Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,299 total in npm · sorted newest first- Jun 24, 2025
Malware in monorepo-lens
1 compromised version
- Jun 24, 2025
Malware in hcbridge
1 compromised version
- Jun 24, 2025
Malware in eslint-disable-line
1 compromised version
- Jun 24, 2025
Malware in @monorepo-lens/pnpm-collector
1 compromised version
- Jun 24, 2025
Malicious code in adril712 (npm)
1 compromised version
- Jun 24, 2025
Malware in adril712
1 compromised version
- Jun 24, 2025
Malicious code in agoda.cronos.activities.client-side (npm)
5 compromised versions
- Jun 24, 2025
Malicious code in forms-extensions (npm)
- Jun 24, 2025
Malicious code in uphold-sdk-javascript-extensions (npm)
- Jun 24, 2025
Malicious code in messaging-client-lite (npm)
- Jun 24, 2025
Malicious code in @monorepo-lens/pnpm-collector (npm)
- Jun 24, 2025
Malicious code in @native-rabobank/native-qr-scanner (npm)
1 compromised version
- Jun 24, 2025
Malicious code in agoda.cronos.gql (npm)
2 compromised versions
- Jun 24, 2025
Malicious code in fooldependgcbk8x (npm)
1 compromised version
- Jun 24, 2025
Malicious code in fooldepend9f218a (npm)
1 compromised version
- Jun 24, 2025
Malicious code in monorepo-lens (npm)
1 compromised version
- Jun 23, 2025
Malicious code in react-smooth-plugin (npm)
- Jun 23, 2025
Malware in react-smooth-plugin
1 compromised version
- Jun 23, 2025
Malicious code in nf-cl-logger-logger-logger (npm)
- Jun 23, 2025
Malware in nf-cl-logger-logger
1 compromised version
- Jun 23, 2025
Malware in nf-cl-logger-logger-logger
1 compromised version
- Jun 23, 2025
Malicious code in integromat-udt (npm)
2 compromised versions
- Jun 23, 2025
Malware in audible-react-assets
1 compromised version
- Jun 23, 2025
Malware in integromat-iml
1 compromised version
- Jun 23, 2025
Malware in integromat-udt
1 compromised version
- Jun 23, 2025
Malware in masonry-thingies.js
1 compromised version
- Jun 23, 2025
Malware in mydummyproject-zyp
1 compromised version
- Jun 23, 2025
Malware in lucca-sdk
1 compromised version
- Jun 23, 2025
Malicious code in websdk-colours (npm)
- Jun 23, 2025
Malicious code in portal-frontend-helpers (npm)
- Jun 23, 2025
Malicious code in localstorage-retry (npm)
- Jun 23, 2025
Malicious code in k00h (npm)
- Jun 23, 2025
Malicious code in gs_isotope-layout (npm)
- Jun 23, 2025
Malicious code in fix3 (npm)
- Jun 23, 2025
Malicious code in feature-repeaters (npm)
- Jun 23, 2025
Malicious code in by-category (npm)
- Jun 23, 2025
Malicious code in bundle-text (npm)
- Jun 23, 2025
Malicious code in art19-web-player (npm)
- Jun 23, 2025
Malicious code in applinks (npm)
- Jun 23, 2025
Malicious code in 84f2 (npm)
- Jun 23, 2025
Malware in bundle-text
1 compromised version
- Jun 23, 2025
Malware in portal-frontend-helpers
1 compromised version
- Jun 23, 2025
Malware in by-category
1 compromised version
- Jun 23, 2025
Malware in websdk-colours
1 compromised version
- Jun 23, 2025
Malware in gs_isotope-layout
1 compromised version
- Jun 23, 2025
Malware in feature-repeaters
1 compromised version
- Jun 23, 2025
Malware in k00h
1 compromised version
- Jun 23, 2025
Malware in localstorage-retry
1 compromised version
- Jun 23, 2025
Malware in applinks
1 compromised version
- Jun 23, 2025
Malware in art19-web-player
1 compromised version
Page 5849 of 6,646