Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,073 total in npm · sorted newest first- May 25, 2026
Malicious code in nba-blocker-plugin (npm)
1 compromised version
- May 25, 2026
Malicious code in mobile-international (npm)
1 compromised version
- May 25, 2026
Malware in wnba-parent
1 compromised version
- May 25, 2026
Malware in mobile-international
1 compromised version
- May 25, 2026
Malware in nba-blocker-plugin
1 compromised version
- May 25, 2026
Malware in nba-cdn-plugin
1 compromised version
- May 25, 2026
Malicious code in wm-plugin-native-functions-restorer (npm)
2 compromised versions
- May 25, 2026
Malicious code in wm-plugin-json-conditions (npm)
2 compromised versions
- May 25, 2026
Malicious code in wm-plugin-create-iframe-capturing (npm)
2 compromised versions
- May 25, 2026
Malware in wm-plugin-json-conditions
1 compromised version
- May 25, 2026
Malware in wm-plugin-native-functions-restorer
1 compromised version
- May 25, 2026
Malware in wm-plugin-create-iframe-capturing
1 compromised version
- May 25, 2026
Malicious code in wm-w5g-preview (npm)
4 compromised versions
- May 25, 2026
Malicious code in wm-plugin-set-walkme-language (npm)
2 compromised versions
- May 25, 2026
Malicious code in wm-plugin-open-teach-me-after-deployable-played (npm)
2 compromised versions
- May 25, 2026
Malware in wm-plugin-teach-me-widget
1 compromised version
- May 25, 2026
Malware in wm-plugin-set-walkme-language
1 compromised version
- May 25, 2026
Malware in wm-w5g-preview
1 compromised version
- May 25, 2026
Malware in wm-plugin-open-teach-me-after-deployable-played
1 compromised version
- May 25, 2026
Malicious code in @agora-sdk/react-js (npm)
2 compromised versions
- May 25, 2026
Malicious code in ts-relayer-client (npm)
- May 25, 2026
Malicious code in ts-big-lib (npm)
- May 25, 2026
Malicious code in lint-builder-logger (npm)
- May 25, 2026
Malicious code in levex-press (npm)
- May 25, 2026
Malware in levex-press
1 compromised version
- May 25, 2026
Malware in ts-big-lib
1 compromised version
- May 25, 2026
Malware in lint-builder-logger
1 compromised version
- May 25, 2026
Malware in ts-relayer-client
1 compromised version
- May 25, 2026
Malicious code in mcp-dashboards-shared (npm)
1 compromised version
- May 25, 2026
Malicious code in git-en-boite-inventory (npm)
1 compromised version
- May 25, 2026
Malicious code in flow-parser-oxidized (npm)
2 compromised versions
- May 25, 2026
Malware in flow-parser-oxidized
1 compromised version
- May 25, 2026
Malware in mcp-dashboards-shared
1 compromised version
- May 25, 2026
Malware in not-remix
1 compromised version
- May 25, 2026
Malware in git-en-boite-inventory
1 compromised version
- May 25, 2026
Malware in uipath-ui-widgets
1 compromised version
- May 25, 2026
Malware in apollo-vertex
1 compromised version
- May 25, 2026
Malware in standalone-apps
1 compromised version
- May 25, 2026
Malware in apollo-landing
1 compromised version
- May 25, 2026
Malware in process-app-task
1 compromised version
- May 25, 2026
Malicious code in chai-as-float (npm)
2 compromised versions
- May 25, 2026
Malicious code in chai-as-buffer (npm)
2 compromised versions
- May 25, 2026
Malware in chai-as-float
1 compromised version
- May 25, 2026
Malware in chai-as-buffer
1 compromised version
- May 25, 2026
Malicious code in @refactco/refact-os (npm)
4 compromised versions
- May 25, 2026
Malicious code in system-user-identifier-cli (npm)
7 compromised versions
- May 25, 2026
Malicious code in your-unique-package-name1 (npm)
1 compromised version
- May 25, 2026
Malicious code in npm-builderio-qwik-poc (npm)
5 compromised versions
- May 25, 2026
Malicious code in @zizie071/libsignal-node (npm)
2 compromised versions
- May 24, 2026
Malicious code in @stockrepublic/republic-components (npm)
2 compromised versions
Page 81 of 4,802