Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,073 total in npm · sorted newest first- May 24, 2026
Malicious code in shiroai (npm)
6 compromised versions
- May 24, 2026
Malicious code in cxpher-linux-arm32 (npm)
1 compromised version
- May 24, 2026
Malicious code in clipboard-guardian (npm)
4 compromised versions
- May 24, 2026
Malicious code in sysnode (npm)
1 compromised version
- May 24, 2026
Malicious code in class-weaver (npm)
1 compromised version
- May 24, 2026
Malicious code in vite-plugin-css-blend (npm)
1 compromised version
- May 24, 2026
Malicious code in class-blend (npm)
4 compromised versions
- May 24, 2026
Malicious code in power-platform-playwright-toolkit (npm)
1 compromised version
- May 24, 2026
Malware in async-pipeline-builder
1 compromised version
- May 24, 2026
Malware in node-setup-helpers
1 compromised version
- May 24, 2026
Malware in model-switch-router
1 compromised version
- May 24, 2026
Malware in workspace-config-loader
1 compromised version
- May 24, 2026
Malware in build-scripts-utils
1 compromised version
- May 24, 2026
Malware in project-init-tools
1 compromised version
- May 24, 2026
Malware in token-usage-tracker
1 compromised version
- May 24, 2026
Malware in llm-context-compressor
1 compromised version
- May 24, 2026
Malware in prompt-engineering-toolkit
1 compromised version
- May 24, 2026
Malware in dev-env-bootstrapper
1 compromised version
- May 24, 2026
Malicious code in cami-design (npm)
1 compromised version
- May 24, 2026
Malicious code in react-malicious-clone (npm)
1 compromised version
- May 24, 2026
Malicious code in @jonusnattapong/claudecode (npm)
1 compromised version
- May 24, 2026
Malicious code in power-apps (npm)
2 compromised versions
- May 24, 2026
Malicious code in twokey (npm)
5 compromised versions
- May 24, 2026
Malicious code in wallet-agent-ai (npm)
2 compromised versions
- May 24, 2026
Malicious code in harness-skil (npm)
1 compromised version
- May 24, 2026
Malicious code in tailwind-typography-stylecss (npm)
1 compromised version
- May 24, 2026
Malicious code in license-checker-plus (npm)
1 compromised version
- May 24, 2026
Malicious code in solidity-coverage-plus (npm)
2 compromised versions
- May 24, 2026
Malicious code in freertc (npm)
8 compromised versions
- May 23, 2026
Malicious code in hardhat-gas-analytics (npm)
5 compromised versions
- May 23, 2026
Malicious code in openprompt-lang (npm)
11 compromised versions
- May 23, 2026
Malicious code in @gbrlxvii/ts-project-lint (npm)
8 compromised versions
- May 23, 2026
Malicious code in @digicroz/typed-api-kit (npm)
2 compromised versions
- May 23, 2026
Malicious code in pewter-constantstest (npm)
1 compromised version
- May 23, 2026
Malicious code in @audience-common-ui/components (npm)
1 compromised version
- May 23, 2026
Malicious code in @dreamlake/lakeshore (npm)
2 compromised versions
- May 23, 2026
Malicious code in @newline53/newline-ts-sdk (npm)
3 compromised versions
- May 23, 2026
Malicious code in pewter-constants (npm)
1 compromised version
- May 23, 2026
Malicious code in midpatch (npm)
1 compromised version
- May 23, 2026
Malicious code in asavie-ui (npm)
1 compromised version
- May 23, 2026
Malicious code in discovery-build (npm)
4 compromised versions
- May 23, 2026
Malicious code in turbo-axios (npm)
2 compromised versions
- May 23, 2026
Malicious code in hiura-baileys (npm)
3 compromised versions
- May 23, 2026
Malicious code in cosmosdb-server (npm)
2 compromised versions
- May 23, 2026
Malicious code in @asavie/i18n (npm)
3 compromised versions
- May 23, 2026
Malicious code in @zaamx/netme (npm)
2 compromised versions
- May 23, 2026
Malicious code in lhisp-logger (npm)
1 compromised version
- May 23, 2026
Malicious code in @budetzzgantenk/baileys (npm)
1 compromised version
- May 23, 2026
Malicious code in @onerjs/inspector (npm)
1 compromised version
- May 23, 2026
Malicious code in ask-my-llm (npm)
3 compromised versions
Page 82 of 4,802