Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,330 total in npm · sorted newest first- Mar 3, 2025
Malicious code in @smt-front/inner-landing (npm)
1 compromised version
- Mar 3, 2025
Malicious code in @smt-front/common (npm)
1 compromised version
- Mar 3, 2025
Malicious code in @optimystic99/dev-utils (npm)
4 compromised versions
- Mar 3, 2025
Malicious code in @mp-food/restaurant-orders (npm)
1 compromised version
- Mar 3, 2025
Malicious code in @mp-food/knapsack (npm)
1 compromised version
- Mar 3, 2025
Malicious code in @monkey-tilt/client (npm)
3 compromised versions
- Mar 3, 2025
Malicious code in @kone-ds/webcomponents-react (npm)
1 compromised version
- Mar 3, 2025
Malicious code in @kone-ds/tokens (npm)
1 compromised version
- Mar 3, 2025
Malicious code in @kamotive/api-file-upload (npm)
4 compromised versions
- Mar 3, 2025
Malicious code in @darkice/bitcoinjs-message (npm)
2 compromised versions
- Mar 3, 2025
Malicious code in @aoflmkt/is-webp-qualified (npm)
1 compromised version
- Mar 3, 2025
Malicious code in @aoflmkt/is-mobile (npm)
1 compromised version
- Mar 3, 2025
Malicious code in @aoflmkt/form-validators (npm)
1 compromised version
- Mar 3, 2025
Malicious code in @ag2rlamondiale/ag2rlm-lib (npm)
1 compromised version
- Mar 3, 2025
Malicious code in eslint7_0 (npm)
1 compromised version
- Mar 3, 2025
Malicious code in ownyourcode (npm)
6 compromised versions
- Mar 3, 2025
Malicious code in fullscreenify (npm)
1 compromised version
- Mar 3, 2025
Malicious code in @sonahri51/orientation-change-end (npm)
2 compromised versions
- Mar 3, 2025
Malicious code in pages14.0.0_i18n (npm)
1 compromised version
- Mar 3, 2025
Malicious code in zohodeskportalsdksampleappsreactnative (npm)
10 compromised versions
- Mar 3, 2025
Malicious code in azure-boards-estimate (npm)
1 compromised version
- Mar 3, 2025
Malicious code in grafana-metricsdrilldown-app (npm)
1 compromised version
- Mar 3, 2025
Malicious code in dep-poc (npm)
3 compromised versions
- Mar 3, 2025
Malicious code in dependencies-poc (npm)
2 compromised versions
- Mar 3, 2025
Malicious code in mkdocs-material (npm)
1 compromised version
- Mar 3, 2025
Malicious code in formio-tenant (npm)
13 compromised versions
- Mar 3, 2025
Malware in formio-tenant
1 compromised version
- Mar 3, 2025
Malicious code in @tim0310/fetch (npm)
- Mar 3, 2025
Malware in @tim0310/fetch
1 compromised version
- Mar 3, 2025
Malicious code in asdasd-ejansan-nsjansna (npm)
5 compromised versions
- Mar 3, 2025
Malware in asdasd-ejansan-nsjansna
1 compromised version
- Mar 3, 2025
Malware in hcpss
1 compromised version
- Mar 3, 2025
Malicious code in @sie-ppr-web-store/app (npm)
1 compromised version
- Mar 3, 2025
Malicious code in @f2p-mml-frontends/mml-components (npm)
- Mar 3, 2025
Malicious code in @ethena/shared-ui (npm)
- Mar 3, 2025
Malicious code in @f2p-mml-frontends/mml-styles (npm)
1 compromised version
- Mar 3, 2025
Malicious code in @events-ui-toolkit/event-analytics-fetcher (npm)
1 compromised version
- Mar 3, 2025
Malware in @events-ui-toolkit/event-analytics-fetcher
1 compromised version
- Mar 3, 2025
Malware in @starkgate-v2/web
1 compromised version
- Mar 3, 2025
Malware in @sie-ppr-web-store/app
1 compromised version
- Mar 3, 2025
Malware in @xenial-ux/services
1 compromised version
- Mar 3, 2025
Malware in @f2p-mml-frontends/mml-styles
1 compromised version
- Mar 3, 2025
Malware in @ethena/shared-ui
1 compromised version
- Mar 3, 2025
Malware in @f2p-mml-frontends/mml-components
1 compromised version
- Mar 3, 2025
Malicious code in wefweg32 (npm)
- Mar 3, 2025
Malicious code in mercury-web (npm)
- Mar 3, 2025
Malicious code in @dealfront/df-dictionaries (npm)
- Mar 3, 2025
Malware in wefweg32
1 compromised version
- Mar 3, 2025
Malware in @dealfront/df-dictionaries
1 compromised version
- Mar 3, 2025
Malware in mercury-web
1 compromised version
Page 5964 of 6,647