Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jul 24, 2025
Malicious code in kalitestbbh (npm)
1 compromised version
- Jul 24, 2025
Malicious code in dctk (npm)
2 compromised versions
- Jul 24, 2025
Malicious code in ui-data-layer (npm)
1 compromised version
- Jul 24, 2025
Malicious code in lu-anywhere (npm)
- Jul 24, 2025
Malicious code in jquery-tools (npm)
- Jul 24, 2025
Malicious code in drive-sdk (npm)
- Jul 24, 2025
Malicious code in pass-rust-core (npm)
- Jul 24, 2025
Malicious code in google-protobuf-conformance (npm)
1 compromised version
- Jul 24, 2025
Malicious code in react-is-builtin (npm)
1 compromised version
- Jul 24, 2025
Malicious code in react-dom-experimental-builtin (npm)
- Jul 24, 2025
Malicious code in react-dom-builtin (npm)
1 compromised version
- Jul 24, 2025
Malicious code in some-dev (npm)
- Jul 24, 2025
Malicious code in binance-dev (npm)
- Jul 24, 2025
Malicious code in vercel-internal (npm)
- Jul 24, 2025
Malicious code in rcepoc (npm)
- Jul 24, 2025
Malicious code in binance-internals (npm)
- Jul 24, 2025
Malicious code in slack-internals (npm)
- Jul 24, 2025
Malicious code in demo-vault-backup-webapp (npm)
- Jul 24, 2025
Malicious code in retirejs (npm)
- Jul 24, 2025
Malicious code in snx-sips (npm)
- Jul 24, 2025
Malicious code in xk6-top (npm)
1 compromised version
- Jul 24, 2025
Malicious code in runtime-dom (npm)
- Jul 24, 2025
Malicious code in airbnb-internals (npm)
- Jul 24, 2025
Malicious code in hackerone-internal (npm)
1 compromised version
- Jul 24, 2025
Malicious code in ids-core (npm)
1 compromised version
- Jul 24, 2025
Malicious code in testandooteste (npm)
- Jul 24, 2025
Malware in m0m0x01d
1 compromised version
- Jul 24, 2025
Malicious code in tnet-dps (npm)
- Jul 24, 2025
Malicious code in dpsdatahub (npm)
- Jul 24, 2025
Malware in dpsdatahub
1 compromised version
- Jul 24, 2025
Malware in tnet-dps
1 compromised version
- Jul 24, 2025
Malicious code in nodejs-backpack (npm)
- Jul 24, 2025
Malware in nodejs-backpack
1 compromised version
- Jul 23, 2025
Malicious code in flash-hros (npm)
- Jul 23, 2025
Malicious code in flash-tecnologia (npm)
- Jul 23, 2025
Malicious code in splide (npm)
- Jul 23, 2025
Malicious code in plide (npm)
- Jul 23, 2025
Malicious code in app-wheelify (npm)
- Jul 23, 2025
Malicious code in player-component (npm)
- Jul 23, 2025
Malicious code in webxr-input-profiles (npm)
- Jul 23, 2025
Malicious code in vis-donut-chart (npm)
- Jul 23, 2025
Malicious code in headless-skia (npm)
- Jul 23, 2025
Malicious code in swap-token-list-poc (npm)
- Jul 23, 2025
Malicious code in db-connections-templates (npm)
- Jul 23, 2025
Malicious code in mini-builder (npm)
- Jul 23, 2025
Malicious code in nonexistentgibberish (npm)
- Jul 23, 2025
Malicious code in openai-fm (npm)
- Jul 23, 2025
Malicious code in terraform-cloud-action (npm)
- Jul 23, 2025
Malicious code in vercel-internals (npm)
- Jul 23, 2025
Malicious code in askama (npm)
Page 5802 of 6,634