Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- May 28, 2025
Malware in jwt-audit
1 compromised version
- May 28, 2025
Malicious code in loglinea (npm)
- May 28, 2025
Malware in loglinea
1 compromised version
- May 27, 2025
Malicious code in arc-offsec-custom-library (npm)
3 compromised versions
- May 27, 2025
Malicious code in eshops-components-library (npm)
- May 27, 2025
Malicious code in mirror-chat-ctf (npm)
- May 27, 2025
Malware in mirror-chat-ctf
1 compromised version
- May 27, 2025
Malware in mirror-logger-utils
1 compromised version
- May 27, 2025
Malicious code in staking-core (npm)
- May 27, 2025
Malware in staking-core
1 compromised version
- May 27, 2025
Malicious code in airdrop-interface-markets (npm)
- May 27, 2025
Malicious code in airdrop-interface-ad (npm)
- May 27, 2025
Malware in airdrop-interface-markets
1 compromised version
- May 27, 2025
Malware in airdrop-interface-ad
1 compromised version
- May 27, 2025
Malicious code in web3-transaction-fetch (npm)
- May 27, 2025
Malicious code in react-blockchain-checker (npm)
- May 27, 2025
Malicious code in crypto-base-class-new (npm)
- May 27, 2025
Malware in web3-transaction-fetch
1 compromised version
- May 27, 2025
Malware in react-blockchain-checker
1 compromised version
- May 27, 2025
Malware in crypto-base-class-new
1 compromised version
- May 27, 2025
Malicious code in nayan-videos-downloaders (npm)
- May 27, 2025
Malicious code in nayan-apis-servers (npm)
- May 27, 2025
Malware in nayan-videos-downloaders
1 compromised version
- May 27, 2025
Malware in nayan-apis-servers
1 compromised version
- May 27, 2025
Malware in cp-area-nao-correntista-fgts-ui
1 compromised version
- May 27, 2025
Malicious code in telegraf-mysql2-session (npm)
- May 27, 2025
Malicious code in super-randomizer (npm)
- May 27, 2025
Malicious code in rand-helper (npm)
- May 27, 2025
Malicious code in newquest (npm)
- May 27, 2025
Malware in telegraf-mysql2-session
1 compromised version
- May 27, 2025
Malware in rand-helper
1 compromised version
- May 27, 2025
Malware in newquest
1 compromised version
- May 27, 2025
Malware in super-randomizer
1 compromised version
- May 27, 2025
Malicious code in m03124geeztd (npm)
- May 27, 2025
Malicious code in geeztdmailmodule (npm)
- May 27, 2025
Malware in m03124geeztd
1 compromised version
- May 27, 2025
Malware in geeztdmailmodule
1 compromised version
- May 27, 2025
Malware in dep-b
1 compromised version
- May 27, 2025
Malware in symphony-binary-confusion-matrix
1 compromised version
- May 27, 2025
Malware in blahblahblah-definitely-not-a-real-package-name
1 compromised version
- May 27, 2025
Malware in @tribal-worldwide-london/fa-api-service
1 compromised version
- May 27, 2025
Malicious code in bandwith-sdk (npm)
1 compromised version
- May 27, 2025
Malicious code in andes-landings (npm)
1 compromised version
- May 27, 2025
Malicious code in @cyb3rsh4ykh/neondatabase (npm)
1 compromised version
- May 27, 2025
Malware in pog-ui-landings-library
1 compromised version
- May 27, 2025
Malware in andes-landings
1 compromised version
- May 27, 2025
Malware in bandwith-sdk
1 compromised version
- May 27, 2025
Malware in spingroup
1 compromised version
- May 27, 2025
Malware in @cyb3rsh4ykh/neondatabase
1 compromised version
- May 27, 2025
Malicious code in front-exporter (npm)
1 compromised version
Page 5861 of 6,634