Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- May 23, 2025
Malicious code in seacloud-database (npm)
1 compromised version
- May 23, 2025
Malicious code in refreshrewards (npm)
- May 23, 2025
Malicious code in react-xterm2 (npm)
2 compromised versions
- May 23, 2025
Malicious code in mysteryicons (npm)
1 compromised version
- May 23, 2025
Malicious code in mshop2 (npm)
1 compromised version
- May 23, 2025
Malicious code in kyutai-client (npm)
- May 23, 2025
Malicious code in garena-react-template-redux (npm)
1 compromised version
- May 23, 2025
Malicious code in garena-admin (npm)
- May 23, 2025
Malicious code in gacha-box (npm)
- May 23, 2025
Malicious code in estatement-fe (npm)
- May 23, 2025
Malicious code in datamart (npm)
1 compromised version
- May 23, 2025
Malicious code in coral-web-be (npm)
1 compromised version
- May 23, 2025
Malicious code in codeword (npm)
- May 23, 2025
Malicious code in bkeat-pytest (npm)
1 compromised version
- May 23, 2025
Malicious code in admin-id (npm)
1 compromised version
- May 23, 2025
Malware in admin-id
1 compromised version
- May 23, 2025
Malware in sellyourvault
1 compromised version
- May 23, 2025
Malware in mysteryicons
1 compromised version
- May 23, 2025
Malware in sps
1 compromised version
- May 23, 2025
Malware in gacha-box
1 compromised version
- May 23, 2025
Malware in mshop2
1 compromised version
- May 23, 2025
Malware in react-xterm2
1 compromised version
- May 23, 2025
Malware in kyutai-client
1 compromised version
- May 23, 2025
Malware in bkeat-pytest
1 compromised version
- May 23, 2025
Malware in garena-admin
1 compromised version
- May 23, 2025
Malware in tgi-fe
1 compromised version
- May 23, 2025
Malware in garena-react-template-redux
1 compromised version
- May 23, 2025
Malware in coral-web-be
1 compromised version
- May 23, 2025
Malware in seacloud-database
1 compromised version
- May 23, 2025
Malware in refreshrewards
1 compromised version
- May 23, 2025
Malware in xlog-admin-portal
1 compromised version
- May 23, 2025
Malware in estatement-fe
1 compromised version
- May 23, 2025
Malware in codeword
1 compromised version
- May 23, 2025
Malware in tenslots
1 compromised version
- May 23, 2025
Malware in datamart
1 compromised version
- May 23, 2025
Malicious code in url-project (npm)
1 compromised version
- May 23, 2025
Malicious code in node-window-rendering (npm)
1 compromised version
- May 23, 2025
Malicious code in lcs-sistic-integration (npm)
1 compromised version
- May 23, 2025
Malware in lcs-sistic-integration
1 compromised version
- May 23, 2025
Malware in node-window-rendering
1 compromised version
- May 23, 2025
Malware in url-project
1 compromised version
- May 23, 2025
Malicious code in dev.voltstro.unitywebbrowser (npm)
1 compromised version
- May 23, 2025
Malicious code in com.unity.multiplayer.tools (npm)
1 compromised version
- May 23, 2025
Malicious code in com.unity.ml-agents (npm)
1 compromised version
- May 23, 2025
Malicious code in com.unity.live-capture (npm)
1 compromised version
- May 23, 2025
Malicious code in com.unity.cloud.common (npm)
1 compromised version
- May 23, 2025
Malicious code in blog-client (npm)
1 compromised version
- May 23, 2025
Malicious code in @elementor-editor-github-actions/utils (npm)
1 compromised version
- May 23, 2025
Malicious code in @demoability/loadgen-core (npm)
2 compromised versions
- May 23, 2025
Malware in dev.voltstro.unitywebbrowser
1 compromised version
Page 5870 of 6,634