Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
256,077 total · sorted newest first- Jun 15, 2026
Malware in reading-cookies
1 compromised version
- Jun 15, 2026
Malicious code in prettier_v2 (npm)
1 compromised version
- Jun 15, 2026
Malicious code in prettier_v1 (npm)
2 compromised versions
- Jun 15, 2026
Malicious code in browserslist-db-sync (npm)
2 compromised versions
- Jun 15, 2026
Malware in prettier_v1
1 compromised version
- Jun 15, 2026
Malware in optional-cpu-features
1 compromised version
- Jun 15, 2026
Malware in browserslist-db-sync
1 compromised version
- Jun 15, 2026
Malware in prettier_v2
1 compromised version
- Jun 15, 2026
Malicious code in slow-surf (npm)
2 compromised versions
- Jun 15, 2026
Malicious code in numdifftools (npm)
2 compromised versions
- Jun 15, 2026
Malware in numdifftools
1 compromised version
- Jun 15, 2026
Malware in shopify-app-bridge-internal
1 compromised version
- Jun 15, 2026
Malware in slow-surf
1 compromised version
- Jun 15, 2026
Malware in mermaid-v11
1 compromised version
- Jun 15, 2026
Malware in @monitoring-lib/error-tracking
1 compromised version
- Jun 15, 2026
Malware in internallib_v856
1 compromised version
- Jun 15, 2026
Malware in internallib_v557
1 compromised version
- Jun 15, 2026
Malware in internallib_v984
1 compromised version
- Jun 15, 2026
Malware in index-ulid
1 compromised version
- Jun 15, 2026
Malware in ect-839201
1 compromised version
- Jun 15, 2026
Malware in ecto_module
1 compromised version
- Jun 15, 2026
Malware in ect-654321
1 compromised version
- Jun 15, 2026
Malware in ect-839201-ctf
1 compromised version
- Jun 15, 2026
Malware in ect-472839-ctf
1 compromised version
- Jun 15, 2026
Malware in ect-472839
1 compromised version
- Jun 15, 2026
Malicious code in vite-enhancer-config (npm)
12 compromised versions
- Jun 15, 2026
Malicious code in vite-configu-react (npm)
- Jun 15, 2026
Malicious code in chai-smart-assert (npm)
1 compromised version
- Jun 15, 2026
Malware in vite-configu-react
1 compromised version
- Jun 15, 2026
Malware in vite-enhancer-config
1 compromised version
- Jun 15, 2026
Malware in vite-config-react
1 compromised version
- Jun 15, 2026
Malware in chai-smart-assert
1 compromised version
- Jun 15, 2026
Malicious code in testpackagemanyhttpsgo (PyPI)
1 compromised version
- Jun 15, 2026
Malicious code in twrap-toolkit (PyPI)
1 compromised version
- Jun 15, 2026
Malicious code in cipherflow (PyPI)
4 compromised versions
- Jun 15, 2026
Malicious code in lab-helper (npm)
1 compromised version
- Jun 15, 2026
Malicious code in @wacrot/infra-data-kit (npm)
8 compromised versions
- Jun 15, 2026
Malicious code in tn-advertisement (npm)
1 compromised version
- Jun 15, 2026
Malicious code in postcss-minify-selector (npm)
12 compromised versions
- Jun 15, 2026
Malicious code in yunxin-overmind-comment (npm)
1 compromised version
- Jun 15, 2026
Malicious code in @intentsolution/database-security-scanner (npm)
1 compromised version
- Jun 15, 2026
Malicious code in index-ulid (npm)
3 compromised versions
- Jun 15, 2026
Malicious code in dms-backend (npm)
1 compromised version
- Jun 15, 2026
Malicious code in ogd-platform (npm)
1 compromised version
- Jun 15, 2026
Malicious code in vend-utilities (npm)
1 compromised version
- Jun 15, 2026
Malicious code in cardano-addresses-docs (npm)
1 compromised version
- Jun 15, 2026
Malicious code in @resolvx/core (npm)
3 compromised versions
- Jun 15, 2026
Malicious code in intel-ai-safety-explainer (PyPI)
1 compromised version
- Jun 15, 2026
Malicious code in hello-test-s1 (PyPI)
3 compromised versions
- Jun 15, 2026
Malicious code in merino-common (PyPI)
1 compromised version
Page 106 of 5,122