Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Mar 28, 2025
Malicious code in @uniqa/health-claim-ms-api (npm)
1 compromised version
- Mar 28, 2025
Malicious code in @uniqa/document-ms-api (npm)
1 compromised version
- Mar 28, 2025
Malicious code in @uniqa/digital-inventory-ms-spec-api (npm)
1 compromised version
- Mar 28, 2025
Malicious code in @uniqa/device-mgmt-ms-api (npm)
1 compromised version
- Mar 28, 2025
Malicious code in @uniqa/customer-masterdata-ms (npm)
1 compromised version
- Mar 28, 2025
Malicious code in @uniqa/customer-loyalty-ms-api (npm)
1 compromised version
- Mar 28, 2025
Malicious code in @uniqa/contract-ms-spec-api (npm)
1 compromised version
- Mar 28, 2025
Malicious code in @uniqa/contract-answers-ms-api (npm)
1 compromised version
- Mar 28, 2025
Malicious code in @uniqa/claims-ms-api (npm)
1 compromised version
- Mar 28, 2025
Malicious code in @uniqa-extern/capacitor-plugin-unblu (npm)
1 compromised version
- Mar 28, 2025
Malicious code in @uniqa-extern/capacitor-plugin-kofax (npm)
1 compromised version
- Mar 28, 2025
Malicious code in @instant-messengers/vk-teams-bridge (npm)
1 compromised version
- Mar 28, 2025
Malicious code in @domons/test123 (npm)
1 compromised version
- Mar 28, 2025
Malicious code in ilovingcats (npm)
- Mar 28, 2025
Malware in ilovingcats
1 compromised version
- Mar 28, 2025
Malicious code in transactions-generator (npm)
- Mar 28, 2025
Malicious code in coin-address-validation (npm)
- Mar 28, 2025
Malware in coin-address-validation
1 compromised version
- Mar 28, 2025
Malware in transactions-generator
1 compromised version
- Mar 28, 2025
Malicious code in safe-package-winrar (npm)
- Mar 28, 2025
Malware in safe-package-winrar
1 compromised version
- Mar 28, 2025
Malicious code in react-html2pdf.js (npm)
- Mar 28, 2025
Malware in react-html2pdf.js
1 compromised version
- Mar 28, 2025
Malicious code in shipmenttrackingserv-paypal (npm)
1 compromised version
- Mar 28, 2025
Malicious code in shipmentdetails-paypal (npm)
1 compromised version
- Mar 28, 2025
Malicious code in riskchallengeserv-paypal (npm)
1 compromised version
- Mar 28, 2025
Malicious code in pplinkpath (npm)
1 compromised version
- Mar 28, 2025
Malicious code in postp2ptxnserv (npm)
1 compromised version
- Mar 28, 2025
Malicious code in invoicetax-paypal (npm)
1 compromised version
- Mar 28, 2025
Malicious code in identitydocumentserv-multipart-paypal (npm)
1 compromised version
- Mar 28, 2025
Malicious code in contactbookmgmtserv (npm)
1 compromised version
- Mar 28, 2025
Malware in militaty-geza-blessed2025hondo
1 compromised version
- Mar 28, 2025
Malware in contactbookmgmtserv
1 compromised version
- Mar 28, 2025
Malware in postp2ptxnserv
1 compromised version
- Mar 28, 2025
Malware in shipmentdetails-paypal
1 compromised version
- Mar 28, 2025
Malware in mocha-dast-reporter
1 compromised version
- Mar 28, 2025
Malware in pplinkpath
1 compromised version
- Mar 28, 2025
Malware in riskchallengeserv-paypal
1 compromised version
- Mar 28, 2025
Malware in ppcardmanagementv2serv
1 compromised version
- Mar 28, 2025
Malware in shipmenttrackingserv-paypal
1 compromised version
- Mar 28, 2025
Malware in identitydocumentserv-multipart-paypal
1 compromised version
- Mar 28, 2025
Malware in invoicetax-paypal
1 compromised version
- Mar 28, 2025
Malicious code in mafid-prod-fe (npm)
1 compromised version
- Mar 28, 2025
Malware in mafid-prod-fe
1 compromised version
- Mar 28, 2025
Malicious code in mc5-adidas (npm)
1 compromised version
- Mar 28, 2025
Malware in mc5-adidas
1 compromised version
- Mar 28, 2025
Malware in eclipse-tractusx-github-io
1 compromised version
- Mar 28, 2025
Malicious code in icloud-cod (npm)
- Mar 28, 2025
Malware in icloud-cod
1 compromised version
- Mar 28, 2025
Malicious code in resolver-options (npm)
Page 5916 of 6,634