Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,003 total in npm · sorted newest first- Jul 3, 2026
Malicious code in alder_morrgan (npm)
- Jul 3, 2026
Malicious code in @node-cloud/create (npm)
7 compromised versions
- Jul 3, 2026
Malicious code in @lodash-en/lodash-en (npm)
2 compromised versions
- Jul 3, 2026
Malicious code in decode-sdks (npm)
- Jul 3, 2026
Malicious code in @jacobtan/decode-sdk (npm)
1 compromised version
- Jul 2, 2026
Malicious code in epic-internal-tools (npm)
1 compromised version
- Jul 2, 2026
Malicious code in ue-automation-scripts (npm)
1 compromised version
- Jul 2, 2026
Malicious code in robomerge (npm)
1 compromised version
- Jul 2, 2026
Malicious code in unreal-horde-dashboard (npm)
1 compromised version
- Jul 2, 2026
Malicious code in ue-jenkins-buildkite (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @checkrhq/adjudication-api-client (npm)
1 compromised version
- Jul 2, 2026
Malicious code in tailwind-animates (npm)
1 compromised version
- Jul 2, 2026
Malicious code in db-convertor (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @modhamanish/rn-mm-template (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/navbar (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/mychatspreloader (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/madvpopup (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/livestreampreviewpopup (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/infopopup (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/header (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/gotoauthpopup (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/footer (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/fingerprint (npm)
- Jul 2, 2026
Malicious code in @marketfront/fashiononboardingpopup (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/errorcounter (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/dynamicpageparams (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/digitalherobannercarousel (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/devtoolsloader (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/designsystemdevtool (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/customdealsfeed (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/commonecommerce (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/changefilter (npm)
- Jul 2, 2026
Malicious code in @marketfront/captchaservice (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/blenderdevtool (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/basemarkettemplate (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/baobabtech (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/bannerpopup (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/advertisingdevtool (npm)
1 compromised version
- Jul 2, 2026
Malicious code in @marketfront/actualordersnippetpopup (npm)
- Jul 1, 2026
Malicious code in electron-orbit (npm)
32 compromised versions
- Jul 1, 2026
Malicious code in svgcraft-core (npm)
6 compromised versions
- Jul 1, 2026
Malicious code in test-pkg-yarn (npm)
3 compromised versions
- Jul 1, 2026
Malicious code in test-pkg-pnpm (npm)
2 compromised versions
- Jul 1, 2026
Malicious code in test-pkg-x0 (npm)
5 compromised versions
- Jul 1, 2026
Malicious code in polymarket-toolkit (npm)
1 compromised version
- Jul 1, 2026
Malicious code in polymarket-trading-developer-tool (npm)
2 compromised versions
- Jul 1, 2026
Malicious code in polymarket-risk-manager (npm)
1 compromised version
- Jul 1, 2026
Malicious code in ts-clob-math-v2 (npm)
1 compromised version
- Jul 1, 2026
Malicious code in ts-elinter (npm)
1 compromised version
- Jul 1, 2026
Malicious code in ts-eslint-helper (npm)
5 compromised versions
Page 27 of 4,801