Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Jan 31, 2025
Malicious code in @wongapl/sliders (npm)
1 compromised version
- Jan 31, 2025
Malicious code in @wongapl/offer-ui-tools (npm)
1 compromised version
- Jan 31, 2025
Malicious code in @wongapl/offer-selector (npm)
1 compromised version
- Jan 31, 2025
Malicious code in @wongapl/offer-digest (npm)
1 compromised version
- Jan 31, 2025
Malicious code in @wongapl/offer-box (npm)
1 compromised version
- Jan 31, 2025
Malicious code in wallet-adapter-demo (npm)
1 compromised version
- Jan 31, 2025
Malicious code in vite-paypal (npm)
4 compromised versions
- Jan 31, 2025
Malicious code in updatelanguagefiles (npm)
1 compromised version
- Jan 31, 2025
Malicious code in smartling-openapi-spec (npm)
1 compromised version
- Jan 31, 2025
Malicious code in qiot (npm)
1 compromised version
- Jan 31, 2025
Malicious code in overture2osmjs (npm)
8 compromised versions
- Jan 31, 2025
Malicious code in npm-website-example (npm)
1 compromised version
- Jan 31, 2025
Malicious code in nlohmann-json (npm)
5 compromised versions
- Jan 31, 2025
Malicious code in mpl-token-metadata (npm)
1 compromised version
- Jan 31, 2025
Malicious code in magic-enum (npm)
8 compromised versions
- Jan 31, 2025
Malicious code in k6-learn (npm)
2 compromised versions
- Jan 31, 2025
Malicious code in flux-example-chat (npm)
1 compromised version
- Jan 31, 2025
Malicious code in delete-deployments (npm)
1 compromised version
- Jan 31, 2025
Malicious code in css-blocks-monorepo (npm)
1 compromised version
- Jan 31, 2025
Malicious code in compiler-version (npm)
1 compromised version
- Jan 31, 2025
Malicious code in com.unity.ai.navigation (npm)
6 compromised versions
- Jan 31, 2025
Malicious code in checkmkwebapiclient (npm)
2 compromised versions
- Jan 31, 2025
Malicious code in browser-nextjs (npm)
2 compromised versions
- Jan 31, 2025
Malicious code in momnet (npm)
- Jan 31, 2025
Malware in momnet
1 compromised version
- Jan 30, 2025
Malicious code in node-telegram-sdk (npm)
1 compromised version
- Jan 30, 2025
Malicious code in whaletail (npm)
1 compromised version
- Jan 30, 2025
Malicious code in web-actions-v4 (npm)
1 compromised version
- Jan 30, 2025
Malicious code in waseem987 (npm)
1 compromised version
- Jan 30, 2025
Malicious code in waseem (npm)
3 compromised versions
- Jan 30, 2025
Malicious code in vscode-bazel-bsp (npm)
2 compromised versions
- Jan 30, 2025
Malicious code in types-safety-web (npm)
5 compromised versions
- Jan 30, 2025
Malicious code in trigger-gitlab-pipeline (npm)
1 compromised version
- Jan 30, 2025
Malicious code in transaction-report (npm)
1 compromised version
- Jan 30, 2025
Malicious code in tokenization-lab (npm)
1 compromised version
- Jan 30, 2025
Malicious code in theme-tools (npm)
1 compromised version
- Jan 30, 2025
Malicious code in theme-check-vscode (npm)
1 compromised version
- Jan 30, 2025
Malicious code in teswewewewted (npm)
1 compromised version
- Jan 30, 2025
Malicious code in test_package_file (npm)
2 compromised versions
- Jan 30, 2025
Malicious code in talk-desktop (npm)
1 compromised version
- Jan 30, 2025
Malicious code in solhint-plugin-algebra (npm)
4 compromised versions
- Jan 30, 2025
Malicious code in sippo-vroidsdk-test2 (npm)
1 compromised version
- Jan 30, 2025
Malicious code in ruby-typeprof (npm)
1 compromised version
- Jan 30, 2025
Malicious code in rif-wallet (npm)
1 compromised version
- Jan 30, 2025
Malicious code in resources.data.gov (npm)
1 compromised version
- Jan 30, 2025
Malicious code in realtime-from-scratch (npm)
1 compromised version
- Jan 30, 2025
Malicious code in pegin-address-verificator (npm)
4 compromised versions
- Jan 30, 2025
Malicious code in package-maintenance (npm)
1 compromised version
- Jan 30, 2025
Malicious code in otelcollector (npm)
1 compromised version
- Jan 30, 2025
Malicious code in old-celo-base (npm)
1 compromised version
Page 5996 of 6,647