Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
365,464 total · sorted newest first- Nov 2, 2026
Malware in @bigdevin55/calculator-install-demo
1 compromised version
- Nov 2, 2026
Malware in axelarjs-sdk
1 compromised version
- Nov 2, 2026
Malware in sol-wallet-adapter
1 compromised version
- Nov 2, 2026
Malicious code in @bigdevin55/calculator-install-hook (npm)
- Nov 2, 2026
Malware in @bigdevin55/calculator-install-hook
1 compromised version
- Nov 2, 2026
Malware in calculator-preinstall-hook-demo
1 compromised version
- Nov 2, 2026
Malicious code in @nuxzofficial/baileys (npm)
- Nov 2, 2026
Malware in @nuxzofficial/baileys
1 compromised version
- Nov 2, 2026
Malicious code in nuxzofficial (npm)
- Nov 2, 2026
Malware in nuxzofficial
1 compromised version
- Nov 2, 2026
Malicious code in tailwindcss-animate-bridge (npm)
- Nov 2, 2026
Malicious code in @utilitycraft/tailwindcss-motion-atelier (npm)
- Nov 2, 2026
Malware in @utilitycraft/tailwindcss-motion-atelier
1 compromised version
- Nov 2, 2026
Malware in tailwindcss-animate-bridge
1 compromised version
- Nov 2, 2026
Malicious code in @ubedsockets/baileys (npm)
26 compromised versions
- Nov 2, 2026
Malicious code in atlassian-wallboard-plugin1 (npm)
- Nov 2, 2026
Malware in atlassian-wallboard-plugin1
1 compromised version
- Nov 2, 2026
Malware in claims-ac1
1 compromised version
- Nov 2, 2026
Malware in atlassian-wallboard-plugin
1 compromised version
- Nov 2, 2026
Malicious code in shoaib-unity (RubyGems)
1 compromised version
- Nov 2, 2026
Malicious code in intercom-react-native-example-e2e-tests (RubyGems)
1 compromised version
- Nov 2, 2026
Malicious code in persona-ai-sdk (npm)
1 compromised version
- Nov 2, 2026
Malware in persona-ai-sdk
1 compromised version
- Nov 2, 2026
Malicious code in intercom-react-native-example-e2e-tests (RubyGems)
1 compromised version
- Nov 2, 2026
Malicious code in shoaib-unity (RubyGems)
1 compromised version
- Nov 2, 2026
Malicious code in xenacious_kangaroo_blush-47 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in valid_antlion_amber-50 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in unfortunate_crawdad_emerald-79 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in temporary_smelt_lavender-81 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in specific_sheep_violet-22 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in southern_duck_tan-16 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in sound_deer_apricot-15 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in smooth_angelfish_emerald-54 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in pure_opossum_amaranth-54 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in motionless_mandrill_blush-51 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in itchy_gecko_magenta-98 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in intimate_ostrich_amethyst-45 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in inadequate_earwig_magenta-66 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in hushed_zebra_green-81 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in hollow_wildebeest_silver-94 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in gugodapis (npm)
1 compromised version
- Nov 2, 2026
Malicious code in et_phone_home (npm)
1 compromised version
- Nov 2, 2026
Malicious code in colossal_wallaby_pink-87 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in babyyodaa (npm)
1 compromised version
- Nov 2, 2026
Malicious code in @signals-notebook/annotation-editor (npm)
1 compromised version
- Nov 2, 2026
Malicious code in litecore-lib-ltc (npm)
1 compromised version
- Nov 2, 2026
Malicious code in wallet-tracking (PyPI)
1 compromised version
- Nov 2, 2026
Malicious code in @notrainer/nobtrainer-sdk (npm)
1 compromised version
- Nov 2, 2026
Malicious code in self-v8 (npm)
1 compromised version
- Nov 2, 2026
Malicious code in zystcdemo (npm)
1 compromised version
Page 10 of 7,310