Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jun 27, 2025
Malicious code in validate-rb (npm)
1 compromised version
- Jun 27, 2025
Malware in just-config-data
1 compromised version
- Jun 27, 2025
Malware in pxsceneui-example-02
1 compromised version
- Jun 27, 2025
Malicious code in retaillocationserv-paypal (npm)
1 compromised version
- Jun 27, 2025
Malware in walmart-ui
1 compromised version
- Jun 27, 2025
Malware in idse
1 compromised version
- Jun 27, 2025
Malware in myatt
1 compromised version
- Jun 27, 2025
Malware in seller-center
1 compromised version
- Jun 27, 2025
Malware in z0rsdumbtestnonshould
1 compromised version
- Jun 27, 2025
Malware in hardhat-contract-deploy
1 compromised version
- Jun 27, 2025
Malware in @ftapi/secuauth
1 compromised version
- Jun 27, 2025
Malware in @ftapi/components
1 compromised version
- Jun 27, 2025
Malicious code in acme-diagnostics (npm)
2 compromised versions
- Jun 27, 2025
Malware in acme-diagnostics
1 compromised version
- Jun 27, 2025
Malicious code in mercadolibre-prueba-front (npm)
2 compromised versions
- Jun 27, 2025
Malicious code in tableau-widgets-datagrid (npm)
- Jun 27, 2025
Malicious code in tableau-vizportal-webclient-api (npm)
- Jun 27, 2025
Malicious code in defectdojo (npm)
- Jun 27, 2025
Malicious code in defectdojosw (npm)
1 compromised version
- Jun 27, 2025
Malicious code in nf-cl-loger (npm)
2 compromised versions
- Jun 27, 2025
Malicious code in aquasec-orb-test-project (npm)
- Jun 26, 2025
Malicious code in phantom-sign-in-with-solana (npm)
- Jun 26, 2025
Malicious code in phantom-sdk-monorepo (npm)
- Jun 26, 2025
Malicious code in phantom-labs-sandbox (npm)
1 compromised version
- Jun 26, 2025
Malicious code in intercom-intercom-embed (npm)
- Jun 26, 2025
Malicious code in intercom-intermoji (npm)
- Jun 26, 2025
Malicious code in codesandbox-deps (npm)
1 compromised version
- Jun 26, 2025
Malicious code in intercom-pulse (npm)
- Jun 26, 2025
Malicious code in robinhood-internal-utils (npm)
1 compromised version
- Jun 26, 2025
Malicious code in nordic-dev-ts (npm)
3 compromised versions
- Jun 26, 2025
Malicious code in dx-chat-ai-client (npm)
3 compromised versions
- Jun 26, 2025
Malicious code in meli-ai-chat-library (npm)
4 compromised versions
- Jun 26, 2025
Malicious code in sumsub-node-websdk (npm)
- Jun 26, 2025
Malicious code in react-plaid-sdk (npm)
- Jun 26, 2025
Malicious code in jsonspack-logger (npm)
- Jun 26, 2025
Malware in sumsub-node-websdk
1 compromised version
- Jun 26, 2025
Malware in react-plaid-sdk
1 compromised version
- Jun 26, 2025
Malware in jsonspack-logger
1 compromised version
- Jun 26, 2025
Malicious code in json-webhooks (npm)
- Jun 26, 2025
Malware in json-webhooks
1 compromised version
- Jun 26, 2025
Malicious code in masons-chat-ui (npm)
1 compromised version
- Jun 26, 2025
Malware in mdp-client
1 compromised version
- Jun 26, 2025
Malware in masons-chat-ui
1 compromised version
- Jun 26, 2025
Malicious code in confluence-macro-browser (npm)
- Jun 26, 2025
Malicious code in utils-component (npm)
2 compromised versions
- Jun 26, 2025
Malicious code in comp-base-btn-switch (npm)
- Jun 26, 2025
Malicious code in astro-island (npm)
3 compromised versions
- Jun 26, 2025
Malicious code in blade_background (npm)
- Jun 26, 2025
Malicious code in wiki-edit (npm)
- Jun 26, 2025
Malicious code in jira-agile (npm)
Page 5834 of 6,634