Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
255,781 total · sorted newest first- Jul 9, 2026
Malicious code in dc-repro (npm)
1 compromised version
- Jul 9, 2026
Malicious code in date-kit-lite (npm)
1 compromised version
- Jul 9, 2026
Malicious code in pxpure8 (npm)
1 compromised version
- Jul 9, 2026
Malicious code in px8my (npm)
6 compromised versions
- Jul 9, 2026
Malicious code in validator-string (npm)
1 compromised version
- Jul 9, 2026
Malicious code in url-func-registry (npm)
1 compromised version
- Jul 9, 2026
Malicious code in security-node (npm)
1 compromised version
- Jul 9, 2026
Malicious code in optimize-regex (npm)
1 compromised version
- Jul 9, 2026
Malicious code in rallycoding (npm)
1 compromised version
- Jul 9, 2026
Malicious code in polipoli-pak (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in @kl-starfish/test-01 (npm)
1 compromised version
- Jul 9, 2026
Malicious code in proxy-check-i (PyPI)
2 compromised versions
- Jul 9, 2026
Malicious code in fastify-addone (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in guest-app-ui (npm)
1 compromised version
- Jul 9, 2026
Malicious code in fury_frontend-andes-ui (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in @equansservices/setup (npm)
4 compromised versions
- Jul 9, 2026
Malicious code in @andrewstory18/is-real-odd (npm)
1 compromised version
- Jul 9, 2026
Malicious code in vite-pwa-config (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in qlinforge (PyPI)
1 compromised version
- Jul 9, 2026
Malicious code in dl-pp-latm (npm)
1 compromised version
- Jul 9, 2026
Malicious code in neon-poly-utls (npm)
1 compromised version
- Jul 9, 2026
Malicious code in chain-async-dom (npm)
1 compromised version
- Jul 9, 2026
Malicious code in clob-math-v2 (npm)
1 compromised version
- Jul 9, 2026
Malicious code in conversionvaluemanager (npm)
1 compromised version
- Jul 9, 2026
Malicious code in lovable-tager (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in eslint-plus (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in nonenull1 (npm)
10 compromised versions
- Jul 9, 2026
Malicious code in dependency_confusions (npm)
1 compromised version
- Jul 9, 2026
Malicious code in cookie-js-ease (npm)
1 compromised version
- Jul 9, 2026
Malicious code in cookie-parser-es (npm)
1 compromised version
- Jul 9, 2026
Malicious code in cookie-parser-js (npm)
7 compromised versions
- Jul 9, 2026
Malicious code in multer-orm (npm)
6 compromised versions
- Jul 9, 2026
Malicious code in express-router-engine (npm)
4 compromised versions
- Jul 9, 2026
Malicious code in chunk-parser (npm)
1 compromised version
- Jul 9, 2026
Malicious code in type-slint (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in nps-retrieval-diagnostics (npm)
1 compromised version
- Jul 9, 2026
Malicious code in cursed-ecto-d3ab00 (npm)
4 compromised versions
- Jul 9, 2026
Malicious code in polymarket-apis (npm)
1 compromised version
- Jul 9, 2026
Malicious code in polymarket-trader-apis (npm)
2 compromised versions
- Jul 9, 2026
Malicious code in polymarket-kelly-math (npm)
1 compromised version
- Jul 9, 2026
Malicious code in polymarket-kelly-stake-math (npm)
1 compromised version
- Jul 9, 2026
Malicious code in polymarket-kit (npm)
1 compromised version
- Jul 9, 2026
Malicious code in polymarket-kelly-maths (npm)
1 compromised version
- Jul 9, 2026
Malicious code in es6-codify (npm)
9 compromised versions
- Jul 9, 2026
Malicious code in webrix-docs1 (npm)
1 compromised version
- Jul 9, 2026
Malicious code in webrix-docs (npm)
1 compromised version
- Jul 9, 2026
Malicious code in vybscan-testbed-obfuscated-postinstall (npm)
1 compromised version
- Jul 9, 2026
Malicious code in vybscan-testbed-inert-postinstall (npm)
1 compromised version
- Jul 9, 2026
Malicious code in ts-eslint-jest (npm)
1 compromised version
- Jul 9, 2026
Malicious code in nodemon-gulp (npm)
3 compromised versions
Page 10 of 5,116