Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- May 26, 2025
Malware in etherna
1 compromised version
- May 26, 2025
Malware in web3-evm
1 compromised version
- May 26, 2025
Malware in web3ether
1 compromised version
- May 26, 2025
Malicious code in expo-blob-util (npm)
1 compromised version
- May 26, 2025
Malware in expo-blob-util
1 compromised version
- May 26, 2025
Malware in gltfvariantmeld
1 compromised version
- May 26, 2025
Malicious code in ml-preprocessing (npm)
1 compromised version
- May 26, 2025
Malware in ml-preprocessing
1 compromised version
- May 26, 2025
Malicious code in vnc-viewer (npm)
1 compromised version
- May 26, 2025
Malware in vnc-viewer
1 compromised version
- May 26, 2025
Malicious code in mxc-jsbridge (npm)
- May 26, 2025
Malicious code in mx-admin (npm)
- May 26, 2025
Malicious code in mexc-cli (npm)
- May 26, 2025
Malware in mxc-jsbridge
1 compromised version
- May 26, 2025
Malware in mexc-cli
1 compromised version
- May 26, 2025
Malware in mx-admin
1 compromised version
- May 26, 2025
Malicious code in testsec (npm)
- May 26, 2025
Malicious code in mxc-klinecharts (npm)
- May 26, 2025
Malicious code in fe-second-party-pkg (npm)
- May 26, 2025
Malware in testsec
1 compromised version
- May 26, 2025
Malware in fe-second-party-pkg
1 compromised version
- May 26, 2025
Malware in mxc-klinecharts
1 compromised version
- May 26, 2025
Malicious code in hibernate-validator (npm)
1 compromised version
- May 26, 2025
Malware in hibernate-validator
1 compromised version
- May 26, 2025
Malicious code in core-foundation (npm)
1 compromised version
- May 26, 2025
Malware in core-foundation
1 compromised version
- May 26, 2025
Malicious code in @mkto/analytics-provider (npm)
- May 26, 2025
Malware in @mkto/analytics-provider
1 compromised version
- May 26, 2025
Malicious code in vite-plugin-legacy-umd (npm)
- May 26, 2025
Malware in vite-plugin-legacy-umd
1 compromised version
- May 26, 2025
Malicious code in vite-plugin-esm-import-extension (npm)
1 compromised version
- May 26, 2025
Malicious code in nsubstitute (npm)
1 compromised version
- May 26, 2025
Malware in vite-plugin-esm-import-extension
1 compromised version
- May 26, 2025
Malware in nsubstitute
1 compromised version
- May 26, 2025
Malware in defi-wallet
1 compromised version
- May 26, 2025
Malicious code in catalog-web (npm)
1 compromised version
- May 26, 2025
Malware in catalog-web
1 compromised version
- May 26, 2025
Malicious code in webmaker-sso (npm)
2 compromised versions
- May 26, 2025
Malicious code in osuny (npm)
2 compromised versions
- May 26, 2025
Malware in webmaker-sso
1 compromised version
- May 26, 2025
Malware in osuny
1 compromised version
- May 26, 2025
Malware in webpack-cli-4
1 compromised version
- May 26, 2025
Malicious code in vega-embed-v6 (npm)
2 compromised versions
- May 26, 2025
Malicious code in vega-embed-v5 (npm)
2 compromised versions
- May 26, 2025
Malware in vega-embed-v6
1 compromised version
- May 26, 2025
Malware in webpack-cli-v4
1 compromised version
- May 26, 2025
Malware in vega-embed-v5
1 compromised version
- May 25, 2025
Malicious code in blocks-nextjs (npm)
23 compromised versions
- May 25, 2025
Malicious code in @cat-ecom/pcc-components (npm)
1 compromised version
- May 25, 2025
Malicious code in tml-sso (npm)
1 compromised version
Page 5865 of 6,634