Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- May 15, 2025
Malware in o1js-wrapper
1 compromised version
- May 15, 2025
Malware in precompiled-iris300
1 compromised version
- May 15, 2025
Malware in tree-sitter-sqlite
1 compromised version
- May 15, 2025
Malware in rsk-transaction-helper
1 compromised version
- May 15, 2025
Malware in tree-sitter-dockerfile
1 compromised version
- May 15, 2025
Malware in bridge-transaction-parser-hop400
1 compromised version
- May 15, 2025
Malware in wdio-common
1 compromised version
- May 15, 2025
Malware in precompiled-wasabi100
1 compromised version
- May 15, 2025
Malware in x-tree-view
1 compromised version
- May 15, 2025
Malware in toptal-react-bikes
1 compromised version
- May 15, 2025
Malware in html-webpack-plugin-v4
1 compromised version
- May 15, 2025
Malware in shader-examples
1 compromised version
- May 15, 2025
Malware in com.siccity.gltfutility
1 compromised version
- May 15, 2025
Malware in bazelbuild.vscode-bazel
1 compromised version
- May 15, 2025
Malware in html-webpack-plugin-v5
1 compromised version
- May 15, 2025
Malware in llvm-vs-code-extensions.vscode-clangd
1 compromised version
- May 15, 2025
Malware in typespublishercontenthash
1 compromised version
- May 15, 2025
Malware in spicy-sections
1 compromised version
- May 15, 2025
Malware in conversation-extension-reservation
1 compromised version
- May 15, 2025
Malware in lezer-snowsql
1 compromised version
- May 15, 2025
Malware in @ringcx/agent-mfe-sdk
1 compromised version
- May 15, 2025
Malware in component-modernizr
1 compromised version
- May 15, 2025
Malicious code in developer-bridge (npm)
2 compromised versions
- May 15, 2025
Malicious code in qlkube-docs (npm)
1 compromised version
- May 14, 2025
Malicious code in f0-flow-resolver (npm)
6 compromised versions
- May 14, 2025
Malicious code in @tribal-worldwide-london/fa-loggerpoc (npm)
1 compromised version
- May 14, 2025
Malicious code in volkswagen-onehub-components-raj (npm)
1 compromised version
- May 14, 2025
Malicious code in keypair-encrypt (npm)
- May 14, 2025
Malware in keypair-encrypt
1 compromised version
- May 14, 2025
Malicious code in wix-pilot (npm)
1 compromised version
- May 14, 2025
Malicious code in webpack-cli-v4 (npm)
1 compromised version
- May 14, 2025
Malicious code in vite-logging-patcher (npm)
- May 14, 2025
Malicious code in test-vite-favicons-inject (npm)
- May 14, 2025
Malware in vite-logging-patcher
1 compromised version
- May 14, 2025
Malware in test-vite-favicons-inject
1 compromised version
- May 14, 2025
Malicious code in webpack-cli-4 (npm)
1 compromised version
- May 14, 2025
Malicious code in node-method-indicator (npm)
- May 14, 2025
Malicious code in node-event-listener (npm)
- May 14, 2025
Malicious code in next-auths (npm)
- May 14, 2025
Malicious code in next-auth-core (npm)
- May 14, 2025
Malicious code in mongoose-mongodb (npm)
- May 14, 2025
Malware in next-auth-core
1 compromised version
- May 14, 2025
Malware in next-auths
1 compromised version
- May 14, 2025
Malware in mongoose-mongodb
1 compromised version
- May 14, 2025
Malware in node-method-indicator
1 compromised version
- May 14, 2025
Malware in node-event-listener
1 compromised version
- May 14, 2025
Malicious code in vite-tsconfig-log (npm)
11 compromised versions
- May 14, 2025
Malicious code in middy-js (npm)
7 compromised versions
- May 14, 2025
Malware in middy-js
1 compromised version
- May 14, 2025
Malware in vite-tsconfig-log
1 compromised version
Page 5887 of 6,634