Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- May 2, 2025
Malicious code in aegis-contracts (npm)
1 compromised version
- May 2, 2025
Malicious code in ui-platform-business-elements (npm)
4 compromised versions
- May 2, 2025
Malicious code in component-modernizr (npm)
1 compromised version
- May 2, 2025
Malicious code in wasitestforeducation (npm)
1 compromised version
- May 2, 2025
Malicious code in twewewewest6 (npm)
1 compromised version
- May 2, 2025
Malicious code in sxg-playground (npm)
- May 2, 2025
Malicious code in swap-subgraph (npm)
1 compromised version
- May 2, 2025
Malicious code in smart-wallet-permissions (npm)
1 compromised version
- May 2, 2025
Malicious code in passkeys-integration (npm)
2 compromised versions
- May 2, 2025
Malicious code in fiddlesticks (npm)
1 compromised version
- May 2, 2025
Malicious code in bffhfuruhejfhdj (npm)
9 compromised versions
- May 2, 2025
Malware in smart-wallet-permissions
1 compromised version
- May 2, 2025
Malware in swap-subgraph
1 compromised version
- May 2, 2025
Malware in fiddlesticks
1 compromised version
- May 2, 2025
Malware in passkeys-integration
1 compromised version
- May 2, 2025
Malware in sxg-playground
1 compromised version
- May 2, 2025
Malware in twewewewest6
1 compromised version
- May 2, 2025
Malware in bffhfuruhejfhdj
1 compromised version
- May 2, 2025
Malware in wasitestforeducation
1 compromised version
- May 2, 2025
Malware in example-advanced
1 compromised version
- May 2, 2025
Malware in appqos-client
1 compromised version
- May 2, 2025
Malware in continue-docs
1 compromised version
- May 2, 2025
Malware in ad-language-monitor
1 compromised version
- May 2, 2025
Malware in hosted-wallet-page
1 compromised version
- May 2, 2025
Malware in moonpay-widget
1 compromised version
- May 2, 2025
Malware in safe-modules
1 compromised version
- May 2, 2025
Malware in drift-v1-cli
1 compromised version
- May 2, 2025
Malware in web3-trade
1 compromised version
- May 2, 2025
Malware in stablecoin-aptos
1 compromised version
- May 2, 2025
Malicious code in selfbot.js-v13 (npm)
- May 2, 2025
Malware in selfbot.js-v13
1 compromised version
- May 2, 2025
Malicious code in discord-json-parser (npm)
- May 2, 2025
Malware in discord-json-parser
1 compromised version
- May 2, 2025
Malware in 32red-checkout
1 compromised version
- May 2, 2025
Malware in 32red-api-client
1 compromised version
- May 2, 2025
Malware in 32red-connect
1 compromised version
- May 2, 2025
Malware in 32red-api
1 compromised version
- May 2, 2025
Malware in 32red-analytics
1 compromised version
- May 2, 2025
Malware in 32red-auth
1 compromised version
- May 2, 2025
Malware in 32red-cloud
1 compromised version
- May 2, 2025
Malware in 32red-admin
1 compromised version
- May 2, 2025
Malware in 32red-cache
1 compromised version
- May 2, 2025
Malware in 32red-database
1 compromised version
- May 2, 2025
Malware in planweb-core-ui
1 compromised version
- May 2, 2025
Malicious code in vanjavajs (npm)
3 compromised versions
- May 2, 2025
Malware in vanjavajs
1 compromised version
- May 2, 2025
Malicious code in socket-event-trigger (npm)
- May 2, 2025
Malware in socket-event-trigger
1 compromised version
- May 2, 2025
Malicious code in serverlog-dispatch (npm)
- May 2, 2025
Malicious code in mongo-errorlog (npm)
Page 5895 of 6,634