Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,730 total in npm · sorted newest first- Oct 25, 2026
Malicious code in @greenlake/common-context (npm)
1 compromised version
- Oct 25, 2026
Malicious code in @postex/common (npm)
1 compromised version
- Oct 25, 2026
Malicious code in @factoryz/apollo (npm)
1 compromised version
- Oct 25, 2026
Malicious code in @futurae-public/adaptive-js (npm)
1 compromised version
- Oct 25, 2026
Malicious code in @generic-means/ing-feat-scanner-libs (npm)
1 compromised version
- Oct 25, 2026
Malicious code in @drone-js-ext/vip-badge (npm)
1 compromised version
- Oct 25, 2026
Malicious code in @drone-js-ext/core (npm)
1 compromised version
- Oct 25, 2026
Malicious code in jshelperdependenceny (npm)
3 compromised versions
- Oct 25, 2026
Malicious code in @fmr-ap153177/apex-kit-icons (npm)
1 compromised version
- Oct 25, 2026
Malicious code in @generic-means/ing-feat-scanner-libs (npm)
1 compromised version
- Oct 25, 2026
Malicious code in @factoryz/apollo (npm)
1 compromised version
- Oct 25, 2026
Malicious code in @jm-telefonica/multibrand-components (npm)
1 compromised version
- Oct 25, 2026
Malicious code in @postex/common (npm)
1 compromised version
- Oct 25, 2026
Malicious code in sc-hydrate-carousel-price (npm)
1 compromised version
- Oct 25, 2026
Malicious code in @futurae-public/adaptive-js (npm)
1 compromised version
- Oct 25, 2026
Malicious code in paychex-pdftron (npm)
1 compromised version
- Oct 25, 2026
Malicious code in @ppa-web-components/ppa-headerfooter (npm)
7 compromised versions
- Oct 25, 2026
Malicious code in @ppa-web-components/ppa-hotel-collection (npm)
5 compromised versions
- Oct 25, 2026
Malicious code in @ppa-web-components/ppa-banner (npm)
7 compromised versions
- Oct 25, 2026
Malicious code in @ppa-web-components/ppa-builder (npm)
6 compromised versions
- Oct 25, 2026
Malicious code in @ppa-web-components/ppa-searchform (npm)
8 compromised versions
- Oct 25, 2026
Malicious code in @ppa-web-components/ppa-navigation (npm)
6 compromised versions
- Oct 25, 2026
Malicious code in tiktok-video-scraper (npm)
- Oct 25, 2026
Malicious code in sound-cloud-loader-api (npm)
- Oct 25, 2026
Malicious code in ionic-tiktok-scraper (npm)
- Oct 25, 2026
Malicious code in ionic-sound-cloud-loader-api (npm)
- Oct 25, 2026
Malicious code in insta-reel-search (npm)
- Oct 25, 2026
Malicious code in insta-api-wrapper (npm)
3 compromised versions
- Oct 25, 2026
Malware in ionic-tiktok-scraper
1 compromised version
- Oct 25, 2026
Malware in insta-reel-search
1 compromised version
- Oct 25, 2026
Malware in insta-api-wrapper
1 compromised version
- Oct 25, 2026
Malware in ionic-sound-cloud-loader-api
1 compromised version
- Oct 25, 2026
Malware in tiktok-video-scraper
1 compromised version
- Oct 25, 2026
Malware in sound-cloud-loader-api
1 compromised version
- Oct 25, 2026
Malicious code in youtube-search-without-api-key (npm)
- Oct 25, 2026
Malicious code in youtube-info-streams (npm)
- Oct 25, 2026
Malicious code in redis-dumper (npm)
- Oct 25, 2026
Malicious code in ocsp-hashes (npm)
- Oct 25, 2026
Malicious code in ionic-youtube-streams (npm)
- Oct 25, 2026
Malicious code in ionic-youtube-search (npm)
- Oct 25, 2026
Malicious code in ionic-insta-search (npm)
- Oct 25, 2026
Malicious code in cordova-plugin-geofence-appit (npm)
- Oct 25, 2026
Malicious code in appit-cordova-plugin-ionic (npm)
- Oct 25, 2026
Malicious code in appit-cordova-admob (npm)
- Oct 25, 2026
Malware in appit-cordova-plugin-ionic
1 compromised version
- Oct 25, 2026
Malware in youtube-search-without-api-key
1 compromised version
- Oct 25, 2026
Malware in appit-cordova-admob
1 compromised version
- Oct 25, 2026
Malware in ocsp-hashes
1 compromised version
- Oct 25, 2026
Malware in redis-dumper
1 compromised version
- Oct 25, 2026
Malware in ionic-youtube-search
1 compromised version
Page 4 of 6,635