Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
331,688 total in npm · sorted newest first- Mar 14, 2025
Malicious code in airbnb-bootstrap-data (npm)
- Mar 14, 2025
Malware in data-ui-v
1 compromised version
- Mar 14, 2025
Malware in eslint-config-dx
1 compromised version
- Mar 14, 2025
Malware in paypal-logger
1 compromised version
- Mar 14, 2025
Malware in hellojpd
1 compromised version
- Mar 14, 2025
Malware in tfjs-layers
1 compromised version
- Mar 14, 2025
Malware in gl-emoji-version
1 compromised version
- Mar 14, 2025
Malware in process-tick
1 compromised version
- Mar 14, 2025
Malware in tsl-select-trigger
1 compromised version
- Mar 14, 2025
Malware in tsl-card-body
1 compromised version
- Mar 14, 2025
Malware in tfjs-data
1 compromised version
- Mar 14, 2025
Malware in airbnb-bootstrap-data
1 compromised version
- Mar 14, 2025
Malware in tfjs-core
1 compromised version
- Mar 14, 2025
Malware in nyc-config
1 compromised version
- Mar 14, 2025
Malware in oauth2-paypal
1 compromised version
- Mar 14, 2025
Malware in user-paypal
1 compromised version
- Mar 14, 2025
Malware in airbnb-jitney-schemas
1 compromised version
- Mar 14, 2025
Malware in fnd-validation
1 compromised version
- Mar 14, 2025
Malicious code in zero-timeout-message (npm)
1 compromised version
- Mar 14, 2025
Malicious code in projects_workspace_events (npm)
- Mar 14, 2025
Malicious code in productprovisionserv (npm)
1 compromised version
- Mar 14, 2025
Malware in zero-timeout-message
1 compromised version
- Mar 14, 2025
Malware in projects_workspace_events
1 compromised version
- Mar 14, 2025
Malware in productprovisionserv
1 compromised version
- Mar 14, 2025
Malicious code in epic-debug (npm)
- Mar 14, 2025
Malware in epic-debug
1 compromised version
- Mar 14, 2025
Malicious code in topper-docs (npm)
1 compromised version
- Mar 14, 2025
Malicious code in redux-debounce-example (npm)
1 compromised version
- Mar 14, 2025
Malicious code in razorpaysalesdemo (npm)
1 compromised version
- Mar 14, 2025
Malware in secureshield4
1 compromised version
- Mar 14, 2025
Malware in redux-debounce-example
1 compromised version
- Mar 14, 2025
Malware in topper-docs
1 compromised version
- Mar 14, 2025
Malware in razorpaysalesdemo
1 compromised version
- Mar 14, 2025
Malicious code in smart-power-strip (npm)
2 compromised versions
- Mar 14, 2025
Malicious code in reason-calculator (npm)
1 compromised version
- Mar 14, 2025
Malicious code in new-nav-docusaurus-2-2 (npm)
1 compromised version
- Mar 14, 2025
Malicious code in elementor-editor-github-actions (npm)
1 compromised version
- Mar 14, 2025
Malicious code in apache-superset-docs (npm)
1 compromised version
- Mar 14, 2025
Malware in reason-calculator
1 compromised version
- Mar 14, 2025
Malware in new-nav-docusaurus-2-2
1 compromised version
- Mar 14, 2025
Malware in apache-superset-docs
1 compromised version
- Mar 14, 2025
Malware in elementor-editor-github-actions
1 compromised version
- Mar 14, 2025
Malware in smart-power-strip
1 compromised version
- Mar 14, 2025
Malware in @c11-lib-ts/document-handler
1 compromised version
- Mar 14, 2025
Malicious code in remix-run-route (npm)
- Mar 14, 2025
Malware in remix-run-route
1 compromised version
- Mar 14, 2025
Malicious code in request-draft-ui (npm)
2 compromised versions
- Mar 14, 2025
Malicious code in digits-electron-src (npm)
3 compromised versions
- Mar 14, 2025
Malicious code in digits-common (npm)
3 compromised versions
- Mar 14, 2025
Malware in digits-electron-src
1 compromised version
Page 5932 of 6,634