Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Jun 2, 2025
Malicious code in logs-conf (npm)
- Jun 2, 2025
Malicious code in logs-bind (npm)
- Jun 2, 2025
Malicious code in log-trap-catch (npm)
- Jun 2, 2025
Malware in logs-conf
1 compromised version
- Jun 2, 2025
Malware in log-trap-catch
1 compromised version
- Jun 2, 2025
Malware in logs-bind
1 compromised version
- Jun 2, 2025
Malicious code in chromecast-caf-receiver (npm)
1 compromised version
- Jun 2, 2025
Malware in chromecast-caf-receiver
1 compromised version
- Jun 2, 2025
Malicious code in yaml-mcp-wrapper (npm)
- Jun 2, 2025
Malware in yaml-mcp-wrapper
1 compromised version
- Jun 2, 2025
Malware in gateway-v2
1 compromised version
- Jun 2, 2025
Malware in angular-tealium
1 compromised version
- Jun 2, 2025
Malicious code in rose-web3-utils (npm)
- Jun 2, 2025
Malicious code in rose-bsc-utils (npm)
- Jun 2, 2025
Malware in rose-web3-utils
1 compromised version
- Jun 2, 2025
Malware in rose-bsc-utils
1 compromised version
- Jun 2, 2025
Malicious code in messages-hub-realestates-lib (npm)
17 compromised versions
- Jun 2, 2025
Malicious code in cx-hub-interaction-lib (npm)
18 compromised versions
- Jun 2, 2025
Malware in messages-hub-realestates-lib
1 compromised version
- Jun 2, 2025
Malware in cx-hub-interaction-lib
1 compromised version
- Jun 2, 2025
Malware in shaktihacker
1 compromised version
- Jun 1, 2025
Malicious code in bombomfortester (npm)
1 compromised version
- Jun 1, 2025
Malicious code in consumerweb-captcha (npm)
1 compromised version
- Jun 1, 2025
Malicious code in inter-frontend-svgs (npm)
2 compromised versions
- Jun 1, 2025
Malicious code in beacon-labs-translations (npm)
1 compromised version
- Jun 1, 2025
Malicious code in yasssinhami (npm)
1 compromised version
- Jun 1, 2025
Malicious code in pkurbatsky-uni-kit (npm)
- Jun 1, 2025
Malicious code in bombombombom (npm)
1 compromised version
- Jun 1, 2025
Malicious code in rosetta-elements (npm)
1 compromised version
- Jun 1, 2025
Malicious code in rosetta-primitives (npm)
1 compromised version
- Jun 1, 2025
Malicious code in helloworldmyworld (npm)
1 compromised version
- Jun 1, 2025
Malicious code in react-native-google-acm (npm)
1 compromised version
- May 31, 2025
Malicious code in is24 (npm)
1 compromised version
- May 31, 2025
Malicious code in scout24 (npm)
1 compromised version
- May 31, 2025
Malicious code in com.meta.utilities (npm)
1 compromised version
- May 31, 2025
Malicious code in @majidalfuttaim/maf-ui (npm)
- May 31, 2025
Malicious code in swap-token-list (npm)
- May 31, 2025
Malicious code in moorkh_hai_tu (npm)
2 compromised versions
- May 31, 2025
Malicious code in shiva_rrrraaaaooo (npm)
1 compromised version
- May 31, 2025
Malicious code in @seo-frontend-components/blog-schema (npm)
3 compromised versions
- May 31, 2025
Malicious code in @seo-frontend-components/card-blog-carousel (npm)
3 compromised versions
- May 31, 2025
Malicious code in @seo-frontend-components/card-blog-entry (npm)
3 compromised versions
- May 31, 2025
Malicious code in @seo-frontend-components/card-blog-carousel-mobile (npm)
3 compromised versions
- May 31, 2025
Malicious code in @pentestleg/core (npm)
2 compromised versions
- May 31, 2025
Malicious code in @chatbot-builder/core (npm)
3 compromised versions
- May 31, 2025
Malicious code in simpledep2 (npm)
1 compromised version
- May 31, 2025
Malicious code in @worksmobile/wmeet-sdk (npm)
1 compromised version
- May 30, 2025
Malicious code in @fronteg/react (npm)
1 compromised version
- May 30, 2025
Malicious code in openkitjs-simple-sample (npm)
1 compromised version
- May 30, 2025
Malicious code in kakao-pixel-web (npm)
2 compromised versions
Page 5858 of 6,634