Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jul 30, 2025
Malicious code in bridge-emulator (npm)
2 compromised versions
- Jul 30, 2025
Malicious code in internal-pkg (npm)
1 compromised version
- Jul 30, 2025
Malicious code in airpr-honeybadger (npm)
- Jul 30, 2025
Malicious code in 7702-eoa-implementation (npm)
- Jul 30, 2025
Malicious code in blanl-pkg (npm)
1 compromised version
- Jul 30, 2025
Malicious code in hw-transport-node-hid (npm)
1 compromised version
- Jul 30, 2025
Malicious code in turborepo-examples (npm)
1 compromised version
- Jul 30, 2025
Malicious code in react-native-gainsight-px (npm)
- Jul 30, 2025
Malicious code in edenx (npm)
- Jul 30, 2025
Malicious code in sentry-utils (npm)
- Jul 30, 2025
Malicious code in @video-platform/react-osd (npm)
- Jul 30, 2025
Malicious code in @video-platform/react-core (npm)
- Jul 30, 2025
Malicious code in @video-platform/core (npm)
- Jul 30, 2025
Malicious code in @sme-configs/karma-coverage (npm)
- Jul 30, 2025
Malware in @video-platform/react-core
1 compromised version
- Jul 30, 2025
Malware in @video-platform/react-osd
1 compromised version
- Jul 30, 2025
Malware in @sme-configs/karma-coverage
1 compromised version
- Jul 30, 2025
Malware in @video-platform/core
1 compromised version
- Jul 30, 2025
Malicious code in @platform-ui-storybook/copy-button (npm)
- Jul 30, 2025
Malicious code in @hypervector/hypervector-test (npm)
- Jul 30, 2025
Malicious code in @hypervector/hypervector-tbank-test (npm)
- Jul 30, 2025
Malware in @hypervector/hypervector-tbank-test
1 compromised version
- Jul 30, 2025
Malware in @hypervector/hypervector-test
1 compromised version
- Jul 30, 2025
Malware in @platform-ui-storybook/copy-button
1 compromised version
- Jul 30, 2025
Malicious code in rca-overlay-panel (npm)
1 compromised version
- Jul 30, 2025
Malicious code in inditextech (npm)
3 compromised versions
- Jul 30, 2025
Malicious code in mimelib2 (npm)
- Jul 30, 2025
Malware in mimelib2
1 compromised version
- Jul 30, 2025
Malicious code in @azet/api (npm)
1 compromised version
- Jul 30, 2025
Malicious code in webpack-server-config (npm)
- Jul 30, 2025
Malware in webpack-server-config
1 compromised version
- Jul 30, 2025
Malicious code in vite-simpleparse (npm)
- Jul 30, 2025
Malware in vite-simpleparse
1 compromised version
- Jul 30, 2025
Malicious code in vite-postcss-nested (npm)
1 compromised version
- Jul 30, 2025
Malware in vite-postcss-nested
1 compromised version
- Jul 30, 2025
Malicious code in vite-postcss-kit (npm)
- Jul 30, 2025
Malware in vite-postcss-kit
1 compromised version
- Jul 30, 2025
Malicious code in vite-log-plugin (npm)
- Jul 30, 2025
Malware in vite-log-plugin
1 compromised version
- Jul 30, 2025
Malicious code in vanilla-cacher (npm)
- Jul 30, 2025
Malware in vanilla-cacher
1 compromised version
- Jul 30, 2025
Malicious code in stream-loggers (npm)
- Jul 30, 2025
Malware in stream-loggers
1 compromised version
- Jul 30, 2025
Malicious code in redux-eslint-saga (npm)
- Jul 30, 2025
Malware in redux-eslint-saga
1 compromised version
- Jul 30, 2025
Malicious code in real-socket-rt (npm)
1 compromised version
- Jul 30, 2025
Malware in real-socket-rt
1 compromised version
- Jul 30, 2025
Malicious code in react-qrcode-icon (npm)
- Jul 30, 2025
Malicious code in react-icon-maker (npm)
- Jul 30, 2025
Malware in react-icon-maker
1 compromised version
Page 5797 of 6,634