Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,064 total in npm · sorted newest first- Jun 16, 2026
Malicious code in aillmgen (npm)
1 compromised version
- Jun 16, 2026
Malicious code in @kalipto/local (npm)
4 compromised versions
- Jun 16, 2026
Malicious code in test-copppss (npm)
1 compromised version
- Jun 16, 2026
Malicious code in @welcome-onboarding-web/mobile-focus-account-beta-merging (npm)
1 compromised version
- Jun 16, 2026
Malicious code in binproto (npm)
2 compromised versions
- Jun 16, 2026
Malicious code in motion-lib (npm)
1 compromised version
- Jun 16, 2026
Malicious code in js-digest (npm)
1 compromised version
- Jun 16, 2026
Malicious code in pretie_x2 (npm)
5 compromised versions
- Jun 16, 2026
Malicious code in pretie_x1 (npm)
5 compromised versions
- Jun 16, 2026
Malicious code in nottuff7 (npm)
3 compromised versions
- Jun 16, 2026
Malicious code in nottuff23 (npm)
3 compromised versions
- Jun 16, 2026
Malicious code in nottuff25 (npm)
3 compromised versions
- Jun 16, 2026
Malicious code in nottuff4 (npm)
3 compromised versions
- Jun 16, 2026
Malicious code in nottuff15 (npm)
3 compromised versions
- Jun 16, 2026
Malicious code in mastraqqq (npm)
1 compromised version
- Jun 16, 2026
Malicious code in proto-bin (npm)
4 compromised versions
- Jun 16, 2026
Malicious code in utils-common-helpers (npm)
1 compromised version
- Jun 16, 2026
Malicious code in react-hook-use-debounce-throttle-12 (npm)
3 compromised versions
- Jun 16, 2026
Malicious code in chai-plugin-helper (npm)
4 compromised versions
- Jun 16, 2026
Malicious code in chain-chai-test (npm)
1 compromised version
- Jun 16, 2026
Malicious code in chai-as-polished (npm)
1 compromised version
- Jun 16, 2026
Malicious code in chai-as-tokenized (npm)
1 compromised version
- Jun 16, 2026
Malicious code in chai-guid (npm)
1 compromised version
- Jun 16, 2026
Malicious code in chai-plugin-kit (npm)
1 compromised version
- Jun 16, 2026
Malicious code in chai-plugin (npm)
4 compromised versions
- Jun 16, 2026
Malicious code in chai-solidity-testkit (npm)
2 compromised versions
- Jun 16, 2026
Malicious code in chai-as-decrypted (npm)
1 compromised version
- Jun 16, 2026
Malicious code in uidai_reusable_components (npm)
5 compromised versions
- Jun 16, 2026
Malicious code in easyllmai (npm)
2 compromised versions
- Jun 16, 2026
Malicious code in caspian-day-js (npm)
1 compromised version
- Jun 16, 2026
Malicious code in strict-engine-peer (npm)
2 compromised versions
- Jun 16, 2026
Malicious code in jest-test-plugin-utils (npm)
4 compromised versions
- Jun 16, 2026
Malicious code in noderzero (npm)
4 compromised versions
- Jun 16, 2026
Malicious code in create-vercel-integration (npm)
1 compromised version
- Jun 16, 2026
Malicious code in @dsft/ft-utils (npm)
1 compromised version
- Jun 16, 2026
Malicious code in @dsft/ft-element (npm)
1 compromised version
- Jun 16, 2026
Malicious code in stripe-cli-init-plugin (npm)
1 compromised version
- Jun 16, 2026
Malicious code in conducts (npm)
- Jun 16, 2026
Malware in conducts
1 compromised version
- Jun 16, 2026
Malicious code in atlassian-forge-skills (npm)
1 compromised version
- Jun 16, 2026
Malicious code in claude-jar (npm)
1 compromised version
- Jun 16, 2026
Malicious code in @vantuz/sdk-core (npm)
- Jun 16, 2026
Malware in @vantuz/sdk-core
1 compromised version
- Jun 16, 2026
Malware in mailconfirmer
1 compromised version
- Jun 16, 2026
Malicious code in middleware-jwt (npm)
1 compromised version
- Jun 16, 2026
Malware in middleware-jwt
1 compromised version
- Jun 16, 2026
Malicious code in vortnode (npm)
1 compromised version
- Jun 16, 2026
Malicious code in wordpad-text-ui (npm)
2 compromised versions
- Jun 16, 2026
Malicious code in obfus-jsxy (npm)
1 compromised version
- Jun 16, 2026
Malware in obfus-jsxy
1 compromised version
Page 47 of 4,802