Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,073 total in npm · sorted newest first- May 29, 2026
Malicious code in @t-in-one/add_application (npm)
- May 29, 2026
Malicious code in @t-in-one/add_app_middleware_token (npm)
- May 29, 2026
Malicious code in @sber-ecom-core/sberpay-widget (npm)
- May 29, 2026
Malicious code in @capibar.chat/ui-kit (npm)
- May 28, 2026
Malicious code in @qlab/ui (npm)
1 compromised version
- May 28, 2026
Malicious code in @neon-i18n/core-ui (npm)
1 compromised version
- May 28, 2026
Malicious code in hellowornd (npm)
3 compromised versions
- May 28, 2026
Malicious code in @service-user-notifications/set_refresh_interval (npm)
- May 28, 2026
Malicious code in @service-user-notifications/reset_notifications_not_removable (npm)
- May 28, 2026
Malicious code in @service-suppliers/set_suppliers_loading_stop (npm)
- May 28, 2026
Malicious code in @service-suppliers/set_suppliers_loading_start (npm)
- May 28, 2026
Malicious code in @service-suppliers/set_suppliers_data (npm)
- May 28, 2026
Malicious code in @service-suppliers/set_selected_supplier_action_saga (npm)
- May 28, 2026
Malicious code in @service-suppliers/set_initial_loaded (npm)
- May 28, 2026
Malicious code in @service-suppliers/set_country_list (npm)
- May 28, 2026
Malicious code in @service-suppliers/reset_country_list (npm)
- May 28, 2026
Malware in @service-suppliers/set_initial_loaded
1 compromised version
- May 28, 2026
Malware in @service-suppliers/set_country_list
1 compromised version
- May 28, 2026
Malware in @service-suppliers/set_selected_supplier_action_saga
1 compromised version
- May 28, 2026
Malware in @service-user-notifications/set_notifications_not_removable
1 compromised version
- May 28, 2026
Malware in @service-suppliers/set_suppliers_loading_stop
1 compromised version
- May 28, 2026
Malware in @service-suppliers/set_suppliers_data
1 compromised version
- May 28, 2026
Malware in @service-user-notifications/reset_notifications_not_removable
1 compromised version
- May 28, 2026
Malware in @service-user-notifications/set_refresh_interval
1 compromised version
- May 28, 2026
Malware in @service-suppliers/set_suppliers_loading_start
1 compromised version
- May 28, 2026
Malware in @service-suppliers/reset_country_list
1 compromised version
- May 28, 2026
Malicious code in @service-suppliers/fetch_suppliers_country_list_action_saga (npm)
- May 28, 2026
Malicious code in @service-suppliers/fetch_initial_suppliers_action_saga (npm)
- May 28, 2026
Malicious code in @service-suppliers/fetch-suppliers-watcher-saga (npm)
- May 28, 2026
Malicious code in @service-suppliers/fetch-initial-suppliers-watcher-saga (npm)
- May 28, 2026
Malicious code in @polka-ui/recoc (npm)
- May 28, 2026
Malicious code in @polka-ui/reco (npm)
- May 28, 2026
Malicious code in @polka-ui/loads (npm)
- May 28, 2026
Malicious code in @polka-ui/configuration (npm)
- May 28, 2026
Malicious code in @hcs-hybrid/uirouter-core (npm)
- May 28, 2026
Malicious code in @bcs-bank-complex-ui/deeplink (npm)
1 compromised version
- May 28, 2026
Malware in @service-suppliers/fetch_suppliers_country_list_action_saga
1 compromised version
- May 28, 2026
Malware in @service-suppliers/fetch_initial_suppliers_action_saga
1 compromised version
- May 28, 2026
Malware in @bcs-bank-complex-ui/deeplink
1 compromised version
- May 28, 2026
Malware in @service-suppliers/set_selected_supplier
1 compromised version
- May 28, 2026
Malware in @polka-ui/configuration
1 compromised version
- May 28, 2026
Malware in @service-suppliers/fetch-initial-suppliers-watcher-saga
1 compromised version
- May 28, 2026
Malware in @service-suppliers/suppliers
1 compromised version
- May 28, 2026
Malware in @polka-ui/reco
1 compromised version
- May 28, 2026
Malware in @polka-ui/recoc
1 compromised version
- May 28, 2026
Malware in @databus-service-ui/ui-event
1 compromised version
- May 28, 2026
Malware in @hcs-hybrid/uirouter-core
1 compromised version
- May 28, 2026
Malware in @polka-ui/loader
1 compromised version
- May 28, 2026
Malware in @loans/vehicles-api
1 compromised version
- May 28, 2026
Malware in @pulse-web-platform-core/scripts-loader
1 compromised version
Page 72 of 4,802