Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,070 total in npm · sorted newest first- Jun 8, 2026
Malware in classwind-utils
1 compromised version
- Jun 8, 2026
Malicious code in regexp-ts (npm)
1 compromised version
- Jun 8, 2026
Malicious code in nodemon-lint (npm)
1 compromised version
- Jun 8, 2026
Malware in nodemon-lint
1 compromised version
- Jun 8, 2026
Malware in regexp-ts
1 compromised version
- Jun 8, 2026
Malicious code in nodemon-copack (npm)
2 compromised versions
- Jun 8, 2026
Malicious code in chai-mocks (npm)
1 compromised version
- Jun 8, 2026
Malware in nodemon-copack
1 compromised version
- Jun 8, 2026
Malware in chai-mocks
1 compromised version
- Jun 8, 2026
Malicious code in zer0one-dnslog (npm)
10 compromised versions
- Jun 7, 2026
Malicious code in consumerweb-authflow (npm)
2 compromised versions
- Jun 7, 2026
Malicious code in sequoia-engineering (npm)
1 compromised version
- Jun 7, 2026
Malicious code in @solana-labs/web3-js (npm)
7 compromised versions
- Jun 7, 2026
Malicious code in @solana-labs/etherjs (npm)
8 compromised versions
- Jun 6, 2026
Malicious code in unifi-portal (npm)
3 compromised versions
- Jun 6, 2026
Malicious code in uisp-connector (npm)
3 compromised versions
- Jun 6, 2026
Malicious code in encrypted-archive (npm)
2 compromised versions
- Jun 6, 2026
Malicious code in uhd-setup (npm)
2 compromised versions
- Jun 5, 2026
Malicious code in reactvora (npm)
- Jun 5, 2026
Malware in reactvora
1 compromised version
- Jun 5, 2026
Malicious code in glyphr (npm)
- Jun 5, 2026
Malware in glyphr
1 compromised version
- Jun 5, 2026
Malware in react-ui-polyfills
1 compromised version
- Jun 5, 2026
Malware in utils-mf
1 compromised version
- Jun 5, 2026
Malicious code in ulid-os (npm)
1 compromised version
- Jun 5, 2026
Malware in ulid-os
1 compromised version
- Jun 5, 2026
Malicious code in wrangler-deploy (npm)
1 compromised version
- Jun 5, 2026
Malicious code in node-env-resolver-vite (npm)
1 compromised version
- Jun 5, 2026
Malicious code in node-env-resolver-nextjs (npm)
1 compromised version
- Jun 5, 2026
Malicious code in node-env-resolver-dotenvx (npm)
2 compromised versions
- Jun 5, 2026
Malicious code in node-env-resolver-aws (npm)
4 compromised versions
- Jun 5, 2026
Malicious code in node-env-resolver (npm)
1 compromised version
- Jun 5, 2026
Malicious code in mountly-tailwind (npm)
1 compromised version
- Jun 5, 2026
Malicious code in mountly (npm)
1 compromised version
- Jun 5, 2026
Malicious code in github-archiver (npm)
26 compromised versions
- Jun 5, 2026
Malicious code in executable-stories-vitest (npm)
7 compromised versions
- Jun 5, 2026
Malicious code in executable-stories-react (npm)
1 compromised version
- Jun 5, 2026
Malicious code in executable-stories-playwright (npm)
6 compromised versions
- Jun 5, 2026
Malicious code in executable-stories-mcp (npm)
1 compromised version
- Jun 5, 2026
Malicious code in executable-stories-jest (npm)
6 compromised versions
- Jun 5, 2026
Malicious code in executable-stories-init (npm)
1 compromised version
- Jun 5, 2026
Malicious code in executable-stories-formatters (npm)
1 compromised version
- Jun 5, 2026
Malicious code in executable-stories-demo (npm)
1 compromised version
- Jun 5, 2026
Malicious code in executable-stories-cypress (npm)
6 compromised versions
- Jun 5, 2026
Malicious code in eslint-plugin-executable-stories-vitest (npm)
2 compromised versions
- Jun 5, 2026
Malicious code in eslint-plugin-executable-stories-playwright (npm)
2 compromised versions
- Jun 5, 2026
Malicious code in eslint-plugin-executable-stories-jest (npm)
2 compromised versions
- Jun 5, 2026
Malicious code in eslint-plugin-awaitly (npm)
2 compromised versions
- Jun 5, 2026
Malicious code in effect-analyzer (npm)
1 compromised version
- Jun 5, 2026
Malicious code in discord-search (npm)
2 compromised versions
Page 62 of 4,802