Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,003 total in npm · sorted newest first- Jul 1, 2026
Malicious code in vega-lite-next (npm)
1 compromised version
- Jul 1, 2026
Malicious code in vitest-agent (npm)
3 compromised versions
- Jul 1, 2026
Malicious code in hardhat-plugin-solidity (npm)
4 compromised versions
- Jul 1, 2026
Malicious code in hardhat-compile-ethers (npm)
13 compromised versions
- Jul 1, 2026
Malicious code in zyncmap (npm)
2 compromised versions
- Jul 1, 2026
Malicious code in svgson-lite (npm)
8 compromised versions
- Jul 1, 2026
Malicious code in base65-85x (npm)
1 compromised version
- Jul 1, 2026
Malicious code in @andes-tools/colors (npm)
1 compromised version
- Jul 1, 2026
Malicious code in npm-show-date-proof-strings (npm)
2 compromised versions
- Jul 1, 2026
Malicious code in date-fns-lite (npm)
13 compromised versions
- Jul 1, 2026
Malicious code in node-pino (npm)
1 compromised version
- Jun 30, 2026
Malicious code in ecto-corsair-flag-7kq3mz (npm)
3 compromised versions
- Jun 30, 2026
Malicious code in module-index-cache (npm)
3 compromised versions
- Jun 30, 2026
Malicious code in ripshakti (npm)
1 compromised version
- Jun 30, 2026
Malicious code in @sudoughnym/enviro-demo (npm)
2 compromised versions
- Jun 30, 2026
Malicious code in @businessapp-microsites/apis (npm)
3 compromised versions
- Jun 30, 2026
Malicious code in cursed-modules (npm)
19 compromised versions
- Jun 30, 2026
Malicious code in procwire (npm)
2 compromised versions
- Jun 30, 2026
Malicious code in quoting (npm)
- Jun 30, 2026
Malicious code in brock-react-alerts (npm)
- Jun 30, 2026
Malicious code in brock-loader (npm)
- Jun 30, 2026
Malicious code in setup-cicd (npm)
1 compromised version
- Jun 30, 2026
Malicious code in postcss-property-rollup (npm)
1 compromised version
- Jun 30, 2026
Malicious code in nbmolviz-js (npm)
1 compromised version
- Jun 30, 2026
Malicious code in confluent-kafka-javascript (npm)
1 compromised version
- Jun 30, 2026
Malicious code in agent-starter-pack (npm)
1 compromised version
- Jun 30, 2026
Malicious code in ts-linting-builder (npm)
1 compromised version
- Jun 30, 2026
Malicious code in ts-lint-builders-v2.1 (npm)
1 compromised version
- Jun 30, 2026
Malicious code in rs-biginteger (npm)
2 compromised versions
- Jun 30, 2026
Malicious code in terminal-prettier (npm)
54 compromised versions
- Jun 30, 2026
Malicious code in vue-demi-fix (npm)
3 compromised versions
- Jun 30, 2026
Malicious code in ripshakti1 (npm)
1 compromised version
- Jun 30, 2026
Malicious code in anthropic-toolkit (npm)
22 compromised versions
- Jun 30, 2026
Malicious code in ts-bn-proto (npm)
1 compromised version
- Jun 30, 2026
Malicious code in thirdwebb (npm)
1 compromised version
- Jun 30, 2026
Malicious code in thirdwb (npm)
1 compromised version
- Jun 30, 2026
Malicious code in polymarket-trading-developer-tools (npm)
2 compromised versions
- Jun 30, 2026
Malicious code in polymarket-clob-maths (npm)
2 compromised versions
- Jun 30, 2026
Malicious code in log-taker1 (npm)
1 compromised version
- Jun 30, 2026
Malicious code in decimal-format-core (npm)
7 compromised versions
- Jun 30, 2026
Malicious code in console-fmt-cli (npm)
11 compromised versions
- Jun 29, 2026
Malicious code in @webda-infra-ui/static-images (npm)
1 compromised version
- Jun 29, 2026
Malicious code in @sixt-payment/form-react (npm)
- Jun 29, 2026
Malicious code in @digitalpharmacist/http-error-util (npm)
1 compromised version
- Jun 29, 2026
Malicious code in @deel-ui/animation (npm)
1 compromised version
- Jun 29, 2026
Malicious code in @deel-core/client-payroll-onboarding-types (npm)
1 compromised version
- Jun 29, 2026
Malicious code in @cseo-hr/trpweb-shared (npm)
- Jun 29, 2026
Malicious code in @contentprod-authoring/block-manager (npm)
1 compromised version
- Jun 29, 2026
Malicious code in @concerns/i18n (npm)
1 compromised version
- Jun 29, 2026
Malicious code in @bscom/styling (npm)
1 compromised version
Page 28 of 4,801