Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jul 3, 2025
Malicious code in n8n-nodes-zalo-user-v2 (npm)
- Jul 3, 2025
Malware in n8n-nodes-zalo-user-v2
1 compromised version
- Jul 3, 2025
Malicious code in @stihlus/stihl-icons-pack (npm)
7 compromised versions
- Jul 3, 2025
Malware in @stihlus/stihl-icons-pack
1 compromised version
- Jul 3, 2025
Malware in @saas2/utils
1 compromised version
- Jul 3, 2025
Malicious code in @figshare/old-viewers (npm)
1 compromised version
- Jul 3, 2025
Malware in @figshare/old-viewers
1 compromised version
- Jul 3, 2025
Malicious code in poseidon-validate (npm)
9 compromised versions
- Jul 3, 2025
Malware in poseidon-validate
1 compromised version
- Jul 3, 2025
Malicious code in show-dependencies (npm)
1 compromised version
- Jul 3, 2025
Malicious code in grafana-lokiexplore-app (npm)
1 compromised version
- Jul 2, 2025
Malicious code in k6-studio (npm)
3 compromised versions
- Jul 2, 2025
Malicious code in @frontend-clients/design-system (npm)
2 compromised versions
- Jul 2, 2025
Malicious code in @frontend-clients/core (npm)
10 compromised versions
- Jul 2, 2025
Malicious code in helioviewer.org (npm)
2 compromised versions
- Jul 2, 2025
Malicious code in dds-js (npm)
1 compromised version
- Jul 2, 2025
Malicious code in pyroscope-nodejs (npm)
1 compromised version
- Jul 2, 2025
Malicious code in grafana-pyroscope (npm)
2 compromised versions
- Jul 2, 2025
Malicious code in cmr-stac (npm)
5 compromised versions
- Jul 2, 2025
Malware in volehai-poc
1 compromised version
- Jul 2, 2025
Malicious code in hardhat-deploy-notification (npm)
4 compromised versions
- Jul 2, 2025
Malware in hardhat-deploy-notification
1 compromised version
- Jul 2, 2025
Malicious code in hardhat-deploy-notifier (npm)
- Jul 2, 2025
Malware in hardhat-deploy-notifier
1 compromised version
- Jul 2, 2025
Malware in eyeblue1
1 compromised version
- Jul 2, 2025
Malware in maxdome-compute
1 compromised version
- Jul 2, 2025
Malicious code in eslint-plugin-vhtml-slptypography (npm)
- Jul 2, 2025
Malware in eslint-plugin-vhtml-slptypography
1 compromised version
- Jul 2, 2025
Malware in aristotle-fetcher
1 compromised version
- Jul 2, 2025
Malware in ist-schemas
1 compromised version
- Jul 2, 2025
Malware in station-signal-client-lib
1 compromised version
- Jul 2, 2025
Malware in requests-json-overview-pkg
1 compromised version
- Jul 2, 2025
Malware in wmreact-p13n
1 compromised version
- Jul 2, 2025
Malware in requests-json-overview
1 compromised version
- Jul 2, 2025
Malware in @zyp3_/api-ecom-errors
1 compromised version
- Jul 2, 2025
Malicious code in @type-script-node/vite (npm)
- Jul 2, 2025
Malware in @type-script-node/vite
1 compromised version
- Jul 2, 2025
Malicious code in react-babel-purify (npm)
- Jul 2, 2025
Malicious code in nextjs-babel-toastify (npm)
- Jul 2, 2025
Malware in react-babel-purify
1 compromised version
- Jul 2, 2025
Malware in nextjs-babel-toastify
1 compromised version
- Jul 2, 2025
Malicious code in ytdl-vol (npm)
- Jul 2, 2025
Malicious code in neroxbail (npm)
- Jul 2, 2025
Malware in ytdl-vol
1 compromised version
- Jul 2, 2025
Malware in neroxbail
1 compromised version
- Jul 2, 2025
Malicious code in solana-dextrade-parser (npm)
- Jul 2, 2025
Malicious code in dotenv-log (npm)
- Jul 2, 2025
Malicious code in chunk-validation (npm)
1 compromised version
- Jul 2, 2025
Malware in dotenv-log
1 compromised version
- Jul 2, 2025
Malware in solana-dextrade-parser
1 compromised version
Page 5827 of 6,634