Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,070 total in npm · sorted newest first- May 29, 2026
Malware in @clearpool/streaming
1 compromised version
- May 29, 2026
Malware in @timelycare/api
1 compromised version
- May 29, 2026
Malware in @tallyui/storage-sqlite
1 compromised version
- May 29, 2026
Malware in @rsi-community/hub-client-app
1 compromised version
- May 29, 2026
Malware in @timelycare/core
1 compromised version
- May 29, 2026
Malicious code in foundry-config (npm)
- May 29, 2026
Malware in deepl-sync
1 compromised version
- May 29, 2026
Malware in dit-envv
1 compromised version
- May 29, 2026
Malware in foundry-config
1 compromised version
- May 29, 2026
Malicious code in codex-devcontainer-install (npm)
- May 29, 2026
Malicious code in @cplace-project-planning-fe/cf-project-planning (npm)
- May 29, 2026
Malware in @antv/x6-plugin-stencil
1 compromised version
- May 29, 2026
Malware in @antv/x6-common
1 compromised version
- May 29, 2026
Malware in @antv/x6-plugin-dnd
1 compromised version
- May 29, 2026
Malware in @antv/xflow
1 compromised version
- May 29, 2026
Malware in @antv/translator
1 compromised version
- May 29, 2026
Malware in @antv/util
1 compromised version
- May 29, 2026
Malware in codex-devcontainer-install
1 compromised version
- May 29, 2026
Malware in @clearpool/comms
1 compromised version
- May 29, 2026
Malware in dds-js-idl-types
1 compromised version
- May 29, 2026
Malware in @antv/torch
1 compromised version
- May 29, 2026
Malware in @antv/x6-plugin-history
1 compromised version
- May 29, 2026
Malware in @cplace-project-planning-fe/cf-project-planning
1 compromised version
- May 29, 2026
Malware in @antv/vis-predict-engine
1 compromised version
- May 29, 2026
Malicious code in ethers-hash (npm)
- May 29, 2026
Malware in ethers-hash
1 compromised version
- May 29, 2026
Malware in ast-plugin
1 compromised version
- May 29, 2026
Malware in ally-eagw-identity
1 compromised version
- May 29, 2026
Malware in axis-notification
1 compromised version
- May 29, 2026
Malware in ally-ccapi
1 compromised version
- May 29, 2026
Malicious code in @timelycare/common (npm)
- May 29, 2026
Malicious code in @lir-portal/web-components (npm)
- May 29, 2026
Malware in @lir-portal/web-components
1 compromised version
- May 29, 2026
Malware in @timelycare/common
1 compromised version
- May 29, 2026
Malware in @citi-icg-158830/elemental-ui-react
1 compromised version
- May 29, 2026
Malware in @breezeai-frontend/cargo-ui
1 compromised version
- May 29, 2026
Malware in @antv/g6-editor
1 compromised version
- May 29, 2026
Malware in @antv/gpt-vis
1 compromised version
- May 29, 2026
Malware in @clearpool/table
1 compromised version
- May 29, 2026
Malware in apexpro-node
1 compromised version
- May 29, 2026
Malware in ally-badges
1 compromised version
- May 29, 2026
Malware in @lint-md/cli
1 compromised version
- May 29, 2026
Malware in @breezeai-frontend/i18n-config
1 compromised version
- May 29, 2026
Malware in @antv/x6-plugin-transform
1 compromised version
- May 29, 2026
Malware in @antv/l7-leaflet
1 compromised version
- May 29, 2026
Malware in @antv/x6-react-components
1 compromised version
- May 29, 2026
Malware in @antv/s2
1 compromised version
- May 29, 2026
Malware in @antv/t8
1 compromised version
- May 29, 2026
Malware in @antv/wx-f2
1 compromised version
- May 29, 2026
Malware in @antv/g-mobile-canvas-element
1 compromised version
Page 70 of 4,802