Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jun 25, 2025
Malicious code in bar.app.bar_rights (npm)
- Jun 25, 2025
Malicious code in work_app (npm)
- Jun 25, 2025
Malicious code in ted-ui (npm)
- Jun 25, 2025
Malicious code in dropdown_styles.css (npm)
- Jun 25, 2025
Malicious code in pnp-resume (npm)
- Jun 25, 2025
Malicious code in irradiance (npm)
- Jun 25, 2025
Malicious code in ember-htmlbars (npm)
- Jun 25, 2025
Malicious code in demo-confusion (npm)
- Jun 25, 2025
Malware in aog-checker
1 compromised version
- Jun 25, 2025
Malware in taskcluster-db
1 compromised version
- Jun 25, 2025
Malware in demo-confusion
1 compromised version
- Jun 25, 2025
Malicious code in kwp-a-b-testing (npm)
- Jun 25, 2025
Malicious code in kendo.core.min (npm)
- Jun 25, 2025
Malicious code in kwp-client (npm)
- Jun 25, 2025
Malicious code in event.custom (npm)
- Jun 25, 2025
Malicious code in webengage (npm)
- Jun 25, 2025
Malicious code in sap.ushell.components.tiles.utils (npm)
- Jun 25, 2025
Malicious code in company-secret-lib (npm)
- Jun 25, 2025
Malicious code in secure-r007k17 (npm)
- Jun 25, 2025
Malicious code in @hamishwhc-testing/evil (npm)
- Jun 25, 2025
Malicious code in kkyun-xss-payload (npm)
- Jun 25, 2025
Malicious code in ironrouter (npm)
1 compromised version
- Jun 25, 2025
Malicious code in variables-dark (npm)
1 compromised version
- Jun 25, 2025
Malicious code in vite-loader-svg (npm)
- Jun 25, 2025
Malware in vite-loader-svg
1 compromised version
- Jun 25, 2025
Malicious code in zd-cms (npm)
1 compromised version
- Jun 25, 2025
Malicious code in magewire (npm)
1 compromised version
- Jun 25, 2025
Malicious code in attributors (npm)
1 compromised version
- Jun 25, 2025
Malicious code in profile-page-app (npm)
1 compromised version
- Jun 25, 2025
Malicious code in nstmrt-stf-api (npm)
7 compromised versions
- Jun 25, 2025
Malicious code in aog-checker (npm)
3 compromised versions
- Jun 25, 2025
Malicious code in jun-xss-payload (npm)
- Jun 24, 2025
Malicious code in angular-intro (npm)
1 compromised version
- Jun 24, 2025
Malicious code in acme-analytics (npm)
- Jun 24, 2025
Malicious code in deere-ui-commonjs-shim (npm)
- Jun 24, 2025
Malicious code in ptl-oem-wifi-portal (npm)
3 compromised versions
- Jun 24, 2025
Malicious code in braintree-dropin (npm)
2 compromised versions
- Jun 24, 2025
Malicious code in web-experience-app (npm)
- Jun 24, 2025
Malicious code in homey-web-app (npm)
- Jun 24, 2025
Malware in monorepo-lens
1 compromised version
- Jun 24, 2025
Malware in hcbridge
1 compromised version
- Jun 24, 2025
Malware in eslint-disable-line
1 compromised version
- Jun 24, 2025
Malware in @monorepo-lens/pnpm-collector
1 compromised version
- Jun 24, 2025
Malicious code in adril712 (npm)
1 compromised version
- Jun 24, 2025
Malware in adril712
1 compromised version
- Jun 24, 2025
Malicious code in agoda.cronos.activities.client-side (npm)
5 compromised versions
- Jun 24, 2025
Malicious code in forms-extensions (npm)
- Jun 24, 2025
Malicious code in uphold-sdk-javascript-extensions (npm)
- Jun 24, 2025
Malicious code in messaging-client-lite (npm)
- Jun 24, 2025
Malicious code in @monorepo-lens/pnpm-collector (npm)
Page 5836 of 6,634