Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,078 total in npm · sorted newest first- May 19, 2026
Malicious code in @mc-xp/mc-monolith-js-src-package (npm)
1 compromised version
- May 19, 2026
Malicious code in @piewasm/pie-web-npm-package (npm)
1 compromised version
- May 19, 2026
Malicious code in is-really-odd (npm)
- May 19, 2026
Malware in is-really-odd
1 compromised version
- May 19, 2026
Malware in chai-use-chain
1 compromised version
- May 19, 2026
Malicious code in psxjson (npm)
1 compromised version
- May 19, 2026
Malware in psxjson
1 compromised version
- May 19, 2026
Malicious code in paysafe-gbp-virtual-assistant-lib-fe (npm)
1 compromised version
- May 19, 2026
Malicious code in chai-as-attracted (npm)
- May 19, 2026
Malware in chai-as-attracted
1 compromised version
- May 19, 2026
Malicious code in chai-as-vec (npm)
1 compromised version
- May 19, 2026
Malware in chai-as-vec
1 compromised version
- May 19, 2026
Malware in chai-as-elevated
1 compromised version
- May 19, 2026
Malicious code in paysafe-gbp-virtual-terminal-lib-fe (npm)
2 compromised versions
- May 19, 2026
Malware in size-sensor
1 compromised version
- May 19, 2026
Malware in @antv/color-util
1 compromised version
- May 19, 2026
Malware in @antv/g-mobile-canvas
1 compromised version
- May 19, 2026
Malware in @antv/f-react
1 compromised version
- May 19, 2026
Malware in @antv/g
1 compromised version
- May 19, 2026
Malware in @antv/g-svg
1 compromised version
- May 19, 2026
Malware in @antv/graphin-icons
1 compromised version
- May 19, 2026
Malware in @antv/g-plugin-html-renderer
1 compromised version
- May 19, 2026
Malware in @antv/g6-plugins
1 compromised version
- May 19, 2026
Malware in @antv/istanbul
1 compromised version
- May 19, 2026
Malware in @antv/x6-react-shape
1 compromised version
- May 19, 2026
Malware in @antv/g-plugin-dragndrop
1 compromised version
- May 19, 2026
Malware in @antv/s2-ssr
1 compromised version
- May 19, 2026
Malware in @antv/g2-extension-ava
1 compromised version
- May 19, 2026
Malware in @antv/ckb
1 compromised version
- May 19, 2026
Malware in @antv/f2-vue
1 compromised version
- May 19, 2026
Malware in @antv/l7plot-component
1 compromised version
- May 19, 2026
Malware in babel-plugin-version
1 compromised version
- May 19, 2026
Malware in @antv/f2-context
1 compromised version
- May 19, 2026
Malware in jest-expect
1 compromised version
- May 19, 2026
Malware in @antv/insight-component
1 compromised version
- May 19, 2026
Malware in @antv/xflow-hook
1 compromised version
- May 19, 2026
Malware in @antv/x6-plugin-keyboard
1 compromised version
- May 19, 2026
Malware in @antv/layout-wasm
1 compromised version
- May 19, 2026
Malware in @antv/g-plugin-gpgpu
1 compromised version
- May 19, 2026
Malware in filesize.js
1 compromised version
- May 19, 2026
Malware in @antv/x6-plugin-minimap
1 compromised version
- May 19, 2026
Malware in @antv/x6-vue3-shape
1 compromised version
- May 19, 2026
Malware in react-adsense
1 compromised version
- May 19, 2026
Malware in @antv/expr
1 compromised version
- May 19, 2026
Malware in @antv/g-webgpu-core
1 compromised version
- May 19, 2026
Malware in @antv/gpt-vis-ssr
1 compromised version
- May 19, 2026
Malware in @antv/g2-extension-3d
1 compromised version
- May 19, 2026
Malware in timeago-react
1 compromised version
- May 19, 2026
Malware in echarts-for-react
1 compromised version
- May 19, 2026
Malware in @antv/g-webgpu
1 compromised version
Page 91 of 4,802