Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,327 total in npm · sorted newest first- Aug 14, 2025
Malicious code in @crabas0npm/ab-excepturi-pariatur (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/ab-animi-vitae (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/a-qui-ullam-possimus (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/a-amet-molestiae-earum (npm)
- Aug 14, 2025
Malicious code in @crabas0npm/a-aliquid-ducimus-non (npm)
- Aug 14, 2025
Malicious code in @corptools-frontend/northwestregisteredagent.com (npm)
1 compromised version
- Aug 14, 2025
Malicious code in @core-pas/cyb-core (npm)
- Aug 14, 2025
Malicious code in @coolblue-development/next-recently-viewed (npm)
- Aug 14, 2025
Malicious code in @conversation-app/core-api (npm)
- Aug 14, 2025
Malicious code in @com-td-aacs/td-emerald-standards (npm)
- Aug 14, 2025
Malicious code in @com-td-aacs/td (npm)
- Aug 14, 2025
Malicious code in @cognam/shared-project (npm)
- Aug 14, 2025
Malicious code in @cobalt-marketplace/react-stateful-button (npm)
- Aug 14, 2025
Malicious code in @clickhouse-team/clickhouse-backups-plugin (npm)
- Aug 14, 2025
Malicious code in @clickhouse-team/backup-components (npm)
- Aug 14, 2025
Malicious code in @citrixgs/g11n-sdk-react (npm)
- Aug 14, 2025
Malicious code in @citrix-dc/dc-test (npm)
- Aug 14, 2025
Malicious code in @citi-gcg-167407/web-common (npm)
- Aug 14, 2025
Malicious code in @citi-gcg-167407/core-services (npm)
- Aug 14, 2025
Malicious code in @citi-gcg-167407/common (npm)
- Aug 14, 2025
Malicious code in @bttr-devs/nuxt-layer-base (npm)
- Aug 14, 2025
Malicious code in @bmw-ds/components (npm)
- Aug 14, 2025
Malicious code in @billing-info/react (npm)
- Aug 14, 2025
Malicious code in @billing-info/common (npm)
- Aug 14, 2025
Malicious code in @berush/tracking-pixel (npm)
- Aug 14, 2025
Malicious code in @berush/referral-cookie-handler (npm)
- Aug 14, 2025
Malicious code in @berufungirnpm/vel-impedit-nobis (npm)
- Aug 14, 2025
Malicious code in @behemothx00/webpinger1 (npm)
- Aug 14, 2025
Malicious code in @behemothx00/webpinger (npm)
- Aug 14, 2025
Malicious code in @behemothx00/webp1nger (npm)
- Aug 14, 2025
Malicious code in @behemothx00/cacademee (npm)
- Aug 14, 2025
Malicious code in @bazel-example/vue-library (npm)
- Aug 14, 2025
Malicious code in @balea/ui (npm)
- Aug 14, 2025
Malicious code in @ba-bc-child/provider (npm)
1 compromised version
- Aug 14, 2025
Malicious code in @azl-react-components/svgs (npm)
1 compromised version
- Aug 14, 2025
Malicious code in @azl-react-components/molecules (npm)
1 compromised version
- Aug 14, 2025
Malicious code in @azl-react-components/atoms (npm)
1 compromised version
- Aug 14, 2025
Malicious code in @aws-ee/base-services (npm)
- Aug 14, 2025
Malicious code in @avocado-team/app-center-sdk-for-white-team (npm)
- Aug 14, 2025
Malicious code in @avocado-team/app-center-mini-landing (npm)
- Aug 14, 2025
Malicious code in @avocado-team/app-center-app-widget (npm)
- Aug 14, 2025
Malicious code in @avoc-analytics-skeleton-monorepo/log (npm)
- Aug 14, 2025
Malicious code in @avoc-analytics-skeleton-monorepo/config (npm)
- Aug 14, 2025
Malicious code in @avoc-analytics-skeleton-monorepo/auth (npm)
- Aug 14, 2025
Malicious code in @aviationpast/niotest (npm)
- Aug 14, 2025
Malicious code in @augloop/types-core (npm)
- Aug 14, 2025
Malicious code in @augloop/session-protocol (npm)
- Aug 14, 2025
Malicious code in @augloop/logging (npm)
- Aug 14, 2025
Malicious code in @augloop/interfaces (npm)
- Aug 14, 2025
Malicious code in @async-mutex/mutex (npm)
Page 5196 of 6,667