Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jul 17, 2025
Malicious code in sol-validator (npm)
- Jul 17, 2025
Malicious code in eth-validator (npm)
- Jul 17, 2025
Malware in sol-validator
1 compromised version
- Jul 17, 2025
Malware in eth-validator
1 compromised version
- Jul 17, 2025
Malicious code in nodemailer-helper (npm)
- Jul 17, 2025
Malware in nodemailer-helper
1 compromised version
- Jul 17, 2025
Malicious code in winston-compose (npm)
- Jul 17, 2025
Malicious code in react-hook-form-ui (npm)
- Jul 17, 2025
Malware in winston-compose
1 compromised version
- Jul 17, 2025
Malware in react-hook-form-ui
1 compromised version
- Jul 17, 2025
Malicious code in rtp-rapyd (npm)
- Jul 17, 2025
Malware in rtp-rapyd
1 compromised version
- Jul 17, 2025
Malicious code in dex-sample-app (npm)
- Jul 17, 2025
Malware in public-tools-and-demos
1 compromised version
- Jul 17, 2025
Malware in mttdocs
1 compromised version
- Jul 17, 2025
Malware in print-vault-node
1 compromised version
- Jul 17, 2025
Malware in eth-multisig-v4
1 compromised version
- Jul 17, 2025
Malware in glean-mcp-server
1 compromised version
- Jul 17, 2025
Malware in canonical-bridge-ui
1 compromised version
- Jul 17, 2025
Malware in dex-sample-app
1 compromised version
- Jul 17, 2025
Malware in notificationsandbox
1 compromised version
- Jul 17, 2025
Malware in lunasec
1 compromised version
- Jul 17, 2025
Malware in jenkins-for-jira-ui
1 compromised version
- Jul 17, 2025
Malware in iwf-typescript-sdk
1 compromised version
- Jul 17, 2025
Malicious code in @jssrv/template (npm)
1 compromised version
- Jul 17, 2025
Malicious code in marcom-ac-console (npm)
2 compromised versions
- Jul 17, 2025
Malicious code in dascxcxcxcxcxcxxc (npm)
3 compromised versions
- Jul 17, 2025
Malicious code in acsascasccsaascascacs (npm)
5 compromised versions
- Jul 17, 2025
Malicious code in @company-internal/logger (npm)
1 compromised version
- Jul 17, 2025
Malicious code in @secsol5g/qlik-sense (npm)
1 compromised version
- Jul 17, 2025
Malicious code in vercel-edge (npm)
1 compromised version
- Jul 17, 2025
Malicious code in codex-action (npm)
2 compromised versions
- Jul 17, 2025
Malicious code in ts-browser-webpack (npm)
2 compromised versions
- Jul 17, 2025
Malicious code in node-ts-esm-auto (npm)
1 compromised version
- Jul 17, 2025
Malicious code in preview-server-auth-poc (npm)
1 compromised version
- Jul 17, 2025
Malicious code in ngx-satoris (npm)
2 compromised versions
- Jul 17, 2025
Malicious code in lunasec (npm)
1 compromised version
- Jul 17, 2025
Malicious code in @ivy-shared-components/testing (npm)
1 compromised version
- Jul 16, 2025
Malicious code in ethers3-wallet (npm)
- Jul 16, 2025
Malware in ethers3-wallet
1 compromised version
- Jul 16, 2025
Malicious code in pro-rhr-container (npm)
1 compromised version
- Jul 16, 2025
Malicious code in npmdeco (npm)
1 compromised version
- Jul 16, 2025
Malicious code in datadog-instrumentations (npm)
2 compromised versions
- Jul 16, 2025
Malicious code in router-parse (npm)
- Jul 16, 2025
Malware in router-parse
1 compromised version
- Jul 16, 2025
Malware in target_user_list
1 compromised version
- Jul 16, 2025
Malware in @3kali182/angular-1.6
1 compromised version
- Jul 16, 2025
Malware in @3kali182/selenium-webdriver4
1 compromised version
- Jul 16, 2025
Malware in coverage-v8
1 compromised version
- Jul 16, 2025
Malware in rollup-linux-riscv64-gnu
1 compromised version
Page 5809 of 6,634