Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,073 total in npm · sorted newest first- May 25, 2026
Malware in fivem-monitor
1 compromised version
- May 25, 2026
Malicious code in internallib_v95 (npm)
- May 25, 2026
Malware in internallib_v95
1 compromised version
- May 25, 2026
Malicious code in auth0-sample-dus-utils (npm)
- May 25, 2026
Malicious code in auth0-net-sdk-utils (npm)
- May 25, 2026
Malicious code in auth0-internal-collector (npm)
- May 25, 2026
Malicious code in auth0-common-telemetry (npm)
- May 25, 2026
Malicious code in auth0-aspnetcore-utils (npm)
- May 25, 2026
Malicious code in auth0-android-helper-utils (npm)
- May 25, 2026
Malware in auth0-net-sdk-utils
1 compromised version
- May 25, 2026
Malware in webservices.rest-utils
1 compromised version
- May 25, 2026
Malware in auth0-common-telemetry
1 compromised version
- May 25, 2026
Malware in auth0-internal-collector
1 compromised version
- May 25, 2026
Malware in auth0-android-helper-utils
1 compromised version
- May 25, 2026
Malware in auth0-sample-dus-utils
1 compromised version
- May 25, 2026
Malware in auth0-aspnetcore-utils
1 compromised version
- May 25, 2026
Malware in webservices.rest
1 compromised version
- May 25, 2026
Malicious code in chai-as-redeploy (npm)
3 compromised versions
- May 25, 2026
Malware in chai-as-redeploy
1 compromised version
- May 25, 2026
Malicious code in vite-plugin-env-compat-plus (npm)
1 compromised version
- May 25, 2026
Malicious code in vite-plugin-env-compat-1.5 (npm)
- May 25, 2026
Malicious code in expo-config-plugin-typescript (npm)
- May 25, 2026
Malware in expo-config-plugin-typescript
1 compromised version
- May 25, 2026
Malware in vite-plugin-env-compat-1.5
1 compromised version
- May 25, 2026
Malware in vite-plugin-env-compat-plus
1 compromised version
- May 25, 2026
Malicious code in unique-string-64 (npm)
- May 25, 2026
Malware in unique-string-64
1 compromised version
- May 25, 2026
Malicious code in motion-ui-tool (npm)
- May 25, 2026
Malware in motion-ui-tool
1 compromised version
- May 25, 2026
Malicious code in explorhub-sdk (npm)
- May 25, 2026
Malicious code in explorhub-mcp-server (npm)
- May 25, 2026
Malicious code in explorhub-claude-bridge (npm)
- May 25, 2026
Malicious code in explorhub-ai-agent (npm)
- May 25, 2026
Malicious code in eh-bridge-utils (npm)
- May 25, 2026
Malware in eh-bridge-utils
1 compromised version
- May 25, 2026
Malware in explorhub-claude-bridge
1 compromised version
- May 25, 2026
Malware in explorhub-sdk
1 compromised version
- May 25, 2026
Malware in explorhub-ai-agent
1 compromised version
- May 25, 2026
Malware in explorhub-mcp-server
1 compromised version
- May 25, 2026
Malicious code in core-utility-tools (npm)
- May 25, 2026
Malicious code in apple-app-store-server-library-v3 (npm)
- May 25, 2026
Malware in apple-appstore-full-library-utility
1 compromised version
- May 25, 2026
Malware in apple-app-store-server-library-v3
1 compromised version
- May 25, 2026
Malware in core-utility-tools
1 compromised version
- May 25, 2026
Malware in apple-internal-security-audit-v99
1 compromised version
- May 25, 2026
Malware in ac-sasskit-beta
1 compromised version
- May 25, 2026
Malicious code in flownodelp5 (npm)
- May 25, 2026
Malware in flownodelp5
1 compromised version
- May 25, 2026
Malicious code in wnba-parent (npm)
1 compromised version
- May 25, 2026
Malicious code in nba-cdn-plugin (npm)
1 compromised version
Page 80 of 4,802