Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,078 total in npm · sorted newest first- May 20, 2026
Malicious code in code-tool-langfuse (npm)
5 compromised versions
- May 20, 2026
Malicious code in hpsetup (npm)
11 compromised versions
- May 20, 2026
Malicious code in etherjs-utils (npm)
1 compromised version
- May 20, 2026
Malicious code in jsonbson (npm)
5 compromised versions
- May 20, 2026
Malicious code in @mcpassure/mcp-cnes (npm)
11 compromised versions
- May 20, 2026
Malicious code in @mcpassure/mcp-anvisa-bulario (npm)
10 compromised versions
- May 20, 2026
Malicious code in hardhat-gas-profiler-plugin (npm)
1 compromised version
- May 20, 2026
Malicious code in chainlink-price-feed-aggregator (npm)
1 compromised version
- May 20, 2026
Malicious code in @rocketreach/rr-components (npm)
1 compromised version
- May 20, 2026
Malicious code in @tailwind-core/postcss (npm)
1 compromised version
- May 20, 2026
Malicious code in crypto-javascript (npm)
5 compromised versions
- May 20, 2026
Malicious code in ganache-cli-provider (npm)
1 compromised version
- May 20, 2026
Malicious code in solna-web3 (npm)
1 compromised version
- May 20, 2026
Malicious code in solana-pda-helper (npm)
1 compromised version
- May 20, 2026
Malicious code in foundry-deploy-helper (npm)
1 compromised version
- May 20, 2026
Malicious code in ethers-multicall-utils (npm)
1 compromised version
- May 19, 2026
Malicious code in @tailwind-core/vite (npm)
1 compromised version
- May 19, 2026
Malicious code in lokal-mcp (npm)
1 compromised version
- May 19, 2026
Malicious code in tubebrain (npm)
1 compromised version
- May 19, 2026
Malicious code in to-cms (npm)
2 compromised versions
- May 19, 2026
Malicious code in @flowselections/core (npm)
2 compromised versions
- May 19, 2026
Malicious code in @riteshkumar04/stack-audit (npm)
3 compromised versions
- May 19, 2026
Malicious code in martinez-polygon-clipping-tony (npm)
1 compromised version
- May 19, 2026
Malicious code in did-0091 (npm)
5 compromised versions
- May 19, 2026
Malicious code in zod-to-js (npm)
2 compromised versions
- May 19, 2026
Malicious code in venturo-playwright-runner (npm)
4 compromised versions
- May 19, 2026
Malicious code in collected-forms-embed-js (npm)
4 compromised versions
- May 19, 2026
Malicious code in venturo-playwright (npm)
1 compromised version
- May 19, 2026
Malicious code in @arbocollab/arbo-web-people (npm)
6 compromised versions
- May 19, 2026
Malicious code in @dknzo/soonex-ai (npm)
2 compromised versions
- May 19, 2026
Malicious code in @tarojs/cli (npm)
2 compromised versions
- May 19, 2026
Malicious code in clsx-js (npm)
3 compromised versions
- May 19, 2026
Malicious code in workrally (npm)
1 compromised version
- May 19, 2026
Malicious code in btd-smart (npm)
2 compromised versions
- May 19, 2026
Malicious code in crypto-hash-sdk (npm)
1 compromised version
- May 19, 2026
Malicious code in xorma-js (npm)
1 compromised version
- May 19, 2026
Malicious code in qr-code-styling-temp (npm)
2 compromised versions
- May 19, 2026
Malicious code in alya-baileys (npm)
8 compromised versions
- May 19, 2026
Malicious code in whiteboard-agent (npm)
2 compromised versions
- May 19, 2026
Malicious code in claude-all-config (npm)
3 compromised versions
- May 19, 2026
Malicious code in @shadanai/openclaw (npm)
3 compromised versions
- May 19, 2026
Malicious code in @bonsai-ai/claude-code (npm)
2 compromised versions
- May 19, 2026
Malicious code in corelia (npm)
1 compromised version
- May 19, 2026
Malicious code in @bonsai-ai/claude-code-win32-x64 (npm)
1 compromised version
- May 19, 2026
Malicious code in open-agents-ai (npm)
10 compromised versions
- May 19, 2026
Malicious code in superacli (npm)
2 compromised versions
- May 19, 2026
Malicious code in @citely/mcp-server (npm)
2 compromised versions
- May 19, 2026
Malicious code in prettier-sdk (npm)
1 compromised version
- May 19, 2026
Malicious code in cheaty-sync-bot (npm)
1 compromised version
- May 19, 2026
Malicious code in bytecore (npm)
1 compromised version
Page 90 of 4,802