Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
256,077 total · sorted newest first- Jun 13, 2026
Malicious code in warp-dependency (npm)
2 compromised versions
- Jun 13, 2026
Malicious code in dash-grid-normalizer (PyPI)
5 compromised versions
- Jun 12, 2026
Malicious code in ect-472839-ctf (npm)
1 compromised version
- Jun 12, 2026
Malicious code in ect-654321 (npm)
7 compromised versions
- Jun 12, 2026
Malicious code in ect-839201 (npm)
11 compromised versions
- Jun 12, 2026
Malicious code in ect-839201-ctf (npm)
1 compromised version
- Jun 12, 2026
Malicious code in textwrap-toolkit-stager (PyPI)
1 compromised version
- Jun 12, 2026
Malicious code in claudechor (npm)
5 compromised versions
- Jun 12, 2026
Malicious code in beamz (npm)
6 compromised versions
- Jun 12, 2026
Malicious code in chalk-plus-js (npm)
1 compromised version
- Jun 12, 2026
Malicious code in chalk-pro (npm)
2 compromised versions
- Jun 12, 2026
Malicious code in jextic-eclib (npm)
1 compromised version
- Jun 12, 2026
Malicious code in chalk-plus-ts (npm)
2 compromised versions
- Jun 12, 2026
Malicious code in vite-plugin-logo (npm)
9 compromised versions
- Jun 12, 2026
Malicious code in workflow-postgres-setup (npm)
1 compromised version
- Jun 12, 2026
Malicious code in vite-plugin-compress-js (npm)
3 compromised versions
- Jun 12, 2026
Malicious code in vite-svgr (npm)
2 compromised versions
- Jun 12, 2026
Malicious code in friendly-greeter-demo (npm)
11 compromised versions
- Jun 12, 2026
Malicious code in theta-connector (npm)
1 compromised version
- Jun 12, 2026
Malicious code in theta-kit (npm)
4 compromised versions
- Jun 12, 2026
Malicious code in ttspc-server-sample (npm)
6 compromised versions
- Jun 12, 2026
Malicious code in eslint-plugin-mistica-local-rules (npm)
1 compromised version
- Jun 12, 2026
Malicious code in flexitest (PyPI)
1 compromised version
- Jun 12, 2026
Malicious code in vite-react-toolkit (npm)
1 compromised version
- Jun 12, 2026
Malicious code in transportator (npm)
1 compromised version
- Jun 12, 2026
Malicious code in chai-web3-testkit (npm)
1 compromised version
- Jun 12, 2026
Malware in chai-web3-testkit
1 compromised version
- Jun 12, 2026
Malware in transportator
1 compromised version
- Jun 12, 2026
Malware in vite-react-toolkit
1 compromised version
- Jun 12, 2026
Malicious code in internallib_v856 (npm)
1 compromised version
- Jun 12, 2026
Malicious code in internallib_v984 (npm)
6 compromised versions
- Jun 12, 2026
Malicious code in nagios-xi (PyPI)
2 compromised versions
- Jun 12, 2026
Malicious code in voyager-web (npm)
1 compromised version
- Jun 12, 2026
Malicious code in web-model-bridge (npm)
1 compromised version
- Jun 12, 2026
Malware in web-dotenv
1 compromised version
- Jun 12, 2026
Malicious code in sea-bound-siren (npm)
23 compromised versions
- Jun 12, 2026
Malicious code in ecto-win-flag-q2m7 (npm)
2 compromised versions
- Jun 12, 2026
Malicious code in ecto-spirit-win-k4n8 (npm)
1 compromised version
- Jun 12, 2026
Malicious code in ecto-spectral-leak-8d4e2 (npm)
3 compromised versions
- Jun 12, 2026
Malicious code in ecto-rust-read-f3a9c1 (npm)
3 compromised versions
- Jun 12, 2026
Malicious code in ecto-nightly-spirit (npm)
7 compromised versions
- Jun 12, 2026
Malicious code in ecto-flag-read-m7p2 (npm)
1 compromised version
- Jun 12, 2026
Malicious code in ecto-corsair-flag-x9m4 (npm)
1 compromised version
- Jun 12, 2026
Malicious code in @malwguy/ecto-corsair-whisper-3d2a7c (npm)
1 compromised version
- Jun 12, 2026
Malware in ecto-nightly-spirit
1 compromised version
- Jun 12, 2026
Malware in ecto-spectral-leak-8d4e2
1 compromised version
- Jun 12, 2026
Malware in ecto-spirit-win-k4n8
1 compromised version
- Jun 12, 2026
Malware in ecto-flag-read-m7p2
1 compromised version
- Jun 12, 2026
Malware in ecto-corsair-flag-x9m4
1 compromised version
- Jun 12, 2026
Malware in coral-wraith
1 compromised version
Page 109 of 5,122