Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jul 8, 2025
Malware in haha-sana
1 compromised version
- Jul 8, 2025
Malware in cms-media-bridge
1 compromised version
- Jul 8, 2025
Malware in astrobot
1 compromised version
- Jul 8, 2025
Malware in create-app-attachment-github-action
1 compromised version
- Jul 8, 2025
Malicious code in tickets-tutorial (npm)
- Jul 8, 2025
Malicious code in minicom-platform (npm)
- Jul 8, 2025
Malicious code in gdpr-tracker-data (npm)
- Jul 8, 2025
Malicious code in berrynet (npm)
- Jul 8, 2025
Malware in natel-plotly-panel
1 compromised version
- Jul 8, 2025
Malware in minicom-platform
1 compromised version
- Jul 8, 2025
Malware in berrynet
1 compromised version
- Jul 8, 2025
Malware in gdpr-tracker-data
1 compromised version
- Jul 8, 2025
Malware in tickets-tutorial
1 compromised version
- Jul 8, 2025
Malware in handlebars-formatter
1 compromised version
- Jul 8, 2025
Malicious code in service-chii-90s (npm)
- Jul 8, 2025
Malware in service-chii-90s
1 compromised version
- Jul 8, 2025
Malicious code in react-router-scroll-navar (npm)
- Jul 8, 2025
Malware in react-router-scroll-navar
1 compromised version
- Jul 8, 2025
Malicious code in phone-mockup-react-js (npm)
3 compromised versions
- Jul 8, 2025
Malware in phone-mockup-react-js
1 compromised version
- Jul 8, 2025
Malicious code in vault-wallet-toolkit (npm)
1 compromised version
- Jul 8, 2025
Malicious code in graphprotocol-tools-monorepo (npm)
- Jul 8, 2025
Malicious code in popper.html (npm)
- Jul 8, 2025
Malicious code in textlocal-messenger (npm)
- Jul 8, 2025
Malicious code in playwright-e2e-testing (npm)
1 compromised version
- Jul 8, 2025
Malicious code in sync365 (npm)
1 compromised version
- Jul 8, 2025
Malicious code in scriptstierium11 (npm)
2 compromised versions
- Jul 8, 2025
Malicious code in modules9382 (npm)
1 compromised version
- Jul 8, 2025
Malicious code in androidvoues (npm)
- Jul 8, 2025
Malware in scriptstierium11
1 compromised version
- Jul 8, 2025
Malware in androidvoues
1 compromised version
- Jul 8, 2025
Malware in sync365
1 compromised version
- Jul 8, 2025
Malware in modules9382
1 compromised version
- Jul 8, 2025
Malicious code in vite-plugin-enhance (npm)
3 compromised versions
- Jul 8, 2025
Malicious code in vite-meta-plugin (npm)
2 compromised versions
- Jul 8, 2025
Malware in vite-meta-plugin
1 compromised version
- Jul 8, 2025
Malware in vite-plugin-enhance
1 compromised version
- Jul 8, 2025
Malicious code in elbol (npm)
- Jul 8, 2025
Malware in testetedep
1 compromised version
- Jul 8, 2025
Malware in elbol
1 compromised version
- Jul 8, 2025
Malware in undeconf
1 compromised version
- Jul 8, 2025
Malware in stencil-module-base
1 compromised version
- Jul 8, 2025
Malware in phantom-labs-sandbox
1 compromised version
- Jul 8, 2025
Malware in phantom-sdk-monorepo
1 compromised version
- Jul 8, 2025
Malware in phantom-sign-in-with-solana
1 compromised version
- Jul 8, 2025
Malicious code in mark-testing (npm)
- Jul 8, 2025
Malware in mark-testing
1 compromised version
- Jul 8, 2025
Malicious code in geothmetic-meandian (npm)
- Jul 8, 2025
Malicious code in cdk8s-kbld (npm)
- Jul 8, 2025
Malware in @hamishwhc-testing/evil
1 compromised version
Page 5821 of 6,634