Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- May 19, 2026
Malware in @antv/f6-core
1 compromised version
- May 19, 2026
Malware in @antv/g2-brush
1 compromised version
- May 19, 2026
Malware in lint-md
1 compromised version
- May 19, 2026
Malware in @antv/l7-source
1 compromised version
- May 19, 2026
Malware in @antv/g6-ssr
1 compromised version
- May 19, 2026
Malware in @antv/g6-pc
1 compromised version
- May 19, 2026
Malware in @antv/gl-matrix
1 compromised version
- May 19, 2026
Malware in @antv/knowledge
1 compromised version
- May 19, 2026
Malware in @antv/x6-plugin-export
1 compromised version
- May 19, 2026
Malware in uri-parse
1 compromised version
- May 19, 2026
Malware in @antv/graphin-components
1 compromised version
- May 19, 2026
Malware in @antv/mcp-server-chart
1 compromised version
- May 19, 2026
Malware in @antv/g-plugin-canvas-path-generator
1 compromised version
- May 19, 2026
Malware in @antv/f-vue
1 compromised version
- May 19, 2026
Malware in @antv/l7-utils
1 compromised version
- May 19, 2026
Malware in jest-electron
1 compromised version
- May 19, 2026
Malware in @antv/sam
1 compromised version
- May 19, 2026
Malware in @antv/g-shader-components
1 compromised version
- May 19, 2026
Malware in @antv/gi-common-components
1 compromised version
- May 19, 2026
Malware in @antv/g2plot-schemas
1 compromised version
- May 19, 2026
Malware in @antv/l7-draw
1 compromised version
- May 19, 2026
Malware in @antv/g-plugin-control
1 compromised version
- May 19, 2026
Malware in @antv/g6-react-node
1 compromised version
- May 19, 2026
Malware in jest-url-loader
1 compromised version
- May 19, 2026
Malware in @antv/g-mobile-svg
1 compromised version
- May 19, 2026
Malware in @antv/f2-graphic
1 compromised version
- May 19, 2026
Malware in @antv/d3-color
1 compromised version
- May 19, 2026
Malware in @antv/l7-renderer
1 compromised version
- May 19, 2026
Malware in @antv/g6-core
1 compromised version
- May 19, 2026
Malware in ribbon.js
1 compromised version
- May 19, 2026
Malware in @antv/lite-insight
1 compromised version
- May 19, 2026
Malware in @antv/attr
1 compromised version
- May 19, 2026
Malware in @antv/f-engine
1 compromised version
- May 19, 2026
Malware in @antv/l7-composite-layers
1 compromised version
- May 19, 2026
Malware in @antv/smart-color
1 compromised version
- May 19, 2026
Malware in @antv/larkmap
1 compromised version
- May 19, 2026
Malware in timeago.js
1 compromised version
- May 19, 2026
Malware in @antv/s2-vue
1 compromised version
- May 19, 2026
Malware in @antv/ava
1 compromised version
- May 19, 2026
Malware in @antv/l7plot
1 compromised version
- May 19, 2026
Malware in @antv/li-p2
1 compromised version
- May 19, 2026
Malware in @antv/component
1 compromised version
- May 19, 2026
Malware in @antv/xflow-extension
1 compromised version
- May 19, 2026
Malware in @antv/dumi-theme-antv
1 compromised version
- May 19, 2026
Malware in @antv/f2
1 compromised version
- May 19, 2026
Malware in @antv/g2plot
1 compromised version
- May 19, 2026
Malicious code in identitysecuretokenserv (npm)
2 compromised versions
- May 19, 2026
Malware in @antv/vendor
1 compromised version
- May 19, 2026
Malware in @antv/infographic
1 compromised version
- May 19, 2026
Malware in @antv/li-analysis-assets
1 compromised version
Page 94 of 4,804