Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jul 1, 2025
Malicious code in fb-error-lite (npm)
41 compromised versions
- Jul 1, 2025
Malicious code in airbnb-location-suggester (npm)
106 compromised versions
- Jul 1, 2025
Malware in react-forget-runtime
1 compromised version
- Jul 1, 2025
Malware in hero-tracing-placeholder
1 compromised version
- Jul 1, 2025
Malware in gkx
1 compromised version
- Jul 1, 2025
Malware in fb-error-lite
1 compromised version
- Jul 1, 2025
Malware in sdp-transform-grammar
1 compromised version
- Jul 1, 2025
Malware in airbnb-location-suggester
1 compromised version
- Jul 1, 2025
Malicious code in dm-cloak-security (npm)
- Jul 1, 2025
Malicious code in cloak-security (npm)
- Jul 1, 2025
Malware in cloak-security
1 compromised version
- Jul 1, 2025
Malware in dm-cloak-security
1 compromised version
- Jul 1, 2025
Malware in @evoplay-spinential/poc-rce
1 compromised version
- Jul 1, 2025
Malware in @evoplay-spinential/test-module
1 compromised version
- Jul 1, 2025
Malicious code in themeone-event (npm)
6 compromised versions
- Jul 1, 2025
Malicious code in groq-link (npm)
7 compromised versions
- Jul 1, 2025
Malicious code in icinga (npm)
1 compromised version
- Jul 1, 2025
Malicious code in paysafe-wac-web-2fa-lib-fe (npm)
1 compromised version
- Jul 1, 2025
Malware in handelsblatt-hypesignals-ui-components
1 compromised version
- Jul 1, 2025
Malicious code in node-orm-mongoose (npm)
- Jul 1, 2025
Malware in node-orm-mongoose
1 compromised version
- Jul 1, 2025
Malicious code in keythereum-utils (npm)
6 compromised versions
- Jul 1, 2025
Malware in keythereum-utils
1 compromised version
- Jul 1, 2025
Malicious code in react-svg-config (npm)
- Jul 1, 2025
Malware in react-svg-config
1 compromised version
- Jul 1, 2025
Malicious code in zaranian (npm)
1 compromised version
- Jul 1, 2025
Malware in zaranian
1 compromised version
- Jul 1, 2025
Malware in my-not-confused-packages
1 compromised version
- Jul 1, 2025
Malware in my-not-confused-package
1 compromised version
- Jul 1, 2025
Malicious code in os-info-es6 (npm)
- Jul 1, 2025
Malware in os-info-es6
1 compromised version
- Jul 1, 2025
Malicious code in expo-session (npm)
- Jul 1, 2025
Malware in expo-session
1 compromised version
- Jul 1, 2025
Malicious code in workflows-template (npm)
1 compromised version
- Jul 1, 2025
Malicious code in cors-utils (npm)
- Jul 1, 2025
Malicious code in cors-util (npm)
- Jul 1, 2025
Malware in cors-utils
1 compromised version
- Jul 1, 2025
Malware in cors-util
1 compromised version
- Jul 1, 2025
Malicious code in vite-plugin-next-refresh (npm)
- Jul 1, 2025
Malware in vite-plugin-next-refresh
1 compromised version
- Jul 1, 2025
Malicious code in velocky (npm)
- Jul 1, 2025
Malware in velocky
1 compromised version
- Jul 1, 2025
Malicious code in notification-logs (npm)
- Jul 1, 2025
Malicious code in notification-loggers (npm)
- Jul 1, 2025
Malware in notification-logs
1 compromised version
- Jul 1, 2025
Malware in notification-loggers
1 compromised version
- Jul 1, 2025
Malicious code in axios-browseragent (npm)
6 compromised versions
- Jul 1, 2025
Malware in axios-browseragent
1 compromised version
- Jun 30, 2025
Malicious code in cvent-event-calendar (npm)
- Jun 30, 2025
Malicious code in protos-gen-node (npm)
Page 5831 of 6,634