Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,011 total in npm · sorted newest first- Jun 19, 2026
Malicious code in new-ecro (npm)
3 compromised versions
- Jun 19, 2026
Malicious code in node-slot (npm)
3 compromised versions
- Jun 19, 2026
Malicious code in ordered-btree (npm)
1 compromised version
- Jun 19, 2026
Malicious code in @mep-exp/api-tools (npm)
1 compromised version
- Jun 19, 2026
Malicious code in @qlab/component-intelligence (npm)
1 compromised version
- Jun 19, 2026
Malicious code in nodepathbalance54 (npm)
1 compromised version
- Jun 19, 2026
Malicious code in conversa-sdk (npm)
2 compromised versions
- Jun 19, 2026
Malicious code in electron-internal-utils (npm)
1 compromised version
- Jun 19, 2026
Malicious code in eyee (npm)
1 compromised version
- Jun 19, 2026
Malicious code in portloop (npm)
2 compromised versions
- Jun 19, 2026
Malicious code in ts-linter-builders (npm)
1 compromised version
- Jun 19, 2026
Malicious code in eslint-helper-1 (npm)
1 compromised version
- Jun 19, 2026
Malicious code in mjs-eslint-helper (npm)
1 compromised version
- Jun 19, 2026
Malicious code in eslint-helper (npm)
2 compromised versions
- Jun 18, 2026
Malicious code in node-vfs-polyfill (npm)
2 compromised versions
- Jun 18, 2026
Malicious code in db-connector-log (npm)
2 compromised versions
- Jun 18, 2026
Malicious code in runtime-query (npm)
1 compromised version
- Jun 18, 2026
Malicious code in clx-cookie-signature (npm)
1 compromised version
- Jun 18, 2026
Malicious code in @httpactions/strict-uri-encode (npm)
1 compromised version
- Jun 18, 2026
Malicious code in @httpactions/encode-url (npm)
2 compromised versions
- Jun 18, 2026
Malicious code in @gbrlxvi/ts-project-lint (npm)
1 compromised version
- Jun 18, 2026
Malicious code in react-error-lint (npm)
1 compromised version
- Jun 18, 2026
Malicious code in ratelimitsucks (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in ratelimitsucks6 (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in abuden221 (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in abuden22 (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in abuden218 (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in panrouter-admin (npm)
1 compromised version
- Jun 18, 2026
Malicious code in panrouter (npm)
2 compromised versions
- Jun 18, 2026
Malicious code in @onum-releases/utils (npm)
2 compromised versions
- Jun 18, 2026
Malicious code in @onum-releases/shared-components (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in @onum-releases/ixel (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in @onum-releases/sdk (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in @onum-releases/auth (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in @onum-releases/api-client (npm)
3 compromised versions
- Jun 18, 2026
Malicious code in @caspianph/storyteller (npm)
1 compromised version
- Jun 18, 2026
Malicious code in computerrock-babel-preset-react-app (npm)
1 compromised version
- Jun 18, 2026
Malicious code in metavu (npm)
2 compromised versions
- Jun 18, 2026
Malicious code in parket-helper (npm)
2 compromised versions
- Jun 18, 2026
Malware in parket-helper
1 compromised version
- Jun 18, 2026
Malware in parket-slot
1 compromised version
- Jun 18, 2026
Malware in uidai_reusable_components
1 compromised version
- Jun 18, 2026
Malicious code in @rafaelsene01/agent-flow (npm)
17 compromised versions
- Jun 18, 2026
Malware in @rafaelsene01/agent-flow
1 compromised version
- Jun 18, 2026
Malicious code in stackus (npm)
1 compromised version
- Jun 18, 2026
Malicious code in jwtmode (npm)
1 compromised version
- Jun 18, 2026
Malicious code in requests-middleware (npm)
1 compromised version
- Jun 18, 2026
Malicious code in roblox-api-client (npm)
1 compromised version
- Jun 18, 2026
Malicious code in intquery (npm)
2 compromised versions
- Jun 18, 2026
Malware in intquery
1 compromised version
Page 38 of 4,801