Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- May 7, 2025
Malware in @starkgate/web
1 compromised version
- May 7, 2025
Malware in @johndeere-tech/helios-styles
1 compromised version
- May 7, 2025
Malware in @johndeere-tech/eslint-plugin-timbercloud-custom-rules
1 compromised version
- May 7, 2025
Malware in @acesso-io/genoma-ui
1 compromised version
- May 7, 2025
Malware in @johndeere-tech/helios-ng-components
1 compromised version
- May 7, 2025
Malware in @johndeere-tech/helios-mat-styles
1 compromised version
- May 7, 2025
Malware in @klarna-travel-platform/travel-booking-shared-types
1 compromised version
- May 7, 2025
Malware in echo-color
1 compromised version
- May 7, 2025
Malware in substrate-faucet
1 compromised version
- May 7, 2025
Malicious code in @joshcyber123/frontend-logger (npm)
2 compromised versions
- May 7, 2025
Malware in @joshcyber123/frontend-logger
1 compromised version
- May 7, 2025
Malicious code in poc-malicious-sim (npm)
6 compromised versions
- May 7, 2025
Malware in poc-npm-hooks
1 compromised version
- May 7, 2025
Malware in poc-malicious-sim
1 compromised version
- May 7, 2025
Malware in poc-sim
1 compromised version
- May 7, 2025
Malware in discord-vc-manager
1 compromised version
- May 7, 2025
Malicious code in log-task (npm)
- May 7, 2025
Malware in log-task
1 compromised version
- May 7, 2025
Malicious code in krnl-cli (npm)
- May 7, 2025
Malicious code in create-krnl-app (npm)
- May 7, 2025
Malware in create-krnl-app
1 compromised version
- May 7, 2025
Malware in krnl-cli
1 compromised version
- May 7, 2025
Malicious code in outline-shadowsocksconfig (npm)
1 compromised version
- May 7, 2025
Malicious code in bitpay-push-notification-client (npm)
2 compromised versions
- May 7, 2025
Malware in outline-shadowsocksconfig
1 compromised version
- May 7, 2025
Malware in bitpay-push-notification-client
1 compromised version
- May 7, 2025
Malicious code in graphalgo (npm)
7 compromised versions
- May 7, 2025
Malicious code in express-cronjs (npm)
2 compromised versions
- May 7, 2025
Malware in express-cronjs
1 compromised version
- May 7, 2025
Malware in graphalgo
1 compromised version
- May 7, 2025
Malware in rose-bn
1 compromised version
- May 7, 2025
Malicious code in toast-sliders (npm)
1 compromised version
- May 7, 2025
Malware in toast-sliders
1 compromised version
- May 7, 2025
Malicious code in orvyn (npm)
- May 7, 2025
Malware in orvyn
1 compromised version
- May 7, 2025
Malicious code in glance-design (npm)
- May 7, 2025
Malware in glance-design
1 compromised version
- May 7, 2025
Malicious code in flueneceenergy (npm)
1 compromised version
- May 7, 2025
Malicious code in fluenceenergy (npm)
1 compromised version
- May 7, 2025
Malware in flueneceenergy
1 compromised version
- May 7, 2025
Malware in fluenceenergy
1 compromised version
- May 7, 2025
Malware in feather-provider-filter
1 compromised version
- May 7, 2025
Malicious code in pixel-percent (npm)
- May 7, 2025
Malware in pixel-percent
1 compromised version
- May 7, 2025
Malicious code in framer-motion-ext (npm)
- May 7, 2025
Malware in framer-motion-ext
1 compromised version
- May 7, 2025
Malicious code in crypto-provider (npm)
1 compromised version
- May 6, 2025
Malicious code in @acesso-io/genoma-ui (npm)
1 compromised version
- May 6, 2025
Malicious code in toloka-tb (npm)
1 compromised version
- May 6, 2025
Malware in toloka-tb
1 compromised version
Page 5891 of 6,634