Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Apr 29, 2025
Malicious code in jsonspecific (npm)
- Apr 29, 2025
Malicious code in jsonsecs (npm)
- Apr 29, 2025
Malicious code in jsonpacks (npm)
- Apr 29, 2025
Malicious code in chalk-config (npm)
- Apr 29, 2025
Malware in jsonsecs
1 compromised version
- Apr 29, 2025
Malware in chalk-config
1 compromised version
- Apr 29, 2025
Malware in jsonspecific
1 compromised version
- Apr 29, 2025
Malware in jsonpacks
1 compromised version
- Apr 29, 2025
Malicious code in webview-common (npm)
- Apr 29, 2025
Malware in webview-common
1 compromised version
- Apr 29, 2025
Malicious code in @reserach_org_jfhalsdhfkslsfds/openai-server-skfghdg (npm)
1 compromised version
- Apr 29, 2025
Malicious code in @reserach_org_jfhalsdhfkslsfds/openai-client-gadfjgfsf (npm)
4 compromised versions
- Apr 29, 2025
Malicious code in @reserach_org_jfhalsdhfkslsfds/metadata-collector (npm)
3 compromised versions
- Apr 29, 2025
Malware in @reserach_org_jfhalsdhfkslsfds/openai-server-skfghdg
1 compromised version
- Apr 29, 2025
Malware in @reserach_org_jfhalsdhfkslsfds/metadata-collector
1 compromised version
- Apr 29, 2025
Malware in @reserach_org_jfhalsdhfkslsfds/openai-client-gadfjgfsf
1 compromised version
- Apr 29, 2025
Malicious code in metadata-collector (npm)
- Apr 29, 2025
Malware in metadata-collector
1 compromised version
- Apr 28, 2025
Malicious code in husky-ts (npm)
23 compromised versions
- Apr 28, 2025
Malware in husky-ts
1 compromised version
- Apr 28, 2025
Malicious code in eslint-js (npm)
35 compromised versions
- Apr 28, 2025
Malware in eslint-js
1 compromised version
- Apr 28, 2025
Malicious code in node-hashing (npm)
- Apr 28, 2025
Malware in node-hashing
1 compromised version
- Apr 28, 2025
Malicious code in auth-help3r (npm)
- Apr 28, 2025
Malware in auth-help3r
1 compromised version
- Apr 28, 2025
Malicious code in turbo-bike-inspector (npm)
- Apr 28, 2025
Malware in turbo-bike-inspector
1 compromised version
- Apr 28, 2025
Malicious code in fc-online (npm)
- Apr 28, 2025
Malware in fc-online
1 compromised version
- Apr 28, 2025
Malicious code in jd-npm-com-test (npm)
1 compromised version
- Apr 28, 2025
Malware in jd-npm-com-test
1 compromised version
- Apr 28, 2025
Malicious code in needlecast_mvd_ads_site_client (npm)
- Apr 28, 2025
Malicious code in needlecast_b9s_jewel_fyc_fe_client (npm)
- Apr 28, 2025
Malware in needlecast_mvd_ads_site_client
1 compromised version
- Apr 28, 2025
Malware in needlecast_b9s_jewel_fyc_fe_client
1 compromised version
- Apr 28, 2025
Malicious code in jcp-benchmarking (npm)
1 compromised version
- Apr 28, 2025
Malicious code in harman-experience (npm)
1 compromised version
- Apr 28, 2025
Malicious code in green-giant (npm)
1 compromised version
- Apr 28, 2025
Malicious code in gcp-alert-service (npm)
1 compromised version
- Apr 28, 2025
Malicious code in cerberus-management-dashboard (npm)
1 compromised version
- Apr 28, 2025
Malware in green-giant
1 compromised version
- Apr 28, 2025
Malware in cerberus-management-dashboard
1 compromised version
- Apr 28, 2025
Malware in vault-action
1 compromised version
- Apr 28, 2025
Malware in cb-cookie-manager
1 compromised version
- Apr 28, 2025
Malware in gcp-alert-service
1 compromised version
- Apr 28, 2025
Malware in jcp-benchmarking
1 compromised version
- Apr 28, 2025
Malware in studocu-extension-pack
1 compromised version
- Apr 28, 2025
Malware in harman-experience
1 compromised version
- Apr 28, 2025
Malicious code in vonage-status-panel (npm)
3 compromised versions
Page 5898 of 6,634