Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Jan 30, 2025
Malicious code in telegram-util (npm)
1 compromised version
- Jan 30, 2025
Malicious code in node-telegram-bot-sdk (npm)
1 compromised version
- Jan 30, 2025
Malicious code in grammyjs-utils (npm)
1 compromised version
- Jan 30, 2025
Malicious code in grammy-utils (npm)
4 compromised versions
- Jan 29, 2025
Malicious code in openbet-access-controller (npm)
1 compromised version
- Jan 29, 2025
Malicious code in requests-async (npm)
10 compromised versions
- Jan 29, 2025
Malicious code in @komoot/kvstore (npm)
1 compromised version
- Jan 29, 2025
Malicious code in org.cocoapods.csv (npm)
3 compromised versions
- Jan 29, 2025
Malicious code in sample_cluster (npm)
1 compromised version
- Jan 29, 2025
Malicious code in digitalexp-datasource-definitions (npm)
3 compromised versions
- Jan 28, 2025
Malicious code in digitalexp-components (npm)
13 compromised versions
- Jan 28, 2025
Malicious code in home-assignment (npm)
1 compromised version
- Jan 28, 2025
Malicious code in intel-enterprise-rag-ui (npm)
1 compromised version
- Jan 28, 2025
Malicious code in gatsby-theme-tinker-tailor (npm)
1 compromised version
- Jan 28, 2025
Malicious code in testbcms (npm)
1 compromised version
- Jan 28, 2025
Malicious code in kuvvet_poc (npm)
2 compromised versions
- Jan 28, 2025
Malicious code in theice (npm)
7 compromised versions
- Jan 28, 2025
Malicious code in sandstorm-widgets-nyse-website (npm)
3 compromised versions
- Jan 28, 2025
Malicious code in waltz-ng (npm)
3 compromised versions
- Jan 28, 2025
Malicious code in compound-protocol-alpha (npm)
- Jan 28, 2025
Malicious code in compound-protocol (npm)
- Jan 28, 2025
Malware in waltz-ng
1 compromised version
- Jan 28, 2025
Malware in compound-protocol
1 compromised version
- Jan 28, 2025
Malware in com.db.gtb.ppe.rtp-authjs
1 compromised version
- Jan 28, 2025
Malware in compound-protocol-alpha
1 compromised version
- Jan 28, 2025
Malware in venmo-ui
1 compromised version
- Jan 27, 2025
Malicious code in bindbc-loader (npm)
1 compromised version
- Jan 27, 2025
Malicious code in tomcrypt (npm)
1 compromised version
- Jan 27, 2025
Malicious code in dummy-loosesight-gc (npm)
1 compromised version
- Jan 27, 2025
Malicious code in @adsk-forks/jsonpath (npm)
1 compromised version
- Jan 26, 2025
Malicious code in monaco-npm (npm)
1 compromised version
- Jan 26, 2025
Malicious code in nord-security-task (npm)
1 compromised version
- Jan 26, 2025
Malicious code in swift-login-api (npm)
1 compromised version
- Jan 26, 2025
Malicious code in test-test-121333 (npm)
1 compromised version
- Jan 25, 2025
Malicious code in diffuse-the-rest (npm)
2 compromised versions
- Jan 25, 2025
Malicious code in pascoresend (npm)
4 compromised versions
- Jan 25, 2025
Malicious code in casier (npm)
3 compromised versions
- Jan 24, 2025
Malicious code in web3-parser (npm)
- Jan 24, 2025
Malware in web3-parser
1 compromised version
- Jan 24, 2025
Malicious code in upm-ci-utils (npm)
- Jan 24, 2025
Malware in upm-ci-utils
1 compromised version
- Jan 24, 2025
Malicious code in upm-npm (npm)
- Jan 24, 2025
Malicious code in com.unity.test.metadata-manager (npm)
- Jan 24, 2025
Malware in upm-npm
1 compromised version
- Jan 24, 2025
Malware in com.unity.test.metadata-manager
1 compromised version
- Jan 24, 2025
Malicious code in lexical-esm-nextjs (npm)
- Jan 24, 2025
Malware in lexical-esm-nextjs
1 compromised version
- Jan 24, 2025
Malware in mlb-site-core
1 compromised version
- Jan 24, 2025
Malicious code in ig-sonar-runner (npm)
- Jan 24, 2025
Malicious code in ig-release (npm)
Page 5998 of 6,647