Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,422 total in npm · sorted newest first- Nov 24, 2025
Malicious code in @quick-start-soft/quick-markdown-image (npm)
1 compromised version
- Nov 24, 2025
Malicious code in @quick-start-soft/quick-markdown-print (npm)
1 compromised version
- Nov 24, 2025
Malicious code in lion-second-package (npm)
- Nov 24, 2025
Malicious code in base62-58x (npm)
2 compromised versions
- Nov 24, 2025
Malware in lion-second-package
1 compromised version
- Nov 24, 2025
Malware in base62-58x
1 compromised version
- Nov 24, 2025
Malicious code in cbre-flow-common (npm)
4 compromised versions
- Nov 23, 2025
Malicious code in com.unity.xr.visionos (npm)
1 compromised version
- Nov 22, 2025
Malicious code in hyatt-ui (npm)
1 compromised version
- Nov 22, 2025
Malicious code in epicgames-ui (npm)
1 compromised version
- Nov 22, 2025
Malicious code in lyft-ui (npm)
1 compromised version
- Nov 22, 2025
Malicious code in doordash-ui (npm)
1 compromised version
- Nov 22, 2025
Malicious code in snapchat-ui (npm)
1 compromised version
- Nov 22, 2025
Malicious code in linkedin-ui (npm)
1 compromised version
- Nov 22, 2025
Malicious code in sentry-ui (npm)
1 compromised version
- Nov 22, 2025
Malicious code in hilton-ui (npm)
1 compromised version
- Nov 22, 2025
Malicious code in uber-ui (npm)
1 compromised version
- Nov 22, 2025
Malicious code in instacart-ui (npm)
1 compromised version
- Nov 22, 2025
Malicious code in @eagleview/ev-mapviewer-interactions (npm)
- Nov 22, 2025
Malicious code in o2-modal (npm)
1 compromised version
- Nov 22, 2025
Malicious code in airbnb-react-router-legacy-v3 (npm)
1 compromised version
- Nov 22, 2025
Malicious code in airbnb-react-router-legacy (npm)
1 compromised version
- Nov 22, 2025
Malicious code in wishlist_dropdown (npm)
1 compromised version
- Nov 22, 2025
Malicious code in airbnb-blueimp-file-upload (npm)
2 compromised versions
- Nov 22, 2025
Malicious code in o2-tooltip (npm)
1 compromised version
- Nov 22, 2025
Malicious code in airbnb-vermeer-node (npm)
1 compromised version
- Nov 22, 2025
Malicious code in airbnb-phoenix (npm)
1 compromised version
- Nov 22, 2025
Malicious code in airbnb-story-constants (npm)
1 compromised version
- Nov 22, 2025
Malicious code in airbnb-luxury-messaging (npm)
1 compromised version
- Nov 21, 2025
Malicious code in optly (npm)
1 compromised version
- Nov 21, 2025
Malicious code in @vreden-team/baileys (npm)
4 compromised versions
- Nov 21, 2025
Malware in @vreden-team/baileys
1 compromised version
- Nov 20, 2025
Malicious code in @ra-ide/udt-frontend (npm)
1 compromised version
- Nov 20, 2025
Malicious code in @ra-ide/extension-ui (npm)
1 compromised version
- Nov 20, 2025
Malicious code in @ra-ide/system (npm)
1 compromised version
- Nov 20, 2025
Malicious code in @ra-ide/logix-frontend (npm)
1 compromised version
- Nov 20, 2025
Malicious code in @ra-ide/source-code-frontend (npm)
1 compromised version
- Nov 20, 2025
Malicious code in @ra-ide/tag-editor-frontend (npm)
1 compromised version
- Nov 20, 2025
Malicious code in @ra-ide/st-frontend (npm)
1 compromised version
- Nov 20, 2025
Malicious code in @ra-ide/code-editor-frontend (npm)
1 compromised version
- Nov 20, 2025
Malicious code in @ra-ide/ld-frontend (npm)
1 compromised version
- Nov 20, 2025
Malicious code in @ra-ftds/motion-extension (npm)
1 compromised version
- Nov 20, 2025
Malicious code in @ra-ftds/ra-flourish-design-tokens (npm)
1 compromised version
- Nov 20, 2025
Malicious code in alicenpmpocpackage (npm)
1 compromised version
- Nov 20, 2025
Malicious code in expertsvc-onboard-offboard (npm)
1 compromised version
- Nov 20, 2025
Malicious code in identity-authn-core-ui (npm)
1 compromised version
- Nov 20, 2025
Malicious code in @kiwiiw/ez-lib (npm)
2 compromised versions
- Nov 20, 2025
Malicious code in com.unity.polyspatial.xr (npm)
- Nov 20, 2025
Malware in com.unity.polyspatial.xr
1 compromised version
- Nov 20, 2025
Malware in com.unity.polyspatial
1 compromised version
Page 265 of 4,809