Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jul 22, 2025
Malware in fathom-fox
1 compromised version
- Jul 22, 2025
Malware in tfjs-backend-nodegl
1 compromised version
- Jul 22, 2025
Malware in tfjs-vis
1 compromised version
- Jul 22, 2025
Malware in ppsdkconstants
1 compromised version
- Jul 22, 2025
Malware in airbnb-api-resource
1 compromised version
- Jul 22, 2025
Malware in @verge-vcl-react/empty-state
1 compromised version
- Jul 22, 2025
Malware in airbnb-shims
1 compromised version
- Jul 22, 2025
Malware in community-pass-react-native-wrapper
1 compromised version
- Jul 22, 2025
Malicious code in @lain-test-org/test-package2 (npm)
- Jul 22, 2025
Malicious code in @lain-test-org/test-package (npm)
- Jul 22, 2025
Malware in @lain-test-org/test-package2
1 compromised version
- Jul 22, 2025
Malware in @rupahealth/design
1 compromised version
- Jul 22, 2025
Malware in @lain-test-org/test-package
1 compromised version
- Jul 22, 2025
Malicious code in axios-hehe (npm)
11 compromised versions
- Jul 22, 2025
Malware in axios-hehe
1 compromised version
- Jul 21, 2025
Malicious code in cloud-inquisitor (npm)
- Jul 21, 2025
Malicious code in dewiz-xyz (npm)
- Jul 21, 2025
Malicious code in dewiz-xyz-protego (npm)
- Jul 21, 2025
Malicious code in indexer-worker-service (npm)
- Jul 21, 2025
Malicious code in shopify-css-import (npm)
- Jul 21, 2025
Malicious code in google-login-flow (npm)
- Jul 21, 2025
Malicious code in login-oauth (npm)
- Jul 21, 2025
Malicious code in vue4-google-auth (npm)
- Jul 21, 2025
Malicious code in @toptal/picasso-utils (npm)
1 compromised version
- Jul 21, 2025
Malicious code in omulamuzi (npm)
- Jul 21, 2025
Malicious code in ochot (npm)
- Jul 21, 2025
Malicious code in ochot-odong (npm)
- Jul 21, 2025
Malicious code in axr-smart-contracts (npm)
- Jul 21, 2025
Malicious code in synckit (npm)
1 compromised version
- Jul 21, 2025
Malicious code in napi-postinstall (npm)
1 compromised version
- Jul 21, 2025
Malicious code in got-fetch (npm)
2 compromised versions
- Jul 21, 2025
Malicious code in eslint-plugin-prettier (npm)
2 compromised versions
- Jul 21, 2025
Malicious code in eslint-config-prettier (npm)
4 compromised versions
- Jul 21, 2025
Malicious code in @pkgr/core (npm)
1 compromised version
- Jul 21, 2025
Malicious code in vite-lightsparse (npm)
- Jul 21, 2025
Malware in vite-lightsparse
1 compromised version
- Jul 21, 2025
Malicious code in websyncer (npm)
3 compromised versions
- Jul 21, 2025
Malicious code in evmlogger (npm)
7 compromised versions
- Jul 21, 2025
Malware in websyncer
1 compromised version
- Jul 21, 2025
Malware in evmlogger
1 compromised version
- Jul 20, 2025
Malicious code in vite-postcss-helper (npm)
- Jul 20, 2025
Malware in vite-postcss-helper
1 compromised version
- Jul 20, 2025
Malware in okta-core-component
1 compromised version
- Jul 20, 2025
Malicious code in mooduliop (npm)
- Jul 20, 2025
Malware in mooduliop
1 compromised version
- Jul 20, 2025
Malicious code in grayavatar (npm)
- Jul 20, 2025
Malware in grayavatar
1 compromised version
- Jul 20, 2025
Malicious code in rc-logger (npm)
- Jul 20, 2025
Malware in rc-logger
1 compromised version
- Jul 20, 2025
Malicious code in config-log (npm)
Page 5807 of 6,634