Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
333,281 total in npm · sorted newest first- Aug 14, 2025
Malicious code in thinktank-common (npm)
- Aug 14, 2025
Malicious code in thinkapp (npm)
- Aug 14, 2025
Malicious code in thingum-industries-sensors-2 (npm)
- Aug 14, 2025
Malicious code in thingsboard-advanced-attribute-widget (npm)
- Aug 14, 2025
Malicious code in thinatra (npm)
- Aug 14, 2025
Malicious code in thiefapi (npm)
- Aug 14, 2025
Malicious code in thibault (npm)
- Aug 14, 2025
Malicious code in theubald (npm)
- Aug 14, 2025
Malicious code in thetowns (npm)
- Aug 14, 2025
Malicious code in thetaedu (npm)
- Aug 14, 2025
Malicious code in theta-tv-charts (npm)
11 compromised versions
- Aug 14, 2025
Malicious code in theta-nu-query-earth-export (npm)
- Aug 14, 2025
Malicious code in theta-iota-simple-java-monitor (npm)
- Aug 14, 2025
Malicious code in theta-encode-daemon-rho-rain (npm)
- Aug 14, 2025
Malicious code in theslinux (npm)
- Aug 14, 2025
Malicious code in thescene-ts-client-library (npm)
- Aug 14, 2025
Malicious code in thescene-ng2-lib (npm)
- Aug 14, 2025
Malicious code in thescene-api-library (npm)
- Aug 14, 2025
Malicious code in therryn (npm)
- Aug 14, 2025
Malicious code in thermosphere-mysql-prosthetics-chariklo (npm)
- Aug 14, 2025
Malicious code in thermochronology-halley-adonis-dione (npm)
- Aug 14, 2025
Malicious code in thermochronology-framework-jovian-ursa (npm)
- Aug 14, 2025
Malicious code in thermochronology-borealis-blitz-areology (npm)
- Aug 14, 2025
Malicious code in thermochronology-bootes-markdownlint-delphinus (npm)
- Aug 14, 2025
Malicious code in theramore (npm)
- Aug 14, 2025
Malicious code in thepygame (npm)
- Aug 14, 2025
Malicious code in thepond-whitelist-bot (npm)
- Aug 14, 2025
Malicious code in thepig (npm)
- Aug 14, 2025
Malicious code in theme-variants (npm)
- Aug 14, 2025
Malicious code in theme-check (npm)
- Aug 14, 2025
Malicious code in thelmafrye (npm)
- Aug 14, 2025
Malicious code in thekindy (npm)
- Aug 14, 2025
Malicious code in thejake (npm)
- Aug 14, 2025
Malicious code in theia-for-cloud-shell (npm)
- Aug 14, 2025
Malicious code in thedome (npm)
- Aug 14, 2025
Malicious code in thecup (npm)
- Aug 14, 2025
Malicious code in thecarcentre-carsalessuite (npm)
- Aug 14, 2025
Malicious code in thebobcat (npm)
- Aug 14, 2025
Malicious code in theblog (npm)
- Aug 14, 2025
Malicious code in theadoc (npm)
- Aug 14, 2025
Malicious code in the-pod (npm)
- Aug 14, 2025
Malicious code in the-brink-auth (npm)
- Aug 14, 2025
Malicious code in the-api-cache (npm)
- Aug 14, 2025
Malicious code in thavwuieyxbjdrmc (npm)
- Aug 14, 2025
Malicious code in tharsis (npm)
- Aug 14, 2025
Malicious code in thaishop (npm)
- Aug 14, 2025
Malicious code in tgp-pay (npm)
- Aug 14, 2025
Malicious code in tgam-pattern-library (npm)
- Aug 14, 2025
Malicious code in tfclean (npm)
- Aug 14, 2025
Malicious code in tf_client (npm)
Page 5287 of 6,666