Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jun 10, 2025
Malicious code in karma-spec-filter (npm)
1 compromised version
- Jun 10, 2025
Malware in karma-spec-filter
1 compromised version
- Jun 10, 2025
Malicious code in javascript-heap (npm)
1 compromised version
- Jun 10, 2025
Malware in javascript-heap
1 compromised version
- Jun 10, 2025
Malicious code in jasmine-marbers (npm)
1 compromised version
- Jun 10, 2025
Malware in jasmine-marbers
1 compromised version
- Jun 10, 2025
Malware in iot-sdk-device-client-rest-api
1 compromised version
- Jun 10, 2025
Malware in educational-depconf-poc
1 compromised version
- Jun 10, 2025
Malicious code in import-remotes (npm)
1 compromised version
- Jun 10, 2025
Malware in import-remotes
1 compromised version
- Jun 10, 2025
Malicious code in iceberg-api (npm)
1 compromised version
- Jun 10, 2025
Malware in iceberg-api
1 compromised version
- Jun 10, 2025
Malicious code in gunicorn (npm)
1 compromised version
- Jun 10, 2025
Malware in gunicorn
1 compromised version
- Jun 10, 2025
Malicious code in google-auth-httplib2 (npm)
1 compromised version
- Jun 10, 2025
Malware in google-auth-httplib2
1 compromised version
- Jun 10, 2025
Malicious code in espresso-idling-resource (npm)
1 compromised version
- Jun 10, 2025
Malware in espresso-idling-resource
1 compromised version
- Jun 10, 2025
Malicious code in eslint-parser-vue (npm)
1 compromised version
- Jun 10, 2025
Malware in eslint-parser-vue
1 compromised version
- Jun 10, 2025
Malicious code in ember-reactive-decorators (npm)
1 compromised version
- Jun 10, 2025
Malware in ember-reactive-decorators
1 compromised version
- Jun 10, 2025
Malicious code in email-ext (npm)
1 compromised version
- Jun 10, 2025
Malware in email-ext
1 compromised version
- Jun 10, 2025
Malicious code in electron-streams (npm)
1 compromised version
- Jun 10, 2025
Malware in electron-streams
1 compromised version
- Jun 10, 2025
Malicious code in dpts (npm)
1 compromised version
- Jun 10, 2025
Malware in dpts
1 compromised version
- Jun 10, 2025
Malicious code in dplyr (npm)
1 compromised version
- Jun 10, 2025
Malware in dplyr
1 compromised version
- Jun 10, 2025
Malware in dependency-conftest
1 compromised version
- Jun 10, 2025
Malicious code in csvtool (npm)
1 compromised version
- Jun 10, 2025
Malware in csvtool
1 compromised version
- Jun 10, 2025
Malicious code in commons-fileupload (npm)
1 compromised version
- Jun 10, 2025
Malware in commons-fileupload
1 compromised version
- Jun 10, 2025
Malicious code in boost-static-assert (npm)
1 compromised version
- Jun 10, 2025
Malware in boost-static-assert
1 compromised version
- Jun 10, 2025
Malicious code in boost-iterator (npm)
1 compromised version
- Jun 10, 2025
Malware in boost-iterator
1 compromised version
- Jun 10, 2025
Malicious code in axios-browserify (npm)
1 compromised version
- Jun 10, 2025
Malware in axios-browserify
1 compromised version
- Jun 10, 2025
Malicious code in apple-appstore-server-library (npm)
1 compromised version
- Jun 10, 2025
Malware in apple-appstore-server-library
1 compromised version
- Jun 10, 2025
Malware in codex-cipher
1 compromised version
- Jun 9, 2025
Malicious code in react-server-dom-fb (npm)
- Jun 9, 2025
Malicious code in connectnodewebclient (npm)
1 compromised version
- Jun 9, 2025
Malicious code in frontegg-nuxt-example (npm)
1 compromised version
- Jun 9, 2025
Malicious code in flagd-playground (npm)
- Jun 9, 2025
Malicious code in npm-events-package (npm)
- Jun 9, 2025
Malicious code in my-headline (npm)
Page 5853 of 6,634