Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jun 30, 2025
Malicious code in bg-core-payments-automation (npm)
- Jun 30, 2025
Malicious code in webgl-fingerprinting (npm)
- Jun 30, 2025
Malicious code in datanerd (npm)
8 compromised versions
- Jun 30, 2025
Malicious code in ee_else_ce (npm)
- Jun 30, 2025
Malicious code in sweet-bananas (npm)
- Jun 30, 2025
Malicious code in betsson (npm)
- Jun 30, 2025
Malicious code in data-layers (npm)
- Jun 30, 2025
Malicious code in log-styles (npm)
- Jun 30, 2025
Malicious code in youku-search (npm)
- Jun 30, 2025
Malicious code in viryc-hsc (npm)
8 compromised versions
- Jun 30, 2025
Malicious code in very-zeld (npm)
- Jun 30, 2025
Malicious code in root-direct (npm)
- Jun 30, 2025
Malicious code in nodyn (npm)
- Jun 30, 2025
Malicious code in node-smskc (npm)
- Jun 30, 2025
Malicious code in node-pretier (npm)
- Jun 30, 2025
Malicious code in node-pkg-cache (npm)
- Jun 30, 2025
Malicious code in nava-clone (npm)
- Jun 30, 2025
Malicious code in mod-cloud (npm)
- Jun 30, 2025
Malicious code in canvas-chache-kit (npm)
- Jun 30, 2025
Malicious code in @verrylinh/discord (npm)
- Jun 30, 2025
Malware in youku-search
1 compromised version
- Jun 30, 2025
Malware in canvas-chache-kit
1 compromised version
- Jun 30, 2025
Malware in root-direct
1 compromised version
- Jun 30, 2025
Malware in very-zeld
1 compromised version
- Jun 30, 2025
Malware in @verrylinh/discord
1 compromised version
- Jun 30, 2025
Malware in node-pretier
1 compromised version
- Jun 30, 2025
Malware in node-pkg-cache
1 compromised version
- Jun 30, 2025
Malware in nava-clone
1 compromised version
- Jun 30, 2025
Malware in node-smskc
1 compromised version
- Jun 30, 2025
Malware in mod-cloud
1 compromised version
- Jun 30, 2025
Malware in nodyn
1 compromised version
- Jun 30, 2025
Malware in viryc-hsc
1 compromised version
- Jun 30, 2025
Malicious code in viry-nexa (npm)
4 compromised versions
- Jun 30, 2025
Malicious code in veynlinh-sky (npm)
7 compromised versions
- Jun 30, 2025
Malicious code in sysframe (npm)
- Jun 30, 2025
Malware in veynlinh-sky
1 compromised version
- Jun 30, 2025
Malware in viry-nexa
1 compromised version
- Jun 30, 2025
Malware in sysframe
1 compromised version
- Jun 30, 2025
Malicious code in jsontostr (npm)
- Jun 30, 2025
Malicious code in jsonlogs (npm)
- Jun 30, 2025
Malware in jsonlogs
1 compromised version
- Jun 30, 2025
Malware in jsontostr
1 compromised version
- Jun 30, 2025
Malicious code in byaziine_validator (npm)
- Jun 29, 2025
Malicious code in sdk.babelhelpers (npm)
4 compromised versions
- Jun 29, 2025
Malicious code in example-target-package (npm)
- Jun 29, 2025
Malicious code in vwa-visualizer (npm)
- Jun 29, 2025
Malicious code in action_dropdown (npm)
- Jun 29, 2025
Malicious code in sizings (npm)
- Jun 29, 2025
Malicious code in mapbox-gl-js (npm)
- Jun 29, 2025
Malicious code in trace-mapping (npm)
Page 5832 of 6,634