Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,011 total in npm · sorted newest first- Jun 23, 2026
Malicious code in kdrive-utils (npm)
1 compromised version
- Jun 23, 2026
Malicious code in cue-mcp (npm)
1 compromised version
- Jun 23, 2026
Malicious code in tree-sitter-forth (npm)
1 compromised version
- Jun 23, 2026
Malicious code in myebaynode (npm)
1 compromised version
- Jun 23, 2026
Malicious code in poly-utils (npm)
1 compromised version
- Jun 23, 2026
Malicious code in new-solt-1 (npm)
1 compromised version
- Jun 23, 2026
Malicious code in new-solt (npm)
3 compromised versions
- Jun 23, 2026
Malicious code in new-helper (npm)
1 compromised version
- Jun 23, 2026
Malicious code in new-ecro-helper (npm)
1 compromised version
- Jun 23, 2026
Malicious code in ts-numbering (npm)
1 compromised version
- Jun 23, 2026
Malicious code in local-ip-helper (npm)
1 compromised version
- Jun 23, 2026
Malicious code in libsignal-node-travatiger (npm)
2 compromised versions
- Jun 23, 2026
Malicious code in ts-wross (npm)
2 compromised versions
- Jun 23, 2026
Malicious code in node-core-libs (npm)
2 compromised versions
- Jun 23, 2026
Malicious code in search-from-search (npm)
1 compromised version
- Jun 23, 2026
Malicious code in @ts-apis/ts-utils (npm)
7 compromised versions
- Jun 22, 2026
Malicious code in web3-token-helper (npm)
8 compromised versions
- Jun 22, 2026
Malicious code in zod-pino (npm)
6 compromised versions
- Jun 22, 2026
Malicious code in @variational/common-ui (npm)
14 compromised versions
- Jun 22, 2026
Malicious code in node-fetch-utils (npm)
9 compromised versions
- Jun 22, 2026
Malicious code in vitest-cli (npm)
5 compromised versions
- Jun 22, 2026
Malicious code in zomato-mcp (npm)
1 compromised version
- Jun 22, 2026
Malicious code in zomato-espresso (npm)
1 compromised version
- Jun 22, 2026
Malicious code in zomato-core (npm)
1 compromised version
- Jun 22, 2026
Malicious code in sn-internal-testjgsakjdkjadkjah (npm)
5 compromised versions
- Jun 22, 2026
Malicious code in test-package-sajsdkashdj (npm)
2 compromised versions
- Jun 22, 2026
Malicious code in search-from-feed (npm)
1 compromised version
- Jun 22, 2026
Malicious code in gd-auth-client (npm)
1 compromised version
- Jun 22, 2026
Malicious code in @zynkit/jwtbytes (npm)
5 compromised versions
- Jun 22, 2026
Malicious code in @tinyfox/shapecheck (npm)
5 compromised versions
- Jun 22, 2026
Malicious code in @thymelab/logfx (npm)
4 compromised versions
- Jun 22, 2026
Malicious code in @petitcode/eb-retry (npm)
4 compromised versions
- Jun 22, 2026
Malicious code in @nullzero/urlcat (npm)
6 compromised versions
- Jun 22, 2026
Malicious code in @lazyutil/dater (npm)
5 compromised versions
- Jun 22, 2026
Malicious code in @glitchpad/throttler (npm)
5 compromised versions
- Jun 22, 2026
Malicious code in @frostnode/waitfor (npm)
5 compromised versions
- Jun 22, 2026
Malicious code in forge-jsx4 (npm)
1 compromised version
- Jun 22, 2026
Malicious code in respects-switch (npm)
1 compromised version
- Jun 22, 2026
Malicious code in onboarding-respects-modal (npm)
1 compromised version
- Jun 22, 2026
Malicious code in crud-respect (npm)
1 compromised version
- Jun 21, 2026
Malicious code in fork-angular-daterangepicker (npm)
3 compromised versions
- Jun 21, 2026
Malicious code in hyperpure-core (npm)
1 compromised version
- Jun 21, 2026
Malicious code in blinkit-core (npm)
1 compromised version
- Jun 21, 2026
Malicious code in zomato-sushi (npm)
1 compromised version
- Jun 21, 2026
Malicious code in zomato-logger (npm)
1 compromised version
- Jun 21, 2026
Malicious code in zomato-server (npm)
1 compromised version
- Jun 21, 2026
Malicious code in zomato-config (npm)
1 compromised version
- Jun 20, 2026
Malicious code in sf-storybook (npm)
1 compromised version
- Jun 20, 2026
Malicious code in free-anthropic-claude (npm)
26 compromised versions
- Jun 20, 2026
Malicious code in atlasora-config (npm)
1 compromised version
Page 36 of 4,801