Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,003 total in npm · sorted newest first- Jun 26, 2026
Malicious code in js-price-client-node (npm)
1 compromised version
- Jun 26, 2026
Malicious code in js-client-node (npm)
1 compromised version
- Jun 26, 2026
Malicious code in dttfdsdee (npm)
7 compromised versions
- Jun 26, 2026
Malicious code in chai-as-synced (npm)
1 compromised version
- Jun 26, 2026
Malicious code in set-cookie-ease (npm)
1 compromised version
- Jun 26, 2026
Malicious code in mongoose-json-format (npm)
2 compromised versions
- Jun 26, 2026
Malicious code in @dervix/ws (npm)
6 compromised versions
- Jun 26, 2026
Malicious code in wellnpm (npm)
6 compromised versions
- Jun 26, 2026
Malicious code in animatecss-postcss-plugin (npm)
2 compromised versions
- Jun 26, 2026
Malicious code in @help-forms/application-aff (npm)
1 compromised version
- Jun 26, 2026
Malicious code in data-parser-utils (npm)
1 compromised version
- Jun 26, 2026
Malicious code in prism-silq (npm)
1 compromised version
- Jun 26, 2026
Malicious code in hexo-shoka-swiper (npm)
1 compromised version
- Jun 26, 2026
Malicious code in hexo-deployer-wrangler (npm)
1 compromised version
- Jun 25, 2026
Malicious code in random-string-64 (npm)
2 compromised versions
- Jun 25, 2026
Malicious code in kelly-stake (npm)
5 compromised versions
- Jun 25, 2026
Malicious code in gx-npm-lib (npm)
1 compromised version
- Jun 25, 2026
Malicious code in gx-npm-ui (npm)
1 compromised version
- Jun 25, 2026
Malicious code in velocityfix (npm)
5 compromised versions
- Jun 25, 2026
Malicious code in log-update-ts (npm)
1 compromised version
- Jun 25, 2026
Malicious code in @salem_jalal/osc-components (npm)
1 compromised version
- Jun 25, 2026
Malicious code in unsafe-malicious-package (npm)
8 compromised versions
- Jun 25, 2026
Malicious code in starship-timeline (npm)
1 compromised version
- Jun 25, 2026
Malicious code in runtimekit (npm)
2 compromised versions
- Jun 25, 2026
Malicious code in ref-slot (npm)
1 compromised version
- Jun 25, 2026
Malicious code in typedecode (npm)
3 compromised versions
- Jun 25, 2026
Malicious code in textshape-css (npm)
1 compromised version
- Jun 25, 2026
Malicious code in colorpicker-ui (npm)
2 compromised versions
- Jun 25, 2026
Malicious code in tailwind-color-shades (npm)
1 compromised version
- Jun 25, 2026
Malicious code in tailwindcss-effector (npm)
1 compromised version
- Jun 25, 2026
Malicious code in chlklib (npm)
4 compromised versions
- Jun 25, 2026
Malicious code in ts-precision (npm)
1 compromised version
- Jun 25, 2026
Malicious code in ts-opus (npm)
1 compromised version
- Jun 25, 2026
Malicious code in @vpms/design-system (npm)
4 compromised versions
- Jun 25, 2026
Malicious code in chai-as-built (npm)
1 compromised version
- Jun 25, 2026
Malicious code in gx-npm-feature-flags (npm)
1 compromised version
- Jun 25, 2026
Malicious code in @colibri-event-types/megamarket-ru-web (npm)
1 compromised version
- Jun 25, 2026
Malicious code in abu-common-components (npm)
1 compromised version
- Jun 25, 2026
Malicious code in dttsdee (npm)
1 compromised version
- Jun 25, 2026
Malicious code in easy-string-kit232 (npm)
1 compromised version
- Jun 25, 2026
Malicious code in dddooo (npm)
3 compromised versions
- Jun 25, 2026
Malicious code in easy-string-kit (npm)
8 compromised versions
- Jun 25, 2026
Malicious code in wp-codebox-workspace (npm)
1 compromised version
- Jun 25, 2026
Malicious code in simple-node-calc-c (npm)
1 compromised version
- Jun 25, 2026
Malicious code in simple-node-calc-b (npm)
1 compromised version
- Jun 25, 2026
Malicious code in simple-node-calc-a (npm)
1 compromised version
- Jun 25, 2026
Malicious code in simple-node-calc-aa (npm)
1 compromised version
- Jun 25, 2026
Malicious code in simple-node-calc-ccc (npm)
1 compromised version
- Jun 25, 2026
Malicious code in subsearch (npm)
2 compromised versions
- Jun 25, 2026
Malicious code in stitch-design (npm)
2 compromised versions
Page 32 of 4,801