Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,070 total in npm · sorted newest first- May 29, 2026
Malware in @cloudplatform-single-spa/datagrid
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/marketplace-gigachat
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/svp-baas
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/cloud-dns
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/monitoring
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/dataplatform-metastore
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/employees
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/dataplatform-trino
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/enterprise
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/ssh-keys
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/support
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/cnapp-ui
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/svp-interfaces
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/cp-api-gw
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/dataplatform
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/ml-ai-agents-agent
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/svp-s3-storage
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/base-static-page
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/logaas
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/arenadata-db
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/administration
1 compromised version
- May 29, 2026
Malware in @cloudplatform-single-spa/business-solutions
1 compromised version
- May 29, 2026
Malware in power-platform-playwright-toolkit
1 compromised version
- May 29, 2026
Malicious code in puppeteer (npm)
1 compromised version
- May 29, 2026
Withdrawn Advisory: Malware in puppeteer
1 compromised version
- May 29, 2026
Malicious code in midoss (npm)
- May 29, 2026
Malware in midoss
1 compromised version
- May 29, 2026
Malicious code in customerdigital-service-lib (npm)
- May 29, 2026
Malware in relationship.js
1 compromised version
- May 29, 2026
Malware in customerdigital-service-lib
1 compromised version
- May 29, 2026
Malicious code in hardhat-evmchain (npm)
- May 29, 2026
Malicious code in chai-bundle (npm)
1 compromised version
- May 29, 2026
Malware in chai-bundle
1 compromised version
- May 29, 2026
Malware in hardhat-evmchain
1 compromised version
- May 29, 2026
Malware in chai-as-tuned
1 compromised version
- May 29, 2026
Malicious code in appkit-react-utils (npm)
- May 29, 2026
Malware in @rsi-community/hub-schema
1 compromised version
- May 29, 2026
Malware in appkit-react-utils
1 compromised version
- May 29, 2026
Malware in apcyber-test-package
1 compromised version
- May 29, 2026
Malware in @breeze-ai/ui-library
1 compromised version
- May 29, 2026
Malware in @antv/x6-plugin-selection
1 compromised version
- May 29, 2026
Malware in @antv/x6-plugin-snapline
1 compromised version
- May 29, 2026
Malware in @antv/thumbnails-component
1 compromised version
- May 29, 2026
Malware in @antv/layout-gpu
1 compromised version
- May 29, 2026
Malware in @antv/l7-maps
1 compromised version
- May 29, 2026
Malware in @antv/graphin
1 compromised version
- May 29, 2026
Malware in @antv/g2-plugin-slider
1 compromised version
- May 29, 2026
Malware in @antv/f6
1 compromised version
- May 29, 2026
Malware in @antv/g-plugin-rough-canvas-renderer
1 compromised version
- May 29, 2026
Malware in @antv/coord
1 compromised version
Page 67 of 4,802