Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,422 total in npm · sorted newest first- Nov 17, 2025
Malicious code in bcryptkit (npm)
- Nov 17, 2025
Malware in bcryptkit
1 compromised version
- Nov 17, 2025
Malicious code in signals-embed (npm)
- Nov 17, 2025
Malicious code in integrator-filescrypt2025 (npm)
- Nov 17, 2025
Malicious code in integrator-2830 (npm)
- Nov 17, 2025
Malicious code in integrator-2829 (npm)
- Nov 17, 2025
Malicious code in dsidospsodlks (npm)
- Nov 17, 2025
Malicious code in applicationooks21 (npm)
- Nov 17, 2025
Malicious code in application-phskck (npm)
- Nov 17, 2025
Malware in signals-embed
1 compromised version
- Nov 17, 2025
Malware in applicationooks21
1 compromised version
- Nov 17, 2025
Malware in integrator-2830
1 compromised version
- Nov 17, 2025
Malware in integrator-filescrypt2025
1 compromised version
- Nov 17, 2025
Malware in dsidospsodlks
1 compromised version
- Nov 17, 2025
Malware in integrator-2829
1 compromised version
- Nov 17, 2025
Malware in application-phskck
1 compromised version
- Nov 17, 2025
Malicious code in chai-proxify (npm)
- Nov 17, 2025
Malware in chai-proxify
1 compromised version
- Nov 17, 2025
Malicious code in react-native-animated-shine (npm)
- Nov 17, 2025
Malware in react-native-animated-shine
1 compromised version
- Nov 17, 2025
Malicious code in react-confetti-modern (npm)
- Nov 17, 2025
Malware in react-confetti-modern
1 compromised version
- Nov 17, 2025
Malicious code in tailwind-styled-scrollbar (npm)
- Nov 17, 2025
Malware in tailwind-styled-scrollbar
1 compromised version
- Nov 16, 2025
Malicious code in com.mixpanel.unity (npm)
1 compromised version
- Nov 15, 2025
Malicious code in filifecycleserv-paypal (npm)
1 compromised version
- Nov 14, 2025
Malicious code in loger-parser (npm)
1 compromised version
- Nov 14, 2025
Malware in loger-parser
1 compromised version
- Nov 14, 2025
Malicious code in tailwindcss-setflex (npm)
- Nov 14, 2025
Malware in tailwindcss-setflex
1 compromised version
- Nov 14, 2025
Malicious code in validator-node (npm)
1 compromised version
- Nov 14, 2025
Malicious code in chain-test-async (npm)
1 compromised version
- Nov 14, 2025
Malicious code in chai-test-async (npm)
1 compromised version
- Nov 14, 2025
Malware in chai-test-async
1 compromised version
- Nov 14, 2025
Malware in chain-test-async
1 compromised version
- Nov 14, 2025
Malware in validator-node
1 compromised version
- Nov 13, 2025
Malicious code in com.unity.polyspatial (npm)
3 compromised versions
- Nov 13, 2025
Malicious code in worldskills (npm)
1 compromised version
- Nov 13, 2025
Malicious code in form-classifier (npm)
1 compromised version
- Nov 13, 2025
Malicious code in bitsight (npm)
2 compromised versions
- Nov 13, 2025
Malicious code in @walletify/ui (npm)
- Nov 13, 2025
Malicious code in @walletify/core (npm)
- Nov 13, 2025
Malicious code in @walletify/backend (npm)
- Nov 13, 2025
Malware in @walletify/core
1 compromised version
- Nov 13, 2025
Malware in @walletify/ui
1 compromised version
- Nov 13, 2025
Malware in @walletify/backend
1 compromised version
- Nov 13, 2025
Malicious code in vite-chunk-master (npm)
- Nov 13, 2025
Malware in vite-chunk-master
1 compromised version
- Nov 13, 2025
Malicious code in zooarchaeology-nodemon-semantic-release-backend (npm)
- Nov 13, 2025
Malicious code in zooarchaeology-mocha-markdown-neptunology (npm)
Page 268 of 4,809