Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- May 19, 2026
Malware in @antv/g
1 compromised version
- May 19, 2026
Malware in @antv/g-svg
1 compromised version
- May 19, 2026
Malware in @antv/graphin-icons
1 compromised version
- May 19, 2026
Malware in @antv/g-plugin-html-renderer
1 compromised version
- May 19, 2026
Malware in @antv/g6-plugins
1 compromised version
- May 19, 2026
Malware in @antv/istanbul
1 compromised version
- May 19, 2026
Malware in @antv/x6-react-shape
1 compromised version
- May 19, 2026
Malware in @antv/g-plugin-dragndrop
1 compromised version
- May 19, 2026
Malware in @antv/s2-ssr
1 compromised version
- May 19, 2026
Malware in @antv/g2-extension-ava
1 compromised version
- May 19, 2026
Malware in @antv/ckb
1 compromised version
- May 19, 2026
Malware in @antv/f2-vue
1 compromised version
- May 19, 2026
Malware in @antv/l7plot-component
1 compromised version
- May 19, 2026
Malware in babel-plugin-version
1 compromised version
- May 19, 2026
Malware in @antv/f2-context
1 compromised version
- May 19, 2026
Malware in jest-expect
1 compromised version
- May 19, 2026
Malware in @antv/insight-component
1 compromised version
- May 19, 2026
Malware in @antv/xflow-hook
1 compromised version
- May 19, 2026
Malware in @antv/x6-plugin-keyboard
1 compromised version
- May 19, 2026
Malware in @antv/layout-wasm
1 compromised version
- May 19, 2026
Malware in @antv/g-plugin-gpgpu
1 compromised version
- May 19, 2026
Malware in filesize.js
1 compromised version
- May 19, 2026
Malware in @antv/x6-plugin-minimap
1 compromised version
- May 19, 2026
Malware in @antv/x6-vue3-shape
1 compromised version
- May 19, 2026
Malware in react-adsense
1 compromised version
- May 19, 2026
Malware in @antv/expr
1 compromised version
- May 19, 2026
Malware in @antv/g-webgpu-core
1 compromised version
- May 19, 2026
Malware in @antv/gpt-vis-ssr
1 compromised version
- May 19, 2026
Malware in @antv/g2-extension-3d
1 compromised version
- May 19, 2026
Malware in timeago-react
1 compromised version
- May 19, 2026
Malware in echarts-for-react
1 compromised version
- May 19, 2026
Malware in @antv/g-webgpu
1 compromised version
- May 19, 2026
Malware in @antv/g-plugin-a11y
1 compromised version
- May 19, 2026
Malware in @antv/l7-react
1 compromised version
- May 19, 2026
Malware in @antv/f6-element
1 compromised version
- May 19, 2026
Malware in @antv/g-webgl
1 compromised version
- May 19, 2026
Malware in @antv/narrative-text-vis
1 compromised version
- May 19, 2026
Malware in @antv/narrative-text-schema
1 compromised version
- May 19, 2026
Malware in @antv/chart-node-g6
1 compromised version
- May 19, 2026
Malware in @antv/g-plugin-image-loader
1 compromised version
- May 19, 2026
Malware in @antv/graphin-graphscope
1 compromised version
- May 19, 2026
Malware in jest-random-mock
1 compromised version
- May 19, 2026
Malware in @antv/f2-react
1 compromised version
- May 19, 2026
Malware in lint-md-cli
1 compromised version
- May 19, 2026
Malware in @antv/event-emitter
1 compromised version
- May 19, 2026
Malware in @antv/g-canvas
1 compromised version
- May 19, 2026
Malware in @antv/g-base
1 compromised version
- May 19, 2026
Malware in @antv/color-schema
1 compromised version
- May 19, 2026
Malware in @antv/l7-district
1 compromised version
- May 19, 2026
Malware in @antv/x6-plugin-clipboard
1 compromised version
Page 93 of 4,804