Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- May 30, 2025
Malicious code in motion-exts (npm)
- May 30, 2025
Malware in motion-exts
1 compromised version
- May 30, 2025
Malicious code in vite-plugin-svgr-logger (npm)
- May 30, 2025
Malicious code in passport-jwt-logger (npm)
- May 30, 2025
Malware in passport-jwt-logger
1 compromised version
- May 30, 2025
Malware in vite-plugin-svgr-logger
1 compromised version
- May 30, 2025
Malware in fxa-shared-110n
1 compromised version
- May 30, 2025
Malicious code in @bugbounty208/sdk (npm)
- May 30, 2025
Malware in yamoney-guidelines
1 compromised version
- May 30, 2025
Malware in @bugbounty208/sdk
1 compromised version
- May 30, 2025
Malicious code in process-load (npm)
- May 30, 2025
Malware in process-load
1 compromised version
- May 30, 2025
Malware in @abb-ux/commonux-web-components
1 compromised version
- May 30, 2025
Malicious code in express-authgen (npm)
1 compromised version
- May 30, 2025
Malware in express-authgen
1 compromised version
- May 30, 2025
Malware in logging-plugin
1 compromised version
- May 30, 2025
Malware in eslint-plugin-i18n-strings
1 compromised version
- May 30, 2025
Malware in muto-kaiju-npm
1 compromised version
- May 30, 2025
Malware in muto-kaiju-log
1 compromised version
- May 30, 2025
Malicious code in blesx (npm)
- May 30, 2025
Malware in blesx
1 compromised version
- May 30, 2025
Malware in solhint-plugin-algebra
1 compromised version
- May 30, 2025
Malware in coinbase-wallet-history-frontend
1 compromised version
- May 30, 2025
Malware in jaeger-ui
1 compromised version
- May 30, 2025
Malware in proton-parking-page
1 compromised version
- May 30, 2025
Malware in auto-claim-service
1 compromised version
- May 30, 2025
Malware in backpack-foundations
1 compromised version
- May 30, 2025
Malware in fider
1 compromised version
- May 30, 2025
Malware in human-protocol
1 compromised version
- May 30, 2025
Malware in move-binary-format-wasm
1 compromised version
- May 30, 2025
Malware in lido-council-daemon
1 compromised version
- May 30, 2025
Malware in transaction-report
1 compromised version
- May 30, 2025
Malware in ai-chatbot-starter
1 compromised version
- May 30, 2025
Malware in moonpay-sign
1 compromised version
- May 30, 2025
Malicious code in ext-hash (npm)
- May 30, 2025
Malware in @zohaib2121/dtapp
1 compromised version
- May 30, 2025
Malware in widgets-mainappointments
1 compromised version
- May 30, 2025
Malware in ext-hash
1 compromised version
- May 30, 2025
Malicious code in odin-security1 (npm)
- May 30, 2025
Malware in novacredit-global2
1 compromised version
- May 30, 2025
Malware in odin-security1
1 compromised version
- May 30, 2025
Malware in sforce
1 compromised version
- May 30, 2025
Malware in novacredit-global
1 compromised version
- May 30, 2025
Malware in @mpsemea/fspay-smartpay-logging-web-sdk
1 compromised version
- May 30, 2025
Malware in morrrisjs
1 compromised version
- May 30, 2025
Malicious code in safe-query-buffer (npm)
- May 30, 2025
Malware in safe-query-buffer
1 compromised version
- May 30, 2025
Malicious code in http-parse (npm)
- May 30, 2025
Malware in http-parse
1 compromised version
- May 30, 2025
Malware in inter-frontend-hooks
1 compromised version
Page 5859 of 6,634