Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jun 20, 2025
Malware in thunderbolt-features-loaders
1 compromised version
- Jun 20, 2025
Malware in rma-shared
1 compromised version
- Jun 20, 2025
Malware in somm-boilerplate
1 compromised version
- Jun 20, 2025
Malware in pfm-app
1 compromised version
- Jun 20, 2025
Malware in fwc-core
1 compromised version
- Jun 20, 2025
Malware in prismicio-types
1 compromised version
- Jun 20, 2025
Malware in rulai
1 compromised version
- Jun 20, 2025
Malware in cascading-picklists-extenstion
1 compromised version
- Jun 20, 2025
Malware in neuroglancer-rspack-project-source
1 compromised version
- Jun 20, 2025
Malware in zxdb
1 compromised version
- Jun 20, 2025
Malware in pipet-code-agent
1 compromised version
- Jun 20, 2025
Malware in wasm-wasi-core
1 compromised version
- Jun 20, 2025
Malware in automated-native-creatives
1 compromised version
- Jun 20, 2025
Malware in vscode-websearchforcopilot
1 compromised version
- Jun 20, 2025
Malware in traceviz-angular-core
1 compromised version
- Jun 20, 2025
Malware in vscode-azurestaticwebapps
1 compromised version
- Jun 20, 2025
Malware in vscode-spring-initializr
1 compromised version
- Jun 20, 2025
Malware in azure-pipeline-filter
1 compromised version
- Jun 20, 2025
Malware in calculator-sse
1 compromised version
- Jun 20, 2025
Malware in com.google.play.appupdate
1 compromised version
- Jun 20, 2025
Malware in odyssee_teams_api
1 compromised version
- Jun 19, 2025
Malicious code in math-utils-gava (npm)
- Jun 19, 2025
Malicious code in dynamic-global-wallet (npm)
- Jun 19, 2025
Malicious code in hackshack-leaderboard (npm)
- Jun 19, 2025
Malware in vscode-docker
1 compromised version
- Jun 19, 2025
Malware in azure-pipelines
1 compromised version
- Jun 19, 2025
Malware in microviewreact
1 compromised version
- Jun 19, 2025
Malware in client-vue3-dev
1 compromised version
- Jun 19, 2025
Malware in axiom-src
1 compromised version
- Jun 19, 2025
Malware in libsyncrpc
1 compromised version
- Jun 19, 2025
Malware in atom-keybindings
1 compromised version
- Jun 19, 2025
Malicious code in stickycta (npm)
1 compromised version
- Jun 19, 2025
Malicious code in vscode-docker (npm)
- Jun 19, 2025
Malicious code in azure-pipelines (npm)
- Jun 19, 2025
Malicious code in tap-bar (npm)
1 compromised version
- Jun 19, 2025
Malicious code in drivers-kit (npm)
1 compromised version
- Jun 19, 2025
Malicious code in axiom-src (npm)
- Jun 19, 2025
Malicious code in libsyncrpc (npm)
- Jun 19, 2025
Malicious code in atom-keybindings (npm)
- Jun 19, 2025
Malware in consumerweb-captcha
1 compromised version
- Jun 19, 2025
Malicious code in my-not-confused-packages (npm)
1 compromised version
- Jun 19, 2025
Malicious code in styleprefix (npm)
- Jun 19, 2025
Malware in styleprefix
1 compromised version
- Jun 19, 2025
Malicious code in test-package-vans (npm)
1 compromised version
- Jun 19, 2025
Malicious code in web-speed-test (npm)
- Jun 19, 2025
Malicious code in mattermost-hardware-keyboard (npm)
- Jun 19, 2025
Malware in sentry-docs
1 compromised version
- Jun 19, 2025
Malware in typescript-aurelia-api
1 compromised version
- Jun 19, 2025
Malware in web-speed-test
1 compromised version
- Jun 19, 2025
Malware in justsupport
1 compromised version
Page 5839 of 6,634