Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- May 16, 2025
Malware in jb-sol-lib
1 compromised version
- May 16, 2025
Malware in hardhat-configure
1 compromised version
- May 16, 2025
Malicious code in solana-crypto-validator (npm)
- May 16, 2025
Malicious code in node-crypto-validator (npm)
- May 16, 2025
Malware in node-crypto-validator
1 compromised version
- May 16, 2025
Malware in solana-crypto-validator
1 compromised version
- May 16, 2025
Malicious code in @okdev/boiler_plate (npm)
2 compromised versions
- May 16, 2025
Malicious code in ideals-utils (npm)
1 compromised version
- May 16, 2025
Malicious code in compensation-calculator (npm)
1 compromised version
- May 15, 2025
Malicious code in pog-ui-landings-library (npm)
1 compromised version
- May 15, 2025
Malicious code in cp-area-nao-correntista-fgts-ui (npm)
16 compromised versions
- May 15, 2025
Malicious code in momenter (npm)
1 compromised version
- May 15, 2025
Malicious code in lodashing (npm)
2 compromised versions
- May 15, 2025
Malicious code in fastifiyer (npm)
1 compromised version
- May 15, 2025
Malicious code in ctalking (npm)
2 compromised versions
- May 15, 2025
Malware in fastifiyer
1 compromised version
- May 15, 2025
Malware in lodashing
1 compromised version
- May 15, 2025
Malware in momenter
1 compromised version
- May 15, 2025
Malware in ctalking
1 compromised version
- May 15, 2025
Malicious code in @tribal-worldwide-london/fa-api-service (npm)
1 compromised version
- May 15, 2025
Malicious code in symphony-binary-confusion-matrix (npm)
- May 15, 2025
Malicious code in mmsdk-apml-schema (npm)
- May 15, 2025
Malware in mmsdk-apml-schema
1 compromised version
- May 15, 2025
Malware in amazonui
1 compromised version
- May 15, 2025
Malicious code in valida-bepass (npm)
2 compromised versions
- May 15, 2025
Malware in valida-bepass
1 compromised version
- May 15, 2025
Malicious code in yandex-int (npm)
1 compromised version
- May 15, 2025
Malicious code in rushstack (npm)
- May 15, 2025
Malicious code in pcln-popver (npm)
- May 15, 2025
Malicious code in neondatabase (npm)
- May 15, 2025
Malicious code in mozilla-protocol (npm)
- May 15, 2025
Malicious code in lululemon (npm)
- May 15, 2025
Malicious code in att-bit (npm)
- May 15, 2025
Malicious code in airtable-blocks-internal (npm)
- May 15, 2025
Malware in yandex-lego
1 compromised version
- May 15, 2025
Malware in neondatabase
1 compromised version
- May 15, 2025
Malware in pcln-popver
1 compromised version
- May 15, 2025
Malware in firefox-devtools
1 compromised version
- May 15, 2025
Malware in yandex-int
1 compromised version
- May 15, 2025
Malware in wix-pilot
1 compromised version
- May 15, 2025
Malware in wcc-connector
1 compromised version
- May 15, 2025
Malware in rushstack
1 compromised version
- May 15, 2025
Malware in lululemon
1 compromised version
- May 15, 2025
Malware in mozilla-protocol
1 compromised version
- May 15, 2025
Malware in airtable-blocks-internal
1 compromised version
- May 15, 2025
Malware in att-bit
1 compromised version
- May 15, 2025
Malicious code in helvetia-base-patterns (npm)
4 compromised versions
- May 15, 2025
Malicious code in @hotmart-org-ca/cosmos-tokens (npm)
- May 15, 2025
Malicious code in @hotmart-org-ca/cosmos (npm)
- May 15, 2025
Malware in helvetia-base-patterns
1 compromised version
Page 5884 of 6,634