Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Feb 3, 2025
Malicious code in reducal (npm)
1 compromised version
- Feb 3, 2025
Malicious code in precompiled-iris300 (npm)
2 compromised versions
- Feb 3, 2025
Malicious code in pegin-cap-evaluator (npm)
3 compromised versions
- Feb 3, 2025
Malicious code in nuxtjs_style_resources (npm)
1 compromised version
- Feb 3, 2025
Malicious code in new-items-card-component (npm)
1 compromised version
- Feb 3, 2025
Malicious code in moonpay-widget (npm)
1 compromised version
- Feb 3, 2025
Malicious code in meeting-card-component (npm)
1 compromised version
- Feb 3, 2025
Malicious code in markdownalint-cli2 (npm)
1 compromised version
- Feb 3, 2025
Malicious code in invalid-dependency (npm)
1 compromised version
- Feb 3, 2025
Malicious code in insights-card-component (npm)
1 compromised version
- Feb 3, 2025
Malicious code in hosted-wallet-page (npm)
2 compromised versions
- Feb 3, 2025
Malicious code in fitbit-widget-dropdown (npm)
2 compromised versions
- Feb 3, 2025
Malicious code in example-advanced (npm)
1 compromised version
- Feb 3, 2025
Malicious code in effect-layout-function (npm)
1 compromised version
- Feb 3, 2025
Malicious code in drift-v1-cli (npm)
1 compromised version
- Feb 3, 2025
Malicious code in digitalexp-microfrontends-framework (npm)
1 compromised version
- Feb 3, 2025
Malicious code in cxf-plugins (npm)
1 compromised version
- Feb 3, 2025
Malicious code in cth-poc (npm)
12 compromised versions
- Feb 3, 2025
Malicious code in continue-docs (npm)
1 compromised version
- Feb 3, 2025
Malicious code in chakll (npm)
1 compromised version
- Feb 3, 2025
Malicious code in calendar-card-component (npm)
1 compromised version
- Feb 3, 2025
Malicious code in bastion-internship-dependency-confusion-poc (npm)
1 compromised version
- Feb 3, 2025
Malicious code in babel-plugin-remove-jsx-empty-expression (npm)
1 compromised version
- Feb 3, 2025
Malicious code in appqos-client (npm)
1 compromised version
- Feb 3, 2025
Malicious code in ad-language-monitor (npm)
2 compromised versions
- Feb 3, 2025
Malicious code in @patheon-systems/workspace-configs (npm)
3 compromised versions
- Feb 3, 2025
Malicious code in @justworkshr/alma (npm)
2 compromised versions
- Feb 3, 2025
Malicious code in @devstack-angular/jdai (npm)
1 compromised version
- Feb 3, 2025
Malicious code in user-switching (npm)
1 compromised version
- Feb 3, 2025
Malicious code in typespublishercontenthash (npm)
1 compromised version
- Feb 3, 2025
Malicious code in twilio.github.io (npm)
2 compromised versions
- Feb 3, 2025
Malicious code in spicy-sections (npm)
1 compromised version
- Feb 3, 2025
Malicious code in shader-examples (npm)
1 compromised version
- Feb 3, 2025
Malicious code in sahasuhdjdhajdhja (npm)
1 compromised version
- Feb 3, 2025
Malicious code in roro3 (npm)
1 compromised version
- Feb 3, 2025
Malicious code in roro2 (npm)
1 compromised version
- Feb 3, 2025
Malicious code in roro1 (npm)
1 compromised version
- Feb 3, 2025
Malicious code in pages-proxy (npm)
1 compromised version
- Feb 3, 2025
Malicious code in minikit-monorepo (npm)
2 compromised versions
- Feb 3, 2025
Malicious code in llvm-vs-code-extensions.vscode-clangd (npm)
1 compromised version
- Feb 3, 2025
Malicious code in lib-automotive-call-cdm (npm)
1 compromised version
- Feb 3, 2025
Malicious code in k6-docs (npm)
1 compromised version
- Feb 3, 2025
Malicious code in ibm.github.io (npm)
1 compromised version
- Feb 3, 2025
Malicious code in html-webpack-plugin-v5 (npm)
2 compromised versions
- Feb 3, 2025
Malicious code in html-webpack-plugin-v4 (npm)
3 compromised versions
- Feb 3, 2025
Malicious code in guests (npm)
1 compromised version
- Feb 3, 2025
Malicious code in files_texteditor (npm)
1 compromised version
- Feb 3, 2025
Malicious code in external-adapters-js (npm)
1 compromised version
- Feb 3, 2025
Malicious code in com.siccity.gltfutility (npm)
1 compromised version
- Feb 3, 2025
Malicious code in codat (npm)
1 compromised version
Page 5984 of 6,647