Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- May 25, 2025
Malicious code in elysium-checkout (npm)
5 compromised versions
- May 25, 2025
Malicious code in hpglobaldata (npm)
1 compromised version
- May 25, 2025
Malicious code in ghpglobaldata (npm)
1 compromised version
- May 24, 2025
Malicious code in mergify-browser-extension (npm)
- May 24, 2025
Malicious code in @stepstone-genesis/components (npm)
- May 24, 2025
Malicious code in @partners-types/generics (npm)
- May 24, 2025
Malicious code in @monterosa-sdk/enmasse (npm)
- May 24, 2025
Malicious code in @mse-entitlement-sdk/react (npm)
- May 23, 2025
Malicious code in @ing-web-es/application (npm)
- May 23, 2025
Malicious code in @galaxy-nft/frontend (npm)
- May 23, 2025
Malicious code in @fff-web/fff-utilities (npm)
- May 23, 2025
Malicious code in @dbtw/mfe-gateway (npm)
- May 23, 2025
Malicious code in @fms-common-biz/basic-react (npm)
- May 23, 2025
Malicious code in @mc-donate/donateweb (npm)
4 compromised versions
- May 23, 2025
Malicious code in react-stitches (npm)
4 compromised versions
- May 23, 2025
Malware in react-stitches
1 compromised version
- May 23, 2025
Malicious code in dw-api-mock (npm)
2 compromised versions
- May 23, 2025
Malware in dw-api-mock
1 compromised version
- May 23, 2025
Malware in @act-platform/app-sdk
1 compromised version
- May 23, 2025
Malicious code in struct-logger (npm)
- May 23, 2025
Malware in struct-logger
1 compromised version
- May 23, 2025
Malware in ember-super-prosemirror
1 compromised version
- May 23, 2025
Malware in cond-common-components
1 compromised version
- May 23, 2025
Malicious code in react-loggers (npm)
- May 23, 2025
Malware in react-loggers
1 compromised version
- May 23, 2025
Malicious code in koishi-plugin-pinhaofa (npm)
- May 23, 2025
Malicious code in koishi-plugin-majjan-nanikiri (npm)
- May 23, 2025
Malware in koishi-plugin-pinhaofa
1 compromised version
- May 23, 2025
Malware in koishi-plugin-majjan-nanikiri
1 compromised version
- May 23, 2025
Malicious code in next-config-log (npm)
- May 23, 2025
Malware in next-config-log
1 compromised version
- May 23, 2025
Malicious code in feature-runtime (npm)
- May 23, 2025
Malware in feature-runtime
1 compromised version
- May 23, 2025
Malicious code in utility-capsule (npm)
- May 23, 2025
Malicious code in plugin-helper (npm)
- May 23, 2025
Malicious code in package-meta-resolver (npm)
- May 23, 2025
Malicious code in eslint-typescript-runtime-check (npm)
- May 23, 2025
Malware in eslint-config-airbnb-compat
1 compromised version
- May 23, 2025
Malware in eslint-typescript-runtime-check
1 compromised version
- May 23, 2025
Malware in plugin-helper
1 compromised version
- May 23, 2025
Malware in package-meta-resolver
1 compromised version
- May 23, 2025
Malware in utility-capsule
1 compromised version
- May 23, 2025
Malicious code in feng-npm-test666 (npm)
2 compromised versions
- May 23, 2025
Malware in feng-npm-test666
1 compromised version
- May 23, 2025
Malicious code in transaction-generations (npm)
- May 23, 2025
Malware in transaction-generations
1 compromised version
- May 23, 2025
Malicious code in pdfplumber (npm)
2 compromised versions
- May 23, 2025
Malicious code in gatsby-plugin-source-map (npm)
- May 23, 2025
Malware in tree-sitter-your-language
1 compromised version
- May 23, 2025
Malware in pdfplumber
1 compromised version
Page 5866 of 6,634