Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,064 total in npm · sorted newest first- Jun 12, 2026
Malicious code in theta-kit (npm)
4 compromised versions
- Jun 12, 2026
Malicious code in ttspc-server-sample (npm)
6 compromised versions
- Jun 12, 2026
Malicious code in eslint-plugin-mistica-local-rules (npm)
1 compromised version
- Jun 12, 2026
Malicious code in vite-react-toolkit (npm)
1 compromised version
- Jun 12, 2026
Malicious code in transportator (npm)
1 compromised version
- Jun 12, 2026
Malicious code in chai-web3-testkit (npm)
1 compromised version
- Jun 12, 2026
Malware in chai-web3-testkit
1 compromised version
- Jun 12, 2026
Malware in transportator
1 compromised version
- Jun 12, 2026
Malware in vite-react-toolkit
1 compromised version
- Jun 12, 2026
Malicious code in internallib_v856 (npm)
1 compromised version
- Jun 12, 2026
Malicious code in internallib_v984 (npm)
6 compromised versions
- Jun 12, 2026
Malicious code in voyager-web (npm)
1 compromised version
- Jun 12, 2026
Malicious code in web-model-bridge (npm)
1 compromised version
- Jun 12, 2026
Malware in web-dotenv
1 compromised version
- Jun 12, 2026
Malicious code in sea-bound-siren (npm)
23 compromised versions
- Jun 12, 2026
Malicious code in ecto-win-flag-q2m7 (npm)
2 compromised versions
- Jun 12, 2026
Malicious code in ecto-spirit-win-k4n8 (npm)
1 compromised version
- Jun 12, 2026
Malicious code in ecto-spectral-leak-8d4e2 (npm)
3 compromised versions
- Jun 12, 2026
Malicious code in ecto-rust-read-f3a9c1 (npm)
3 compromised versions
- Jun 12, 2026
Malicious code in ecto-nightly-spirit (npm)
7 compromised versions
- Jun 12, 2026
Malicious code in ecto-flag-read-m7p2 (npm)
1 compromised version
- Jun 12, 2026
Malicious code in ecto-corsair-flag-x9m4 (npm)
1 compromised version
- Jun 12, 2026
Malicious code in @malwguy/ecto-corsair-whisper-3d2a7c (npm)
1 compromised version
- Jun 12, 2026
Malware in ecto-nightly-spirit
1 compromised version
- Jun 12, 2026
Malware in ecto-spectral-leak-8d4e2
1 compromised version
- Jun 12, 2026
Malware in ecto-spirit-win-k4n8
1 compromised version
- Jun 12, 2026
Malware in ecto-flag-read-m7p2
1 compromised version
- Jun 12, 2026
Malware in ecto-corsair-flag-x9m4
1 compromised version
- Jun 12, 2026
Malware in coral-wraith
1 compromised version
- Jun 12, 2026
Malware in sea-bound-siren
1 compromised version
- Jun 12, 2026
Malware in ecto-rust-read-f3a9c1
1 compromised version
- Jun 12, 2026
Malware in @malwguy/ecto-corsair-whisper-3d2a7c
1 compromised version
- Jun 12, 2026
Malware in ecto-corsair-whisper-6f3b9
1 compromised version
- Jun 12, 2026
Malware in ecto-win-flag-q2m7
1 compromised version
- Jun 12, 2026
Malicious code in coral-wraith (npm)
47 compromised versions
- Jun 11, 2026
Malicious code in internallib_v557 (npm)
24 compromised versions
- Jun 11, 2026
Malicious code in worker-build (npm)
3 compromised versions
- Jun 11, 2026
Malicious code in @johntaohunter/forge-jsx (npm)
- Jun 11, 2026
Malware in @johntaohunter/forge-jsx
1 compromised version
- Jun 11, 2026
Malicious code in ioredis-typed (npm)
1 compromised version
- Jun 11, 2026
Malicious code in ioredis-orm (npm)
1 compromised version
- Jun 11, 2026
Malware in ioredis-orm
1 compromised version
- Jun 11, 2026
Malware in ioredis-typed
1 compromised version
- Jun 11, 2026
Malware in forge-jsx2
1 compromised version
- Jun 11, 2026
Malware in forge-jsxy
1 compromised version
- Jun 11, 2026
Malicious code in vqlxjmpr (npm)
5 compromised versions
- Jun 11, 2026
Malware in vqlxjmpr
1 compromised version
- Jun 11, 2026
Malicious code in zatzdbai (npm)
- Jun 11, 2026
Malicious code in downlynpm (npm)
3 compromised versions
- Jun 11, 2026
Malware in downlynpm
1 compromised version
Page 52 of 4,802