Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,422 total in npm · sorted newest first- Nov 24, 2025
Malicious code in ethereum-ens (npm)
1 compromised version
- Nov 24, 2025
Malware in ethereum-ens
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/rrweb (npm)
1 compromised version
- Nov 24, 2025
Malware in @posthog/rrweb
1 compromised version
- Nov 24, 2025
Malicious code in zapier-platform-cli (npm)
3 compromised versions
- Nov 24, 2025
Malware in zapier-platform-cli
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/generator-helpers (npm)
3 compromised versions
- Nov 24, 2025
Malware in @asyncapi/generator-helpers
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/generator-components (npm)
3 compromised versions
- Nov 24, 2025
Malware in @asyncapi/generator-components
1 compromised version
- Nov 24, 2025
Malicious code in @postman/aether-icons (npm)
3 compromised versions
- Nov 24, 2025
Malware in @postman/aether-icons
1 compromised version
- Nov 24, 2025
Malicious code in redux-forge (npm)
1 compromised version
- Nov 24, 2025
Malware in redux-forge
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/modelina-cli (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/modelina-cli
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/optimizer (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/optimizer
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/cli (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/cli
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/diff (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/diff
1 compromised version
- Nov 24, 2025
Malicious code in @alaan/s2s-auth (npm)
1 compromised version
- Nov 24, 2025
Malware in @alaan/s2s-auth
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/html-template (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/html-template
1 compromised version
- Nov 24, 2025
Malicious code in signup-failover (npm)
2 compromised versions
- Nov 24, 2025
Malicious code in @asyncapi/bundler (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/bundler
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/nunjucks-filters (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/nunjucks-filters
1 compromised version
- Nov 24, 2025
Malicious code in crypto-addr-codec (npm)
1 compromised version
- Nov 24, 2025
Malware in crypto-addr-codec
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/content-hash (npm)
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/content-hash
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/address-encoder (npm)
1 compromised version
- Nov 24, 2025
Malware in @ensdomains/address-encoder
1 compromised version
- Nov 24, 2025
Malicious code in zapier-platform-core (npm)
3 compromised versions
- Nov 24, 2025
Malware in zapier-platform-core
1 compromised version
- Nov 24, 2025
Malicious code in zapier-platform-schema (npm)
3 compromised versions
- Nov 24, 2025
Malware in zapier-platform-schema
1 compromised version
- Nov 24, 2025
Malicious code in @zapier/secret-scrubber (npm)
3 compromised versions
- Nov 24, 2025
Malware in @zapier/secret-scrubber
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/cli (npm)
1 compromised version
- Nov 24, 2025
Malware in @posthog/cli
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/multi-parser (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/multi-parser
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/converter (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/converter
1 compromised version
- Nov 24, 2025
Malicious code in posthog-react-native-session-replay (npm)
1 compromised version
Page 263 of 4,809