Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- May 2, 2025
Malware in mongo-errorlog
1 compromised version
- May 2, 2025
Malware in serverlog-dispatch
1 compromised version
- May 2, 2025
Malicious code in vite-plugin-tools (npm)
- May 2, 2025
Malicious code in next-log-patcher (npm)
- May 2, 2025
Malware in vite-plugin-tools
1 compromised version
- May 2, 2025
Malware in next-log-patcher
1 compromised version
- May 1, 2025
Malicious code in lezer-snowsql (npm)
17 compromised versions
- May 1, 2025
Malicious code in meridian-web-sdk-assets (npm)
1 compromised version
- May 1, 2025
Malicious code in minicom-support-client (npm)
1 compromised version
- May 1, 2025
Malware in tree-sitter-hcl
1 compromised version
- May 1, 2025
Malware in tree-sitter-r
1 compromised version
- May 1, 2025
Malicious code in customprefix-auth (npm)
2 compromised versions
- May 1, 2025
Malicious code in rei-session (npm)
1 compromised version
- May 1, 2025
Malicious code in array-length-validator (npm)
9 compromised versions
- May 1, 2025
Malware in array-length-validator
1 compromised version
- May 1, 2025
Malicious code in mymte (npm)
- May 1, 2025
Malware in mymte
1 compromised version
- May 1, 2025
Malicious code in mymte2 (npm)
- May 1, 2025
Malicious code in expo-sessoion (npm)
- May 1, 2025
Malicious code in expi-session (npm)
10 compromised versions
- May 1, 2025
Malware in expo-sessoion
1 compromised version
- May 1, 2025
Malware in mymte2
1 compromised version
- May 1, 2025
Malware in expi-session
1 compromised version
- Apr 30, 2025
Malicious code in cxo-storyboard (npm)
11 compromised versions
- Apr 30, 2025
Malware in cxo-storyboard
1 compromised version
- Apr 30, 2025
Malware in @template-builder/iframe-api
1 compromised version
- Apr 30, 2025
Malicious code in express-validator-plugin (npm)
6 compromised versions
- Apr 30, 2025
Malware in express-validator-plugin
1 compromised version
- Apr 30, 2025
Malicious code in pie-docs (npm)
2 compromised versions
- Apr 30, 2025
Malicious code in managethis (npm)
1 compromised version
- Apr 30, 2025
Malware in managethis
1 compromised version
- Apr 30, 2025
Malicious code in unified-login-url (npm)
105 compromised versions
- Apr 30, 2025
Malicious code in ts-39-issue-ts-ignore-tsx (npm)
4 compromised versions
- Apr 30, 2025
Malware in unified-login-url
1 compromised version
- Apr 30, 2025
Malware in ts-39-issue-ts-ignore-tsx
1 compromised version
- Apr 30, 2025
Malicious code in easyship-components (npm)
55 compromised versions
- Apr 30, 2025
Malware in easyship-components
1 compromised version
- Apr 30, 2025
Malware in r5-wallet
1 compromised version
- Apr 30, 2025
Malicious code in passports-twitter (npm)
2 compromised versions
- Apr 30, 2025
Malware in passports-twitter
1 compromised version
- Apr 30, 2025
Malicious code in internal-payroll-lib-v3 (npm)
1 compromised version
- Apr 30, 2025
Malicious code in internal-payroll-lib-v2 (npm)
1 compromised version
- Apr 30, 2025
Malware in internal-payroll-lib-v3
1 compromised version
- Apr 30, 2025
Malware in internal-payroll-lib-v2
1 compromised version
- Apr 30, 2025
Malicious code in mcrodoasp.net (npm)
1 compromised version
- Apr 30, 2025
Malicious code in deals1flash (npm)
1 compromised version
- Apr 30, 2025
Malicious code in carcandofilex (npm)
1 compromised version
- Apr 30, 2025
Malicious code in basstiontrestbeesk (npm)
1 compromised version
- Apr 30, 2025
Malware in markdownalint-cli2
1 compromised version
- Apr 30, 2025
Malware in mcrodoasp.net
1 compromised version
Page 5896 of 6,634