Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,422 total in npm · sorted newest first- Nov 24, 2025
Malware in @posthog/plugin-contrib
1 compromised version
- Nov 24, 2025
Malicious code in test-hardhat-app (npm)
4 compromised versions
- Nov 24, 2025
Malware in test-hardhat-app
1 compromised version
- Nov 24, 2025
Malicious code in zuper-cli (npm)
1 compromised version
- Nov 24, 2025
Malware in zuper-cli
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/ens-validation (npm)
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/ens-validation
1 compromised version
- Nov 24, 2025
Malicious code in skills-use (npm)
2 compromised versions
- Nov 24, 2025
Malware in skills-use
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/piscina (npm)
1 compromised version
- Nov 24, 2025
Malware in @posthog/piscina
1 compromised version
- Nov 24, 2025
Malicious code in typeorm-orbit (npm)
1 compromised version
- Nov 24, 2025
Malware in typeorm-orbit
1 compromised version
- Nov 24, 2025
Malicious code in orbit-nebula-editor (npm)
1 compromised version
- Nov 24, 2025
Malware in orbit-nebula-editor
1 compromised version
- Nov 24, 2025
Malicious code in @trigo/atrix-elasticsearch (npm)
1 compromised version
- Nov 24, 2025
Malware in @trigo/atrix-elasticsearch
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/siphash (npm)
1 compromised version
- Nov 24, 2025
Malware in @posthog/siphash
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/rrweb-record (npm)
1 compromised version
- Nov 24, 2025
Malware in @posthog/rrweb-record
1 compromised version
- Nov 24, 2025
Malicious code in @trigo/atrix-soap (npm)
1 compromised version
- Nov 24, 2025
Malware in @trigo/atrix-soap
1 compromised version
- Nov 24, 2025
Malicious code in eslint-config-zeallat-base (npm)
1 compromised version
- Nov 24, 2025
Malware in eslint-config-zeallat-base
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/java-spring-template (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/java-spring-template
1 compromised version
- Nov 24, 2025
Malicious code in iron-shield-miniapp (npm)
1 compromised version
- Nov 24, 2025
Malware in iron-shield-miniapp
1 compromised version
- Nov 24, 2025
Malware in shinhan-limit-scrap
1 compromised version
- Nov 24, 2025
Malicious code in create-glee-app (npm)
2 compromised versions
- Nov 24, 2025
Malware in create-glee-app
1 compromised version
- Nov 24, 2025
Malicious code in @seung-ju/next (npm)
1 compromised version
- Nov 24, 2025
Malware in @seung-ju/next
1 compromised version
- Nov 24, 2025
Malicious code in @actbase/react-native-tiktok (npm)
1 compromised version
- Nov 24, 2025
Malware in @actbase/react-native-tiktok
1 compromised version
- Nov 24, 2025
Malicious code in discord-bot-server (npm)
1 compromised version
- Nov 24, 2025
Malware in discord-bot-server
1 compromised version
- Nov 24, 2025
Malicious code in react-native-use-modal (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @seung-ju/openapi-generator (npm)
1 compromised version
- Nov 24, 2025
Malware in react-native-use-modal
1 compromised version
- Nov 24, 2025
Malware in @seung-ju/openapi-generator
1 compromised version
- Nov 24, 2025
Malicious code in @seung-ju/react-hooks (npm)
1 compromised version
- Nov 24, 2025
Malware in @seung-ju/react-hooks
1 compromised version
- Nov 24, 2025
Malicious code in @actbase/react-native-naver-login (npm)
1 compromised version
- Nov 24, 2025
Malware in @actbase/react-native-naver-login
1 compromised version
- Nov 24, 2025
Malicious code in @zapier/browserslist-config-zapier (npm)
3 compromised versions
- Nov 24, 2025
Malware in @zapier/browserslist-config-zapier
1 compromised version
- Nov 24, 2025
Malicious code in @kvytech/medusa-plugin-announcement (npm)
1 compromised version
- Nov 24, 2025
Malware in @kvytech/medusa-plugin-announcement
1 compromised version
Page 260 of 4,809