Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,422 total in npm · sorted newest first- Nov 24, 2025
Malware in posthog-react-native-session-replay
1 compromised version
- Nov 24, 2025
Malicious code in @postman/csv-parse (npm)
3 compromised versions
- Nov 24, 2025
Malware in @postman/csv-parse
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/generator-react-sdk (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/generator-react-sdk
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/modelina (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/modelina
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/ai (npm)
1 compromised version
- Nov 24, 2025
Malware in @posthog/ai
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/generator (npm)
3 compromised versions
- Nov 24, 2025
Malware in @asyncapi/generator
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/react-component (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/react-component
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/protobuf-schema-parser (npm)
3 compromised versions
- Nov 24, 2025
Malware in @asyncapi/protobuf-schema-parser
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/avro-schema-parser (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/avro-schema-parser
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/openapi-schema-parser (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/openapi-schema-parser
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/parser (npm)
2 compromised versions
- Nov 24, 2025
Malware in @asyncapi/parser
1 compromised version
- Nov 24, 2025
Malicious code in @postman/tunnel-agent (npm)
3 compromised versions
- Nov 24, 2025
Malware in @postman/tunnel-agent
1 compromised version
- Nov 24, 2025
Malicious code in @asyncapi/specs (npm)
6 compromised versions
- Nov 24, 2025
Malware in @asyncapi/specs
1 compromised version
- Nov 24, 2025
Malicious code in @posthog/core (npm)
1 compromised version
- Nov 24, 2025
Malware in @posthog/core
1 compromised version
- Nov 24, 2025
Malicious code in @zapier/zapier-sdk (npm)
3 compromised versions
- Nov 24, 2025
Malware in @zapier/zapier-sdk
1 compromised version
- Nov 24, 2025
Malicious code in @ensdomains/cypress-metamask (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @validate-pubkey/hex (npm)
3 compromised versions
- Nov 24, 2025
Malware in @validate-pubkey/hex
1 compromised version
- Nov 24, 2025
Malicious code in parse-session (npm)
1 compromised version
- Nov 24, 2025
Malicious code in chai-async-chain (npm)
1 compromised version
- Nov 24, 2025
Malware in chai-async-chain
1 compromised version
- Nov 24, 2025
Malware in parse-session
1 compromised version
- Nov 24, 2025
Malicious code in tailwind-inquirer (npm)
- Nov 24, 2025
Malware in tailwind-inquirer
1 compromised version
- Nov 24, 2025
Malicious code in tailwind-pulse (npm)
- Nov 24, 2025
Malware in tailwind-pulse
1 compromised version
- Nov 24, 2025
Malicious code in hash-guard (npm)
- Nov 24, 2025
Malware in hash-guard
1 compromised version
- Nov 24, 2025
Malicious code in loliloli (npm)
32 compromised versions
- Nov 24, 2025
Malware in loliloli
1 compromised version
- Nov 24, 2025
Malicious code in token-verify-passport (npm)
- Nov 24, 2025
Malware in token-verify-passport
1 compromised version
- Nov 24, 2025
Malware in hellospa
1 compromised version
- Nov 24, 2025
Malware in lululemon-b2b-utils
1 compromised version
- Nov 24, 2025
Malicious code in vue3-transpiler (npm)
1 compromised version
- Nov 24, 2025
Malicious code in shinhan-limit-scrap (npm)
1 compromised version
Page 264 of 4,809