Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- May 26, 2025
Malicious code in ideals-types (npm)
1 compromised version
- May 26, 2025
Malicious code in syf-api (npm)
1 compromised version
- May 26, 2025
Malicious code in ideals-ui-components (npm)
1 compromised version
- May 26, 2025
Malicious code in inter-dc-lib (npm)
- May 26, 2025
Malicious code in ideals-models (npm)
1 compromised version
- May 26, 2025
Malicious code in muto-kaiju-npm (npm)
3 compromised versions
- May 26, 2025
Malicious code in ideals-services (npm)
1 compromised version
- May 26, 2025
Malicious code in angular-tealium (npm)
1 compromised version
- May 26, 2025
Malicious code in k8s-lint-action (npm)
- May 26, 2025
Malicious code in qsc-workspace (npm)
- May 26, 2025
Malicious code in typescript-go (npm)
- May 26, 2025
Malicious code in html-report (npm)
- May 26, 2025
Malicious code in ccv-token-manager (npm)
- May 26, 2025
Malicious code in log5j-v2 (npm)
- May 26, 2025
Malicious code in iot-sdk-device-client-rest-api (npm)
- May 26, 2025
Malicious code in aspirejavascript-vite (npm)
- May 26, 2025
Malicious code in nuget-trends (npm)
- May 26, 2025
Malicious code in style-value-parser (npm)
- May 26, 2025
Malicious code in dependency-conftest (npm)
- May 26, 2025
Malicious code in react-native-xaml-repo (npm)
- May 26, 2025
Malicious code in reacts-gh (npm)
- May 26, 2025
Malicious code in gateway-v2 (npm)
- May 26, 2025
Malicious code in miro-plugin-tag-crawler (npm)
- May 26, 2025
Malicious code in skipthedishes_react (npm)
1 compromised version
- May 26, 2025
Malicious code in justeatapplepayjs (npm)
- May 26, 2025
Malicious code in cspotcode (npm)
2 compromised versions
- May 26, 2025
Malicious code in fatfingers-mybigpackage (npm)
1 compromised version
- May 26, 2025
Malicious code in @omnia-low-code/shared-components (npm)
- May 26, 2025
Malicious code in winstons-logger (npm)
- May 26, 2025
Malicious code in winston-core (npm)
- May 26, 2025
Malicious code in rainbowkit-sdk (npm)
- May 26, 2025
Malicious code in prisma-clients (npm)
- May 26, 2025
Malware in winston-core
1 compromised version
- May 26, 2025
Malware in rainbowkit-sdk
1 compromised version
- May 26, 2025
Malware in winstons-logger
1 compromised version
- May 26, 2025
Malware in prisma-clients
1 compromised version
- May 26, 2025
Malicious code in pushlabzy (npm)
1 compromised version
- May 26, 2025
Malware in pushlabzy
1 compromised version
- May 26, 2025
Malware in f0-flow-resolver
1 compromised version
- May 26, 2025
Malicious code in iokit (npm)
1 compromised version
- May 26, 2025
Malware in iokit
1 compromised version
- May 26, 2025
Malicious code in expo-firestore-upload (npm)
1 compromised version
- May 26, 2025
Malware in expo-firestore-upload
1 compromised version
- May 26, 2025
Malicious code in logs-buffer (npm)
- May 26, 2025
Malware in logs-buffer
1 compromised version
- May 26, 2025
Malicious code in apache-iotdb (npm)
1 compromised version
- May 26, 2025
Malware in apache-iotdb
1 compromised version
- May 26, 2025
Malicious code in web3ether (npm)
- May 26, 2025
Malicious code in web3-evm (npm)
- May 26, 2025
Malicious code in etherna (npm)
Page 5864 of 6,634