template
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/agent (npm)
1 compromised version
- Nov 24, 2025
Malware in @posthog/agent
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/plugin-contrib (npm)
1 compromised version
Page 259 of 4,809