Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
240,160 total in npm · sorted newest first- May 19, 2026
Malicious code in @antv/g6-alipay (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g6 (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g2plot-schemas (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g2plot (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g2-ssr (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g2-plugin-slider (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g2-extension-plot (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g2-extension-ava (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g2-extension-3d (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g2-brush (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g2 (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-webgpu-unitchart (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-webgpu-raytracer (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-webgpu-engine (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-webgpu-core (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-webgpu-compiler (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-webgpu (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-webgl-compute (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-webgl (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-web-components (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-web-animations-api (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-svg (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-shader-components (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-zdog-svg-renderer (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-zdog-canvas-renderer (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-yoga (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-webgpu-device (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-webgl-renderer (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-webgl-device (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-svg-renderer (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-svg-picker (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-rough-svg-renderer (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-rough-canvas-renderer (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-physx (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-mobile-interaction (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-matterjs (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-image-loader (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-html-renderer (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-gpgpu (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-gesture (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-dragndrop (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-dom-interaction (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-device-renderer (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-css-select (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-control (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-canvaskit-renderer (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-canvas-renderer (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-canvas-picker (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-canvas-path-generator (npm)
2 compromised versions
- May 19, 2026
Malicious code in @antv/g-plugin-box2d (npm)
2 compromised versions
Page 99 of 4,804