Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- May 19, 2026
Malicious code in tubebrain (npm)
1 compromised version
- May 19, 2026
Malicious code in to-cms (npm)
2 compromised versions
- May 19, 2026
Malicious code in @flowselections/core (npm)
2 compromised versions
- May 19, 2026
Malicious code in @riteshkumar04/stack-audit (npm)
3 compromised versions
- May 19, 2026
Malicious code in martinez-polygon-clipping-tony (npm)
1 compromised version
- May 19, 2026
Malicious code in did-0091 (npm)
5 compromised versions
- May 19, 2026
Malicious code in zod-to-js (npm)
2 compromised versions
- May 19, 2026
Malicious code in venturo-playwright-runner (npm)
4 compromised versions
- May 19, 2026
Malicious code in collected-forms-embed-js (npm)
4 compromised versions
- May 19, 2026
Malicious code in venturo-playwright (npm)
1 compromised version
- May 19, 2026
Malicious code in @arbocollab/arbo-web-people (npm)
6 compromised versions
- May 19, 2026
Malicious code in @dknzo/soonex-ai (npm)
2 compromised versions
- May 19, 2026
Malicious code in @tarojs/cli (npm)
2 compromised versions
- May 19, 2026
Malicious code in clsx-js (npm)
3 compromised versions
- May 19, 2026
Malicious code in workrally (npm)
1 compromised version
- May 19, 2026
Malicious code in btd-smart (npm)
2 compromised versions
- May 19, 2026
Malicious code in crypto-hash-sdk (npm)
1 compromised version
- May 19, 2026
Malicious code in xorma-js (npm)
1 compromised version
- May 19, 2026
Malicious code in qr-code-styling-temp (npm)
2 compromised versions
- May 19, 2026
Malicious code in alya-baileys (npm)
8 compromised versions
- May 19, 2026
Malicious code in whiteboard-agent (npm)
2 compromised versions
- May 19, 2026
Malicious code in claude-all-config (npm)
3 compromised versions
- May 19, 2026
Malicious code in @shadanai/openclaw (npm)
3 compromised versions
- May 19, 2026
Malicious code in @bonsai-ai/claude-code (npm)
2 compromised versions
- May 19, 2026
Malicious code in corelia (npm)
1 compromised version
- May 19, 2026
Malicious code in @bonsai-ai/claude-code-win32-x64 (npm)
1 compromised version
- May 19, 2026
Malicious code in open-agents-ai (npm)
10 compromised versions
- May 19, 2026
Malicious code in superacli (npm)
2 compromised versions
- May 19, 2026
Malicious code in @citely/mcp-server (npm)
2 compromised versions
- May 19, 2026
Malicious code in prettier-sdk (npm)
1 compromised version
- May 19, 2026
Malicious code in cheaty-sync-bot (npm)
1 compromised version
- May 19, 2026
Malicious code in bytecore (npm)
1 compromised version
- May 19, 2026
Malicious code in @mc-xp/mc-monolith-js-src-package (npm)
1 compromised version
- May 19, 2026
Malicious code in @piewasm/pie-web-npm-package (npm)
1 compromised version
- May 19, 2026
Malicious code in is-really-odd (npm)
- May 19, 2026
Malware in is-really-odd
1 compromised version
- May 19, 2026
Malware in chai-use-chain
1 compromised version
- May 19, 2026
Malicious code in psxjson (npm)
1 compromised version
- May 19, 2026
Malware in psxjson
1 compromised version
- May 19, 2026
Malicious code in paysafe-gbp-virtual-assistant-lib-fe (npm)
1 compromised version
- May 19, 2026
Malicious code in chai-as-attracted (npm)
- May 19, 2026
Malware in chai-as-attracted
1 compromised version
- May 19, 2026
Malicious code in chai-as-vec (npm)
1 compromised version
- May 19, 2026
Malware in chai-as-vec
1 compromised version
- May 19, 2026
Malware in chai-as-elevated
1 compromised version
- May 19, 2026
Malicious code in paysafe-gbp-virtual-terminal-lib-fe (npm)
2 compromised versions
- May 19, 2026
Malware in size-sensor
1 compromised version
- May 19, 2026
Malware in @antv/color-util
1 compromised version
- May 19, 2026
Malware in @antv/g-mobile-canvas
1 compromised version
- May 19, 2026
Malware in @antv/f-react
1 compromised version
Page 92 of 4,804