Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- May 12, 2025
Malicious code in digitalexp-generic-action-executor-base-module (npm)
2 compromised versions
- May 12, 2025
Malware in digitalexp-generic-action-executor-base-module
1 compromised version
- May 12, 2025
Malicious code in snake_case_name (npm)
1 compromised version
- May 12, 2025
Malware in snake_case_name
1 compromised version
- May 12, 2025
Malicious code in abuse-ui-internal (npm)
- May 12, 2025
Malware in abuse-ui-internal
1 compromised version
- May 12, 2025
Malicious code in vojislav-web3-utils (npm)
- May 12, 2025
Malware in vojislav-web3-utils
1 compromised version
- May 12, 2025
Malicious code in lavanew (npm)
1 compromised version
- May 12, 2025
Malware in lavanew
1 compromised version
- May 12, 2025
Malware in fake-linter-no-schema
1 compromised version
- May 12, 2025
Malware in customprefix-auth
1 compromised version
- May 12, 2025
Malware in 0x-smart-contracts
1 compromised version
- May 12, 2025
Malware in gql-test-client
1 compromised version
- May 12, 2025
Malicious code in zksync-root (npm)
- May 12, 2025
Malicious code in wwemix-contract (npm)
- May 12, 2025
Malicious code in voting-client-js (npm)
- May 12, 2025
Malicious code in next.js-localized (npm)
- May 12, 2025
Malicious code in mag-client (npm)
- May 12, 2025
Malicious code in harvest-strategy (npm)
- May 12, 2025
Malicious code in frame-minter-contracts (npm)
- May 12, 2025
Malicious code in dforce-staking-v2 (npm)
- May 12, 2025
Malicious code in defisaver-v3-contracts (npm)
- May 12, 2025
Malicious code in coinpayments-api (npm)
- May 12, 2025
Malware in mag-client
1 compromised version
- May 12, 2025
Malware in next.js-localized
1 compromised version
- May 12, 2025
Malware in frame-minter-contracts
1 compromised version
- May 12, 2025
Malware in voting-client-js
1 compromised version
- May 12, 2025
Malware in dforce-staking-v2
1 compromised version
- May 12, 2025
Malware in zksync-root
1 compromised version
- May 12, 2025
Malware in coinpayments-api
1 compromised version
- May 12, 2025
Malware in harvest-strategy
1 compromised version
- May 12, 2025
Malware in crisp-import-conversations
1 compromised version
- May 12, 2025
Malware in harvest-strategy-arbitrum
1 compromised version
- May 12, 2025
Malware in wwemix-contract
1 compromised version
- May 12, 2025
Malware in defisaver-v3-contracts
1 compromised version
- May 12, 2025
Malicious code in ghosts3c (npm)
- May 12, 2025
Malware in ghosts3c
1 compromised version
- May 12, 2025
Malware in scrt-www
1 compromised version
- May 12, 2025
Malware in pocketnet
1 compromised version
- May 12, 2025
Malware in rei-session
1 compromised version
- May 12, 2025
Malware in braze-i18n-knockout
1 compromised version
- May 12, 2025
Malware in my-rei-browser-shim
1 compromised version
- May 12, 2025
Malware in rei-breakpoint-detector
1 compromised version
- May 12, 2025
Malware in font-impact
1 compromised version
- May 12, 2025
Malicious code in conversation-extension-reservation (npm)
1 compromised version
- May 11, 2025
Malicious code in client-aem-content-engine (npm)
1 compromised version
- May 11, 2025
Malicious code in atlaskit-registry (npm)
4 compromised versions
- May 11, 2025
Malicious code in gear-idea-indexer-db (npm)
1 compromised version
- May 11, 2025
Malicious code in com.unity.visualeffectgraph (npm)
1 compromised version
Page 5889 of 6,634