Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jul 31, 2025
Malicious code in essentialss (npm)
4 compromised versions
- Jul 31, 2025
Malicious code in ent-profile-template (npm)
1 compromised version
- Jul 31, 2025
Malicious code in emailphotogallery (npm)
1 compromised version
- Jul 31, 2025
Malicious code in e-voting-libraries-ui-kit (npm)
7 compromised versions
- Jul 31, 2025
Malicious code in dndattachmentt (npm)
1 compromised version
- Jul 31, 2025
Malicious code in disabled_native_dep (npm)
1 compromised version
- Jul 31, 2025
Malicious code in core.trigger (npm)
1 compromised version
- Jul 31, 2025
Malicious code in comp-base-birthdate (npm)
1 compromised version
- Jul 31, 2025
Malicious code in com.google.xr.xdtk (npm)
1 compromised version
- Jul 31, 2025
Malicious code in cloudflared-x64 (npm)
1 compromised version
- Jul 31, 2025
Malicious code in box-lib-node (npm)
2 compromised versions
- Jul 31, 2025
Malicious code in boost-chii-new (npm)
3 compromised versions
- Jul 31, 2025
Malicious code in bergaa (npm)
4 compromised versions
- Jul 31, 2025
Malicious code in assetdash-og-new (npm)
1 compromised version
- Jul 31, 2025
Malicious code in asdqweasdregistry-auth-token (npm)
1 compromised version
- Jul 31, 2025
Malicious code in analytics-messages-definition-activities (npm)
1 compromised version
- Jul 31, 2025
Malicious code in ai-workbench (npm)
1 compromised version
- Jul 31, 2025
Malicious code in adobe-cr (npm)
1 compromised version
- Jul 31, 2025
Malicious code in actions-detectenv (npm)
1 compromised version
- Jul 31, 2025
Malicious code in aave-improvement-process (npm)
1 compromised version
- Jul 31, 2025
Malicious code in @sequoia-engineering/eureka-components (npm)
1 compromised version
- Jul 31, 2025
Malicious code in @infocert/idt-liveness (npm)
1 compromised version
- Jul 31, 2025
Malicious code in @emburse/embark-core (npm)
1 compromised version
- Jul 31, 2025
Malicious code in @bat-sec/pr0tobuff-loaders (npm)
1 compromised version
- Jul 31, 2025
Malicious code in nubank-www-latam-commons (npm)
1 compromised version
- Jul 31, 2025
Malicious code in bullyshitty (npm)
1 compromised version
- Jul 31, 2025
Malicious code in rca-url-adaptator (npm)
1 compromised version
- Jul 30, 2025
Malicious code in actions-set-env-vars (npm)
- Jul 30, 2025
Malicious code in epic-fortnite-webpack-config (npm)
- Jul 30, 2025
Malicious code in enkryptcom (npm)
- Jul 30, 2025
Malicious code in subchart (npm)
- Jul 30, 2025
Malicious code in epic-games-nav-share (npm)
2 compromised versions
- Jul 30, 2025
Malicious code in epic-fortnite-shared-values (npm)
- Jul 30, 2025
Malicious code in sentry-core (npm)
- Jul 30, 2025
Malicious code in weavejs-backend (npm)
- Jul 30, 2025
Malicious code in @0xme5war/apicli (npm)
- Jul 30, 2025
Malicious code in spendesk (npm)
- Jul 30, 2025
Malicious code in astro-benchmark (npm)
5 compromised versions
- Jul 30, 2025
Malicious code in openai-tsp (npm)
2 compromised versions
- Jul 30, 2025
Malicious code in tms-spike (npm)
- Jul 30, 2025
Malicious code in mpesa-ui-components (npm)
- Jul 30, 2025
Malicious code in docusaurus-theme (npm)
- Jul 30, 2025
Malicious code in credit-card-input (npm)
- Jul 30, 2025
Malicious code in weavejs-frontend (npm)
- Jul 30, 2025
Malicious code in deno-r4-basic (npm)
- Jul 30, 2025
Malicious code in reference-library (npm)
1 compromised version
- Jul 30, 2025
Malicious code in build-angular (npm)
1 compromised version
- Jul 30, 2025
Malicious code in external-pkg (npm)
1 compromised version
- Jul 30, 2025
Malicious code in library-with-exports (npm)
1 compromised version
- Jul 30, 2025
Malicious code in plugin-commonjs (npm)
Page 5796 of 6,634