Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,011 total in npm · sorted newest first- Jun 18, 2026
Malware in pkg-telemetry-r4f9
1 compromised version
- Jun 18, 2026
Malware in @ncurran/sandbox-recon-7c4e1a
1 compromised version
- Jun 18, 2026
Malware in npm-sandbox-research-f1g2
1 compromised version
- Jun 18, 2026
Malware in npm-sandbox-research-c5d6
1 compromised version
- Jun 18, 2026
Malware in @ncurran/dc-selftest-33afb7
1 compromised version
- Jun 17, 2026
Malicious code in vite-common-utils (npm)
3 compromised versions
- Jun 17, 2026
Malicious code in uol-simple-api-futebol (npm)
5 compromised versions
- Jun 17, 2026
Malicious code in ai-chat-helper (npm)
3 compromised versions
- Jun 17, 2026
Malicious code in @hotcappuccino/nodepull (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @array-util/nodepull (npm)
3 compromised versions
- Jun 17, 2026
Malicious code in pino-slite (npm)
2 compromised versions
- Jun 17, 2026
Malicious code in set-proto-chain (npm)
1 compromised version
- Jun 17, 2026
Malicious code in ebpf-tracker-action (npm)
1 compromised version
- Jun 17, 2026
Malicious code in opt-archetype-check (npm)
3 compromised versions
- Jun 17, 2026
Malicious code in @civitatis/bot-ui (npm)
2 compromised versions
- Jun 17, 2026
Malicious code in libsc-runtime-telemetry (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/observability (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/observability
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/loggers (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/loggers
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/redis (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/redis
1 compromised version
- Jun 17, 2026
Malicious code in n8n-nodes-security-test-poc (npm)
5 compromised versions
- Jun 17, 2026
Malicious code in lab-services (npm)
1 compromised version
- Jun 17, 2026
Malicious code in scan-only (npm)
14 compromised versions
- Jun 17, 2026
Malicious code in swift-parse-stream (npm)
2 compromised versions
- Jun 17, 2026
Malicious code in quirky-token (npm)
3 compromised versions
- Jun 17, 2026
Malware in chai-as-tokenized
1 compromised version
- Jun 17, 2026
Malware in api-rs-node
1 compromised version
- Jun 17, 2026
Malicious code in sodel-pych (npm)
2 compromised versions
- Jun 17, 2026
Malware in sodel-pych
1 compromised version
- Jun 17, 2026
Malicious code in sort-btree (npm)
2 compromised versions
- Jun 17, 2026
Malicious code in @ignacionunez91/keccak24 (npm)
- Jun 17, 2026
Malware in sort-btree
1 compromised version
- Jun 17, 2026
Malware in @ignacionunez91/keccak24
1 compromised version
- Jun 17, 2026
Malicious code in tailwindcss-animates-css (npm)
- Jun 17, 2026
Malicious code in qrcode-generator-node (npm)
- Jun 17, 2026
Malicious code in qrcode-express (npm)
- Jun 17, 2026
Malicious code in express-validates (npm)
- Jun 17, 2026
Malware in tailwindcss-animates-css
1 compromised version
- Jun 17, 2026
Malware in express-validates
1 compromised version
- Jun 17, 2026
Malware in qrcode-generator-node
1 compromised version
- Jun 17, 2026
Malware in qrcode-express
1 compromised version
- Jun 17, 2026
Malicious code in virtualization-compression-collapse (npm)
2 compromised versions
- Jun 17, 2026
Malicious code in userinterface-machinelearning (npm)
1 compromised version
- Jun 17, 2026
Malicious code in touchid-images (npm)
1 compromised version
- Jun 17, 2026
Malicious code in streaming-downloads (npm)
2 compromised versions
- Jun 17, 2026
Malicious code in socket-network (npm)
1 compromised version
- Jun 17, 2026
Malicious code in request-tracking-sqlite (npm)
2 compromised versions
- Jun 17, 2026
Malicious code in request-performance (npm)
1 compromised version
Page 40 of 4,801