Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jul 23, 2025
Malicious code in teamstelemetry (npm)
1 compromised version
- Jul 23, 2025
Malicious code in creditorwatch (npm)
2 compromised versions
- Jul 23, 2025
Malicious code in marcom-ac-analytics (npm)
- Jul 23, 2025
Malware in pre-and-postinstall-scripts-example
1 compromised version
- Jul 23, 2025
Malware in splice-pulumi-common-validator
1 compromised version
- Jul 23, 2025
Malware in one-fixed-dep-bins
1 compromised version
- Jul 23, 2025
Malicious code in bingo-pretty (npm)
- Jul 23, 2025
Malicious code in bingo-logger (npm)
- Jul 23, 2025
Malicious code in bingo-abstract-transport (npm)
- Jul 23, 2025
Malware in bingo-pretty
1 compromised version
- Jul 23, 2025
Malware in bingo-logger
1 compromised version
- Jul 23, 2025
Malware in bingo-abstract-transport
1 compromised version
- Jul 23, 2025
Malicious code in react-international-phone-js (npm)
5 compromised versions
- Jul 23, 2025
Malware in react-international-phone-js
1 compromised version
- Jul 23, 2025
Malicious code in svelte-intl (npm)
- Jul 23, 2025
Malicious code in durilka (npm)
- Jul 23, 2025
Withdrawn Advisory: Malware in stylus
1 compromised version
- Jul 23, 2025
Malware in durilka
1 compromised version
- Jul 23, 2025
Malware in ufo-rocks2
1 compromised version
- Jul 23, 2025
Malware in svelte-intl
1 compromised version
- Jul 23, 2025
Malware in creator-portal-web
1 compromised version
- Jul 23, 2025
Malware in dewiz-xyz
1 compromised version
- Jul 23, 2025
Malware in dewiz-xyz-protego
1 compromised version
- Jul 23, 2025
Malware in slf4j-api
1 compromised version
- Jul 23, 2025
Malware in spring-tx
1 compromised version
- Jul 23, 2025
Malware in jcl-over-slf4j
1 compromised version
- Jul 23, 2025
Malware in logback-classic
1 compromised version
- Jul 23, 2025
Malware in wc
1 compromised version
- Jul 23, 2025
Malware in cosmjs
1 compromised version
- Jul 23, 2025
Malware in grammarly-editor-sdk
1 compromised version
- Jul 23, 2025
Malicious code in @wptv/player (npm)
- Jul 23, 2025
Malicious code in @wptv/seo (npm)
- Jul 23, 2025
Malicious code in @wptv/stats (npm)
- Jul 23, 2025
Malicious code in @wptv/navik (npm)
- Jul 23, 2025
Malicious code in @wptv/logger (npm)
- Jul 23, 2025
Malicious code in mv-fe-scss (npm)
- Jul 22, 2025
Malicious code in pre-and-postinstall-scripts-example (npm)
- Jul 22, 2025
Malicious code in pro-stocks-widget (npm)
- Jul 22, 2025
Malicious code in @wptv/components (npm)
- Jul 22, 2025
Malicious code in cosmjs (npm)
- Jul 22, 2025
Malicious code in anchor5 (npm)
2 compromised versions
- Jul 22, 2025
Malicious code in spring-tx (npm)
- Jul 22, 2025
Malicious code in spring-context (npm)
- Jul 22, 2025
Malicious code in jsr305 (npm)
- Jul 22, 2025
Malicious code in logback-classic (npm)
- Jul 22, 2025
Malicious code in jcl-over-slf4j (npm)
- Jul 22, 2025
Malicious code in slf4j-api (npm)
- Jul 22, 2025
Malicious code in grammarly-editor-sdk (npm)
- Jul 22, 2025
Malicious code in okx-dex (npm)
- Jul 22, 2025
Malicious code in telenet (npm)
Page 5803 of 6,634