Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
256,077 total · sorted newest first- Jun 17, 2026
Malicious code in @mastra/schema-compat (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/evals (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/schema-compat
1 compromised version
- Jun 17, 2026
Malware in @mastra/evals
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/langfuse (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/ai-sdk (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/ai-sdk
1 compromised version
- Jun 17, 2026
Malware in @mastra/langfuse
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/pg (npm)
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/mcp (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/mcp
1 compromised version
- Jun 17, 2026
Malware in @mastra/pg
1 compromised version
- Jun 17, 2026
Malicious code in @mastra/libsql (npm)
1 compromised version
- Jun 17, 2026
Malware in @mastra/libsql
1 compromised version
- Jun 17, 2026
Malicious code in mastra (npm)
1 compromised version
- Jun 17, 2026
Malware in mastra
1 compromised version
- Jun 16, 2026
Malicious code in abuden21 (npm)
3 compromised versions
- Jun 16, 2026
Malicious code in speed4 (npm)
2 compromised versions
- Jun 16, 2026
Malware in internallib_v346
1 compromised version
- Jun 16, 2026
Malicious code in backoffice-charges-module (npm)
3 compromised versions
- Jun 16, 2026
Malicious code in bubblestr (npm)
1 compromised version
- Jun 16, 2026
Malicious code in tw-theme-kit (npm)
1 compromised version
- Jun 16, 2026
Malicious code in vite-config-field (npm)
6 compromised versions
- Jun 16, 2026
Malicious code in react-vite-assert (npm)
1 compromised version
- Jun 16, 2026
Malicious code in ssr-auth-sync (npm)
1 compromised version
- Jun 16, 2026
Malicious code in package-uploader (npm)
1 compromised version
- Jun 16, 2026
Malicious code in mci-sdk (npm)
6 compromised versions
- Jun 16, 2026
Malicious code in chai-test-mocks (npm)
1 compromised version
- Jun 16, 2026
Malicious code in aillmgen (npm)
1 compromised version
- Jun 16, 2026
Malicious code in @kalipto/local (npm)
4 compromised versions
- Jun 16, 2026
Malicious code in test-copppss (npm)
1 compromised version
- Jun 16, 2026
Malicious code in @welcome-onboarding-web/mobile-focus-account-beta-merging (npm)
1 compromised version
- Jun 16, 2026
Malicious code in binproto (npm)
2 compromised versions
- Jun 16, 2026
Malicious code in motion-lib (npm)
1 compromised version
- Jun 16, 2026
Malicious code in js-digest (npm)
1 compromised version
- Jun 16, 2026
Malicious code in pretie_x2 (npm)
5 compromised versions
- Jun 16, 2026
Malicious code in pretie_x1 (npm)
5 compromised versions
- Jun 16, 2026
Malicious code in nottuff7 (npm)
3 compromised versions
- Jun 16, 2026
Malicious code in nottuff23 (npm)
3 compromised versions
- Jun 16, 2026
Malicious code in nottuff25 (npm)
3 compromised versions
- Jun 16, 2026
Malicious code in nottuff4 (npm)
3 compromised versions
- Jun 16, 2026
Malicious code in nottuff15 (npm)
3 compromised versions
- Jun 16, 2026
Malicious code in mastraqqq (npm)
1 compromised version
- Jun 16, 2026
Malicious code in proto-bin (npm)
4 compromised versions
- Jun 16, 2026
Malicious code in utils-common-helpers (npm)
1 compromised version
- Jun 16, 2026
Malicious code in react-hook-use-debounce-throttle-12 (npm)
3 compromised versions
- Jun 16, 2026
Malicious code in chai-plugin-helper (npm)
4 compromised versions
- Jun 16, 2026
Malicious code in chain-chai-test (npm)
1 compromised version
- Jun 16, 2026
Malicious code in chai-as-polished (npm)
1 compromised version
- Jun 16, 2026
Malicious code in chai-as-tokenized (npm)
1 compromised version
Page 103 of 5,122